General

Hello All!We recently upgraded PRA from 24.3.4 → 25.2.2 → 25.3.5 . After the upgrade 100+ Ubuntu 24.04 headless devices are no longer accessible. We have used the standard linux installer in these machines and were able to do screen share using PRA over the years. Remote users need to be able to see the login screen as there are different user profiles (IT, engineer etc)Has anyone seen similar issues after upgrades? Support team is basically asking us to use headless installer  which is of not any help. When we use headless installer it doesn’t even show Screen Share tab in PRA console.For our existing standard client which is now broken, in the logs I see PRA creating a new virtual display and is switching between the GDM x0 and PRA-created virtual display. Any suggestions ? 

Anyway of being able to mass delete users in PRA? E.g. if not authenticated in X amount of days?GUI doesn’t have check boxes to select multiple users to perform bulk tasks. There’s a 5+ sec gap when deleting individual users one buy one and whilst waiting for the user table to refresh, quite tedious!  No automated settings I’m aware of for internal users, whereas vendor users have this option -Will implementing SCIM (SAML only currently) address this or will it only disable users rather than delete?​​​​​​​

Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?

Hi Everyone,I would like to raise a concern that we have noticed after upgrading to 25.3.3 related to clipboard restriction on shell sessions.launching shell jump (no jump client installed) does not restrict user clipboard even if the session policy restrict.tried applying session policy on both user level and jump item but still user can copy/past in both directions.Simulator in Session policy shows restriction but doesn’t really apply after connecting to shell session. anyone using 25.3.3 facing this issue ? Thanks.

We have Cimplicity Webspace in our environment, which is web based. The main dashboard does not have a login screen, but each page off of the main page is an embedded IDE object that has its own authentication. We are trying right now to run the application as a Web Jump, but Web Jump does not see the authentication fields because they are in the embedded IDE and not HTML fields.Has anyone found a way to use Cimplicity Webspace with PRA?

Hi guys.I was looking in other topics that some people have in their PRA consoles the option to create an Web Jump connection type. But it doesn’t appear on my console as you can see in the print below.What is the requirements to enable this option?I didn’t find any documentation explaining this. 

Good day all,Forgive me if this is an obvious question, but I was not the one who set-up our PRA environment and the admin left our company leaving little documentation behind. I’m finding that when a vendor signs in, they have visibility into pretty much all of our devices with the PRA endpoint installed, even if they cannot sign into them (no credentials for the actual machine but they can get into the console) Looking at Asset Groups, I can see many users in them, but I cannot figure out where they are inheriting the permissions from to remove them. (See screenshot for a small snippet of what I am referring to) Any guidance on where to track this down to resolve it? I am now signed up for the Beyond Trust University and am learning the environment but am hoping to resolve this sooner rather than later.I wasn’t certain what information, or screenshots would be needed to understand the issue fully, so please feel free to ask any clarifying questions. Thank you all!-Michael 

I have multiple Database admins I need to give access to our database for. We have no resources for PAW or Internal Admin machines. Is it the purpose of Beyondtrust SQL server tunnels to be ran on BYOD device and have them tunnel SQL Studio traffic to my on prem SQL server? Has anyone done this? I believe I have the tunnel up. How do you use Management studio? My “Open datasource Client” is grayed out. How do the credentials work? Do the credentials I use for the tunnel work for everyone using the tunnel? Or do I need to create one tunnel per person? 

Hi Everyone!Is it possible to create a Jump Item in Privileged Remote Access (PRA) to access an IBM i (AS/400) system?The environment uses TN5250 over TLS (port 992), and I would like to know if PRA supports this type of connection natively or if an external TN5250 client needs to be integrated with PRA.If anyone has implemented this scenario or knows the limitations and best practices, I would appreciate any guidance. Thanks in advance

Ran into an issue while upgrading to 25.3.3 (and 26.1.1 + Base 8.2) this week, maybe I’m incorrect in my assertion but I’ve updated our appliance several times since going live, and haven’t had this issue before.After updating to 25.3.3 all of our Desktop clients stopped working, we use SAML auth, and the SAML itself works fine, we see successful logins, but when the login is complete, the desktop console doesn’t do anything, it remains in its default state, waiting for you to press login, and the cycle repeats.I tested this both on going from 25.3.2 to 25.3.3 and 26.1.1, with desktop consoles both on 25.3.2 and 25.3.3, same thing on both.Again, I’ve updated the appliance several times, without the need to manually re-install the desktop console.SAML login to the /login page and /console page in web works fine.

