A general place for Privileged Remote Access conversations.
Recently active
The OT Remote Access Problem Has Outgrown the VPN Conversation It’s easy to say, “replace the VPN.” That is directionally right, but it’s not a complete strategy.The deeper problem is that many OT environments were never designed for today’s remote operating model. They were built around availability, safety, uptime, segmentation, and specialized engineering workflows. Then digital transformation, IT/OT convergence, OEM support models, cloud connectivity, IoT, and workforce shortages changed the reality.Now, organizations need remote access that is secure enough to effectively manage cyber risk, but practical enough for operations. That means the new standard cannot be broad network access. It has to be: Identity-secured access Least-privilege access Just-in-time (JIT) access Session-monitored access Credential-protected access Operationally aware access Auditable access This is why BeyondTrust’s OT positioning is highly relevant. Its OT security message focuses on helping
With the 26.3 release of Secure Remote Access (GA targeted for November 3, 2026), BeyondTrust will begin automatically upgrading deployments that have opted in to automatic updates. Upgrades occur only during your selected maintenance window, with advance notice, based on the Automatic Updates Channel you've chosen. Channels are activated in phases. Fast Track deployments will be upgraded to 26.3.x beginning approximately mid-January 2026. Standard Track deployments will receive their first automatic upgrade (to 26.3.x) after 27.1 ships, and Enterprise Track deployments after 27.2 ships. No deployment will ever be automatically moved to a version older than 26.3. This applies only to deployments on 25.3.1 or later with Automatically install the latest updates during maintenance day(s) and time enabled. Your channel affects version upgrades only; patches for your current version and critical security patches are not affected by your channel selection. We recommend reviewing your setting
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.A patch has been applied to all Remote Support & Privileged Remote Access SaaS customers as of Feb 2, 2026 that remediates this vulnerability (No further action is required for these sites). For the latest information on this Security Advisory from BeyondTrust, please reference the below post on our Trust Portal. Updates: 13-Feb-26 - The Security Advisory has been updated.13-Feb-26 - Knowledge Base article added: KB0023293 BeyondTrust Trust Portal - BT26-02Knowledge Base Article: KB0023293
Hello, We are looking for a way to block nested RDP sessions inside a remote RDP jump. We tried adding mstsc.exe under Application Sharing Restrictions on the relevant Session Policy, but does not seem to work. For reference, in a similar solution by Fortinet (FortiPAM), there is the option of applying a Windows App Profile where you can block specific executables (see below). Do you know if this is supported in general or I’ve missed something in our configuration? Thanks in advance.
We are currently configuring and validating a BeyondTrust Privileged Remote Access (PRA) ATLAS cluster running version 26.2.3 the new installation, and we would appreciate your assistance in clarifying some questions regarding Traffic Node selection and connectivity.Environment OverviewOur environment consists of three ATLAS appliances: Primary: atlasp.xx.xx – 10 Traffic Node 1: atlas1.xx.xx – 10 Traffic Node 2: atlas2.xx.xx – 10 The public access hostname is remot.xx.xx, which resolves to the Primary appliance. The cluster is configured and synchronized, the hostnames are configured, and the wildcard SSL certificate for *.xx.xxhas been installed. The Traffic Node selection method is currently set to Random.Issues and Questions When accessing https://console, the Web Access Console displays a “Connect to” selector with the Primary and both Traffic Nodes available. Is this the expected behavior in PRA 26.2.3? Is there a supported configuration option to hide this selector and allow
Hi all,We have deployed a BeyondTrust PRA Cloud instance through Pathfinder in one of our customers.Due to several users with personal accounts (e.g. Gmail), we are restricted in sharing with them the Microsoft My Apps link (with the Tenant ID) in order for them to click the BeyondTrust application.That’s ok; however, we observe that there is a minimum of three clicks for a user to reach the /console page (one on the Enterprise Application, one on the PRA application on Pathfinder, and then the Launch Privileged Web Access Console).I have selected the option to Redirect to the Privileged Web Access Console under Management > Site Configuration > HTTP, but I think this is for direct connections to the instance.No big deal, but just trying to figure out if there is a way to minimize the number of clicks for such a use case.Thanks all.
Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?
