Recently active topics

Hi all,Just want to check, does anyone have the official slide deck for the BeyondTrust Password Safe solution from BeyondTrust?Thanks.

Hi. We have a default Group Policy for all support teams that gives access to all jump clients. The policy applies to all members of our tenant, using the tenant ID. Is there a way to exclude specific agents so that the policy does not apply to them? I want to set up a separate Group Policy only for one agent to have access to only a very limited number of jump clients, but I can’t if they are already a member of the default group because they are a tenant member.

Has anybody here ever implemented Qualys scanning against their PS on-premises appliances? Is it possible to create a local account for Qualys on our on-prem appliances for Qualys scanning or is this not allowed?

The release notes for 26.3 mention that JIT Admin notifications have been added so users know right away that they have been approved/denied without needing to constantly check the endpoint utility app. It explicitly says JIT Admin. Does anyone know offhand if those notifications have been added for JIT Application approvals? 

Hello, I was wondering if anyone else is having any issues with logging into the Remote Support representative console after updating to macOS 27 Golden Gate?We are a small team, but so far we have four people who have updated, and currently two of them are not able to sign in. There is a spinning wheel for about 10-15 seconds after clicking login, and then it just stays on the authentication page as if nothing happened. Reinstalling the program doesn’t help, and we also tried using the following command:sudo tccutil reset All com.bomgar.bomgar-sccThis would allow one successful login, however the issue would happen again the net time we tried to login. 

I have created a daily backup for my PS using Windows File shares and was pointed to one of my Windows File Share using a domain service account. This one works fine. My only concern is that we keep receiving alerts about NTLM login failure/SMB session failure for the service account since it was running from the U-series appliance (non-domain joined) and connecting to the windows file share in the domain using the domain service account. Even though the daily alerts keep popping up with those failures, we still have the completed backups. I was wondering if you guys have any better option with this backup and minimize these kinds of alerts?

Hi Team,We are planning to implement a BeyondTrust Password Safe Cold Spare DR appliance in AWS West while our production environment is running in AWS East.Could anyone share the implementation steps, prerequisites, and best practices for setting up a Cold Spare appliance?Specifically looking for guidance on:Prerequisites before enabling Cold Spare Hostname/DNS requirements SSL certificate requirements Backup and restore process Validation/testing after setup DR activation procedure during a regional outage Failback process once the production region is restored Any lessons learned or common issues to avoidAny documentation, implementation guides, or real-world experiences would be greatly appreciated.Our production environment consists of an HA pair in AWS US East (10.209.66.xxx/ 10.209.66.xxx) and a Cold Spare appliance in AWS US West (10.207.12.xxx). The Cold Spare KB states that a Temporary Appliance Name must differ from the primary hostname, while the U-Series Business Continuit

How to export Secret Safe from 24.X On prem to 26.1 Cloud?I m able to export the folder names, secret names but not keys, credentials and files. how can we do this in bulk.

A few times I’m asked about what to do about employees who have left the organization and their accounts that are in PasswordSafe. The following are some suggestions on next steps, and components to watch out for when cleaning up the environment. Step 1: Audit Current Access in PasswordSafe I would recommend running this before deprovisioning a user so you have a record of their configurations to make clean-up activities a bit easier. Unless the user is an Admin - skip to step 2. Step 2: Remove Access to PasswordSafe 🚩 Note: if you have let go an Administrator, validate PasswordSafe immediately, regardless if automation is configured, to ensure there are no potential paths into the vault by removing access to PasswordSafe. While this may be the most obvious, there may be a few components worth noting. Occasionally this may be set up with a SCIM, or integrated into an automation for user lifecycle management. The short version is to ensure the users aren’t provisioned to a group that p

Dear Team, Could you please advise on the best approach to onboard accounts that are managed in an IBM LDAP Directory Server and used on standalone AIX systems

 Description of Integration:The integration described in this guide uses webhooks and API requests to allow users to approve EPM BeyondTrust application access request tickets in ServiceNow using CVE scores and severity ratings from Tenable, which eliminates manual intervention and delays, helping organizations improve their overall security posture.DisclaimerThis integration is an example of a working prototype and will not be supported by BeyondTrust. Any sample or proof of concept code (“Code”) provided on the Community is provided “as is” and without any express or implied warranties. This means that we do not promise that it will work for your specific needs or that it is error-free. Such Code is community supported and not officially supported by BeyondTrust. BeyondTrust and its contributors are not liable for any damage you or others might experience from using the Code, including but not limited to, loss of data, loss of profits, or any interruptions to your business, no matter

We need to evaluate Mikron remote access solution at Molex:Key areas to cover:Identify PRA use cases that might applyUnderstand architecture and discovery potencial solution with BTDocument current Mikron use cases and architecture.Validate PLC/OT device connectivity and vendor remote-access requirements.

We need to onboard Linux systems that use a graphical interface, such as GNOME. What options do I have to do this so that I can also record sessions, just like with RDP? It must also be supported by BT.Regards Arno 

Hello All!We recently upgraded PRA from 24.3.4 → 25.2.2 → 25.3.5 . After the upgrade 100+ Ubuntu 24.04 headless devices are no longer accessible. We have used the standard linux installer in these machines and were able to do screen share using PRA over the years. Remote users need to be able to see the login screen as there are different user profiles (IT, engineer etc)Has anyone seen similar issues after upgrades? Support team is basically asking us to use headless installer  which is of not any help. When we use headless installer it doesn’t even show Screen Share tab in PRA console.For our existing standard client which is now broken, in the logs I see PRA creating a new virtual display and is switching between the GDM x0 and PRA-created virtual display. Any suggestions ? 

A common question that I’ve been receiving in newer deployments is how to build a mature process for managing EPM-WM policies and risks of what’s allowed in an organization. While Technical Account Manager (TAM) calls go into more strategy discussions based on the unique environment, there are common foundational layers that lead to more successful reviews, and security gates that should be in place regardless that any customer can adopt. Getting Started with Data and Broad StrokesTell People What You’re DoingIf you’re afraid of telling people that there’s a change and everyone will blame this change so you don’t tell them of the change you implement, then welcome to a worse outcome 😶 The curious few will find the new item in the task-bar, see a new pop-up, etc., and will lose trust before you even get started.The best option is to have a written policy you can point to that acts as a pointer in an EPM policy messages, your change management communications, and details any procedures

I really bought into “If you can do it in powershell, you can run it in a powerrule” but I’m learning it’s really not that easy. What I want to do: If someone runs the “Hyper-V Manager” console, it automatically will add that user to the hyper-v administrators local group in Windows.I have a script that adds the user to the group, uploaded it, and targeted it with an app group to run, but it doesn’t do anything. I started looking into power rules more (EPM for Windows core scripting | EPM-WM) but quickly realized, it seems like there are special cmdlets you have to use? It’s very confusing.If anyone can point me in the right direction, I’d really appreaciate it.