Unanswered questions

Hello Everyone,We are trying to implement Propagation action for one of the managed accounts. The requirement here is that - “Whenever password for this account changes, it shall run a powershell script on corresponding managed system and update the password”.Since we are new to use of ‘propagation action’ functionality any document which can help to understand the usage will be useful.  Thanks,Prasad 

I have both my app registration (Microsoft EntraID) and IdP settings setup according to KB0019022; however, on the mac, whenever I try to authenticate via MFA from a message, I receive the error “The identity provider is unavailable” and it fails. The same app registration works fine for Windows. I have the Mac re-direct and verified the OIDC url is reachable. Anyone else run across this? 

Hello For PRA SaaS , we would need to allow from internal jumpoints to PRA SaaS on port 443 mainly right? and from PRA to AD on 636 ? For protocol tunnel, how is the network communication?  From enduser IP to PRA on port 443, communication will be established? and from there jumpoint will try to establish session on the protocol tunnel port mentioned to the services?

I have two assets hosting a database cluster:Server 1 hosts DB01 which load balances to 4 database servers Server 2 hosts DB02 which load balance to 4 database serversI ran a scan on both servers. The results showed that Server 1 discovered 0 databases, while Server 2 discovered DB02.How can I confirm whether this behavior is expected?Additionally, I have a few questions:How can I verify that there is already a link/relationship between the two cluster nodes without performing a failover test? From the database side, there is supposed to be a floating hostname that redirects connections to the active node. However, during discovery, we only detected the hostname of one of the databases instead of the floating hostname. Is this the expected behavior? How will password rotation be handled in this clustered setup? 

Hello,I’ve got a couple of questions from our customer that I couldn’t find answers in the documentation and I hope one of you could know the answers.They want to buy EPM-L with Pathfinder and asked how long BT keeps logs and how much can be stored in the BT cloud. They also wanted to know when/if EPM will be hosted in Europe rather than US. Finally there is an issue of automation of endpoint installation. Is there a ready-to-use method of adding multiple endpoints to EPM?I’ll be grateful if you could help me clarify this issues.

 We are experiencing an issue where the Support Desk (Challenge/Response) prompt disappears within 1–3 seconds, preventing users from entering a response code and elevating applications.EnvironmentEPM-M Version: 26.1.0.120 OS: macOS Tahoe 26.4 Users sometimes receive a "Deadline Reached" notificationWe reviewed KB0020349, but the issue is documented as fixed in 23.7.1+, and our clients are already on 26.1.0.120.A comparison between working and affected devices showed no significant differences other than hardware (M2 vs M3 Pro and different Mac models).BeyondTrust advised that newer macOS versions may limit the prompt display time to approximately 10–14 seconds and suggested Challenge/Response or JIT Application Requests as workarounds. However, in our case, the prompt disappears in only 1–3 seconds, which seems abnormal.  As soon as message gets disappeared, users get attached message :- BeeKeepers, please let me know :- Has anyone seen this behavior on EPM-M 26.1 ? Are there any know

Hi Everyone!Is it possible to create a Jump Item in Privileged Remote Access (PRA) to access an IBM i (AS/400) system?The environment uses TN5250 over TLS (port 992), and I would like to know if PRA supports this type of connection natively or if an external TN5250 client needs to be integrated with PRA.If anyone has implemented this scenario or knows the limitations and best practices, I would appreciate any guidance. Thanks in advance

Dear Team,We need to retrieve the scanned user account details for servers, either through the BeyondTrust Password Safe REST API or from the Analytics & Reports section in the Password Safe portal.Could anyone please provide guidance on the appropriate API endpoint or the relevant report that can be used to extract this information? If there is any documentation or recommended approach available, kindly share it for reference.Your support on this would be greatly appreciated.

After installing the BeyondTrust EPM agent in Windows, on a few support user’s machine, the service desk team is unable to copy and paste any text from their machine to a remote session machine. They are using Team viewer for the remote session.We have already  followed this KB article  and create customer token and separate rule for team viewer:-  https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0021340&source=community  This issue occurs across applications such as Word, Notepad, and other tools. The issue is completely blocking the support user’s ability to perform work in remote sessions. List of apps/functions tried : Windows UAC, Word, Notepad, Browser. After uninstalling EPM agents, the issue was resolved. Client version :-  26.1.59.0Adaptor version :- 26.1.1495.0OS :- Microsoft Windows 11 Enterprise Please share your experience on this. If you have any solution please let us know.

We are installing a new PRA , onpremise installation and on Asser Management menu , we are missing gateway tab.

We are currently working on creating a Power BI (PBI) report to capture the details of On-demand feature usage. Everything has been configured and is functioning as expected. In the existing PBI report, we would like to include the "User Reason" field. However, we are unable to identify the exact API that provides the "User Reason" field data. Could you please guide us on how to retrieve this information via API?

Currently i have created a local account on all of our DMZ servers and they are administrators. This works So So is there a more streamlined way to accomplish this task.I want to manage the administrator as well as all local accounts in the Administrator Group.

We are using BeyondTrust Password Safe, and we would like to understand the clipboard permission behavior during Password Safe sessions.Currently, users are prompted to allow clipboard access every time they start a session. We would like to know:Is it possible to enable clipboard access by default for all Password Safe sessions? Can this setting be configured globally or through a policy/Jump Policy? Are there any security considerations or best practices for enabling clipboard access by default?

