Unanswered questions

Hello Team We are facing delay in BI console and in sessions taken via passwordsafe when accessed from site other than the management node site. How could we troubleshoot on this and improve on the setup.

Is there any way to change IP address of already onboarded assets to Beyondtrust password safe? everytime we have to delete the older asset and then re-onboard the asset.

We recently updated to BeyondInsight and PasswordSafe 26.2, that introduced Personal Access Tokens. In my testing, with my Microsoft Entra account, I can’t get this to work, I’m pasting the PAT as the password and thought that was enough, am I doing it wrong? I thought the documentation that Direct Connect not working with Entra accounts was because of SSO and Password limitations?Update: I just tried to log in with a local user, and its PAT works perfectly fineThanks,Inuk

Hi All,My organisation has auditing requirement to review who approved what session request for certain applications. Now - Using the Activity Report in Analytics and Report, I have managed to generate the reports who approved session for RDP and SSH connections but I am unable to generate the same for application connections. Now this is mainly because as per my understanding you cannot classify an application connector as asset or an asset smart group hence I am not able to generate this report. I am looking for any guidance on how to generate application connector’s session approval request or alternatively how I can classify application connector as an asset smart group for report generation Thanks in advance for any support.

Hi Everyone,Has anyone tried or using MS SQL Server on Linux for Password Safe Active-Active deployment or as a external SQL database.From BeyondTrust support perspective, Is there any limitation on using MS SQL Server 2022 as a external database which is deployed on Linux system. I know Amazon RDS for SQL Server which is a MS SQL deployed on Amazon Linux and is officially supported by BT. I would like to know if there are any support concerns on using MS SQL on self-hosted Linux. 

Hi teamI have a few questions about when a session is delivered in Password Safe.1- A user's connection request remains open for the duration of their approved session, right? Once connected, when the session is about to expire, is there any warning before the session closes, or does the user remain connected? (Is this configurable?)2- Does the approver's request remain open for the same duration until they approve or deny it? Or does it expire before then?3- If I requested 2 hours of connection, can I connect as many times as I need during those 2 hours? If so, can I restrict this on certain servers so that if a user disconnects, they have to request a new connection?I look forward to your comments.

I have active passive cluster , the mirror state frequently changes to suspended then back to synchronizedRAM Usage is over 80% without any causewhen I review logs from primary node I found contradiction where in HAService log file the isPrimary tag is false while in HAMonitoringService the Are Primary is false but sometimes change to true then after this change the state is suspended  

Hello everyone,After reinstalling the resource brokers in our environment, I began noticing intermittent failures during automatic password rotations on managed Linux and AIX systems.Error recorded in the resource broker logs and console:"The connection was closed by the server. Make sure you are connecting to an SSH or SFTP server."Error recorded in the managed systems' sshd logs:"Jul 28 04:30:43 Server01 sshderror: kex_exchange_identification: Connection closed by remote host"Both errors occurred at the same date and time.Has anyone else encountered this behavior?Could this be resolved using the "Enable legacy algorithms for SSH account management tasks" option found under Configuration > Privileged Access Management > Miscellaneous?According to KB0017016, "The option Enable legacy algorithms for SSH account management tasks enables legacy encryption, MAC, and key exchange (Kex) algorithms that were previously enabled in Password Safe".If anyone has experienced this, I would gr

Hello,We have the following use case related to email notification - Notify certain email IDs with message about password is rotated in password safe. Notify certain email IDs about next password change date.I have seen below KBA article for email notification- BeyondInsight / Password Safe - How to add, change or remove email notificationsDoes ‘release notifications for Managed Accounts’ help with above requirements.I would like to understand the feasibility on these email notifications. Thanks,Prasad

Hello, An issue we are having in our PRA instance is that when we try to do a large file transfer such as an .iso file from our local machine to a remote asset via Beyond trust PRA RDP connection it seems like the transfer will time out\fail before all of the data has been transferred. In general file transfer works fine for smaller files back and forth but we have trouble with large ones. Wondering if anyone has any tips/tricks for copying large files through PRA? 

When running the Secrets Safe Entitlement report, it is not reporting on any secrets that are stored in any of the folders within the Safe.  Is this expected?

Hello there, Anybody who has a solution to this: Ability to prompt users for a ‘reason’ when using ssh direct connect in password safe? Can it be scripted somehow? Maybe sent with the direct connect string… Today I only get this when logging in: Keyboard-interactive authentication prompts from server:| Password Safe SSH Direct Connect| Password:| Your session is loading. Please wait...   RegardsMichael

Hi, currently I have trouble to onboard Microsoft SQL Management Studio 2022 application into ps_automate. I read almost all documentations and articles regarding to this issue but they had been created for Microsoft SQL Management Studio 2019. I have trouble to configure ini file,  because of AppWindowControlID field value is missing in AutoIt > Summary >  Advanced (Class).  

I want to export managed server list report and help to add two more column, the FA account , and FA account status (managed or not managed).I am working on password failure checking task, and there is one type of error is FA account password incorrect, so I'd like to know the server and FA mapping, and if the FA is managed or not.Need a single report in which managed system>managed system’s functional account > FA status (managed/not managed) status should be there.

