Skip to main content

Recently active topics

100 Topics
B
BartoszApprentice
posted in General
More granular access rights for custom PS Admin roles

Hello everyone,We’re struggling with lack of possibility to introduce more granular access for PS Administrators, there’s an idea for the same More granular access rights for custom PS | All Product Ideas - Public Do you have similar experience with the product? If yes then please share your thoughts on that and like an idea if you find it useful, maybe it will get some attention thanks to that.Cheers,Bartosz 

406
R
T
tsipesNewcomer
asked in General
Accessing SRA API

This may have been asked already.  I have been working in the APIs for PWS with no issue.  Moving over to SRA, I cannot get the connection to work.  Tells me it is not allowed.  I have the account and API client/secret encoded.  I am using Powershell and tried it with/without the -Method POST option.  My code is $AuthKey = "Basic MyBase64Key"$AuthURI = "https://OURSITE.beyondtrustcloud.com/oauth2/token"$headers = @{ Authorization=$AuthKey}$Response = Invoke-RestMethod -URI $AuthURI -Header $headersWhat in the name of the sake of sanity am I missing?  Once I get this I know the rest falls into place. TIA

71
P
BeyondTrust Employee
A
AdamSaNewcomer
posted in Windows & MacOS
Best Practices of application policies - macOS

Hello! First time poster here, hope everyone’s doing well.I have a couple of questions regarding the macOS application policies, hopefully someone can lend me a hand and help out :) My BT EPM for Mac is currently set to ‘listening mode’ - it reports back on our users application usage [what’s installed, what’s opened, what’s being used etc.]. I want to use it to create policies on applications that should be ‘allowed’ or ‘disallowed’ based on different factors. The questions are as follows:When adding a policy based on a reported application, the in-built ‘add to policy’ button gives me two automatically assigned arguments: URI and Publisher. Could someone explain, what an URI is? Is it ok to use that as an argument regarding if an application should be allowed for usage? My first though was that it’s the applications unique ID - the bundle ID - but that’s not it after further insight. Is there a way to have an argument that uses the Bundle ID of an application? for example: com.micros

121
M
The Fabulous Leon Robinson
BeyondTrust Employee
The Fabulous Leon RobinsonBeyondTrust Employee
posted in Buzz Board
Launch of Education Subscription Podcast: 'OneSecBeyond'

In the education team we’re always looking for new avenues to help inform our product users on topics associated with what we deliver. As classroom teaching can be quite proscriptive we've kicked off a podcast series where we can expand and discuss topics related to the core interest of security and the training on the products we deliver.The first three episodes are available now for education subscription customers at https://university.beyondtrust.com/pages/54/podcasts

50
The Fabulous Leon Robinson
BeyondTrust Employee
B
BartoszApprentice
asked in General
ESA deployment requirements

Hello community,I’m looking for a list of requirements for ESA deployment along with information if SMB3 is supported and which SMB version is the default one?I can’t find this information anywhere in documentation, the only mention about it is this KBA but its 9 months old and I’m not sure if its up to date at this moment.Cheers,Bartosz

164
GloriaB
BeyondTrust Employee
C
ChaseApprentice
posted in Windows & MacOS
EndpointUtility.exe and Trellix

Our company utilizes a full Trellix stack of products (unfortunately) in addition to Endpoint Privilege Management.  We have recently upgraded from our On-Prem ePO managed Privilege Management solution to the new SaaS PMC.  One thing we have learned is that when using the EndpointUtility.exe tool to gather logs, is that the Endpoint Utility wants to grab all of the McAfee ProgramData logs even though we have just finished fully migrating over from on-prem ePO managed to SaaS.It seems Trellix Self-Protection is causing a permissions error at the very end of the log capturing process. After working with support and confirming there is no CLI available in this tool, we are basically forced to disable all of self-protect in order to gather logs, McAfee logs at that, that aren’t even necessary.Making this post as a means to communicate our findings in case others coming from on-prem ePO to SaaS experience this problem.  It would be extremely beneficial if there were baked in CLI arguments t

153
C
B
bt101Veteran
asked in Windows & MacOS
access denied error while installing dinocapture app

Hello, I am seeing access denied error while installing below app. The policy allows child processes with Full Admin token. In EPM Analytics I see that child processes are getting the token assigned. https://www.dinolite.us/download/  Dinocapture 2.0 In Process Explorer it shows only 4 child processes. These are getting Full Admin assigned per PMC logs.I couldn’t see any processes accessing the said files from error screenshot when checked in handle.exe.Attaching the logs , in case anyone has seen similar errors in other apps and got any pointers to troubleshoot further. The install works fine with local admin user. 

