General

Hi everyone, I’m quite new to BeyondTrust and am completing the Privileged Remote Access - BCIE course.I wanted to know the difference between a Remote RDP Jump Item vs Remote Jump Item.Is Remote RDP Jump similar to using a VM session?Thanks in advance!

From what I can tell, dedicated account mapping (e.g. KB0017035) the only option available is to map the exact same attribute in both domains. For example, employeedomain\user1 has attribute1 set to “user1”privilegeddomain\admin1 has attribute1 set to “user1”to drive the mapping via smart rules. However, that implies that modifying attribute1 in employeedomain to a different value, say, “user2” would grant user1 access to user2’s privileged resources, giving domain1 authority over a privileged domain’s access. What I want to be able to do is have privilegeddomain\admin1 attribute1 set to “user1”, and map that to employeedomain\user1’s name field (or samaccountname, or SID - something not modifiable without breaking the employeedomain\user1 account). Is that possible? 

Hi,We are experiencing an issue with the session termination behavior in PRA.We have configured the system so that when a session ends, the user's session on the target server should be logged off automatically. However, after ending a session and reconnecting, everything remains exactly as it was left previously, which indicates that the user session is not actually being logged off.Both the web console and the desktop console are running version 25.3.2.We found a KB article that appears to describe a similar issue, but it does not seem to apply to the version we are currently running.Additionally, we are currently applying the Session Policy through Group Policies. To rule out a policy inheritance issue, we also assigned the same Session Policy directly to the Jump Item, but the behavior remained exactly the same.If anyone has experienced a similar issue or knows why this might be happening, we would really appreciate any guidance or suggestions on what else we should verify.Thank yo

I have multiple Database admins I need to give access to our database for. We have no resources for PAW or Internal Admin machines. Is it the purpose of Beyondtrust SQL server tunnels to be ran on BYOD device and have them tunnel SQL Studio traffic to my on prem SQL server? Has anyone done this? I believe I have the tunnel up. How do you use Management studio? My “Open datasource Client” is grayed out. How do the credentials work? Do the credentials I use for the tunnel work for everyone using the tunnel? Or do I need to create one tunnel per person? 

I would like to know which default browser BeyondTrust is integrated for the web jump method. Is there any default browser for this method, or does it utilize the browser from the Jumpoint server?

Hi Everyone,I would like to raise a concern that we have noticed after upgrading to 25.3.3 related to clipboard restriction on shell sessions.launching shell jump (no jump client installed) does not restrict user clipboard even if the session policy restrict.tried applying session policy on both user level and jump item but still user can copy/past in both directions.Simulator in Session policy shows restriction but doesn’t really apply after connecting to shell session. anyone using 25.3.3 facing this issue ? Thanks.

In AWS, we created a Global Accelerator service and associated the Windows machines used by the Risk-Team with this accelerator service.Then, the Risk Team will access the Windows machine using the IP provided by the acceleration service.In terms of user experience, it is much smoother than directly connecting to a Windows machine, and it is convenient to operate on a Windows machine.However, after connecting to the Windows machine via PRA-Console, the fluidity decreases, operations become sluggish, which is not conducive to data processing actions. So, I would like to know if PRA has its own built-in acceleration service. Or, can I configure AWS Global Accelerator for PRA? This would improve the user experience for staff working in China.

Hello, An issue we are having in our PRA instance is that when we try to do a large file transfer such as an .iso file from our local machine to a remote asset via Beyond trust PRA RDP connection it seems like the transfer will time out\fail before all of the data has been transferred. In general file transfer works fine for smaller files back and forth but we have trouble with large ones. Wondering if anyone has any tips/tricks for copying large files through PRA? 

Hi team We're writing to report a problem that has been occurring with our client. Several users have reported that while connected to a session, their session suddenly disconnects. This has happened to multiple users, and we'd like to know the cause of this behavior and if it's a known bug.

Hello!We are using PRA - jump client based connections as well as BYOT RDP (more hops). We have frequently noticed drastic lag /slowness when remote sessions are used for HD/4K video manipulation, 3D modelling other GPU-accelerated use cases. In certain cases Solidworks models don’t even show up in PRA. Bandwidth and remote computer resources are not a concern  as these are purpose built workstations. Anyone else has faced similar issues ? any suggestions to improve performance 

Hi Everyone. A client is asking details around capacity planning for session recordings in PRA. I tried to dig out BT documents around this but couldn’t find any appropriate information. If anyone could help me out with this info, that would be great. Thanks!Average/Peak recording bitrate per session Average and peak data generated by each recorded session (Mbps or MB/min). Daily storage growth Daily storage consumption for session recordings. Please provide the calculation (Average recording size × Number of recorded sessions per day) or historical storage usage data over several days Capacity margin (preferably N-1)Please demonstrate that sufficient storage capacity is available even if one storage component fails (N-1 capacity).Confirmation that the 1 Gbps NIC is sufficientPlease confirm that the 1 Gbps network interface is adequate and will not become saturated under peak screen-sharing and session-recording workloads.  

