Recently active topics

We have a case where users connecting to VPN from outside the country get a specific pool/subnet of IPs when successfully connected to VPN. Now we have a case, that such users should not be able to access certain Assets/IPs. Can we have any kind of control for this. PAM can check what is the source IP and then do not allow access to restricted assets. Is this doable?

Hi guys,I just want to clarify how the asset-based licensing works in Password Safe.For example, if we have 50 asset-based licenses and all 50 licenses are currently being used, but the client wants to onboard one additional asset/managed system, we would need an additional license.My question is: If we decommission/delete one of the existing licensed assets/managed systems, will that license be released and become available so that we can onboard the new asset/managed system using the same license?In other words, can a license be reused after removing an existing managed system, or would we still need to purchase an additional license for the new system?Could someone please clarify how Password Safe handles this scenario?Thanks.

How to export Secret Safe from 24.X On prem to 26.1 Cloud?I m able to export the folder names, secret names but not keys, credentials and files. how can we do this in bulk.

We have Cimplicity Webspace in our environment, which is web based. The main dashboard does not have a login screen, but each page off of the main page is an embedded IDE object that has its own authentication. We are trying right now to run the application as a Web Jump, but Web Jump does not see the authentication fields because they are in the embedded IDE and not HTML fields.Has anyone found a way to use Cimplicity Webspace with PRA?

Hi All,I need to test the functional account test on multiple system. Systems are more than 500 and all systems are non domain joined. I need to test password and create the report. Post that I will work with respective team to get it sorted. However currently testing one one system it is very difficult.I want to understand how can I do testing of functional account in bulk Is there any API available to do functional testing in bulk.I need help here please to understand how can I resolve this issue ?Regards,Immi

Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?

I really bought into “If you can do it in powershell, you can run it in a powerrule” but I’m learning it’s really not that easy. What I want to do: If someone runs the “Hyper-V Manager” console, it automatically will add that user to the hyper-v administrators local group in Windows.I have a script that adds the user to the group, uploaded it, and targeted it with an app group to run, but it doesn’t do anything. I started looking into power rules more (EPM for Windows core scripting | EPM-WM) but quickly realized, it seems like there are special cmdlets you have to use? It’s very confusing.If anyone can point me in the right direction, I’d really appreaciate it.

Why We Built ThisBeyondTrust and CrowdStrike both ship native Model Context Protocol (MCP) servers: Pathfinder MCP for identity and privilege data, Falcon MCP for detections and threat telemetry. Used separately, each lets an AI agent query one platform. Wired together behind a single conversational agent, they let a security analyst ask one question and get an answer that spans both platforms — for example, whether an identity's privilege exposure lines up with what's actually happening on the detection side. Better together:  Next-Gen SIEM + Pathfinder.   Configure CrowdStrikeTo configure Claude Desktop for the CrowdStrike Falcon MCP server, you need to set up your CrowdStrike API credentials and update your claude_desktop_config.json file:  "falcon-mcp": { "command": "uvx", "args": [ "falcon-mcp" ], "env": { "FALCON_CLIENT_ID": "<Your_client_id>", "FALCON_CLIENT_SECRET": "<Your_client_secret>", "FALCON_BASE_URL": "https:

Objective:Wiring CrowdStrike Falcon and BeyondTrust Pathfinder into a single conversational agent on Amazon Bedrock AgentCore AWS Bedrock Harness Playground with both MCP servers. Why We Built ThisBeyondTrust and CrowdStrike both ship native Model Context Protocol (MCP) servers: Pathfinder MCP for identity and privilege data, Falcon MCP for detections and threat telemetry. Used separately, each lets an AI agent query one platform. Wired together behind a single conversational agent, they let a security analyst ask one question and get an answer that spans both platforms — for example, whether an identity's privilege exposure lines up with what's actually happening on the detection side.This guide walks through how we built exactly that on Amazon Bedrock AgentCore, using Claude as the reasoning model. It documents every real snag we hit, because the snags are where the actual learning is.  Architecture at a GlanceOne Harness (a Bedrock AgentCore conversational agent, running Claude) wit

