Skip to main content

Recently active topics

88 Topics
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
published in General
Monthly Buzz - April - Privileged Remote Access

Looking to automatically backup your PRA / RS appliance on a schedule?BeyondTrust's Integration Client can help facilitate this (free of charge!). The BeyondTrust Integration Client is used to transfer session logs and recordings from the BeyondTrust Appliance B Series to an external system. Two external systems are currently supported: Microsoft SQL Server and Windows-based file systems. The BeyondTrust Integration Client supports plugins for these systems. A plugin defines the transfer details, such as the destination directory/file name or database to use. Plugin details and the standard SQL Server Schema are defined in this guide. Latest Available Version: PRA 25.1.1– April 2025 Beekeepers Hot Topics PRA Deployment Questions“Appreciate your feedback on the below queries. For PRA Cloud what is the communication matrix (firewall ports) that needs to be allowed for Jump Points, Jump clients and PRA to work smoothly?   For PRA Jump Points, what is the recommended hardware sizing (CPU

180
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
published in Windows & MacOS
Monthly Buzz - April - Endpoint Privilege Management - Windows and Mac

New Just-in-Time Admin Access Release 24.7 introduces Just-in-Time (JIT) Admin Access, designed to enhance productivity while maintaining least privilege. This important new feature now allows users to request temporary local admin permissions directly through the EPM endpoint app, making it easier to manage scenarios not yet covered by existing policies. Admins can approve or deny requests, set session durations, and monitor privileged actions during a session to ensure full auditability and compliance. Integration with IT Service Management (ITSM) tools like Jira −via webhooks integration−provide even more flexibility in managing access requests.  Watch the following YouTube link for a walkthrough on how to set this up in PM Cloud:  Interested in learning more?  See the following post in our BeeKeepers Community for additional information along with our technical documentation. Latest Available Version:Endpoint Management Cloud 25.2– February 2025Endpoint Management for Windows 25.2.

350
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
published in General
Monthly Buzz - April - Password Safe

Discover What's New in Password Safe 24.3: Enhanced Cloud Support and Security Features As organizations continue to adopt and migrate to cloud, ensuring management of all identities has become more complex than ever before. Addressing secrets sprawl and access management across the entire estate to achieve compliance and maintain security is complicated and requires visibility into more areas than many organizations have bandwidth to achieve. Further, DevOps teams are being tasked with deploying as quickly as possible and are often needing access to the same credentials across teams, while also ensuring least privilege access and operational efficiency is maintained.Read the full blog post here. Latest Available Version: Password Safe 24.3– December 2024 Beekeepers Hot Topics Export Accounts from BeyondInsight“We have one environment of BeyondTrust Insight with scanned accounts and managed accounts. We are planning to setup backup environment at different location with different domai

340
B
Community Manager
K
kimberlyvApprentice
asked in General
API Endpoints

When API endpoints are changed, how often will this be? With the last big update BI had, some endpoints were depracated. I am curious how often this is going to happen? APIs have become very popular in our environment and alot of our scripts are breaking with these changes. Ex.) In BeyondInsight/Password Safe 24.3, "UserGroupId" has been deprecated.I know the word “Safe” was also replaced with “Folder”. 

280
K
B
bt101Veteran
asked in General
app parameters for PRA - BT Desktop Agent based app launch and cred injection

Hello! is there any documentation that includes example parameters/strings that should be used while launching apps using PRA BT desktop agent. Admin guide has details of configuration options but nothing further e.g. example strings. I am able to connect to RDP using first set of  credentials , at one time was able to launch web browser but later started seeing error in chat windows that says file name/path could not be found. 

1111
GloriaB
BeyondTrust Employee
C
cmscottRising Star
asked in Windows & MacOS
On-PREM (BI) EPM integration - How to browse AD Users/Groups

Does the Web Policy Editor in a U-Series have the capability to browse AD via BI (i.e. Directory Credentials)?  EPM Cloud is not an option. 

