Skip to main content

General

A general place for Password Safe conversations.

  • 284 Topics
  • 722 Replies
282 Topics
S
SammedPatilNewcomer
asked in General
Managed Account Next change date should consider Last change date

Hello Team,  We have observed a issue with PasswordSafe, where Managed Account Next change date is calculated based on Last scheduled change date. If the user changes the password manually, Next change date is not updated to new date based on Password change Frequency (Xdays). The problem observed today, is that teams who have manually changed the password for a Service account ahead of a policy based 90-day rotation, as part of a RFC change window, will suddenly have the service account password rotated automatically again (potentially just a few days later) on the 90-day rotation enforcement date by PasswordSafe - thus breaking their production service. How can we achieve this use case in such a way that Next change date is updated based on last change date (scheduled & manual)?

463
L
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
published in General
Monthly Buzz - April - Password Safe

Discover What's New in Password Safe 24.3: Enhanced Cloud Support and Security Features As organizations continue to adopt and migrate to cloud, ensuring management of all identities has become more complex than ever before. Addressing secrets sprawl and access management across the entire estate to achieve compliance and maintain security is complicated and requires visibility into more areas than many organizations have bandwidth to achieve. Further, DevOps teams are being tasked with deploying as quickly as possible and are often needing access to the same credentials across teams, while also ensuring least privilege access and operational efficiency is maintained.Read the full blog post here. Latest Available Version: Password Safe 24.3– December 2024 Beekeepers Hot Topics Export Accounts from BeyondInsight“We have one environment of BeyondTrust Insight with scanned accounts and managed accounts. We are planning to setup backup environment at different location with different domai

600
B
Community Manager
B
BartoszApprentice
asked in General
ESA deployment requirements

Hello community,I’m looking for a list of requirements for ESA deployment along with information if SMB3 is supported and which SMB version is the default one?I can’t find this information anywhere in documentation, the only mention about it is this KBA but its 9 months old and I’m not sure if its up to date at this moment.Cheers,Bartosz

555
B
frank.colvin
frank.colvinVeteran
asked in General
SSH using Secure CRT, Winscp or sftp clients

we are rolling out linux/unix managed systems and we are having great success with putty, however our developers user Secure CRT, winscp and sftp clients. does anyone have any advice/guidance? 

1182
R
B
BartoszApprentice
posted in General
More granular access rights for custom PS Admin roles

Hello everyone,We’re struggling with lack of possibility to introduce more granular access for PS Administrators, there’s an idea for the same More granular access rights for custom PS | All Product Ideas - Public Do you have similar experience with the product? If yes then please share your thoughts on that and like an idea if you find it useful, maybe it will get some attention thanks to that.Cheers,Bartosz 

2168
R
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 21 - Apr 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021742 - How to configure Duo as an Identity Provider for SAML KB0022219 - Workforce Passwords continuously spins (loads) and last synchronized shows 'an error occurred' KB0022222 - Group sync fails when selecting a specific Domain Controller in PS cloud KB0022223 - Unable to create Smart Rule - An unknown error occurred KB0022230 - With Host Headers Restriction State (HHRS) configured, accessing an application or remote session results in error: Invalid session token KB0022231 - AD Webconsole logins fail in active active environments following an upgrade "An authentication error occurred" KB0022234 - Okta SAML integration is failing with 500 internal server error KB0022240 - Unable to rename organization "an error occurred while attempting to save this item" KB0022241 - Password Safe tile Accou

330
GloriaB
BeyondTrust Employee
T
BeyondTrust Employee
tkellumBeyondTrust Employee
asked in General
Remote App Launch Display Scaling

