Recently active topics

Has anyone else encountered issues with the Rep Console app after updating to iOS and iPadOS 27? After updating, when trying to login via SAML, the Login button doesn’t do anything. We have the app setting to open external browser for passkey support and in iOS 26, it successfully would open Safari for the authentication. Now, the button just appears to be a dead button.

Hello, We are looking for a way to block nested RDP sessions inside a remote RDP jump. We tried adding mstsc.exe under Application Sharing Restrictions on the relevant Session Policy, but does not seem to work. For reference, in a similar solution by Fortinet (FortiPAM), there is the option of applying a Windows App Profile where you can block specific executables (see below).  Do you know if this is supported in general or I’ve missed something in our configuration? Thanks in advance.

Hey guys-We're planning to migrate our on-prem BeyondTrust Remote Support environment to the cloud and I'm curious to hear about others' experiences.We're working with a 90-day migration window and plan to build everything from scratch rather than restore a backup, mainly to clean things up and standardize our configuration. We're also planning to keep our existing hostname to minimize disruption.A few things I'm curious about: Did your existing Jump Clients continue working after cutover, or did you have to redeploy them? Were you able to keep using your existing rep consoles, or did those need to be reinstalled? Any general gotchas or things you wish you'd known before making the switch? We're working through some of these questions with Support, but it'd be great to hear from anyone who's been through it. Any advice or lessons learned would be appreciated!

Hi all,Environment:BeyondInsight / Password Safe on-premises, U-Series Appliance, version[26.3.x – confirm build] Deployment:[ Active-Passive HA ] Managed servers: Windows and Linux, spread across multiple VLANs RDP/SSH sessions go through the Password Safe session proxy, with recording and Change Password After Release enabledOur challenge: Admins can still bypass Password Safe and connect to servers directly with mstsc.exe or PuTTY. Those sessions aren't requested, approved or recorded. Our current setup:GPO adds regular accounts to local Administrators. Restricted Groups / GPP add domain groups containing admins' regular (non-privileged) accounts to the local Administrators group on servers. Servers are spread across multiple VLANs. Admin workstation VLANs can route to server VLANs, and inter-VLAN rules allow TCP 3389/22. Default RDP logon rights. Any member of local Administrators can log on through Remote Desktop.Questions:Does BeyondTrust have an official recommendation or harden

Context Tenable OPEN for AI program enables customers to use preferred AI models, agents and tools to improve visibility, insight and action. Beyondtrust is an official partner.  All partners are listed here. Use Case: Identity-Aware Exposure InvestigationBy connecting the BeyondTrust Pathfinder MCP server and the Tenable Hexa AI MCP Server in a single AI agent session, security teams can join Tenable vulnerability findings with BeyondTrust identity and privileged access data for assets present in both platforms. Starting from a Tenable scan finding or a BeyondTrust detection, analysts can identify the identities and privileged accounts tied to an exposed host, assess whether its vulnerabilities could be chained for lateral movement, and prioritize remediation or investigation with both exposure and identity context.  

 Hi AllI have one requirement to change password of managed account on HPE Storceonce device. This devices supports password change only using Rest APIs. I know we can create custom plugin and from there we call APIs for password rotation. I wanted to understand if there is any other way , where in we can call Powershell script. This script I can write that can hit API and rotate password. Please let me if know if any solution is present.Regards,Imran Aliyani  

We are currently configuring and validating a BeyondTrust Privileged Remote Access (PRA) ATLAS cluster running version 26.2.3 the new installation, and we would appreciate your assistance in clarifying some questions regarding Traffic Node selection and connectivity.Environment OverviewOur environment consists of three ATLAS appliances: Primary: atlasp.xx.xx – 10 Traffic Node 1: atlas1.xx.xx – 10 Traffic Node 2: atlas2.xx.xx – 10 The public access hostname is remot.xx.xx, which resolves to the Primary appliance. The cluster is configured and synchronized, the hostnames are configured, and the wildcard SSL certificate for *.xx.xxhas been installed. The Traffic Node selection method is currently set to Random.Issues and Questions When accessing https://console, the Web Access Console displays a “Connect to” selector with the Primary and both Traffic Nodes available. Is this the expected behavior in PRA 26.2.3? Is there a supported configuration option to hide this selector and allow

Password Safe on-prem: if an Access Policy has Approvers = 3, must all 3 approvers approve before access is granted? Is sequential (multi-level) approval supported?

AI Agents Are Here. Is Your Security Ready? AI Agent Security is officially live, and we’re launching new training to go with it. AI agents are no longer a “someday” technology. They’re booking, querying, coding, and acting on your behalf right now, often with real access to real systems. That’s powerful. It also raises a question every organization needs to answer: who’s keeping the agents in check?That’s exactly the gap AI Agent Security closes. Secure your AI agents with confidence.Discover how AI Agent Security closes the gap between innovation and control in our two hour live workshop. Learn the core principles, key terminology, and dependencies that power the platform, then see how to get started and how its enforcement model keeps every agent in check. Your AI agents are ready to work. Make sure they work safely. What you’ll walk away with The “why”: what AI Agent Security is and the organizational gap it fills The “what”: core principles, key terminology, and what the platfor

Hello All, I was referring this KBA article -Knowledge Article - Customer Support (KB0016945)In this its explained about the column ‘Mapped to User’. Do we know how this mapping is established. Is it something in Smart rule which helps in setting this mapping. Thanks,Prasad  

Hi all,We have deployed a BeyondTrust PRA Cloud instance through Pathfinder in one of our customers.Due to several users with personal accounts (e.g. Gmail), we are restricted in sharing with them the Microsoft My Apps link (with the Tenant ID) in order for them to click the BeyondTrust application.That’s ok; however, we observe that there is a minimum of three clicks for a user to reach the /console page (one on the Enterprise Application, one on the PRA application on Pathfinder, and then the Launch Privileged Web Access Console).I have selected the option to Redirect to the Privileged Web Access Console under Management > Site Configuration > HTTP, but I think this is for direct connections to the instance.No big deal, but just trying to figure out if there is a way to minimize the number of clicks for such a use case.Thanks all.