How to Strengthen Your Microsoft Defenses in 2026: Security Recommendations Relying entirely on patching or simple fixes is an inadequate defense strategy. Remediation must be paired with proactive architectural guardrails. Implement a multilayered defense-in-depth model built on these key report recommendations: Tailor vulnerability management to your environment and move away from a one-size-fits-all approach. Prioritize security updates based on your unique environment, ensure your operating system and third-party software are up-to-date, and avoid using end-of-life software. Implement least privilege and zero trust controls across the stack. Restricting privilege across network, identity, account, cloud, and application layers provides a safety net that limits lateral movement and the blast radius of zero day exploits. Secure remote access pathways by replacing common entry points such as RDP and VPNs. Enforce authentication and session monitoring to detect misuse early. Impl
We need to evaluate Mikron remote access solution at Molex:Key areas to cover:Identify PRA use cases that might applyUnderstand architecture and discovery potencial solution with BTDocument current Mikron use cases and architecture.Validate PLC/OT device connectivity and vendor remote-access requirements.
Hello All!We recently upgraded PRA from 24.3.4 → 25.2.2 → 25.3.5 . After the upgrade 100+ Ubuntu 24.04 headless devices are no longer accessible. We have used the standard linux installer in these machines and were able to do screen share using PRA over the years. Remote users need to be able to see the login screen as there are different user profiles (IT, engineer etc)Has anyone seen similar issues after upgrades? Support team is basically asking us to use headless installer which is of not any help. When we use headless installer it doesn’t even show Screen Share tab in PRA console.For our existing standard client which is now broken, in the logs I see PRA creating a new virtual display and is switching between the GDM x0 and PRA-created virtual display. Any suggestions ?
Anyway of being able to mass delete users in PRA? E.g. if not authenticated in X amount of days?GUI doesn’t have check boxes to select multiple users to perform bulk tasks. There’s a 5+ sec gap when deleting individual users one buy one and whilst waiting for the user table to refresh, quite tedious! No automated settings I’m aware of for internal users, whereas vendor users have this option -Will implementing SCIM (SAML only currently) address this or will it only disable users rather than delete?
Hi Everyone,I would like to raise a concern that we have noticed after upgrading to 25.3.3 related to clipboard restriction on shell sessions.launching shell jump (no jump client installed) does not restrict user clipboard even if the session policy restrict.tried applying session policy on both user level and jump item but still user can copy/past in both directions.Simulator in Session policy shows restriction but doesn’t really apply after connecting to shell session. anyone using 25.3.3 facing this issue ? Thanks.
BeyondTrust Privileged Remote Access 26.2: Smarter Sessions, Sharper ControlPrivileged Remote Access 26.2 introduces AI sessions summaries, deeper credential controls, and enhanced auditability to sharpen session visibility and accelerate service delivery. Session Intelligence That Works as Hard as Your Team Does Privileged access used to end at the session. You granted access, monitored it, recorded it, and if you needed to understand what happened, you had to manually review hours of recordings. BeyondTrust Privileged Remote Access (PRA) 26.2 changes that. With AI-generated session summaries, in-session credential injection, mandatory access justification, and keystroke-level logging, Privileged Remote access 26.2 turns every session into structured, auditable, and reusable intelligence, without slowing your team down or compromising control. Read on for the highlights, or click here to view the complete release notes for detailed technical updates. Key Enhancements in Privileged
We have Cimplicity Webspace in our environment, which is web based. The main dashboard does not have a login screen, but each page off of the main page is an embedded IDE object that has its own authentication. We are trying right now to run the application as a Web Jump, but Web Jump does not see the authentication fields because they are in the embedded IDE and not HTML fields.Has anyone found a way to use Cimplicity Webspace with PRA?
Hi guys.I was looking in other topics that some people have in their PRA consoles the option to create an Web Jump connection type. But it doesn’t appear on my console as you can see in the print below.What is the requirements to enable this option?I didn’t find any documentation explaining this.