EPM Windows and Mac certification just got simpler. Instead of moving between two separate courses, admins now learn application control and privilege elevation across both platforms in one instructor-led course — shared concepts taught once, platform differences called out where they matter. One course, one certification, less time away from the job.What's Changed One course, not two – The EPM Windows & Mac Certification course now delivers 20 hours of instruction and lab exercises in a single class (previously 24 hours split across two separate courses). 1 week instead of 2 – Certification training now runs in one week rather than two. One certification, two operating systems – A single credential now covers both Windows and macOS. FAQ What if I only purchased Mac training? Any training you've already purchased is still fully supported. How do I take the new combined course? Enroll using the key provided at the time of purchase. Will the certification cover both W

Hi guys.I was looking in other topics that some people have in their PRA consoles the option to create an Web Jump connection type. But it doesn’t appear on my console as you can see in the print below.What is the requirements to enable this option?I didn’t find any documentation explaining this. 

Installing the Linux Remote Support jumpclient in system mode breaks our GDM authentication configuration by installing the file /etc/dconf/profile/gdm with the contents:user-db:user system-db:gdm file-db:/usr/share/gdm/greeter-dconf-defaultsRedHat systems configure gdm by default via the dconf site database. RedHat expects a confguration like:user-db:user system-db:local system-db:site system-db:distro By removing the local, site, and distro DBs you are completely breaking the standard RedHat configuration. This is completely irresponsible on your part to be modifying such a critical system configuration. This took most of my day to resolve and locked a couple of users out of their machines for a few hours.I had actually just decided to enable your automatic updating of Remote Support - but that is out the window now if you are going to be releasing stuff like this.

Good day all,Forgive me if this is an obvious question, but I was not the one who set-up our PRA environment and the admin left our company leaving little documentation behind. I’m finding that when a vendor signs in, they have visibility into pretty much all of our devices with the PRA endpoint installed, even if they cannot sign into them (no credentials for the actual machine but they can get into the console) Looking at Asset Groups, I can see many users in them, but I cannot figure out where they are inheriting the permissions from to remove them. (See screenshot for a small snippet of what I am referring to) Any guidance on where to track this down to resolve it? I am now signed up for the Beyond Trust University and am learning the environment but am hoping to resolve this sooner rather than later.I wasn’t certain what information, or screenshots would be needed to understand the issue fully, so please feel free to ask any clarifying questions. Thank you all!-Michael 

I have multiple Database admins I need to give access to our database for. We have no resources for PAW or Internal Admin machines. Is it the purpose of Beyondtrust SQL server tunnels to be ran on BYOD device and have them tunnel SQL Studio traffic to my on prem SQL server? Has anyone done this? I believe I have the tunnel up. How do you use Management studio? My “Open datasource Client” is grayed out. How do the credentials work? Do the credentials I use for the tunnel work for everyone using the tunnel? Or do I need to create one tunnel per person? 

Hi Everyone!Is it possible to create a Jump Item in Privileged Remote Access (PRA) to access an IBM i (AS/400) system?The environment uses TN5250 over TLS (port 992), and I would like to know if PRA supports this type of connection natively or if an external TN5250 client needs to be integrated with PRA.If anyone has implemented this scenario or knows the limitations and best practices, I would appreciate any guidance. Thanks in advance

Ran into an issue while upgrading to 25.3.3 (and 26.1.1 + Base 8.2) this week, maybe I’m incorrect in my assertion but I’ve updated our appliance several times since going live, and haven’t had this issue before.After updating to 25.3.3 all of our Desktop clients stopped working, we use SAML auth, and the SAML itself works fine, we see successful logins, but when the login is complete, the desktop console doesn’t do anything, it remains in its default state, waiting for you to press login, and the cycle repeats.I tested this both on going from 25.3.2 to 25.3.3 and 26.1.1, with desktop consoles both on 25.3.2 and 25.3.3, same thing on both.Again, I’ve updated the appliance several times, without the need to manually re-install the desktop console.SAML login to the /login page and /console page in web works fine.

Hi Can we deploy jumpoints in Prod and DR site, if reachability is there? should it be in same VLAN?