Hi there, currently i got some case request for one of my customers, their using 3 UVM 2016 in A/A deployment with BI version 25.1. they want to upgrade UVM 2016 to UVM 2022. is there any one that experiencing this upgrade scenario before ? because , i just planning  to add on new UVM 2022 as worker node first before enable the new UVM 2022 as an admin console before all UVM 2016 will be take down and dismantled. Thanks, and hope you are all have a great day a head.

Is anyone aware if the API can be used to approve or deny JIT Application requests. It looks like the API is able to handle this for JIT Admin. If no, has there been any word on when this could be coming. I’m in the process of building a mobile app for the JIT App approvals and the front end is done, but the pesky API backend is not cooperating.

I am facing an issue while launching PS_Automate through CMD.Initially, there was no issue when I tested it with the default BIWebApp.ini file. However, after making a copy of the same file and renaming it to WAF.ini, I started receiving the following error when trying to launch PS_Automate:Error: Subscript used on non-accessible variable.My BeyondInsight/Password Safe version is 26.2.Could anyone please guide me on what might be causing this issue and how I can troubleshoot or resolve it? 

Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?

Hello, I was wondering if anyone else is having any issues with logging into the Remote Support representative console after updating to macOS 27 Golden Gate?We are a small team, but so far we have four people who have updated, and currently two of them are not able to sign in. There is a spinning wheel for about 10-15 seconds after clicking login, and then it just stays on the authentication page as if nothing happened. Reinstalling the program doesn’t help, and we also tried using the following command:sudo tccutil reset All com.bomgar.bomgar-sccThis would allow one successful login, however the issue would happen again the net time we tried to login. 

The release notes for 26.3 mention that JIT Admin notifications have been added so users know right away that they have been approved/denied without needing to constantly check the endpoint utility app. It explicitly says JIT Admin. Does anyone know offhand if those notifications have been added for JIT Application approvals? 

Hi. We have a default Group Policy for all support teams that gives access to all jump clients. The policy applies to all members of our tenant, using the tenant ID. Is there a way to exclude specific agents so that the policy does not apply to them? I want to set up a separate Group Policy only for one agent to have access to only a very limited number of jump clients, but I can’t if they are already a member of the default group because they are a tenant member.

Has anybody here ever implemented Qualys scanning against their PS on-premises appliances? Is it possible to create a local account for Qualys on our on-prem appliances for Qualys scanning or is this not allowed?

Hello,I have a CloudShare Based Windows Server 2022 VM with EPM Client, Adapter and Package Manager installed. It is visible in Pathfinder as connected, up to date, with the right policy assigned. When I update policy at the endpoint it says the latest available version is present. I am using default Workstyles (High, Medium and Low Flexibility) and created one user (at the endpoint) for each Workstyle. I defined filters with the specific user names and SID’s in each workstyle. However, the policy seems to have no effect.I compared behaviour of High and Low Flexibility account. I tried installing basic software (e.g. 7-zip) - both are getting error: Access is denied. I tried running regedit - both run it, but have access denied to the same entries. I tried creating a new folder in Program Files, and got Access Denied. The Analytics tab in Pathfinder shows no activity at all. In short - everything acts if EPM was not there at all, although all connectivity seems to be fine.I suspect I m

Hello Beekeepers community!!!We currently add Active Directory (AD) users to local BT Group security groups for access management. However, we have identified a concern regarding user lifecycle management and audit compliance.At present, when a user account is disabled or becomes inactive in Active Directory, the user is not automatically removed from the local group(s) to which access was previously granted. As a result, the group membership does not accurately reflect the list of active users.For example:Local group: BT-PAM-ACCESS Total members displayed: 10 users Actual active users: 8 users Disabled users in AD: 2 usersEven though the 2 users are disabled in Active Directory, they continue to appear as members of the local group. During audits, we provide screenshots of the local group membership as evidence of access reviews. This results in audit evidence showing all 10 users, which can be misleading because it includes accounts that are no longer active.Concern: The current proc

Hey all, I’m looking to optimize how we use BeyondInsight/Password Safe Managed Account Propagation Settings and would love to get your input. Right now, we want to automate password rotations for our domain service accounts without accidentally breaking dependencies like Windows Services, Scheduled Tasks, or IIS App Pools. I’m curious to know exactly how the propagation engine behaves under the hood in your environments?What specific use cases you’re leveraging it for and most importantly, what configurations or operational habits you’ve put in place to ensure 100% consistent results without missing target servers or causing service downtime. So, how are you guys handling this successfully?

Is there any way to change IP address of already onboarded assets to Beyondtrust password safe? everytime we have to delete the older asset and then re-onboard the asset.

In BeyondTrust Password Safe, Cloud  why are some manually added assets unable to change the assigned workgroup? The option appears unavailable & disabled.