General

Hello community. I have several AWS console access accounts and would like to provide access to clients in the same way shown in this video, where Password Safe injects the credential without the user knowing the password. I have already used RDS Application for delivering MSSQL and other applications, but according to this older video, it's not clear to me whether RDS Application is being used. Could you tell me which method is currently supported by Password Safe for accessing web consoles like AWS and Azure without exposing the password? I don't have PRA, where I know everything would be solved with Web Jump. I only have Password Safe without Workforce. Thank you very much."  

Hi , I have a few queries (mentioned below), I am not able to find relevant information in documentations. If someone know please let me know -1. which user has checked out account ? - I want to see who has checked out an account so that I can go ahead and ask them to check the account back in to passwordsafe.2. Email notification on usage of specific accounts. - Is there a way I can setup email notifications to be sent out to some DL on usage of some accounts(not all), like when the account is requested and password is changed.3.Who changed the last password ? - I would like to see the username of the user who changed or initiated the password change. I can see “changed by User” in password history but no detail on who the actual user was.

Hello everyone,After reinstalling the resource brokers in our environment, I began noticing intermittent failures during automatic password rotations on managed Linux and AIX systems.Error recorded in the resource broker logs and console:"The connection was closed by the server. Make sure you are connecting to an SSH or SFTP server."Error recorded in the managed systems' sshd logs:"Jul 28 04:30:43 Server01 sshderror: kex_exchange_identification: Connection closed by remote host"Both errors occurred at the same date and time.Has anyone else encountered this behavior?Could this be resolved using the "Enable legacy algorithms for SSH account management tasks" option found under Configuration > Privileged Access Management > Miscellaneous?According to KB0017016, "The option Enable legacy algorithms for SSH account management tasks enables legacy encryption, MAC, and key exchange (Kex) algorithms that were previously enabled in Password Safe".If anyone has experienced this, I would gr

Hi mates, I am in a trouble with Discovery Scan and each time it can surprise me with new issue.I can not scan Linux  and Linux based assets (like Palo Alto firewalls) with Discovery Scan. It  displays the error “NoValidTargets” error altought is was working properly yesterday and suddenly started to give this error.  There is not any Network connections issue. Appliance can connect to SSH ports of Linux machines. Credentials issue. I use root user and tested its password a few times, no fail while manually login. No service error. I checked with getc, teste, testc commands. I tried on new VMs and formerly scanned ones. All scans returned same error mentioned above.Everything is ok with Windows scans.

Hello.We have a use case with non-domain account on a network device which has special characters # and \\.apic#fallback\\adminWhen a user launches SSH session from BIPS Webconsole the session fails. In PBSM logs it shows the username being used to authenticate to device is \admin . Are there any special characters like [ ] that we need to put the username in so that it is sent as-is. I tried [ ] and “ “ , didn’t work .It also has other domain accounts linked to the device 

how BeyondTrust PRA would handle SSH access in Alibaba Cloud and specifically how credential injection would work. He wants to know whether PRA injects credentials or if Alibaba SSH keys would continue to be used.

Hello, I am trying to setup an Azure SQL Database for a new AA BT PWS environment. Is there any way to use a serverless SQL with own key material for TDE?Right now the installer just gets stuck and although I can run the connection check I get a small window stating “validation failed” after I click next on the database configuration step.Any recommendations?  Thanks!

I have recently upgraded my Appliance version and BeyondInsight/Password Safe version with belowPassword Safe Appliance 4.4.1.1317 → 4.6.1.155 BeyondInsight 25.1.1.165 → 26.1.0.878Upgrade was successful. The following day, my users started receiving an SSO authentication failed error from their browsers. It seems like there was a token lifetime validation happening and it is now failing against my users. Clearing the browser cache and deleting the previous token somewhat helped but this is more of a manual intervention per user I am doing now. Has anybody encountered this and know how to resolve this?Microsoft.IdentityModel.Tokens.SecurityTokenExpiredException: IDX10223: Lifetime validation failed. The token is expired. ValidTo (UTC): '8/13/2026 9:26:02 PM', Current time (UTC): '8/13/2026 9:51:55 PM'. at Microsoft.IdentityModel.Tokens.ValidatorUtilities.ValidateLifetime(Nullable`1 notBefore, Nullable`1 expires, SecurityToken securityToken, TokenValidationParameters validationParameters

I want to export managed server list report and help to add two more column, the FA account , and FA account status (managed or not managed).I am working on password failure checking task, and there is one type of error is FA account password incorrect, so I'd like to know the server and FA mapping, and if the FA is managed or not.Need a single report in which managed system>managed system’s functional account > FA status (managed/not managed) status should be there.