I wanted to bring this to the community for feedback as it was brought up for discussion during a troubleshooting case for a Password Safe customer, while configuring Remote Applications to be launched via ps_automate.exeIt was found that if we expand the Remote App window during the login process, we may see the login screen display look distorted based on the size the window takes up on the user’s screen. I attached a screen capture showing what was observed while initiating the session with a single high resolution display detected and one with multiple displays detected. observed remote app loginThe important thing to note here is that this does NOT affect the look of the actual application when it appears in RemoteApp mode and it does not affect the ability to launch the application itself. This is purely a cosmetic concern.I have three questions on this:Is this this due to the configuration of the Remote App session? Is this the result of a limitation of FreeRDP? What would be th

360
T
BeyondTrust Employee
R
Robert A.Rising Star
asked in General
Securing default generic accounts (bt/bi/bu-admin)

Hi,I’m trying to find a good way to secure these generic accounts and still to be able to use them as bt- and buadmin are used on a regular basis for updates and support cases. As I have 4 appliances to manage and have high security requirements I’d need to have individual passwords, with regular changes and changes after access for each of them. It would be a challenge to manage the regular changes and make performing regular tasks challenging.I had posted an idea to use the Enterprise Updater as SPOC (Single Point of Control) which would have it’s own credentials and would have an encrypted key based connection to all appliances. From the Updater one could create individual schedules for the updates and unlock/lock them centrally. This would make tracking, planning and handling of updates a lot easier and only one generic user (buadmin) would need to be secured. I’d prefer a personal account though and leaving the generic account as a breaking glas solution. This would only cover the

1216
R
B
BartoszApprentice
posted in General
Additional TOTP step for federated authentication

Hi all,I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Additional TOTP step for federated | All Product Ideas - Public it’s not possible to use TOTP when federated authentication to Password Safe is enabled.Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,Bartosz 

805
rhagerm
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021352 - Secrets Safe import secrets menu option missing KB0022203 - User in admin group is not able to see "view all safes" toggle in Secrets Safe KB0022204 - Cannot view discovery reports "An error was reported" KB0022217 - Secrets Cache install fails with error "0x80070643 - Fatal error during installation" KB0022218 - End user does not have personal folder in Secrets Safe

160
GloriaB
BeyondTrust Employee
S
suhail.salimNewcomer
asked in General
Change AD user status from active to inactive/disabled

Hi All,We have AD users in password safe who are quarantined and form login disabled. The users are no longer in organizations. The group we created to onboard these users are also disabled/deleted. The access revoke method used by earlier admins were incorrect and they removed the group from password before syncing them. Is there a way we can make these users status as inactive?

1212
MikeK
D
Didla DheerajNewcomer
asked in General
Enhance the disco scans so they don't generate the false-positive logon events

Hi All,When the Password Safe Detailed Discovery Scan runs against a Windows server, the BTExecService agent deployed on the scanned server enumerates the members of all local admin groups, so these can eventually be onboarded and managed by Password Safe. We have observed that Group Memberships for each enumerated account are also checked. This enumeration process is causing the LastLogonTimeStamp for the enumerated accounts to be updated, generating logon events attributed to the Discovery Scan agent BTExecExt.Phoenix.exe, even though no actual logon operation took place.In fact, according to the Microsoft article below, the LastLogonTimeStamp attribute can be updated and trigger a logon event even if the user has not logged on. This behaviour is an artifact of a Kerberos operation known as Service-for-User-to-Self (S4u2Self), in which a client/service can request a ticket for a user that is only useful for things like determining Access Checks or Group Membership.https://techcommuni

2431
H
BeyondTrust Employee
D
Didla DheerajNewcomer
asked in General
Native web application support in PAM

Hi All,Currently it's not possible to add a webbrowser application native in BeyondInsight Password Safe and inject the privileged/managed account credentials, without RDP/RDS server integration. Please add the option to: Add a (web)application page and inject the privileged/managed account credentials Add a rotate option, using an API functional account with custom API scripting/calls. Best regards,Dheeraj.

