Recently active topics

A common question that I’ve been receiving in newer deployments is how to build a mature process for managing EPM-WM policies and risks of what’s allowed in an organization. While Technical Account Manager (TAM) calls go into more strategy discussions based on the unique environment, there are common foundational layers that lead to more successful reviews, and security gates that should be in place regardless that any customer can adopt. Getting Started with Data and Broad StrokesTell People What You’re DoingIf you’re afraid of telling people that there’s a change and everyone will blame this change so you don’t tell them of the change you implement, then welcome to a worse outcome 😶 The curious few will find the new item in the task-bar, see a new pop-up, etc., and will lose trust before you even get started.The best option is to have a written policy you can point to that acts as a pointer in an EPM policy messages, your change management communications, and details any procedures

Hello All!We recently upgraded PRA from 24.3.4 → 25.2.2 → 25.3.5 . After the upgrade 100+ Ubuntu 24.04 headless devices are no longer accessible. We have used the standard linux installer in these machines and were able to do screen share using PRA over the years. Remote users need to be able to see the login screen as there are different user profiles (IT, engineer etc)Has anyone seen similar issues after upgrades? Support team is basically asking us to use headless installer  which is of not any help. When we use headless installer it doesn’t even show Screen Share tab in PRA console.For our existing standard client which is now broken, in the logs I see PRA creating a new virtual display and is switching between the GDM x0 and PRA-created virtual display. Any suggestions ? 

I really bought into “If you can do it in powershell, you can run it in a powerrule” but I’m learning it’s really not that easy. What I want to do: If someone runs the “Hyper-V Manager” console, it automatically will add that user to the hyper-v administrators local group in Windows.I have a script that adds the user to the group, uploaded it, and targeted it with an app group to run, but it doesn’t do anything. I started looking into power rules more (EPM for Windows core scripting | EPM-WM) but quickly realized, it seems like there are special cmdlets you have to use? It’s very confusing.If anyone can point me in the right direction, I’d really appreaciate it.

We have multiple Password Safe appliances behind load balancer. Appliances are not directly accessible, users must use load balancer.When user receives a forgot password email, it contains a password reset link with appliance hostname instead of load balancer address. Please advise what configuration change is needed, for password reset email to have an URL with load balancer address instead of appliance local hostname.

Hi everybody! 😁 We're looking for current customers who want to share their experiences, connect with the BeyondTrust community, and be recognized and rewarded for their participation.Whether you want to provide product feedback, tell your story, or engage with peers, we'd love to have you join us.Please click here to enroll in the program!*This program is open to current BeyondTrust customers only.

Anyway of being able to mass delete users in PRA? E.g. if not authenticated in X amount of days?GUI doesn’t have check boxes to select multiple users to perform bulk tasks. There’s a 5+ sec gap when deleting individual users one buy one and whilst waiting for the user table to refresh, quite tedious!  No automated settings I’m aware of for internal users, whereas vendor users have this option -Will implementing SCIM (SAML only currently) address this or will it only disable users rather than delete?​​​​​​​

BeyondTrust Pathfinder SCIM API can be used for provisioning into all BT products or modules. It replaces the standalone SCIM API found in Password Safe, Endpoint Privilege Management or EPM Windows & Mac, and Privileged Remote Access or PRA. This guide is a complement to Documentation - SCIM Provisioning The first step is to create a SCIM token as the SCIM service account, and note the Org ID in the upper right corner.  The User must be Administrator in individual BT modules. Create new Application. Under Provisioning, click Configure API integration. Provide Base Url and token. Note:  Url is https://api.beyondtrust.io/api/{organization-id}/platform/auth/scim/v2 and you need to replace {organization-id} with Org ID from Pathfinder. Under Provisioning → To App, enable Create User, Update User Attributes and Deactivate Users. Testing Create a new test Group and add a new test User. Back to the Application, assign the test Group. Test User should be assigned automatically via Group. 

