Unanswered questions

ps automate is not able launch chrome/edge browser sessionHi all i am facing  issue wherein ps automate is not able to launch the browser session. we are using password safe cloud 24.1 version and i downloaded the same version of ps automate. driver versions are also same .still browser session is not opening any idea how to get this issue resolved Awaiting response  RegardsImran

Can we onboard the functional account as a managed account? I can understand as per the best practices we can onboard it in functional account configuration section. but what if we add it as a managed account will it have any impact if we add the functional account as a managed account and disable the account rotation?

This is with regards to Ps automate script unable to launch the browser from RDS session.  We are trying to launch the web application from BT cloud instance.In order to test we tried to install ps automate and chrome/edge drivers on RDSHowever when we are executing below command from Path C:\Program Files\BeyondTrust\pbpsmon, ps_automate.exe ini="BIWebApp.ini" username="username" password="password"TargetURL="https://localhost/WebConsole/index.html#!/dashboard" BrowserName="chrome" We are getting error message which says "Subscript used on non-accessible variables"Below is sceenshot of error  Can anyone please check and help.Regards,Imran Aliyani

HI All, can you please share any one the article to upgrade PRA cloud based application. for your reference attaching the snap. Can we directly upgrade or any instruct the options. Thanks.  

HelloWhen the password contain @ ,the password passed in the application session launched via ps automate tool is wrong, we have added sendkeysraw=1 as well and also tried "%p" in double quotes..but it's not passing password properly when it contains special character.when we set password without special character,the application session login was successful as well.kindly help in passing password with special character successfully.what needs to be done here?

Hi Everyone, I know we have PSAutomate tool that we can use for automating different kind of applications. However as for a more complex automation, we usually use a different tool. As for me, we use nodeJS to automate the login sequence for all web applications. The question here is, does anyone of you also use the same tool that I use? If yes, are you guys currently experiencing an issue after updating the nodeJS version and puppeteer to latest version? Like when opening a web application via PS Remote App, it automatically close, and if we set the Remote App to disabled and check the behavior, it shows an error like this below?Tried this between PSAutomate and NodeJS however this error only happens to NodeJS after upgrading. I know some of you will say that “use PSAutomate” or “revert back to the working version”, but the reason I upgraded my NodeJS and puppeteer is because of a specific web app “FortiAnalyzer”, due to incompatibility issue to the latest version of FortiAnalyzer and

I am encountering a limitation when using BeyondTrust Privileged Remote Access (PRA) for remote access to network shares.I tested an alternative using: Jump Client Session Policies → File Transfer tab ➡️ File transfer works correctly from the remote machine.❌ However, the main issue is that: The session runs under a local administrator account The user accessing the session does have access to the shared folders, but not when using their Active Directory account Requirement / QuestionI would like to know if there is a way: To access the remote machine via Jump Client (File Transfer tab) using the user’s Active Directory account during the session Specifically through: A network tunnel Running the session in the Active Directory user context Active Directory credential injection Or any other native BeyondTrust PRA functionality ObjectiveAllow the remote user to access shared folders and files using their Active Directory account, without using a local administrator account on

We have local cloud kiosks that have been created in Entra and managed by Intune. They are not in AD or DNS. We would like to be able to onboard these devices for local account management and autologon functionality. What is the best way to discover and identify these devices in Password Safe? 

Hello We have EPM Windows agent 24.x version . When a user tries to install Notepad ++ Plugins it throws UAC prompt. I created a rule with all details shown in UAC prompt such as publisher and file name . Later I removed publisher and kept just the executable name , still I get the Windows prompt instead of EPM. Has anyone faced this issue?On 25.x EPM agent with same policy , EPM is able to detect it and elevate it with Notification message 

We are looking to build an automated BeyondTrust Password Safe onboarding process via API, driven by user provided details in a ServiceNow form and lookups against our CMDB.To facilitate this, I’m looking for a way to bulk export the available (and mandatory) fields for the below for every Platform:Creation of an Asset Creation of a Managed System Creation of a Managed Account Population of the ‘Manage Assets Using Password Safe’ Smart Rule Action Population of the ‘Managed Account Setting’ Smart Rule ActionWe need the details for each platform so that we can create branching to provide the right details in the relevant API calls for each platform.The intention is then to map each of the available fields in BeyondTrust to a field in another data source (in the ServiceNow form or CMDB) so that we can populate the API calls for onboarding.I understand Smart Rules can’t be created via API, so we’d instead be looking to pre-create the required ‘Manage Assets Using Password Safe’ and ‘Manag

We have Session Recording Archiving enabled and is working as designed. What happens when (if) I delete recordings from the Archive? Is there a dead link in PWS? Would be interested if anyone has a procedure they use to delete the recordings, say after 12 months. Would like to NOT see any references to the sessions once they are deleted from Archive.