Hello! Does the EPM W Package Manager automatically update itself or we can control it . I see we can control the adapter and client version while using the Package Manager but don’t see a setting to control the version of PM .

Hi,Is there a way to send a notification to all users currently logged into Password Safe Cloud to inform them of an upcoming brief outage?I'm not referring to the Logon Banner, which is displayed prior to authentication. Instead, I'm looking for a way to notify users who are already logged in and actively using the platform.Any suggestions would be appreciated.

Hi community,I'm deploying AD Bridge in a production environment, and the client has a high-availability infrastructure where server restarts are not permitted.Is it possible to install the AD Bridge agent without requiring a server reboot after the installation?I look forward to your response.Thank you.

We are looking to build an automated BeyondTrust Password Safe onboarding process via API, driven by user provided details in a ServiceNow form and lookups against our CMDB.To facilitate this, I’m looking for a way to bulk export the available (and mandatory) fields for the below for every Platform:Creation of an Asset Creation of a Managed System Creation of a Managed Account Population of the ‘Manage Assets Using Password Safe’ Smart Rule Action Population of the ‘Managed Account Setting’ Smart Rule ActionWe need the details for each platform so that we can create branching to provide the right details in the relevant API calls for each platform.The intention is then to map each of the available fields in BeyondTrust to a field in another data source (in the ServiceNow form or CMDB) so that we can populate the API calls for onboarding.I understand Smart Rules can’t be created via API, so we’d instead be looking to pre-create the required ‘Manage Assets Using Password Safe’ and ‘Manag

 Hello,I am connecting to a target system through an RDP session launched from BeyondTrust PRA.I can upload files to the remote system, but I cannot download files from the remote system to my local machine.Is this expected behavior?

Hi all,I’m interested in hearing from anyone who has successfully implemented Azure Application Proxy as a front door to a BeyondTrust PRA appliance, specifically to reduce direct exposure to the internet. Current EnvironmentBeyondTrust PRA appliances hosted on-premises Appliances are internal-only (no direct internet exposure) Internal user authentication handled via SAML with Microsoft Entra ID RequirementWe are looking to enable access for external 3rd-party (guest) users while maintaining a zero/low direct exposure footprint.Key goals:Avoid publishing the PRA appliance directly to the internet Leverage Azure App Proxy as the external entry point Use Entra ID authentication (including B2B guest users) for access control Maintain alignment with our existing guest onboarding and governance model (via Entra B2B) Avoid using the BeyondTrust vendor portal where possible Proposed ApproachExpose a dedicated external URL via Azure App Proxy Require pre-authentication with Entra ID (includin

Hello Team, We are trying to configure AWS Scan Target Collector as connector in Beyond Trust Password Safe (On Premise version 25.1).The required fields for this configuration need Access Key ID and Access Secret.We have a Organization security policy on AWS to rotate these access key ID’s and Secrets every 12 hour for any role. Is there any by which we can get those updated access key and use them for configuration or any alternative way to set up stable connector configuration. Thanks,Prasad

Hi everyone,I have a question regarding PASM. I have users and devices managed through Password Safe, and session delivery is handled by PRA. If I want a user connecting from PRA with credentials injected from Password Safe to provide a reason for connecting, where do I configure this in PS or PRA? Also, if they need an approval workflow, where do I configure that in PS or PRA?

Hi All, Ever since we started using Remote Support for our customers we have been receiving complaints of devices that are regularly connected to the network and are actively being used go into Active/Lost status and will never show back online in the Console. All fingers are pointed towards us and Remote Support being faulty. Does anyone have any idea what causes this to happen to endpoints? (so far what we have advised Service Desk to do start a Session Key session which does bring the endpoints back to Online in the console)

Hi,We are experiencing an issue with the session termination behavior in PRA.We have configured the system so that when a session ends, the user's session on the target server should be logged off automatically. However, after ending a session and reconnecting, everything remains exactly as it was left previously, which indicates that the user session is not actually being logged off.Both the web console and the desktop console are running version 25.3.2.We found a KB article that appears to describe a similar issue, but it does not seem to apply to the version we are currently running.Additionally, we are currently applying the Session Policy through Group Policies. To rule out a policy inheritance issue, we also assigned the same Session Policy directly to the Jump Item, but the behavior remained exactly the same.If anyone has experienced a similar issue or knows why this might be happening, we would really appreciate any guidance or suggestions on what else we should verify.Thank yo

Is there a way to disable this action/button?When a rep removes a customer using this button, the system message in the chat transcript logs it as “Event Type: Conference Member Departed” and “Performed by: [customer name]” which gives the appearance that it was customer initiated. In the chat pane, it displays “(timestamp) [customer name] has left the conversation.”The only mention of “Remove Participant” in the documentation is in the rep doc and appears in the Session Tools section on a list of actions with dedicated icons.As to why disable the button, it is a potential work avoidance issue and the current level of logging makes it difficult to track.

Hello,I am new to EPM - I have just watched the Administrator BTU videos. I am deploying demo environment: 3 ubuntu VMs in cloudshare that I need to manage from Pathfinder. The Pathfinder interface looks way different to the one shown in the BTU materials.Since now, I installed&activated epml client packages at the cloudshare VMs (which is nicely covered in the documentation). I do not know yet how to scan for them from the Pathfinder interface.Could you point me to the proper source explaining how to proceed? Is there any guide available for Pathfinder?Thanks!Tomasz