General

AD Bridge 26.2 – RC4 removed from authentication and domain join protocolsAD Bridge no longer uses RC4 in authentication and domain join protocols, in preparation for Microsoft’s deprecation of RC4 in Active Directory.The change spans Kerberos configuration and encryption-type handling, along with protocol-level updates to SAMR, Netlogon, Schannel, WKSSVC, machine password changes and NTLM message protocol.  Together, these reduce reliance on legacy cryptography and improve your security posture. Customer Case StudyKarma Automotive Strengthens Support and Saves $600,000 in Labor Costs with BeyondTrust Latest Available VersionsAD Bridge 26.2 - August 2026BeeKeepers CommunityCan the AD Bridge console be upgrade over an existing console?Yes, AD Bridge supports in-place upgrades.  Run the latest installer on the computer where AD Bridge is already installed.  For more information refer to the guide on installing the AD Bridge Management Console.For more questions, refer to the AD Bridge FA

Securing Linux and Unix Privileged Access: Strategies for Enterprise Security:The Linux/Unix Privilege Problem and What to Do about It While many organizations have mature Privileged Access Management (PAM) programs for Windows, privilege management across Unix and Linux often remains inconsistent, undocumented, and difficult to audit. As Linux environments grow, privilege sprawl accelerates. Yet, many organizations continue to rely on sudo, which poses limitations and risks. To meet today’s security, compliance, and scalability needs, organizations need a stronger Linux privilege management program. This includes enterprise-grade features such as centralized, identity-based policy management, contextual and granular controls for enacting least privilege everywhere, tamper-proof auditing, and more. Download this guide to uncover the biggest risks in Unix and Linux privilege management, and to benefit from practical guidance to assess your environment, close security gaps, and strengthe

Active Directory best practicesBefore taking any actions with Active Directory, review these best practices carefully. AD Bridge Cells provide a means of directly managing Unix identities in Active Directory. Best practices are to use Cells rather than Unprovisioned mode wherever possible.This is so a user’s Unix group membership can be limited to less than 16 groups when required for NFS (or 32 groups for Solaris) without impacting normal Windows group membership management practices. Directory Integrated modeAfter installing the AD Bridge tools, the first determination that must be made regards Directory Integrated or ID Range. Directory Integrated Mode is strongly preferred.This causes all lookups to use indexed attributes in AD, lowering the cost of each lookup against the AD domain controller (DC). Windows 2012 Forest Mode forests with Windows 2012 R2 domain controllers can be transitioned to Directory Integrated Mode without extending the AD Schema. Cell designAD Bridge Cells all

AD Bridge Reporting Tool Best Practices Before taking any actions with the AD Bridge Reporting Tool, review these best practices carefully. Database: AD Bridge Reporting requires an SQL Server database. Because SQL Server integrates fully with AD, database ownership and rights can be set directly for AD users, and SQL Server supports Integrated Security (which does not require username and password combinations in connection strings). Collector servers: AD Bridge Reporting also requires Windows platforms to run the Collector server and Enterprise Database Forwarder. These are the only Windows services that AD Bridge software ships. Best practice for network design and WAN traffic management is to place the Collector servers closer to the AD Bridge agents. To support auditing in case of a Collector failure, the AD Bridge agents only need to be pointed to a different collector. To support this situation, we suggest that the customer build a number of Collector servers equal to or greater

Kerberos Caches How to clear Kerberos Credentials CachesAD Bridge (ADB) does not support clearing Kerberos cache files (typically stored in /tmp as krb5cc_xxxxx). However, since these files reside in /tmp, they are automatically removed upon system restart. Additionally, they can be manually deleted without impacting the functionality of ADB, provided that Kerberos and AD Bridge are functioning correctly. The cache will regenerate automatically when needed.  /opt/pbis/bin/kdestroy Adding the following to /etc/bash.bash_logout will remove the current user's cache file at logoff. The below command to delete the current user's cache file, or with -c username to delete another user's (with root permission): /opt/pbis/bin/kdestroy Refer to Kerberos commands in ADB for more information.  Customer Case Studyivision: How ivision Simplifies and Scales Identity Security with BeyondTrust Latest Available VersionsAD Bridge 26.1 - May 2026AD Bridge 25.2 – December 2025 BeeKeepers CommunityClick her

AD Bridge 26.1.0 Machine Account Password EncryptionTo improve credential protection, as of ADBridge 26.1, machine account passwords are encrypted by default when stored in the machine-level secrets stored (registry) on Linux systems.  This reduces exposure in the event of system compromise and better aligns with common security control requirements for authenticator protection.  The registry setting on the Linux system added by Active Directory Bridge controls the machine account password encryption behavior:HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory\PstoreCompatLevelPstoreCompatLevel settings: 1 - The machine account password is encrypted when stored 0 - The machine account password is not encrypted when stored When upgrading from a previous AD Bridge release to 26.1, the plaintext machine password will be encrypted the next time it rotates. Existing binaries that use the machine password are unaffected and will continue to work. To disable the setting, r

New Features in AD Bridge 25.2 Improved Linux workstation experience with Entra ID We’ve enhanced the Linux workstation login experience by integrating Microsoft Entra ID, making identity management simpler and more secure. This improvement supports the growing adoption of Entra ID bridging on Linux desktops, enabling organizations to unify access across platforms and strengthen compliance Tenantjoin: Endpoint key renewal A new configuration option allows administrators to define the lifespan of an app secret, enabling automated renewal workflows. When the secret approaches expiration, a renewal process is triggered by a script, which can be customized by administrators to align with their preferred tooling or operational practices. More information can be found in the new config option MachineSecretLifespan. Customer Case Study Nash County Public Schools: Nash County Public Schools Transforms IT Support with BeyondTrust Remote Support Latest Available Version AD Bridge 25.2 – December