761
H
BeyondTrust Employee
T
tsipesNewcomer
asked in General
API /Secrets-Safe/Secrets returns no data

We recently upgrade to 24.3 and now we have a reporting issue.  Using the API /Secrets-Safe/Secrets with a GET returned all the secrets stored.  Now, it returns nothing.  Other API calls to other endpoints work with no problem.  This is a SOX reporting issue now.  I have opened a ticket but thought I would try here to see if anyone had any thoughts.  Other than the software upgrade, nothing else has changed. TIA

441
H
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 7 - Apr 14)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021854 - BeyondTrust Product Update Server changing from Imperva to CloudFlare KB0022146 - Not receiving reports from the Analytics and Reporting tool - No records were found matching your criteria KB0022192 - Appliance logs not downloading - timeout error "The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing" KB0022199 - How to upgrade Secrets Cache for Windows KB0022211 - Resource Broker update fails "Setup Wizard ended prematurely because of an error"

270
GloriaB
BeyondTrust Employee
P
prasadp87Trailblazer
asked in General
Bulk Functional account changes

Hello Team,We have around 500+ Managed Systems, and we want to change their functional account in bulk. Can someone please suggest best possible way to do this?Note: The functional account remains same for all. Thanks,Prasad

411
R
J
BeyondTrust Employee
Johnli AzucenaBeyondTrust Employee
posted in General
Password Safe: Discovering and Adding Assets Interactive Workshop 

Hop on and join our interactive workshop, where you can gain hands-on experience and handle different use case scenarios.TITLE: Password Safe: Discovering and Adding Assets Interactive Workshop Date: 28 May 2025 Time: 8 am Eastern and 1 pm UK and 8 pm SGTDuration: 90 minutes  Workshop Aim:This interactive workshop enables participants to learn the aim and process of adding Assets into BeyondInsight. There will be an opportunity to troubleshoot and configure Discovery Scanning for different Use Cases, configure these within a virtual test environment and collaborate with other contributors. Learning Objective:Learn how to create and configure Discovery Scanning in Password Safe and apply them to specific use cases In this session we will cover:Known Assets and Managed Assets Adding an Asset into BeyondInsight manually Configuring a Detailed Discovery Scan Discovering and Scanning an Asset from a Directory Scheduling a Scan by Address Group Discovery Scanning Use Case ConfigurationClick 

360
J
BeyondTrust Employee
J
BeyondTrust Employee
Johnli AzucenaBeyondTrust Employee
posted in General
Password Safe: Access Policies Interactive Workshop

TITLE: Password Safe: Access Policies Interactive Workshop Date: 29 April 2025 Time: 3 am Eastern and 8 am UK and 3 pm SGTDuration: 90 minutes  Workshop Aim:This interactive workshop enables participants to learn the aim and process of configuring and scheduling Access Policies in Password Safe. There will be an opportunity to troubleshoot and configure Access Policies for different Use Cases, configure these within a virtual test environment and collaborate with other contributors. Learning Objective:Learn how to create, configure and schedule Access Policies in Password Safe and apply them to specific use cases In this session we will cover:Introduction to Access Policies Access Policy Types Configuring and Scheduling an Access Policy Connection Profiles Access Policy Use Case ConfigurationClick here to enroll! For more information on workshops or to make suggestions, please navigate here. 

310
J
BeyondTrust Employee
D
DerianVNewcomer
posted in General
Ability to upload our private CA certificate or to be able to turn off the certificate verification in the UI.

Hi all,I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Ability to upload our private CA certificate or to be able to turn off the certificate verification in the UI. Sometimes if a CA certificate it’s not working, we need to rebuild the certificate instead of being able to only turn off the certificate verification option for SIEM integration (QRADAR) for example.Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,DerianV

461
tclowater
BeyondTrust Employee
J
JayaNewcomer
posted in General
More Description Error message when RDP fails

