Recently active topics

Our current On prem environment has many API use cases, where we use APIs to add assets, managed systems, onboard AD groups e.t.c. using python script from AWS Lambda. And we also have many application teams retrieving managed account passwords, secret safes using APIs from a dedicated server or applications. Now the issue is, in on prem environment, we usually whitelist private IPs, like IP if the servers or IP range that AWS account uses. However, in SaaS environment private IP is not working, as it is only taking public IP [Understandably expected behaviour from SaaS]. Is there any solution for this ? because public IPs is not static and we cannot keep on modifying the rules for 100s of API registrations. How are other BT customers dealing with this ?

Hi, currently I have trouble to onboard Microsoft SQL Management Studio 2022 application into ps_automate. I read almost all documentations and articles regarding to this issue but they had been created for Microsoft SQL Management Studio 2019. I have trouble to configure ini file,  because of AppWindowControlID field value is missing in AutoIt > Summary >  Advanced (Class).  

Hello! I see that EPM Windows does not have option to remove local admin users . There is an idea created 4 years ago. Also, available reporting is limited i.e. who has admin access - I believe this report is based on user login. We are working on removing admin rights from users who had exception requests and finding it difficult to provide reliable evidence which is easy to generate from within a console - currently relying on multiple tools such as scripts for VPN, internal network computers, SCCM and PRA for computers not currently connected to internal network etc. I see we can trigger powershell scripts using EPM  based on certain events e.g. Creating rule to launch the script when certain known application like MS edge update is run.  Just want to check how others are handling such scenarios 

Hello!We are using PRA - jump client based connections as well as BYOT RDP (more hops). We have frequently noticed drastic lag /slowness when remote sessions are used for HD/4K video manipulation, 3D modelling other GPU-accelerated use cases. In certain cases Solidworks models don’t even show up in PRA. Bandwidth and remote computer resources are not a concern  as these are purpose built workstations. Anyone else has faced similar issues ? any suggestions to improve performance 

Hello! Does the EPM W Package Manager automatically update itself or we can control it . I see we can control the adapter and client version while using the Package Manager but don’t see a setting to control the version of PM .

Hello Everyone,We are trying to implement Propagation action for one of the managed accounts. The requirement here is that - “Whenever password for this account changes, it shall run a powershell script on corresponding managed system and update the password”.Since we are new to use of ‘propagation action’ functionality any document which can help to understand the usage will be useful.  Thanks,Prasad 

I have both my app registration (Microsoft EntraID) and IdP settings setup according to KB0019022; however, on the mac, whenever I try to authenticate via MFA from a message, I receive the error “The identity provider is unavailable” and it fails. The same app registration works fine for Windows. I have the Mac re-direct and verified the OIDC url is reachable. Anyone else run across this? 

Hi Everyone. A client is asking details around capacity planning for session recordings in PRA. I tried to dig out BT documents around this but couldn’t find any appropriate information. If anyone could help me out with this info, that would be great. Thanks!Average/Peak recording bitrate per session Average and peak data generated by each recorded session (Mbps or MB/min). Daily storage growth Daily storage consumption for session recordings. Please provide the calculation (Average recording size × Number of recorded sessions per day) or historical storage usage data over several days Capacity margin (preferably N-1)Please demonstrate that sufficient storage capacity is available even if one storage component fails (N-1 capacity).Confirmation that the 1 Gbps NIC is sufficientPlease confirm that the 1 Gbps network interface is adequate and will not become saturated under peak screen-sharing and session-recording workloads.  

Currently i have created a local account on all of our DMZ servers and they are administrators. This works So So is there a more streamlined way to accomplish this task.I want to manage the administrator as well as all local accounts in the Administrator Group.

Hi all,we're scoping a Password Safe and Privileged Remote Access deployment for a public-sector customer whose target virtualisation platform is Proxmox VE – so plain QEMU/KVM.The portal offers appliance images for Nutanix, Hyper-V, VMware and OpenShift, but nothing for KVM / libvirt. Since Nutanix AHV and OpenShift Virtualization both run on top of KVM, my assumption is that a suitable qcow2/raw build exists somewhere – it's just not published.So:1. Is there a KVM / libvirt appliance image (qcow2 or raw) for Password Safe or PRA that I've missed?2. Has anyone actually imported the Nutanix or OpenShift build into Proxmox? Any gotchas – boot mode, virtio, networking?3. Is Proxmox / KVM considered supported, or at least tolerated, from a support perspective? That's the part that matters most here.Disk format conversion is trivial, my concern is what's baked into the appliance and whether we'd end up outside a supported configuration.Any experience appreciated – thanks!

