Unanswered questions

I am trying to move us away from the deprecated support button. My understanding is that the standby jump client should provide a user driven support request similar to support button. My question is what does the user do to initiate a support chat from the jump client? I have it installed on my computer, I can see my jump client in standby in the rep console. From the client my only options are to disable/uninstall or check-in. I was expecting an option to start a support chat.

So, I’ve attempted this multiple times and took a short break to clear my head. Cannot seem to get this wrapped up, and it’s a necessity. Hi, I’m Robert and I’m a Security Engineer for my company. Part of my portfolio is Enterprise Software Management via Intune. I manage all software deployments for the company on a tenant level, using assignment groups to make certain apps available to pertinent groups. Over the past 3 years, I’ve learned a lot where Intune deployments and the Windows OS intersect. I’m still on the learning path, but I’m figuring out the nuances, the lowest common denominators and getting better at troubleshooting issues. This is where things get complicated: 100% of my experience in this arena is Windows 10 / Windows 11 based. And we now have a very small fleet (<10 devices) of Mac devices for our Marketing team. Now, I’ve tried everything I can find online, but the documentation on how to pull this off via Intune is scarce and incomplete. Reddit has been the mos

We have seen an issue where in some scenarios, it may be possible to connect to a user’s screen without requiring their acceptance. When you initially establish a jump session and perform Shell work to fix an issue, users may have their screen locked or logged out.  Unfortunately, the session policies do not appear to re-evaluate, so whatever the status of the device was when you established the jump session is held throughout the session. A workaround would be to disconnect the jump session and establish a fresh session before you use the screenshare function, which would then pick up the user is logged on and present the prompt.For example:User reports an issue on desktop, walks away.The machine is connected to (Shell, System etc but not screen sharing).User returns and unlocks the machine.Screen sharing is started from the Rep Console.Due to the existing session already established (using Shell and System Information), no prompt for the user to accept is required, and it connects to

We are planning to migrate our BeyondTrust Password Safe On-Prem environment from Active‑Passive (A‑P) to Active‑Active (A‑A).We have already built the external SQL node, and our current Active node will be used as the Management Node, while the second Passive node will function as a Worker Node.Could you please confirm if any additional licenses are required for this migration from A‑P to A‑A?  

Hi everyone,I’m trying to use aca to block some commands after user switch to a root account using pbrun. But I’m not able to achieve it, below is the sample script I have. Please suggest the changes to effectively use aca to block commands.bash is an alias command to switch to root user. I can still run whoami command after switch to root.if (command == bash){aca("file", "/use/bin/whoami", "!all", "BLOCK");accept;} Thanks,

One of our customers are using UVM 2016 version in on Prem environment & servers were deployed in AWS which in A/P mode, what is the process of upgrading to UVM 2022 version. 

Hi, We have an issue of manual policy from PMC console is not getting refreshed to latest version when trying to manually refresh the policy. Although all looks good on PMC console, if I try to manually refresh a policy on a machine in PMC console it will say that system is on latest assigned policy, I will also get a message that system is on latest revision but when I check in BT icon > right click the policy is still on older version.Automatic policy refresh works fine that is when system check-in with PMC console on its own the latest policy is applied without any issue.I have test policy group where the policy refresh is working perfectly fine only production policy group we are facing this issue.If anyone of you has encountered this issue, it will great help if you can suggest what could be the possible reason.  

After success fully installed EPM windows application to the user machine still user unable get the elevated access properly.

HelloWe have a situation with the Web Jump where user needs to open a specific website which automaticaly downloads an instalation package. I was able to configure web jump but when user connects to it - it just displays the webpage. Is it possible to set web jump to auto download the file after connecting?Kind Regards

HelloWhen the password contain @ ,the password passed in the application session launched via ps automate tool is wrong, we have added sendkeysraw=1 as well and also tried "%p" in double quotes..but it's not passing password properly when it contains special character.when we set password without special character,the application session login was successful as well.kindly help in passing password with special character successfully.what needs to be done here?

I have a question regarding RDS CALs per user. If only one functional account is defined in the Application settings, then do I only need one RDS CALs because only that functional account is technically initiating the RDP session to the RDS server.

Hello,I need to upgrade the operating system from Windows Server 2016 to Windows Server 2019 on the servers hosting the BeyondInsight databases. These servers are part of a cluster, and all cluster nodes will be upgraded.My question is: how will this impact Password Safe operations? Will services return to normal automatically once the upgrade is completed, or are there any actions required from our side?Additionally, are there any notes or precautions that should be considered to avoid potential failures during or after the upgrade?

ps automate is not able launch chrome/edge browser sessionHi all i am facing  issue wherein ps automate is not able to launch the browser session. we are using password safe cloud 24.1 version and i downloaded the same version of ps automate. driver versions are also same .still browser session is not opening any idea how to get this issue resolved Awaiting response  RegardsImran

This is with regards to Ps automate script unable to launch the browser from RDS session.  We are trying to launch the web application from BT cloud instance.In order to test we tried to install ps automate and chrome/edge drivers on RDSHowever when we are executing below command from Path C:\Program Files\BeyondTrust\pbpsmon, ps_automate.exe ini="BIWebApp.ini" username="username" password="password"TargetURL="https://localhost/WebConsole/index.html#!/dashboard" BrowserName="chrome" We are getting error message which says "Subscript used on non-accessible variables"Below is sceenshot of error  Can anyone please check and help.Regards,Imran Aliyani

HI All, can you please share any one the article to upgrade PRA cloud based application. for your reference attaching the snap. Can we directly upgrade or any instruct the options. Thanks.  

