Recently active topics

Greetings all, When we first deployed our 3 appliance architecture, we were told by BeyondTrust, NEVER run admin functionality on more than 1 appliance due to data corruption.The last software update I ran, the primary (admin) appliance failed and had to be recovered. To aid in people getting to work, I enabled the admin web console on the second appliance and dropped it from the load balancer. I thought I set it back to non-admin by disabling the BeyondInsight Manager Engine but I missed the BeyondInsight Management Web Console until today when an admin IM’ed me on Teams with a screenshot.I went in and disabled the web admin portal but it got me wondering. If I enabled the web admin portal but left the manager engine disabled, would that still cause problems?We have most our service accounts unmanaged. We ask users to rotate those once a year but they ignore us for the most part. If they could get the ability to change passwords without logging into the admin portal with username and

Just In Time (JIT) and Just Enough Access (JEA) are hot topics right now. Gartner points out, by 2025, 75% of cyber insurance companies will require the use of the JIT principle when implementing Privileged Access Management (PAM).As organizations look to drive forward their PAM and Identity Security maturity many are focusing on JIT in 2025 to improve their security posture especially in cloud and SaaS areas.Is this an area you are actively working on? How are you thinking about reducing standing privileges and enabling JIT access?Resources:https://www.beyondtrust.com/blog/entry/just-in-time-access-what-it-is-why-you-need-ithttps://www.beyondtrust.com/resources/whitepapers/guide-to-just-in-time-privileged-access-management

Is anyone using or planning to integrate with Serval ticketing system?   I’d like to see if there are integration instructions for webhooks for JIT admin and application requests.

I am curious how many organizations that utilize BeyondTrust Privilege Management Cloud and Package Manager to manage your updates, if you configure everything to route through a proxy or not?My organization utilizes proxy for the traffic and we have a few headaches with it.  The biggest headache I’m facing is that we utilize Skyhigh Client Proxy, and I’ve found that Skyhigh Client 5.x has issues identifying and routing IPv4-mapped IPv6 addresses which is affecting our Azure VDI environment and Package Manager activating and updating BTPM clients.Does your org use a Proxy, or do you route BTPM straight through the network firewall?  What are your thoughts on the most feasible configuration?

 Hi AllI have one requirement to change password of managed account on HPE Storceonce device. This devices supports password change only using Rest APIs. I know we can create custom plugin and from there we call APIs for password rotation. I wanted to understand if there is any other way , where in we can call Powershell script. This script I can write that can hit API and rotate password. Please let me if know if any solution is present.Regards,Imran Aliyani  

We have a custom propagation action that we have that is a Powershell script that when an EntraID password is rotated, it fires this action and updates the password in Azure Key Vault.  It works very well, however, everything has to be hard code.  For example, when userA has password rotated, on the parameters for the custom propagation action, we have ‘%p’ ‘%u’ ‘subscriptionid’ ‘keyvaultname’ on the command line.  It works great for this user and this key vault only.  We need to be able to pass subscriptionid and keyvault name dynamically via some variable if possible from the managed account properties.  I am not seeing a way to so that.  With only have a few options for parameter variables, it is making this a bit difficult.  Has anyone been able to over come the variable limitation and pass in variables from the managed account to the custom propagation scripts?  See the image attached for what I am talking about.  I changed the actual values to subid and vault to hide them. I wish

Hello all, We are experiencing a behavior with RDP sessions via Password Safe initiated from machines with Windows 11.The session has a slow image loading, appearing to load in rows of images and in blocks.A simple movement of windows within the RDP session causes the image loading of this movement to be very slow.This does not occur if the RDP session is direct with the destination server.But if the connection is through Password Safe being Windows 11 > Resource Broker > Destination server, this slowness is noticed. Has anyone else noticed this problem in your environments? Additionally, this behavior does not occur in Windows 10.Points that I have already checked:- The software installed on the computers are the same between Windows 10 and 11;- The network settings are the same. This behavior occurs on both wireless and wired networks;- The GPOs of the Windows 10/11 stations, Resource Brokers and destination servers have already been checked. No Remote Desktop configurations th

Hello!We are using PRA - jump client based connections as well as BYOT RDP (more hops). We have frequently noticed drastic lag /slowness when remote sessions are used for HD/4K video manipulation, 3D modelling other GPU-accelerated use cases. In certain cases Solidworks models don’t even show up in PRA. Bandwidth and remote computer resources are not a concern  as these are purpose built workstations. Anyone else has faced similar issues ? any suggestions to improve performance 

After upgrading to PRA 26.2.3, we have observed that users are experiencing blurred screens and poor visibility when connecting to endpoints. Has anyone else encountered this issue after the upgrade? If so, could you please share any known solutions or recommended fixes?Thank you.