As identity security rapidly advances, staying ahead requires the right skills. BeyondTrust University is proud to introduce the newly launched Entitle Administration Certification, designed for professionals committed to deepening their capabilities in identity governance, access control, and privilege management.This isn’t just another certification. It’s your gateway to mastering one of the most modern, intelligent, and scalable identity security solutions on the market. Why Earn the Entitle Administration Certification?·         Become the identity expert everyone trusts - Master identity governance and streamline access with confidence.·         Boost your career with in‑demand IAM skills - Stand out with expertise across Entra ID, Okta, AD, and more.·         Drive efficiency with automation and smart policies - Cut manual work and accelerate access workflows.·         Strengthen security with actionable insights - Spot excessive permissions and risky accounts early.·         Imp

Hello Team,We are currently working on project to discover Amazon RDS hosted databases and managed accounts from those DB’s.I found out below nice article explaining step by step process. AWS RDS Oracle Database - Password Safe Discovery for Managed Accounts | CommunityHowever, the first step suggests using Resource Zone for resource broker configuration. (Seems to be only for Password Safe cloud).We are using On-Premises Password safe (Version 25.1). So based on this in above document, we would like to know from which step we need to follow the instructions.Thanks,Prasad

Hi Everyone!Is it possible to create a Jump Item in Privileged Remote Access (PRA) to access an IBM i (AS/400) system?The environment uses TN5250 over TLS (port 992), and I would like to know if PRA supports this type of connection natively or if an external TN5250 client needs to be integrated with PRA.If anyone has implemented this scenario or knows the limitations and best practices, I would appreciate any guidance. Thanks in advance

Hello For PRA SaaS , we would need to allow from internal jumpoints to PRA SaaS on port 443 mainly right? and from PRA to AD on 636 ? For protocol tunnel, how is the network communication?  From enduser IP to PRA on port 443, communication will be established? and from there jumpoint will try to establish session on the protocol tunnel port mentioned to the services?

 Getting started with Password Safe and the location of information is a single jumping-off point that links to everything you need. General info — Customer Portal tour, Support Guide, how to contact Support, KB notification signup, eLearning courses, and available resources Password Safe basics — what it is, supported platforms, Getting Started guide, account glossary, Smart Rules/Groups, remote session (SSH/RDP) behavior, and security best practices.The next section is organized by deployment type. Pathfinder — welcome page, inviting users, password resets, update process, maintenance notifications, Resource Broker sizing, and port lists Cloud — welcome page, first login/admin setup, maintenance notifications, Resource Broker sizing, port lists, instance upgrades, and IP restriction On-premises — welcome page, best practices, SUPI updates, and U-Series port lists

I have two assets hosting a database cluster:Server 1 hosts DB01 which load balances to 4 database servers Server 2 hosts DB02 which load balance to 4 database serversI ran a scan on both servers. The results showed that Server 1 discovered 0 databases, while Server 2 discovered DB02.How can I confirm whether this behavior is expected?Additionally, I have a few questions:How can I verify that there is already a link/relationship between the two cluster nodes without performing a failover test? From the database side, there is supposed to be a floating hostname that redirects connections to the active node. However, during discovery, we only detected the hostname of one of the databases instead of the floating hostname. Is this the expected behavior? How will password rotation be handled in this clustered setup? 

Hello,I’ve got a couple of questions from our customer that I couldn’t find answers in the documentation and I hope one of you could know the answers.They want to buy EPM-L with Pathfinder and asked how long BT keeps logs and how much can be stored in the BT cloud. They also wanted to know when/if EPM will be hosted in Europe rather than US. Finally there is an issue of automation of endpoint installation. Is there a ready-to-use method of adding multiple endpoints to EPM?I’ll be grateful if you could help me clarify this issues.