262
M
A
ArnoApprentice
asked in General
Enhance performance for PRA

Hi Community,Is there any experience that latency times increase as longer as a PRA appliance runs?Subjectively, we have the impression that the PRA connection is getting slower, even within the sessions.Are there ways of measuring this objectively?What can be done to improve it? More RAM in the jump points or something similar? RegardsArno

654
I
B
BartoszApprentice
asked in General
ESA deployment requirements

Hello community,I’m looking for a list of requirements for ESA deployment along with information if SMB3 is supported and which SMB version is the default one?I can’t find this information anywhere in documentation, the only mention about it is this KBA but its 9 months old and I’m not sure if its up to date at this moment.Cheers,Bartosz

265
B
frank.colvin
frank.colvinVeteran
asked in General
SSH using Secure CRT, Winscp or sftp clients

we are rolling out linux/unix managed systems and we are having great success with putty, however our developers user Secure CRT, winscp and sftp clients. does anyone have any advice/guidance? 

352
R
B
BartoszApprentice
posted in General
More granular access rights for custom PS Admin roles

Hello everyone,We’re struggling with lack of possibility to introduce more granular access for PS Administrators, there’s an idea for the same More granular access rights for custom PS | All Product Ideas - Public Do you have similar experience with the product? If yes then please share your thoughts on that and like an idea if you find it useful, maybe it will get some attention thanks to that.Cheers,Bartosz 

648
R
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 21 - Apr 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021742 - How to configure Duo as an Identity Provider for SAML KB0022219 - Workforce Passwords continuously spins (loads) and last synchronized shows 'an error occurred' KB0022222 - Group sync fails when selecting a specific Domain Controller in PS cloud KB0022223 - Unable to create Smart Rule - An unknown error occurred KB0022230 - With Host Headers Restriction State (HHRS) configured, accessing an application or remote session results in error: Invalid session token KB0022231 - AD Webconsole logins fail in active active environments following an upgrade "An authentication error occurred" KB0022234 - Okta SAML integration is failing with 500 internal server error KB0022240 - Unable to rename organization "an error occurred while attempting to save this item" KB0022241 - Password Safe tile Accou

100
GloriaB
BeyondTrust Employee
T
BeyondTrust Employee
tkellumBeyondTrust Employee
asked in General
Remote App Launch Display Scaling

I wanted to bring this to the community for feedback as it was brought up for discussion during a troubleshooting case for a Password Safe customer, while configuring Remote Applications to be launched via ps_automate.exeIt was found that if we expand the Remote App window during the login process, we may see the login screen display look distorted based on the size the window takes up on the user’s screen. I attached a screen capture showing what was observed while initiating the session with a single high resolution display detected and one with multiple displays detected. observed remote app loginThe important thing to note here is that this does NOT affect the look of the actual application when it appears in RemoteApp mode and it does not affect the ability to launch the application itself. This is purely a cosmetic concern.I have three questions on this:Is this this due to the configuration of the Remote App session? Is this the result of a limitation of FreeRDP? What would be th

180
T
BeyondTrust Employee
T
TimNewcomer
posted in General
We run RDS farms for PSCloud on premises - what would you use in AWS?

Hi All, We expect to close our on premises DC’s in the coming years, and we currently run a traditional RDS farm with F5’s in front to enable the non-SSH/RDP workloads managed by PasswordSafe Cloud…Microsoft RDS licensing options in AWS (AWS is the only answer for us - please don’t suggest Azure!) are very limited and the equivalent would be significantly more costly than the current level. For other internal systems, we’re looking at AppStream2 - has anyone looked at this or other options for PasswordSafe Cloud or are we locked to RDS and the associated costs?Trying to gauge what the community is doing and what experience, if any, is out there 😀 Many thanks in advanceTim

210
T
H
HamzaTrailblazer
asked in General
PRA Multiple approvers

Can there be multiple approvers in PRA to approve jump session?if yes, how it works, any one to approve or all must approve?

