Apprentice

Question

Security Concerns with Application Sessions in Password Safe Cloud (File Access & Browser Restrictions)

Forum|Forum|4 months ago
April 9, 2026
2 replies
81 views

I have a question regarding use of BeyondTrust Password Safe Cloud, specifically around application session security controls.

We are currently experiencing several security concerns when launching application sessions through the platform:

1. File Access via Chrome Download

When an application session is initiated, users can successfully access the target application via Chrome. However, if a user downloads a file and clicks “Show in folder”, it opens File Explorer on the application server.

This behavior allows users to:

Browse system directories
Access sensitive locations (e.g., C:\ drive)

2. Unrestricted Browser Usage

Within the same application session, users are able to:

Open new browser tabs
Navigate to other websites or internal applications
Perform actions outside the intended application scope

Security Concerns

This creates a significant risk, as users may gain unintended access to:

Unauthorized system resources
Sensitive files and directories

Has anyone implemented similar restrictions in Password Safe Cloud application sessions?

Are there recommended configurations, policies, or best practices to achieve this level of control?
Is this something that needs to be enforced at the Password Safe level, or should it be handled at the OS / browser configuration level (e.g., GPO, kiosk mode, hardening)?

BeyondTrust Employee

Password Safe provide remote sessions and application sessions similarly as though you’re performing a native mstsc to a terminal server. The user will inherit the permission of the managed account. Password Safe is not designed to handle application control. The simplest way would be use a kiosk mode or control through Windows Group policy.

If you’re looking for application control then review BeyondTrust Endpoint Privilege Management.

Rising Star

You need to restrict the functional account used to launch the RDP sessions the app is executed in. I use a combination of a basic FA user (domain users member only), group policy (windows, RDS and browser settings), Privileged Management and NTFS permissions to restrict what can be done.
I suggest that kiosk mode is irrelevant as PS_Automate already launches the browser in an ephemeral mode and you can’t change that easily.