 We are experiencing an issue where the Support Desk (Challenge/Response) prompt disappears within 1–3 seconds, preventing users from entering a response code and elevating applications.EnvironmentEPM-M Version: 26.1.0.120 OS: macOS Tahoe 26.4 Users sometimes receive a "Deadline Reached" notificationWe reviewed KB0020349, but the issue is documented as fixed in 23.7.1+, and our clients are already on 26.1.0.120.A comparison between working and affected devices showed no significant differences other than hardware (M2 vs M3 Pro and different Mac models).BeyondTrust advised that newer macOS versions may limit the prompt display time to approximately 10–14 seconds and suggested Challenge/Response or JIT Application Requests as workarounds. However, in our case, the prompt disappears in only 1–3 seconds, which seems abnormal.  As soon as message gets disappeared, users get attached message :- BeeKeepers, please let me know :- Has anyone seen this behavior on EPM-M 26.1 ? Are there any know

Dear Team,We need to retrieve the scanned user account details for servers, either through the BeyondTrust Password Safe REST API or from the Analytics & Reports section in the Password Safe portal.Could anyone please provide guidance on the appropriate API endpoint or the relevant report that can be used to extract this information? If there is any documentation or recommended approach available, kindly share it for reference.Your support on this would be greatly appreciated.

After installing the BeyondTrust EPM agent in Windows, on a few support user’s machine, the service desk team is unable to copy and paste any text from their machine to a remote session machine. They are using Team viewer for the remote session.We have already  followed this KB article  and create customer token and separate rule for team viewer:-  https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0021340&source=community  This issue occurs across applications such as Word, Notepad, and other tools. The issue is completely blocking the support user’s ability to perform work in remote sessions. List of apps/functions tried : Windows UAC, Word, Notepad, Browser. After uninstalling EPM agents, the issue was resolved. Client version :-  26.1.59.0Adaptor version :- 26.1.1495.0OS :- Microsoft Windows 11 Enterprise Please share your experience on this. If you have any solution please let us know.

Hi Beekeepers,I've been building a small automation project that connects Password Safe Cloud to Azure Key Vault for programmatic credential availability, and I'd love your feedback, ideas, and stress-testing.Happy to share the full GitHub repo (currently private — DM me and I'll grant access). At my organization, we use BeyondTrust Password Safe Cloud for privileged breakglass credentials, but several downstream consumers (Azure Functions, Logic Apps, Automation Accounts, third-party SaaS) need to pull those same credentials from Azure Key Vault — because that's what they natively integrate with.The pre-existing process was:Manual retrieval from Password SafeManual paste into Key VaultNo enforced rotation confirmationNo audit trail for SOX / NYDFSI wanted an automation layer that respects BeyondTrust as the source of truth for the credential lifecycle, but pushes the rotated secret into Key Vault with proper version discipline and evidence. What I Built — S.H.A.N.I.Safeguard & Har

We are installing a new PRA , onpremise installation and on Asser Management menu , we are missing gateway tab.

Common challenges with PasswordSafe User Provisioning comes down to the confusion between Smart Rules and Smart Groups, and the concept that PasswordSafe groups are only provisioned if they have permissions assigned to them. You cannot give access to users who are in a group with no permissions.  📌 If you’re wanting an overall yes/no flow if a user can access PasswordSafe or a managed account, please see Whiteboard Workflow Diagrams for PasswordSafe Authentication and Permissions | Community In the effort to share the knowledge, I’m sharing the raw whiteboard notes I have around an approach to thinking about PasswordSafe User Provisioning. Whiteboards are my first step in understanding any system, and, quite frankly, I’ll never get this article posted if I were to transpose this into writing.  🚩 This is a general case. There are different ways of altering what a user is provisioned to access by using the PasswordSafe configurations.  PasswordSafe Users need a provisioned reasonPasswo

We are currently working on creating a Power BI (PBI) report to capture the details of On-demand feature usage. Everything has been configured and is functioning as expected. In the existing PBI report, we would like to include the "User Reason" field. However, we are unable to identify the exact API that provides the "User Reason" field data. Could you please guide us on how to retrieve this information via API?