Good day all,Forgive me if this is an obvious question, but I was not the one who set-up our PRA environment and the admin left our company leaving little documentation behind. I’m finding that when a vendor signs in, they have visibility into pretty much all of our devices with the PRA endpoint installed, even if they cannot sign into them (no credentials for the actual machine but they can get into the console) Looking at Asset Groups, I can see many users in them, but I cannot figure out where they are inheriting the permissions from to remove them. (See screenshot for a small snippet of what I am referring to) Any guidance on where to track this down to resolve it? I am now signed up for the Beyond Trust University and am learning the environment but am hoping to resolve this sooner rather than later.I wasn’t certain what information, or screenshots would be needed to understand the issue fully, so please feel free to ask any clarifying questions. Thank you all!-Michael
I have multiple Database admins I need to give access to our database for. We have no resources for PAW or Internal Admin machines. Is it the purpose of Beyondtrust SQL server tunnels to be ran on BYOD device and have them tunnel SQL Studio traffic to my on prem SQL server? Has anyone done this? I believe I have the tunnel up. How do you use Management studio? My “Open datasource Client” is grayed out. How do the credentials work? Do the credentials I use for the tunnel work for everyone using the tunnel? Or do I need to create one tunnel per person?
Hi Everyone!Is it possible to create a Jump Item in Privileged Remote Access (PRA) to access an IBM i (AS/400) system?The environment uses TN5250 over TLS (port 992), and I would like to know if PRA supports this type of connection natively or if an external TN5250 client needs to be integrated with PRA.If anyone has implemented this scenario or knows the limitations and best practices, I would appreciate any guidance. Thanks in advance
Ran into an issue while upgrading to 25.3.3 (and 26.1.1 + Base 8.2) this week, maybe I’m incorrect in my assertion but I’ve updated our appliance several times since going live, and haven’t had this issue before.After updating to 25.3.3 all of our Desktop clients stopped working, we use SAML auth, and the SAML itself works fine, we see successful logins, but when the login is complete, the desktop console doesn’t do anything, it remains in its default state, waiting for you to press login, and the cycle repeats.I tested this both on going from 25.3.2 to 25.3.3 and 26.1.1, with desktop consoles both on 25.3.2 and 25.3.3, same thing on both.Again, I’ve updated the appliance several times, without the need to manually re-install the desktop console.SAML login to the /login page and /console page in web works fine.
Hi Can we deploy jumpoints in Prod and DR site, if reachability is there? should it be in same VLAN?
Hi everyone, I’m quite new to BeyondTrust and am completing the Privileged Remote Access - BCIE course.I wanted to know the difference between a Remote RDP Jump Item vs Remote Jump Item.Is Remote RDP Jump similar to using a VM session?Thanks in advance!
From what I can tell, dedicated account mapping (e.g. KB0017035) the only option available is to map the exact same attribute in both domains. For example, employeedomain\user1 has attribute1 set to “user1”privilegeddomain\admin1 has attribute1 set to “user1”to drive the mapping via smart rules. However, that implies that modifying attribute1 in employeedomain to a different value, say, “user2” would grant user1 access to user2’s privileged resources, giving domain1 authority over a privileged domain’s access. What I want to be able to do is have privilegeddomain\admin1 attribute1 set to “user1”, and map that to employeedomain\user1’s name field (or samaccountname, or SID - something not modifiable without breaking the employeedomain\user1 account). Is that possible?
Hi,We are experiencing an issue with the session termination behavior in PRA.We have configured the system so that when a session ends, the user's session on the target server should be logged off automatically. However, after ending a session and reconnecting, everything remains exactly as it was left previously, which indicates that the user session is not actually being logged off.Both the web console and the desktop console are running version 25.3.2.We found a KB article that appears to describe a similar issue, but it does not seem to apply to the version we are currently running.Additionally, we are currently applying the Session Policy through Group Policies. To rule out a policy inheritance issue, we also assigned the same Session Policy directly to the Jump Item, but the behavior remained exactly the same.If anyone has experienced a similar issue or knows why this might be happening, we would really appreciate any guidance or suggestions on what else we should verify.Thank yo
I would like to know which default browser BeyondTrust is integrated for the web jump method. Is there any default browser for this method, or does it utilize the browser from the Jumpoint server?
In AWS, we created a Global Accelerator service and associated the Windows machines used by the Risk-Team with this accelerator service.Then, the Risk Team will access the Windows machine using the IP provided by the acceleration service.In terms of user experience, it is much smoother than directly connecting to a Windows machine, and it is convenient to operate on a Windows machine.However, after connecting to the Windows machine via PRA-Console, the fluidity decreases, operations become sluggish, which is not conducive to data processing actions. So, I would like to know if PRA has its own built-in acceleration service. Or, can I configure AWS Global Accelerator for PRA? This would improve the user experience for staff working in China.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