Hello Team, We have a question about AD domain accounts configured in BeyondTrust Password safe as Managed Accounts.When these accounts get deleted from Parent (Active Directory), it seems they don't get deleted automatically from Password safe managed account list. Is there any way to ensure those are getting disabled/deleted from Password safe as well.This is creating unnecessary overhead for us to verify those accounts and delete them manually.Thanks,Prasad

Hi Community,We are experiencing slow authentication responses when users authenticate against Active Directory (AD) in our on-premises BeyondTrust Password Safe,Basic connectivity between Password Safe and the AD domain controllers has been verified, and the required connections are successful. However, authentication is still taking longer than expected.Could anyone share the recommended troubleshooting steps to identify the root cause of this delay?Specifically, I would appreciate guidance on: Which Password Safe logs should be reviewed to investigate slow AD authentication? How can we measure LDAP/LDAPS response times and identify delays during authentication? Are there specific appliance diagnostics or performance checks recommended for this issue? How can we distinguish network latency from slow AD domain controller responses or Password Safe processing delays? Are there any known configuration issues or settings that can contribute to slow AD authentication? .Thank you f

We have active passive cluster and planning to migrate them i will deploy the ova for 2 appliances then i want to know how the backup and restore should workadditionally we have bug in the backup which I found article that this is a defect with no mitigation till nowso how can i backup and restore the appliance?

Configuring a webhook integration with ServiceNow IT Service Management (ITSM) allows you to create incidents automatically in ServiceNow ITSM.ImportantThird-party documentation is subject to change. Updates might not be reflected in BeyondTrust documentation. For the most up-to-date information, visit ServiceNow product documentation.Requirements Access to a BeyondTrust site with an EPM app An EPM account with webhook read/write privileges An service account in ServiceNow, with permissions to create a new user in ServiceNow with the itil role. Create a service accountThe webhook integration between ServiceNow and EPM requires an service account in ServiceNow. You must create a new user in ServiceNow with the itil role and copy the user's sys_id. You require the user's sys_id when configuring the webhook in Insights.NoteFor more information on creating users and assign roles in ServiceNow, see Create a user and Assign a role to a user.Create a webhook integration for ServiceNow - I

Currently testing the new feature for targeting workstyles at Entra ID device groups (26.3.1).Entra ID is integrated and granted permissions per documentation. Groups were synced. Device group was searched and added to the computer filter of a Workstyle in the policy. Test client device was rebooted and synced using the Endpoint Utility.Seems that the targeting isn’t working thus far for me. When syncing with /aad or /identity /refresh, an error states that user is not supported or no filter in place:c:\Program Files\Avecto\Privilege Guard Client>EndpointUtility.exe /aadBeyondTrust Utility ToolCopyright (C) 2026 BeyondTrust Corp.Requesting that BeyondTrust Privilege Management refresh its groups…Error: This user is not supported or there is no filter in place.Targeting works if the computer hostname is added to the computer filter. Any ideas?

 Your privileged access strategy just got a lot easier to master. Become a Total PASM expert, on your terms. Our newest Success Included course is now available on demand and free. Build the skills to take complete control of privileged accounts and put them to work right away. The course is designed to gain the skills to discover, secure, and manage privileged accounts with confidence. Move through the material at your own pace, revisit the modules that matter most, and finish ready to take command of privileged access in your own environment. What Is Total PASM? Total PASM is BeyondTrust’s answer to one of the biggest challenges in IT security: knowing who has privileged access, what they’re doing with it, and how to keep it under control. It combines two industry-leading solutions into one powerful bundle:Password Safe automates privileged asset discovery and onboarding, and manages privileged passwords, DevOps secrets, SSH keys, and more. Privileged Remote Access delivers best-in-c

Context BeyondTrust Pathfinder now has a global, centralized SCIM API, that allows SailPoint Identity Security Cloud to provision access into individual BeyondTrust products.SailPoint ISC : PathFinder SCIM setup guide An optional side-car Privileged Remote Access web service connector is available on Beekeepers for authenticated users:Pathfinder Total PASM connector  Total PASM - Reference Architecture