Hi Everyone, I know we have PSAutomate tool that we can use for automating different kind of applications. However as for a more complex automation, we usually use a different tool. As for me, we use nodeJS to automate the login sequence for all web applications. The question here is, does anyone of you also use the same tool that I use? If yes, are you guys currently experiencing an issue after updating the nodeJS version and puppeteer to latest version? Like when opening a web application via PS Remote App, it automatically close, and if we set the Remote App to disabled and check the behavior, it shows an error like this below?Tried this between PSAutomate and NodeJS however this error only happens to NodeJS after upgrading. I know some of you will say that “use PSAutomate” or “revert back to the working version”, but the reason I upgraded my NodeJS and puppeteer is because of a specific web app “FortiAnalyzer”, due to incompatibility issue to the latest version of FortiAnalyzer and

I am encountering a limitation when using BeyondTrust Privileged Remote Access (PRA) for remote access to network shares.I tested an alternative using: Jump Client Session Policies → File Transfer tab ➡️ File transfer works correctly from the remote machine.❌ However, the main issue is that: The session runs under a local administrator account The user accessing the session does have access to the shared folders, but not when using their Active Directory account Requirement / QuestionI would like to know if there is a way: To access the remote machine via Jump Client (File Transfer tab) using the user’s Active Directory account during the session Specifically through: A network tunnel Running the session in the Active Directory user context Active Directory credential injection Or any other native BeyondTrust PRA functionality ObjectiveAllow the remote user to access shared folders and files using their Active Directory account, without using a local administrator account on

We have local cloud kiosks that have been created in Entra and managed by Intune. They are not in AD or DNS. We would like to be able to onboard these devices for local account management and autologon functionality. What is the best way to discover and identify these devices in Password Safe? 

Hello We have EPM Windows agent 24.x version . When a user tries to install Notepad ++ Plugins it throws UAC prompt. I created a rule with all details shown in UAC prompt such as publisher and file name . Later I removed publisher and kept just the executable name , still I get the Windows prompt instead of EPM. Has anyone faced this issue?On 25.x EPM agent with same policy , EPM is able to detect it and elevate it with Notification message 

We are looking to build an automated BeyondTrust Password Safe onboarding process via API, driven by user provided details in a ServiceNow form and lookups against our CMDB.To facilitate this, I’m looking for a way to bulk export the available (and mandatory) fields for the below for every Platform:Creation of an Asset Creation of a Managed System Creation of a Managed Account Population of the ‘Manage Assets Using Password Safe’ Smart Rule Action Population of the ‘Managed Account Setting’ Smart Rule ActionWe need the details for each platform so that we can create branching to provide the right details in the relevant API calls for each platform.The intention is then to map each of the available fields in BeyondTrust to a field in another data source (in the ServiceNow form or CMDB) so that we can populate the API calls for onboarding.I understand Smart Rules can’t be created via API, so we’d instead be looking to pre-create the required ‘Manage Assets Using Password Safe’ and ‘Manag

Hello teams,I have a case like this:There is an application, let’s call it data_input.exe that installed in my RDS Jumphost server.Two users need to login this application using their own managed accounts (this is done using automation).However, I need both users to launch the application under different functional accounts within the same RDS jump host. For example, person A start the jumphost using FA-1, and person B start the jumphost using FA-2.Is BeyondTrust able to support this type of scenario? Or is there a workaround for this kind of scenario?I tried cloning the data_input.exe application in the BeyondTrust configuration, but it appears that only one functional account can be assigned per managed system. Note: This is not a multi-session issue, i can do multisession already. But more like each functional account must have different privileges for specific reasons. Thank you 

We often hear from our techs that Jump Clients stay offline even though the PC is only and reachable.Trying to restart the sra-pin Service or the whole PC does nothing.The only way you get this client back online is with the user clicking onto “Reconnect now”.As soon as you click reconnect now the client comes back online.Does anyone else have this problem or has an idea how we can get around this?Another problem is that after a reboot the Jump Client often takes more than 10 minutes to get back online. 

Is it possible to launch multiple or duplicate tabs in a Web Jump?

For one of the end user is not able to access Linux machine and getting below error, tried uninstalled & Installed Desktop access but getting same error however it is working in Web console able to access the server.Could someone please assist to fix the issue?

Is there anyone worked on some kind of powershell script to generate policies, application groups etc.?Trying to create some policy automic policy making process.