193
N
BeyondTrust Employee
R
Robert A.Rising Star
asked in General
Securing default generic accounts (bt/bi/bu-admin)

Hi,I’m trying to find a good way to secure these generic accounts and still to be able to use them as bt- and buadmin are used on a regular basis for updates and support cases. As I have 4 appliances to manage and have high security requirements I’d need to have individual passwords, with regular changes and changes after access for each of them. It would be a challenge to manage the regular changes and make performing regular tasks challenging.I had posted an idea to use the Enterprise Updater as SPOC (Single Point of Control) which would have it’s own credentials and would have an encrypted key based connection to all appliances. From the Updater one could create individual schedules for the updates and unlock/lock them centrally. This would make tracking, planning and handling of updates a lot easier and only one generic user (buadmin) would need to be secured. I’d prefer a personal account though and leaving the generic account as a breaking glas solution. This would only cover the

646
R
B
BartoszApprentice
posted in General
Additional TOTP step for federated authentication

Hi all,I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Additional TOTP step for federated | All Product Ideas - Public it’s not possible to use TOTP when federated authentication to Password Safe is enabled.Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,Bartosz 

615
rhagerm
A
AndyHTrailblazer
asked in General
Questions Regarding PRA Failover Implementation

Hello,I am currently implementing PRA failover using the guide available at BeyondTrust PRA Failover Documentation, and I have a few questions that I hope you can help with: I’ve attached our network diagram. Based on the failover guide, it seems that the only applicable method for our setup is DNS Swing. This is because the two appliances are located in separate data centers with different IP schemas, making the Shared IP method unfeasible. Additionally, since the data centers have different public IP addresses, NAT Swing would not work either. Could you please confirm if my understanding is correct? Regarding DNS Swing: When the primary PRA fails, do I need to manually log in to the DNS server and update the domain name to point to the backup PRA's public IP address? Do I also need to log in to the backup PRA to change its role to primary, and conversely, log in to the original primary PRA (once recovered) to switch its role to backup? The guide mentions the following no

203
T
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
Remote Support - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0020807 - Remote Support security scanner CSP directive issue - missing reporting-objective and form-action-objective KB0021299 - Remote Support Cloud Security provider will not save settings "Connection Agent Unavailable" KB0022212 - Unable to copy and paste from the Web Console KB0022225 - User not appearing in Remote Support after syncing the Active Directory group

40
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
Privileged Remote Access - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022212 - Unable to copy and paste from the Web Console KB0022228 - User cannot see credentials for injection Returning 0 credentials - Password Safe integration is not working.

20
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Linux / Unix
Endpoint Privilege Management (Unix/Linux) - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022130 - Unable to use Sudo commands. Client licensing error - No space left on device KB0022139 - pbrun24.1.4-05[2730476]: Could not connect to run host

30
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022205 - EPM-W MSI install command flags KB0022215 - Privilege Management for Mac client app bundle continually verifiying package

60
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021352 - Secrets Safe import secrets menu option missing KB0022203 - User in admin group is not able to see "view all safes" toggle in Secrets Safe KB0022204 - Cannot view discovery reports "An error was reported" KB0022217 - Secrets Cache install fails with error "0x80070643 - Fatal error during installation" KB0022218 - End user does not have personal folder in Secrets Safe

40
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
Active Directory (AD) Bridge - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022197 - Default Packages in RHEL 9 and derivatives don't include perl modules - error when installing FindBin

10
GloriaB
BeyondTrust Employee
M
mikey
asked in Windows & MacOS
Issues with elevating MSI's

Hello, I can start with saying that we do have a support case open at the moment. But just curious is anyone else has encountered this. After updating to 25.2.11 some MSI’s fail directly after launch or mid through the installations.  They get errors like these:2738, Could not access VBScript run time for custom action [2]. 2739, Could not access JScript run time for custom action [2].to solve this one should run regsvr32 jscript.dll or regsvr32 VBScript.dll however after installing 25.2.11 we are no longer able to edit HKEY_CURRENT_USER\Software\Classes\CLSID\{Any CLSID Folder}.If I downgrade BTPM towards 23.9.261.0 the MSI’s does not fail and im able to read the content of HKEY_CURRENT_USER\Software\Classes\CLSID\{Any CLSID Folder}.regardsMichael

26510
N
J
BeyondTrust Employee
Johnli AzucenaBeyondTrust Employee
posted in General
Remote Support: Managing Group Policies Interactive Workshop

Do you still have uncertainties about how to configure Group Policies?  💻🔐 Dive into our Interactive Workshop to learn about our Best Practices and put your knowledge to the test!  🧠💥 Title: Remote Support: Managing Group Policies Interactive WorkshopDate: 20 May 2025Time: 8 am Eastern and 1 pm UK and 8 pm SGTDuration: 90 minutes  Workshop Aim: This Interactive Workshop aims to test participants on their knowledge on how to manage Group Policies and the permissions in a set scenario.  Learning Objective:  At the end of this session, you will have been tested on adjusting, creating and managing  Group Policies by following a scenario environment given to you. You will also understand where permissions need to be changed for users depending on the type of access they need.   In this session we will cover:  What is the purpose of Group Policy  How Group Policy works within Remote Support  Key Concepts and best practices for managing Group Policies  A scenario where you get to confi