The screen recording allowance for BeyondTrust Remote Support has been popping up multiple times a day for myself and all test users that I’ve had update to macOS 15 Sequoia.Clicking “Allow for One Month” does not seem to function - as the pop ups continue. 

Is there any way to change IP address of already onboarded assets to Beyondtrust password safe? everytime we have to delete the older asset and then re-onboard the asset.

Hey all, I’m looking to optimize how we use BeyondInsight/Password Safe Managed Account Propagation Settings and would love to get your input. Right now, we want to automate password rotations for our domain service accounts without accidentally breaking dependencies like Windows Services, Scheduled Tasks, or IIS App Pools. I’m curious to know exactly how the propagation engine behaves under the hood in your environments?What specific use cases you’re leveraging it for and most importantly, what configurations or operational habits you’ve put in place to ensure 100% consistent results without missing target servers or causing service downtime. So, how are you guys handling this successfully?

Hello community. I have several AWS console access accounts and would like to provide access to clients in the same way shown in this video, where Password Safe injects the credential without the user knowing the password. I have already used RDS Application for delivering MSSQL and other applications, but according to this older video, it's not clear to me whether RDS Application is being used. Could you tell me which method is currently supported by Password Safe for accessing web consoles like AWS and Azure without exposing the password? I don't have PRA, where I know everything would be solved with Web Jump. I only have Password Safe without Workforce. Thank you very much."  

Hi , I have a few queries (mentioned below), I am not able to find relevant information in documentations. If someone know please let me know -1. which user has checked out account ? - I want to see who has checked out an account so that I can go ahead and ask them to check the account back in to passwordsafe.2. Email notification on usage of specific accounts. - Is there a way I can setup email notifications to be sent out to some DL on usage of some accounts(not all), like when the account is requested and password is changed.3.Who changed the last password ? - I would like to see the username of the user who changed or initiated the password change. I can see “changed by User” in password history but no detail on who the actual user was.

Hello everyone,After reinstalling the resource brokers in our environment, I began noticing intermittent failures during automatic password rotations on managed Linux and AIX systems.Error recorded in the resource broker logs and console:"The connection was closed by the server. Make sure you are connecting to an SSH or SFTP server."Error recorded in the managed systems' sshd logs:"Jul 28 04:30:43 Server01 sshderror: kex_exchange_identification: Connection closed by remote host"Both errors occurred at the same date and time.Has anyone else encountered this behavior?Could this be resolved using the "Enable legacy algorithms for SSH account management tasks" option found under Configuration > Privileged Access Management > Miscellaneous?According to KB0017016, "The option Enable legacy algorithms for SSH account management tasks enables legacy encryption, MAC, and key exchange (Kex) algorithms that were previously enabled in Password Safe".If anyone has experienced this, I would gr

Hello Beekeepers community!!!We currently add Active Directory (AD) users to local BT Group security groups for access management. However, we have identified a concern regarding user lifecycle management and audit compliance.At present, when a user account is disabled or becomes inactive in Active Directory, the user is not automatically removed from the local group(s) to which access was previously granted. As a result, the group membership does not accurately reflect the list of active users.For example:Local group: BT-PAM-ACCESS Total members displayed: 10 users Actual active users: 8 users Disabled users in AD: 2 usersEven though the 2 users are disabled in Active Directory, they continue to appear as members of the local group. During audits, we provide screenshots of the local group membership as evidence of access reviews. This results in audit evidence showing all 10 users, which can be misleading because it includes accounts that are no longer active.Concern: The current proc

Hi mates, I am in a trouble with Discovery Scan and each time it can surprise me with new issue.I can not scan Linux  and Linux based assets (like Palo Alto firewalls) with Discovery Scan. It  displays the error “NoValidTargets” error altought is was working properly yesterday and suddenly started to give this error.  There is not any Network connections issue. Appliance can connect to SSH ports of Linux machines. Credentials issue. I use root user and tested its password a few times, no fail while manually login. No service error. I checked with getc, teste, testc commands. I tried on new VMs and formerly scanned ones. All scans returned same error mentioned above.Everything is ok with Windows scans.