Hello teams,I have a case like this:There is an application, let’s call it data_input.exe that installed in my RDS Jumphost server.Two users need to login this application using their own managed accounts (this is done using automation).However, I need both users to launch the application under different functional accounts within the same RDS jump host. For example, person A start the jumphost using FA-1, and person B start the jumphost using FA-2.Is BeyondTrust able to support this type of scenario? Or is there a workaround for this kind of scenario?I tried cloning the data_input.exe application in the BeyondTrust configuration, but it appears that only one functional account can be assigned per managed system. Note: This is not a multi-session issue, i can do multisession already. But more like each functional account must have different privileges for specific reasons. Thank you 

We often hear from our techs that Jump Clients stay offline even though the PC is only and reachable.Trying to restart the sra-pin Service or the whole PC does nothing.The only way you get this client back online is with the user clicking onto “Reconnect now”.As soon as you click reconnect now the client comes back online.Does anyone else have this problem or has an idea how we can get around this?Another problem is that after a reboot the Jump Client often takes more than 10 minutes to get back online. 

Is it possible to launch multiple or duplicate tabs in a Web Jump?

For one of the end user is not able to access Linux machine and getting below error, tried uninstalled & Installed Desktop access but getting same error however it is working in Web console able to access the server.Could someone please assist to fix the issue?

Is there anyone worked on some kind of powershell script to generate policies, application groups etc.?Trying to create some policy automic policy making process. 

Hello All,We have a requirement for to not onboard Oracle user account while performing oracle DB scan. We only want ‘Oracle system accounts’ and ‘Oracle Service accounts’ to be onboarded. We have attributes (Same as in DB) defined in BeyondInsight configuration. When we attempt to onboard DB accounts using the smart rule, it captures all accounts. Consequently, when we use the 'Set attributes in each account' action within the smart rule, it assigns attributes to all accounts, regardless of the account type. Thanks,Prasad

Hello, I am trying to setup an Azure SQL Database for a new AA BT PWS environment. Is there any way to use a serverless SQL with own key material for TDE?Right now the installer just gets stuck and although I can run the connection check I get a small window stating “validation failed” after I click next on the database configuration step.Any recommendations?  Thanks!

What is the recommended best practice for upgrading PAM Terminal Servers from Windows Server 2012 to Windows Server 2019, particularly when CAL licensing is involved and the servers are used for PAM applications?We currently operate two application servers behind a load balancer (TRM1 and TRM2). TRM1 was originally running Windows Server 2012 for our PAM application. After performing an in‑place upgrade to Windows Server 2019 using the ISO, the upgrade appeared to complete successfully. However, we encountered a significant issue: when launching any application session through PAM, users now receive full desktop access instead of the intended restricted application session.Additionally, after a recent restart, TRM1 began displaying an RDS Licensing error, and we were only able to access the server through the console. Although we resolved the licensing issue and applied the appropriate CALs, the problem with users receiving full desktop access persists.

Can there be multiple approvers in PRA to approve jump session?if yes, how it works, any one to approve or all must approve?

Has anyone come accross an issue when you set this gpo settings every 5 min you get a google notification but if you remove it everything is happy. It is only that setting.    Authenticate with a Password Safe URL (cloud or self-hosted) If State is set to Enabled , administrators can supply a Password Safe URL to authenticate with Pathfinder. When the user starts Workforce Passwords, they are brought to the URL entered in the GPO screen. The user is not able to modify the Password Safe URL from the pre-configured value, or switch to Pathfinder to login. The URL should follow the format https://ps-instance.local/webconsole

Hi, does anyone have a Huawei Switch/Router custom platform for Password Safe to share with us?

Hi,I lost several projects due to PRA dedicated accounts missing feature. I know that is existing in PasswordSafe but these projectw were really secure remote access use cases. Moreover, our main competitor in France is Wallix and they have this feature embedded. Is somebody in the community know if it could be possible to create automation with APIs to map a user with his user-adm account for example ? With a csv input file it could be good enough. Fabien

Is there is a way to adjust the name of the client or customize the pop up to say, "COMPANY NAME - TECH SUPPORT" or something other than "Remote Support Customer Client" as it sounds incredibly suspicious. 

Hi All,We’re relatively new to BeyondTrust PRA and are deploying multiple on‑prem PRA systems (one large Atlas system plus several HA systems for data‑residency). As we plan appliance upgrades (e.g. 24.2.3 → 24.3.3), we have concerns around remote access disruption and network impact, particularly related to Jumpoints. Environment24x7 OT environments 100+ Jumpoints (growing significantly) Jumpoints used as Jump Zone proxies aligned to Purdue/network segmentation JumpItems - primarily JumpClients and RDP. Remote sites connect via low‑bandwidth, often congested satellite linksKey ConcernsJumpoints are not backward compatible Remote access is unavailable until Jumpoints are upgraded to match the appliance version. Upgrade size & network impact ​​​​​​​Latest guidance suggests Jumpoint upgrades are full installers (~130 MB), creating risk of network congestion at scale. Lack of upgrade controls for Jumpoints ​​​​​​​No way to defer/disable auto‑updates, limit concurrency, throttle ban