200
J
BeyondTrust Employee
A
ArnoNewcomer
asked in General
Enhance performance for PRA

Hi Community,Is there any experience that latency times increase as longer as a PRA appliance runs?Subjectively, we have the impression that the PRA connection is getting slower, even within the sessions.Are there ways of measuring this objectively?What can be done to improve it? More RAM in the jump points or something similar? RegardsArno

383
Kenny Lyman
BeyondTrust Employee
R
Rohit NikamApprentice
asked in General
Issue with BYOT Option – Remote RDP Sessions Terminating

Hello,I am experiencing an issue with the Bring Your Own Tool (BYOT) option when attempting to open a Remote RDP session using an external tool. For some endpoints, the session initiates but terminates within 1-2 seconds. This behavior is inconsistent, as it works fine for other endpoints.Could you please assist in identifying the cause of this issue and suggest a resolution?

926
I
S
suhail.salimNewcomer
asked in General
Change AD user status from active to inactive/disabled

Hi All,We have AD users in password safe who are quarantined and form login disabled. The users are no longer in organizations. The group we created to onboard these users are also disabled/deleted. The access revoke method used by earlier admins were incorrect and they removed the group from password before syncing them. Is there a way we can make these users status as inactive?

232
MikeK
D
Didla DheerajNewcomer
asked in General
Enhance the disco scans so they don't generate the false-positive logon events

Hi All,When the Password Safe Detailed Discovery Scan runs against a Windows server, the BTExecService agent deployed on the scanned server enumerates the members of all local admin groups, so these can eventually be onboarded and managed by Password Safe. We have observed that Group Memberships for each enumerated account are also checked. This enumeration process is causing the LastLogonTimeStamp for the enumerated accounts to be updated, generating logon events attributed to the Discovery Scan agent BTExecExt.Phoenix.exe, even though no actual logon operation took place.In fact, according to the Microsoft article below, the LastLogonTimeStamp attribute can be updated and trigger a logon event even if the user has not logged on. This behaviour is an artifact of a Kerberos operation known as Service-for-User-to-Self (S4u2Self), in which a client/service can request a ticket for a user that is only useful for things like determining Access Checks or Group Membership.https://techcommuni

261
H
BeyondTrust Employee
D
Didla DheerajNewcomer
asked in General
Native web application support in PAM

Hi All,Currently it's not possible to add a webbrowser application native in BeyondInsight Password Safe and inject the privileged/managed account credentials, without RDP/RDS server integration. Please add the option to: Add a (web)application page and inject the privileged/managed account credentials Add a rotate option, using an API functional account with custom API scripting/calls. Best regards,Dheeraj.

231
H
BeyondTrust Employee
T
tsipesNewcomer
asked in General
API /Secrets-Safe/Secrets returns no data

We recently upgrade to 24.3 and now we have a reporting issue.  Using the API /Secrets-Safe/Secrets with a GET returned all the secrets stored.  Now, it returns nothing.  Other API calls to other endpoints work with no problem.  This is a SOX reporting issue now.  I have opened a ticket but thought I would try here to see if anyone had any thoughts.  Other than the software upgrade, nothing else has changed. TIA

191
H
BeyondTrust Employee
S
SathishNewcomer
asked in General
how to setup email notifications to the service account owners once the password is rotated in password safe

We have the following use case:  Onboard the service account to password safeNotify the service account owners with the new password when the password is rotated in password safe. The password need to be communicated to the service account owners for any external service account usage beyond password safe  The service account password should be updated by the password safe on the underlying windows services/scheduled tasks/ IIS application pools.I would like to understand the feasibility on the email notifications, password updates on the services and any challenges that anyone faced while onboarding the service accounts. 

301
H
BeyondTrust Employee

Badge Earners

  • BCA: Endpoint Privilege Management - Windows
    Hakasehas earned the badge BCA: Endpoint Privilege Management - Windows
  • BCA: Endpoint Privilege Management - Mac
    Hakasehas earned the badge BCA: Endpoint Privilege Management - Mac
  • BCA: Remote Support
    Hakasehas earned the badge BCA: Remote Support
  • BCA: Endpoint Privilege Management - Mac
    joselopezhas earned the badge BCA: Endpoint Privilege Management - Mac
  • BCA: Password Safe
    gnajerahas earned the badge BCA: Password Safe
Show all badges
Terms & ConditionsCookie settings