Hi Everyone!Is it possible to create a Jump Item in Privileged Remote Access (PRA) to access an IBM i (AS/400) system?The environment uses TN5250 over TLS (port 992), and I would like to know if PRA supports this type of connection natively or if an external TN5250 client needs to be integrated with PRA.If anyone has implemented this scenario or knows the limitations and best practices, I would appreciate any guidance. Thanks in advance

Hello For PRA SaaS , we would need to allow from internal jumpoints to PRA SaaS on port 443 mainly right? and from PRA to AD on 636 ? For protocol tunnel, how is the network communication?  From enduser IP to PRA on port 443, communication will be established? and from there jumpoint will try to establish session on the protocol tunnel port mentioned to the services?

 Hello,I am connecting to a target system through an RDP session launched from BeyondTrust PRA.I can upload files to the remote system, but I cannot download files from the remote system to my local machine.Is this expected behavior?

Hi all,I’m interested in hearing from anyone who has successfully implemented Azure Application Proxy as a front door to a BeyondTrust PRA appliance, specifically to reduce direct exposure to the internet. Current EnvironmentBeyondTrust PRA appliances hosted on-premises Appliances are internal-only (no direct internet exposure) Internal user authentication handled via SAML with Microsoft Entra ID RequirementWe are looking to enable access for external 3rd-party (guest) users while maintaining a zero/low direct exposure footprint.Key goals:Avoid publishing the PRA appliance directly to the internet Leverage Azure App Proxy as the external entry point Use Entra ID authentication (including B2B guest users) for access control Maintain alignment with our existing guest onboarding and governance model (via Entra B2B) Avoid using the BeyondTrust vendor portal where possible Proposed ApproachExpose a dedicated external URL via Azure App Proxy Require pre-authentication with Entra ID (includin

Hi everyone,I have a question regarding PASM. I have users and devices managed through Password Safe, and session delivery is handled by PRA. If I want a user connecting from PRA with credentials injected from Password Safe to provide a reason for connecting, where do I configure this in PS or PRA? Also, if they need an approval workflow, where do I configure that in PS or PRA?

The following articles were published last week. New Knowledge Base Articles: KB0022631 - How to allow users to copy and paste credentials from the RS or PRA vault KB0022647 - How to download the SIEM Q radar plugin for Remote Support or Privileged Remote Access integration KB0023715 - Vendor self-registration confirmation emails not sent after upgrade to 26.1.1 KB0023716 - Cannot download User Account Report in Remote Support and Privileged Remote Access 26.1.1 KB0023727 - Is Remote Support or Privilege Remote Access vulnerable to CVE-2026-49975?

I would like to establish a connection to a closed network with a jumpoint/gateway every 30 Minutes, do some tasks and then close the connection again.I thought about using the tcp or network tunnel to establish the connection.Does anyone know a way how to automate this with the APIs? I couldn't find anything. thanks for your input on this

The following articles were published last week. New Knowledge Base Articles: KB0022452 - Using an AD vault account to launch an SQL tunnel fails - Login failed. The login is from an untrusted domain and cannot be used with Integration authentication. KB0022465 - Warning message: Installing more than one Jump client being phased out KB0022554 - How to retrieve Integration Client connection string KB0022565 - Rotation of accounts failed for a subdomain in PRA and RS KB0023605 - Endpoints for local accounts are shown incorrectly in Vault accounts tab within the console KB0023608 - Console shows "Error initializing application" or "Account is already in use" KB0023634 - macOS Sequoia does not show RS or PRA as an option in settings to enable screen recording KB0023651 - Are Privileged Remote Access or Remote Support appliances vulnerable to PHP 7.1.29, 8.0.12, or 8.1.27 vulnerabilities?

Hi communityOur clients are currently starting to use SQL Tunnel and PostgreSQL Tunnel connections. When checking the recordings, they are not available; only the transcript is shown. I would like to know if PRA does not support these types of recordings.

Hi team My client is having this problem: some sessions are recording, and others aren't. They have several connections to the same device, and while some recordings are available, others only have the transcript. I'd like to know what's happening in this case and what the problem might be. As an additional note, the product is in version 25.3.2. All sessions are from the same user and are of type RDP

The following articles were published last week. New Knowledge Base Articles: KB0022540 - Is there any effect when changing SMTP authentication from Legacy to Oauth2 with the Integration Client? KB0022553 - What operating system can BeyondTrust SRA Integration Client be installed on? KB0022568 - All new users getting all Asset or Jump Items by default in RS and PRA KB0023619 - Will local users stay in User Accounts after expiry? KB0023656 - Network Tunnel: The privileged remote access network tunnel endpoint service is not installed KB0023658 - Vault checkout error "System name is not configured for directory linked account checkout" KB0023662 - Console tab missing in /login KB0023671 - Can multiple connected screens be viewed simultaneously in separate, detachable windows?