Hello Everyone,I wanted to bring up this issue with RDP Failure error messages in PBPS. Currently, when an RDP session fails, users see a generic message like “Failed to connect RDP session” without any specific details on the reason- whether it’s an account lockout, network issue or authentication failure.Pbsm.log contains more detailed error codes, it would be great if these codes are translated into more meaningful messages within the UI, it would significantly reduce troubleshooting time.We have an idea for same raised:  More Description Error message when RDP | All Product Ideas - PublicWould love to hear if anyone else have encountered same challenges? You can share your experience or vote for an idea if you find it useful.CheersThanks and regardsJaya

1081
tclowater
BeyondTrust Employee
V
VarunsUni29Apprentice
asked in General
Onboard TOTP Seed File to generate OTP Code in Password Safe

Dear Team, The client has a use case to upload TOTP seed file and generate the new OTP on the console [similar to the retrieve password option]. For example, BeyondTrust Password Safe acts like Google/Microsoft authenticator app. I can't find any platform to upload the seed file, which will generate the OTP as output. Anyone who implemented such use case before? This kind of usecase is already available in BitWarden. Please find the link below:Viewing TOTP Code: https://bitwarden.com/help/integrated-authenticator/ Thanks in advance!!Varun

931
tclowater
BeyondTrust Employee
B
BartoszApprentice
posted in General
Limited functionality of discovery scanner

Hello community,I’m wondering if our company is the only one who’s experiencing issues due to limited functionality of discovery scanner in password safe? We’re facing multiple issues including problems with discovering domain accounts added to local admins, constant login event alerts triggering etc.We even raised an idea for improvement for scanner:Improved discovery scanner | All Product Ideas - PublicI would like to know if you’ve got similar experience, maybe you found some solution to make it better, also if you found this idea useful please vote for it.Cheers,Bartosz

481
B
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Mar 31 - Apr 7)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021401 - WinSCP error: Remote side send disconnect message. Type 11 "Invalid Session Token" Authentication failed. KB0021691 - When trying to update a service with dependency that share a managed shared service account, it fails to start service KB0022148 - Discovery scan of Oracle database fails with error code 12514 KB0022150 - How to use EPMs Allow as Password Safe user option to grant access to Failover Cluster Manager KB0022151 - Is SQL always on required for Active Active environments? KB0022162 - Workforce Passwords URL is trimmed when creating a credential KB0022166 - 2019 SQL 2502 (February 2025) update failure KB0022171 - After upgrading to BeyondInsight 24.3 the EPM MMC policy editor login fails - Could not authenticate domain user KB0022172 - Large Active Directory (AD) group sync f

590
GloriaB
BeyondTrust Employee
J
JayaNewcomer
posted in General
Pagination concept to be include in PasswordSafe

Hello everyone,We’re looking for implementation of Pagination concept to efficiently handle large datasets by retrieving data in smaller, manageable chunks. This will improve response time and optimize memory usage, an idea for same has been raised: Pagination concept to be include in | All Product Ideas - PublicDo you have similar situation by any chance? You can share your relevant experience or vote for the idea if you find it useful.Cheers,Thanks and Regards,Jaya 

251
J
BeyondTrust Employee
R
RajabommuNewcomer
asked in General
Be able to import encryption certificates into BI Cloud

Hi All,The option to import QRADAR encryption certificates would allow validation to occur in both directions for TCP-SSL traffic. Regards,Raja

91
tclowater
BeyondTrust Employee

Badge Earners

  • BCIE: Privileged Remote Access
    Flohas earned the badge BCIE: Privileged Remote Access
  • BCIE: Privileged Remote Access
    Ro-Manhas earned the badge BCIE: Privileged Remote Access
  • BCSE: Privileged Remote Access
    Ro-Manhas earned the badge BCSE: Privileged Remote Access
  • BCA: Endpoint Privilege Management - Linux
    Mudupurihas earned the badge BCA: Endpoint Privilege Management - Linux
  • BCIE: Privileged Remote Access
    vilasboashas earned the badge BCIE: Privileged Remote Access
Show all badges
Terms & ConditionsCookie settings