BeyondTrust Pathfinder SCIM API can be used for provisioning into all BT products or modules. It replaces the standalone SCIM API found in Password Safe, Endpoint Privilege Management or EPM Windows & Mac, and Privileged Remote Access or PRA. This guide is a complement to Documentation - SCIM Provisioning The first step is to create a SCIM token as the SCIM service account, and note the Org ID in the upper right corner.  The User must be Administrator in individual BT modules. For an Enterprise Application, add Provisioning configuration and Test Connection. Note:  Url is https://api.beyondtrust.io/api/{organization-id}/platform/auth/scim/v2 and you need to replace {organization-id} with Org ID from Pathfinder. Attribute mappings. Provisioning Settings. Testing Users and groups:  Assign new User to App. Provision on demand:  Provision test user. Provisioning should be a success.The user should be provisioned into Pathfinder. Create a new Group and assign a different test user. Add

Recently a question came up if the (Default) catch-all rules in the EPM-W Quick Start policy should be modified to use a custom token rather than a default Full Admin or Basic Admin token. Posting this here in case others had the same question. The use case is that the support desk will elevate with custom permissions traditionally, and need different privileges than the basic or full admin tokens. The short answer is “no.” Why Not?The support desk permissions required is likely a very small subset of the total cases in which require elevation. When building out a policy with Quick Start, the goal is to identify the common, and the exceptions of the exceptions, in the catch-all rules to help build out a policy that best reflects the privileges required. This ensures that we have a cleaner baseline of “default” when assessing anything new that hits the exception policies, and allows for easier processes changes later on.So What Now?The recommendation would be to have two application gro

Context While standalone BeyondTrust products including Password Safe, Endpoint Privilege Management (EPM) for Windows & Mac, and Privileged Remote Access (PRA) have a SCIM API, PathFinder provides a unified or global SCIM API that supports provisioning Users and Groups that can be consume by each individual products within PathFinder. This guide is a complement to Documentation: SCIM provisioning  and covers SailPoint IdentityIQ or IIQ . The first step is to create a SCIM token as the SCIM service account, and note the Org ID in the upper right corner.  The User must be Administrator in individual BT modules. Create a new Application with Type = SCIM 2.0. Replace {organization-id} in Url https://api.beyondtrust.io/api/{organization-id}/platform/auth/scim/v2 and provide the token. Test Connection should be successful. Discover Schema attributes for account.  Click Preview to test. group:  Discover Schema Attributes. Use Preview to test.    Provisioning Policy:  Create account form.

Context While standalone BeyondTrust products including Password Safe, Endpoint Privilege Management (EPM) for Windows & Mac, and Privileged Remote Access (PRA) have a SCIM API, PathFinder provides a unified or global SCIM API that supports provisioning Users and Groups that can be consume by each individual products within PathFinder. This guide is a complement to Documentation: SCIM provisioning  and covers SailPoint Identity Security Cloud or ISC. The first step is to create a SCIM token as the SCIM service account, and note the Org ID in the upper right corner.  The User must be Administrator in individual BT modules.  In ISC as Admin, select Sources and create a new SCIM 2.0 Source. Enable provisioning. Replace {organization-id} with the Org ID and provide your token.  Click Save. Additional Settings:  Check the box for HTTP Patch.  Click Save. At this point you should be able to Test successfully. Discover and map the Account Schema. Change both roles and entitlements to stri

Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?