Hi Can we deploy jumpoints in Prod and DR site, if reachability is there? should it be in same VLAN?

Hi everyone, I’m quite new to BeyondTrust and am completing the Privileged Remote Access - BCIE course.I wanted to know the difference between a Remote RDP Jump Item vs Remote Jump Item.Is Remote RDP Jump similar to using a VM session?Thanks in advance!

From what I can tell, dedicated account mapping (e.g. KB0017035) the only option available is to map the exact same attribute in both domains. For example, employeedomain\user1 has attribute1 set to “user1”privilegeddomain\admin1 has attribute1 set to “user1”to drive the mapping via smart rules. However, that implies that modifying attribute1 in employeedomain to a different value, say, “user2” would grant user1 access to user2’s privileged resources, giving domain1 authority over a privileged domain’s access. What I want to be able to do is have privilegeddomain\admin1 attribute1 set to “user1”, and map that to employeedomain\user1’s name field (or samaccountname, or SID - something not modifiable without breaking the employeedomain\user1 account). Is that possible? 

Hi,We are experiencing an issue with the session termination behavior in PRA.We have configured the system so that when a session ends, the user's session on the target server should be logged off automatically. However, after ending a session and reconnecting, everything remains exactly as it was left previously, which indicates that the user session is not actually being logged off.Both the web console and the desktop console are running version 25.3.2.We found a KB article that appears to describe a similar issue, but it does not seem to apply to the version we are currently running.Additionally, we are currently applying the Session Policy through Group Policies. To rule out a policy inheritance issue, we also assigned the same Session Policy directly to the Jump Item, but the behavior remained exactly the same.If anyone has experienced a similar issue or knows why this might be happening, we would really appreciate any guidance or suggestions on what else we should verify.Thank yo

I would like to know which default browser BeyondTrust is integrated for the web jump method. Is there any default browser for this method, or does it utilize the browser from the Jumpoint server?

In AWS, we created a Global Accelerator service and associated the Windows machines used by the Risk-Team with this accelerator service.Then, the Risk Team will access the Windows machine using the IP provided by the acceleration service.In terms of user experience, it is much smoother than directly connecting to a Windows machine, and it is convenient to operate on a Windows machine.However, after connecting to the Windows machine via PRA-Console, the fluidity decreases, operations become sluggish, which is not conducive to data processing actions. So, I would like to know if PRA has its own built-in acceleration service. Or, can I configure AWS Global Accelerator for PRA? This would improve the user experience for staff working in China.

Hello, An issue we are having in our PRA instance is that when we try to do a large file transfer such as an .iso file from our local machine to a remote asset via Beyond trust PRA RDP connection it seems like the transfer will time out\fail before all of the data has been transferred. In general file transfer works fine for smaller files back and forth but we have trouble with large ones. Wondering if anyone has any tips/tricks for copying large files through PRA? 

Hi team We're writing to report a problem that has been occurring with our client. Several users have reported that while connected to a session, their session suddenly disconnects. This has happened to multiple users, and we'd like to know the cause of this behavior and if it's a known bug.

Hello!We are using PRA - jump client based connections as well as BYOT RDP (more hops). We have frequently noticed drastic lag /slowness when remote sessions are used for HD/4K video manipulation, 3D modelling other GPU-accelerated use cases. In certain cases Solidworks models don’t even show up in PRA. Bandwidth and remote computer resources are not a concern  as these are purpose built workstations. Anyone else has faced similar issues ? any suggestions to improve performance 

Hi Everyone. A client is asking details around capacity planning for session recordings in PRA. I tried to dig out BT documents around this but couldn’t find any appropriate information. If anyone could help me out with this info, that would be great. Thanks!Average/Peak recording bitrate per session Average and peak data generated by each recorded session (Mbps or MB/min). Daily storage growth Daily storage consumption for session recordings. Please provide the calculation (Average recording size × Number of recorded sessions per day) or historical storage usage data over several days Capacity margin (preferably N-1)Please demonstrate that sufficient storage capacity is available even if one storage component fails (N-1 capacity).Confirmation that the 1 Gbps NIC is sufficientPlease confirm that the 1 Gbps network interface is adequate and will not become saturated under peak screen-sharing and session-recording workloads.  

Hello For PRA SaaS , we would need to allow from internal jumpoints to PRA SaaS on port 443 mainly right? and from PRA to AD on 636 ? For protocol tunnel, how is the network communication?  From enduser IP to PRA on port 443, communication will be established? and from there jumpoint will try to establish session on the protocol tunnel port mentioned to the services?