Hello Everyone, We are currently implementing Beyond Trust–SailPoint IdentityIQ credential cycling. As part of this implementation, we anticipate a high volume of Password Safe requests, potentially exceeding 1,000 requests per day.We would like to understand: Is there a threshold limit for Password Safe requests (for example, per account, per user, or on a daily basis)? What impact, if any, could such a high volume of requests have on the Beyond Trust server? Are there any options to limit, purge, or archive these requests after a certain period? Thanks,Prasad

Hi,I have a lot of customer who needs Secret Safe + Workforce Password features for all their users to be able to provide a central password storage system. However the licensing model around Secret Safe is crazy because they have to buy a full Password Safe license, just to be able to use Secret Safe module…. and moreover they have to buy a new license just for WFP ! I would like to understand why Secret Safe is not bind as WPF on end user licensing ??? Please provide us more flexibility on this because we are loosing projects :-/

 We are experiencing an issue where the Support Desk (Challenge/Response) prompt disappears within 1–3 seconds, preventing users from entering a response code and elevating applications.EnvironmentEPM-M Version: 26.1.0.120 OS: macOS Tahoe 26.4 Users sometimes receive a "Deadline Reached" notificationWe reviewed KB0020349, but the issue is documented as fixed in 23.7.1+, and our clients are already on 26.1.0.120.A comparison between working and affected devices showed no significant differences other than hardware (M2 vs M3 Pro and different Mac models).BeyondTrust advised that newer macOS versions may limit the prompt display time to approximately 10–14 seconds and suggested Challenge/Response or JIT Application Requests as workarounds. However, in our case, the prompt disappears in only 1–3 seconds, which seems abnormal.  As soon as message gets disappeared, users get attached message :- BeeKeepers, please let me know :- Has anyone seen this behavior on EPM-M 26.1 ? Are there any know

Password Safe On-Prem (Active/Passive)Some users are based on a remote location with limited bandwidth. Due to this, their sessions keep disconnecting after 2-3 mins. The packet trace also confirms this.Is there any wayout for such users so their sessions don’t terminate in the case of packet loss?

We are using BeyondTrust Password Safe, and we would like to understand the clipboard permission behavior during Password Safe sessions.Currently, users are prompted to allow clipboard access every time they start a session. We would like to know:Is it possible to enable clipboard access by default for all Password Safe sessions? Can this setting be configured globally or through a policy/Jump Policy? Are there any security considerations or best practices for enabling clipboard access by default?

as it never shows approvers/auditors  how come such a bad report that is totally unusable at all Already shared to BeyondTrust who is too slow to take in as bad things Another point to let us plan to KO this product again.

BeyondTrust is always doing something out of ordinary esp. introducing misleading button “Check-in” request, many people in our shop don’t know the implication behind “Check-in” which is equivalent to almost cancel a request. About to start work with some cases in our shop that needs at least 2 senior managers to approve but when everything is approved, the checkin button is easily making confusion to general users as the button so close to bring up session. I have reflected many times to BeyondTrust who is slow in response at all or never take inn customer feedback seriously. With other issues, we are planning to KO this product soon and may use other alternatives. Really don’t use BeyondTrust in the long run, rather to select others like Cyberark rather.

I need to execute MSEDGE in kioskmode but the INI configuration only works when I test in the Remote Server, when I try to open the published application the browner opens in regular mode.I'm testing using the same command lines configured in the application.What am I doing wrong?

Hello!We are using PRA - jump client based connections as well as BYOT RDP (more hops). We have frequently noticed drastic lag /slowness when remote sessions are used for HD/4K video manipulation, 3D modelling other GPU-accelerated use cases. In certain cases Solidworks models don’t even show up in PRA. Bandwidth and remote computer resources are not a concern  as these are purpose built workstations. Anyone else has faced similar issues ? any suggestions to improve performance 

Hi Everyone. A client is asking details around capacity planning for session recordings in PRA. I tried to dig out BT documents around this but couldn’t find any appropriate information. If anyone could help me out with this info, that would be great. Thanks!Average/Peak recording bitrate per session Average and peak data generated by each recorded session (Mbps or MB/min). Daily storage growth Daily storage consumption for session recordings. Please provide the calculation (Average recording size × Number of recorded sessions per day) or historical storage usage data over several days Capacity margin (preferably N-1)Please demonstrate that sufficient storage capacity is available even if one storage component fails (N-1 capacity).Confirmation that the 1 Gbps NIC is sufficientPlease confirm that the 1 Gbps network interface is adequate and will not become saturated under peak screen-sharing and session-recording workloads.  

Our current On prem environment has many API use cases, where we use APIs to add assets, managed systems, onboard AD groups e.t.c. using python script from AWS Lambda. And we also have many application teams retrieving managed account passwords, secret safes using APIs from a dedicated server or applications. Now the issue is, in on prem environment, we usually whitelist private IPs, like IP if the servers or IP range that AWS account uses. However, in SaaS environment private IP is not working, as it is only taking public IP [Understandably expected behaviour from SaaS]. Is there any solution for this ? because public IPs is not static and we cannot keep on modifying the rules for 100s of API registrations. How are other BT customers dealing with this ?