Hi everyone,
we would like to raise a concern regarding the Command Shell behavior introduced in Remote Support 25.3.1.
The fact that the shell now starts in the context of the logged-in user by default (without requiring user credentials or consent) is, from our perspective, a significant security regression.
In previous versions, this behavior was not possible — access to the user context required explicit authentication. Now, support staff can directly access user-level resources such as OneDrive, network shares, or SharePoint without the user being aware.
In regulated environments (e.g., banking), this is a serious issue:
- it breaks the separation between user and system privileges
- it introduces potential audit and compliance risks
- it allows unintended access to sensitive user data
At the same time, our operational requirement remains:
- we must be able to perform support actions without user interaction
- but strictly within system/administrative context unless explicitly approved otherwise
Currently, we do not see any way to control or restrict this behavior via session policies or configuration, which is a major gap.
Questions to the community (and hopefully BeyondTrust team):
- How are you mitigating this risk today?
- Is there any undocumented workaround to restrict user-context shell access?
- Is BeyondTrust planning to introduce policy-level controls for this?
From our perspective, this is not just an enhancement request but a necessary control for secure operation in enterprise environments.
Without such control, we see a real risk that the product may not be compliant with internal security standards, which could impact its continued use.
Would appreciate feedback from both the community and BeyondTrust.