232
Kenny Lyman
BeyondTrust Employee
Prudhvi Keertipati
Prudhvi KeertipatiVeteran
asked in General
PRA Access Console - Connection Issue

Hi Team,We have a PRA Cloud tenant deployed and there are NO network restrictions setup on /login console. From US, we are able to access the Access Console, but our users from India team are unable to access and getting below error. They can access /login console but not Access Console. Are there any logs that I can verify or what might be the cause?Thanks,Prudhvi

2205
Prudhvi Keertipati
B
bt101Veteran
asked in Windows & MacOS
app parameters for PRA - BT Desktop Agent based app launch and cred injection

Hello! is there any documentation that includes example parameters/strings that should be used while launching apps using PRA BT desktop agent. Admin guide has details of configuration options but nothing further e.g. example strings. I am able to connect to RDP using first set of  credentials , at one time was able to launch web browser but later started seeing error in chat windows that says file name/path could not be found. 

272
B
T
tsipesNewcomer
asked in General
Accessing SRA API

This may have been asked already.  I have been working in the APIs for PWS with no issue.  Moving over to SRA, I cannot get the connection to work.  Tells me it is not allowed.  I have the account and API client/secret encoded.  I am using Powershell and tried it with/without the -Method POST option.  My code is $AuthKey = "Basic MyBase64Key"$AuthURI = "https://OURSITE.beyondtrustcloud.com/oauth2/token"$headers = @{ Authorization=$AuthKey}$Response = Invoke-RestMethod -URI $AuthURI -Header $headersWhat in the name of the sake of sanity am I missing?  Once I get this I know the rest falls into place. TIA

221
P
BeyondTrust Employee
A
AdamSaNewcomer
posted in Windows & MacOS
Best Practices of application policies - macOS

Hello! First time poster here, hope everyone’s doing well.I have a couple of questions regarding the macOS application policies, hopefully someone can lend me a hand and help out :) My BT EPM for Mac is currently set to ‘listening mode’ - it reports back on our users application usage [what’s installed, what’s opened, what’s being used etc.]. I want to use it to create policies on applications that should be ‘allowed’ or ‘disallowed’ based on different factors. The questions are as follows:When adding a policy based on a reported application, the in-built ‘add to policy’ button gives me two automatically assigned arguments: URI and Publisher. Could someone explain, what an URI is? Is it ok to use that as an argument regarding if an application should be allowed for usage? My first though was that it’s the applications unique ID - the bundle ID - but that’s not it after further insight. Is there a way to have an argument that uses the Bundle ID of an application? for example: com.micros

311
M
The Fabulous Leon Robinson
BeyondTrust Employee
The Fabulous Leon RobinsonBeyondTrust Employee
posted in Buzz Board
Launch of Education Subscription Podcast: 'OneSecBeyond'

In the education team we’re always looking for new avenues to help inform our product users on topics associated with what we deliver. As classroom teaching can be quite proscriptive we've kicked off a podcast series where we can expand and discuss topics related to the core interest of security and the training on the products we deliver.The first three episodes are available now for education subscription customers at https://university.beyondtrust.com/pages/54/podcasts

260
The Fabulous Leon Robinson
BeyondTrust Employee
C
ChaseApprentice
posted in Windows & MacOS
EndpointUtility.exe and Trellix

Our company utilizes a full Trellix stack of products (unfortunately) in addition to Endpoint Privilege Management.  We have recently upgraded from our On-Prem ePO managed Privilege Management solution to the new SaaS PMC.  One thing we have learned is that when using the EndpointUtility.exe tool to gather logs, is that the Endpoint Utility wants to grab all of the McAfee ProgramData logs even though we have just finished fully migrating over from on-prem ePO managed to SaaS.It seems Trellix Self-Protection is causing a permissions error at the very end of the log capturing process. After working with support and confirming there is no CLI available in this tool, we are basically forced to disable all of self-protect in order to gather logs, McAfee logs at that, that aren’t even necessary.Making this post as a means to communicate our findings in case others coming from on-prem ePO to SaaS experience this problem.  It would be extremely beneficial if there were baked in CLI arguments t

