Multiple Admin Appliances

Greetings all,

 When we first deployed our 3 appliance architecture, we were told by BeyondTrust, NEVER run admin functionality on more than 1 appliance due to data corruption.

The last software update I ran, the primary (admin) appliance failed and had to be recovered. To aid in people getting to work, I enabled the admin web console on the second appliance and dropped it from the load balancer. I thought I set it back to non-admin by disabling the BeyondInsight Manager Engine but I missed the BeyondInsight Management Web Console until today when an admin IM’ed me on Teams with a screenshot.

I went in and disabled the web admin portal but it got me wondering. If I enabled the web admin portal but left the manager engine disabled, would that still cause problems?

We have most our service accounts unmanaged. We ask users to rotate those once a year but they ignore us for the most part. If they could get the ability to change passwords without logging into the admin portal with username and passsword+TOTP, that would greatly help.

BeyondTrust, when we set it up at least, only allows for 1 SAML logon so by having a dedicated admin appliance with two non-admin appliances in a load balancer, people can use SAML for daily password grabs but they need to use a different URL as well as username and password to login and change a password.

So the question is, does running the admin web portal on multiple appliances corrupt things or Does the BeyondInsight Manager Engine corrupt things if run on multiple appliances?