I have strange behavior in my PasswordSafe.I am using an application session, and when I try to start an RDP Session / Start Application Session: When using the option to run on a different system with the functional account, it works perfectly. When using the option to run on the current system with the user account, the RDP session does not start. It shows a black screen for some time and then closes. When I checked the logs in the second case, I found the following: INFO: Accepted RDP session 1234 for 1.2.3.4:1234 INFO: RDP Handler 1234 starting INFO: Found RDP certificate: My:.... INFO: Reading self signed cert INFO: (RDP server) Client Security: NLA:1 TLS:1 RDP:0 INFO: (RDP server) Negotiated Security: NLA:0 TLS:1 RDP:0 INFO: (RDP server) Server Security: NLA:0 TLS:1 RDP:0 ERROR: (RDP server) BIO_read returned a system error 0: No error ERROR: (RDP server) transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D] ERROR: (RDP) BIO_should_retr

Hi Everyone,I would like to raise a concern that we have noticed after upgrading to 25.3.3 related to clipboard restriction on shell sessions.launching shell jump (no jump client installed) does not restrict user clipboard even if the session policy restrict.tried applying session policy on both user level and jump item but still user can copy/past in both directions.Simulator in Session policy shows restriction but doesn’t really apply after connecting to shell session. anyone using 25.3.3 facing this issue ? Thanks.

In BeyondTrust Password Safe, Cloud  why are some manually added assets unable to change the assigned workgroup? The option appears unavailable & disabled.  

Is there any way to change IP address of already onboarded assets to Beyondtrust password safe? everytime we have to delete the older asset and then re-onboard the asset.

Hi guys,I just want to clarify how the asset-based licensing works in Password Safe.For example, if we have 50 asset-based licenses and all 50 licenses are currently being used, but the client wants to onboard one additional asset/managed system, we would need an additional license.My question is: If we decommission/delete one of the existing licensed assets/managed systems, will that license be released and become available so that we can onboard the new asset/managed system using the same license?In other words, can a license be reused after removing an existing managed system, or would we still need to purchase an additional license for the new system?Could someone please clarify how Password Safe handles this scenario?Thanks.

I am facing an issue while launching PS_Automate through CMD.Initially, there was no issue when I tested it with the default BIWebApp.ini file. However, after making a copy of the same file and renaming it to WAF.ini, I started receiving the following error when trying to launch PS_Automate:Error: Subscript used on non-accessible variable.My BeyondInsight/Password Safe version is 26.2.Could anyone please guide me on what might be causing this issue and how I can troubleshoot or resolve it? 

OutlineWhy this comes up The idea in one paragraph Why an attribute and not something else A starting vocabulary Why decommission needs two states Building it Things that will bite you Pre-staging, which is the fun part An import connector is not a substitute for this Additional ResourcesWhy this comes upI’m often having the same conversation when I show users the Dashboards → PasswordSafe and the failed password changes. A server gets decommissioned somewhere upstream, or a directory account is decommissioned, but nothing tells PasswordSafe of this change; often it’s an object that no longer matches the Smart Rule query for onboarding. Then I come along asking someone to investigate their password test failure report trying to work out whether a box is broken, gone, or was never finished being built in the first place. Multiply that by a few thousand systems, and managed accounts, and then the rotation failure report stops being a signal and starts being wallpaper. 🫠Most PasswordSafe

Installing the Linux Remote Support jumpclient in system mode breaks our GDM authentication configuration by installing the file /etc/dconf/profile/gdm with the contents:user-db:user system-db:gdm file-db:/usr/share/gdm/greeter-dconf-defaultsRedHat systems configure gdm by default via the dconf site database. RedHat expects a confguration like:user-db:user system-db:local system-db:site system-db:distro By removing the local, site, and distro DBs you are completely breaking the standard RedHat configuration. This is completely irresponsible on your part to be modifying such a critical system configuration. This took most of my day to resolve and locked a couple of users out of their machines for a few hours.I had actually just decided to enable your automatic updating of Remote Support - but that is out the window now if you are going to be releasing stuff like this.

We have a case where users connecting to VPN from outside the country get a specific pool/subnet of IPs when successfully connected to VPN. Now we have a case, that such users should not be able to access certain Assets/IPs. Can we have any kind of control for this. PAM can check what is the source IP and then do not allow access to restricted assets. Is this doable?