483
C
B
bt101Veteran
asked in Windows & MacOS
access denied error while installing dinocapture app

Hello, I am seeing access denied error while installing below app. The policy allows child processes with Full Admin token. In EPM Analytics I see that child processes are getting the token assigned. https://www.dinolite.us/download/  Dinocapture 2.0 In Process Explorer it shows only 4 child processes. These are getting Full Admin assigned per PMC logs.I couldn’t see any processes accessing the said files from error screenshot when checked in handle.exe.Attaching the logs , in case anyone has seen similar errors in other apps and got any pointers to troubleshoot further. The install works fine with local admin user. 

253
N
BeyondTrust Employee
R
Robert A.Rising Star
asked in General
Securing default generic accounts (bt/bi/bu-admin)

Hi,I’m trying to find a good way to secure these generic accounts and still to be able to use them as bt- and buadmin are used on a regular basis for updates and support cases. As I have 4 appliances to manage and have high security requirements I’d need to have individual passwords, with regular changes and changes after access for each of them. It would be a challenge to manage the regular changes and make performing regular tasks challenging.I had posted an idea to use the Enterprise Updater as SPOC (Single Point of Control) which would have it’s own credentials and would have an encrypted key based connection to all appliances. From the Updater one could create individual schedules for the updates and unlock/lock them centrally. This would make tracking, planning and handling of updates a lot easier and only one generic user (buadmin) would need to be secured. I’d prefer a personal account though and leaving the generic account as a breaking glas solution. This would only cover the

926
R
B
BartoszApprentice
posted in General
Additional TOTP step for federated authentication

Hi all,I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Additional TOTP step for federated | All Product Ideas - Public it’s not possible to use TOTP when federated authentication to Password Safe is enabled.Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,Bartosz 

685
rhagerm
A
AndyHTrailblazer
asked in General
Questions Regarding PRA Failover Implementation

Hello,I am currently implementing PRA failover using the guide available at BeyondTrust PRA Failover Documentation, and I have a few questions that I hope you can help with: I’ve attached our network diagram. Based on the failover guide, it seems that the only applicable method for our setup is DNS Swing. This is because the two appliances are located in separate data centers with different IP schemas, making the Shared IP method unfeasible. Additionally, since the data centers have different public IP addresses, NAT Swing would not work either. Could you please confirm if my understanding is correct? Regarding DNS Swing: When the primary PRA fails, do I need to manually log in to the DNS server and update the domain name to point to the backup PRA's public IP address? Do I also need to log in to the backup PRA to change its role to primary, and conversely, log in to the original primary PRA (once recovered) to switch its role to backup? The guide mentions the following no

323
T
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
Remote Support - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0020807 - Remote Support security scanner CSP directive issue - missing reporting-objective and form-action-objective KB0021299 - Remote Support Cloud Security provider will not save settings "Connection Agent Unavailable" KB0022212 - Unable to copy and paste from the Web Console KB0022225 - User not appearing in Remote Support after syncing the Active Directory group

130
GloriaB
BeyondTrust Employee

Badge Earners

  • BCA: Endpoint Privilege Management - Windows
    jchewhas earned the badge BCA: Endpoint Privilege Management - Windows
  • BCIE: Password Safe
    ravi.bisramhas earned the badge BCIE: Password Safe
  • BCIE: Privileged Remote Access
    ravi.bisramhas earned the badge BCIE: Privileged Remote Access
  • BCA: Endpoint Privilege Management - Windows
    omarmohy98has earned the badge BCA: Endpoint Privilege Management - Windows
  • BCIE: Password Safe
    Emre Yardimcihas earned the badge BCIE: Password Safe
Show all badges
Terms & ConditionsCookie settings