Hi All,We have onboarded the Remote Web application in our Beyondtrust Password safe instance.  The launch of application is successful and user can access the application without any issues.However whenever user tries to modify the size of browser window, session terminates with below error  Has anyone encountered this issue previously ? If yes, can anyone please suggest how the issue was resolved ?Awaiting response. Thanks in advance .Regards,Immi

I have active passive cluster , the mirror state frequently changes to suspended then back to synchronizedRAM Usage is over 80% without any causewhen I review logs from primary node I found contradiction where in HAService log file the isPrimary tag is false while in HAMonitoringService the Are Primary is false but sometimes change to true then after this change the state is suspended  

Hello Everyone, We are currently implementing Beyond Trust–SailPoint IdentityIQ credential cycling. As part of this implementation, we anticipate a high volume of Password Safe requests, potentially exceeding 1,000 requests per day.We would like to understand: Is there a threshold limit for Password Safe requests (for example, per account, per user, or on a daily basis)? What impact, if any, could such a high volume of requests have on the Beyond Trust server? Are there any options to limit, purge, or archive these requests after a certain period? Thanks,Prasad

I’m not sure how other admins managed their Password Safe but would love to know how others did theirs.My main question is that I have thousands of servers with hundreds of different AD groups (privileged Admin accounts) having local admins to several mixed servers. These AD groups were either assigned via GPO or were manually added as local admins to some servers. How do you manage and link these privileged accounts to the managed systems without creating hundreds of different smart rules? Or is there a simpler way to do this?

Hi Everyone,Has anyone tried or using MS SQL Server on Linux for Password Safe Active-Active deployment or as a external SQL database.From BeyondTrust support perspective, Is there any limitation on using MS SQL Server 2022 as a external database which is deployed on Linux system. I know Amazon RDS for SQL Server which is a MS SQL deployed on Amazon Linux and is officially supported by BT. I would like to know if there are any support concerns on using MS SQL on self-hosted Linux. 

We recently updated to BeyondInsight and PasswordSafe 26.2, that introduced Personal Access Tokens. In my testing, with my Microsoft Entra account, I can’t get this to work, I’m pasting the PAT as the password and thought that was enough, am I doing it wrong? I thought the documentation that Direct Connect not working with Entra accounts was because of SSO and Password limitations?Update: I just tried to log in with a local user, and its PAT works perfectly fineThanks,Inuk

Hello Team We are facing delay in BI console and in sessions taken via passwordsafe when accessed from site other than the management node site. How could we troubleshoot on this and improve on the setup.

Hi All,My organisation has auditing requirement to review who approved what session request for certain applications. Now - Using the Activity Report in Analytics and Report, I have managed to generate the reports who approved session for RDP and SSH connections but I am unable to generate the same for application connections. Now this is mainly because as per my understanding you cannot classify an application connector as asset or an asset smart group hence I am not able to generate this report. I am looking for any guidance on how to generate application connector’s session approval request or alternatively how I can classify application connector as an asset smart group for report generation Thanks in advance for any support.

Hi teamI have a few questions about when a session is delivered in Password Safe.1- A user's connection request remains open for the duration of their approved session, right? Once connected, when the session is about to expire, is there any warning before the session closes, or does the user remain connected? (Is this configurable?)2- Does the approver's request remain open for the same duration until they approve or deny it? Or does it expire before then?3- If I requested 2 hours of connection, can I connect as many times as I need during those 2 hours? If so, can I restrict this on certain servers so that if a user disconnects, they have to request a new connection?I look forward to your comments.

Hello,We have the following use case related to email notification - Notify certain email IDs with message about password is rotated in password safe. Notify certain email IDs about next password change date.I have seen below KBA article for email notification- BeyondInsight / Password Safe - How to add, change or remove email notificationsDoes ‘release notifications for Managed Accounts’ help with above requirements.I would like to understand the feasibility on these email notifications. Thanks,Prasad

When running the Secrets Safe Entitlement report, it is not reporting on any secrets that are stored in any of the folders within the Safe.  Is this expected?

Hello there, Anybody who has a solution to this: Ability to prompt users for a ‘reason’ when using ssh direct connect in password safe? Can it be scripted somehow? Maybe sent with the direct connect string… Today I only get this when logging in: Keyboard-interactive authentication prompts from server:| Password Safe SSH Direct Connect| Password:| Your session is loading. Please wait...   RegardsMichael

Hi, currently I have trouble to onboard Microsoft SQL Management Studio 2022 application into ps_automate. I read almost all documentations and articles regarding to this issue but they had been created for Microsoft SQL Management Studio 2019. I have trouble to configure ini file,  because of AppWindowControlID field value is missing in AutoIt > Summary >  Advanced (Class).  

Hi,I have a lot of customer who needs Secret Safe + Workforce Password features for all their users to be able to provide a central password storage system. However the licensing model around Secret Safe is crazy because they have to buy a full Password Safe license, just to be able to use Secret Safe module…. and moreover they have to buy a new license just for WFP ! I would like to understand why Secret Safe is not bind as WPF on end user licensing ??? Please provide us more flexibility on this because we are loosing projects :-/

Password Safe On-Prem (Active/Passive)Some users are based on a remote location with limited bandwidth. Due to this, their sessions keep disconnecting after 2-3 mins. The packet trace also confirms this.Is there any wayout for such users so their sessions don’t terminate in the case of packet loss?