Unanswered questions

Currently testing the new feature for targeting workstyles at Entra ID device groups (26.3.1).Entra ID is integrated and granted permissions per documentation. Groups were synced. Device group was searched and added to the computer filter of a Workstyle in the policy. Test client device was rebooted and synced using the Endpoint Utility.Seems that the targeting isn’t working thus far for me. When syncing with /aad or /identity /refresh, an error states that user is not supported or no filter in place:c:\Program Files\Avecto\Privilege Guard Client>EndpointUtility.exe /aadBeyondTrust Utility ToolCopyright (C) 2026 BeyondTrust Corp.Requesting that BeyondTrust Privilege Management refresh its groups…Error: This user is not supported or there is no filter in place.Targeting works if the computer hostname is added to the computer filter. Any ideas?

Hi,Can someone share the steps for installing a jump client(PRA) on Ubuntu 24.04. P.s I don’t know much about linux. Any help would be greatly appreciated. Thanks

we have this log Stature to SIEM. we are unbale to understand what these properties mean. Any guide to understand this LEEF:1.0|BeyondTrust|BeyondInsight|24.2.0.1443|PBPS|cat=Change devTime=Oct 28 2025 06:08:06 devTimeFormat=MMM dd yyyy HH:mm:ss sev=1 src= resource=PAMBT-PR dst= usrName=Omniworker groupID=2 AgentID=PBPS AgentVer=26.2.0.1443 EventDesc=Cancelled EventName=Managed EventType=0 WorkgroupDesc=BeyondTrust Workgroup btCategory=Change LogID=104999 LogTime=UserName=Omniworker UserID=ManagedAccountID= ManagedSystemID= ChangeDt= ChangeReasonCd=O Result=AccountName=NextChangeDate= EventID=evtUID=

Hi Community,We are experiencing slow authentication responses when users authenticate against Active Directory (AD) in our on-premises BeyondTrust Password Safe,Basic connectivity between Password Safe and the AD domain controllers has been verified, and the required connections are successful. However, authentication is still taking longer than expected.Could anyone share the recommended troubleshooting steps to identify the root cause of this delay?Specifically, I would appreciate guidance on: Which Password Safe logs should be reviewed to investigate slow AD authentication? How can we measure LDAP/LDAPS response times and identify delays during authentication? Are there specific appliance diagnostics or performance checks recommended for this issue? How can we distinguish network latency from slow AD domain controller responses or Password Safe processing delays? Are there any known configuration issues or settings that can contribute to slow AD authentication? .Thank you f

I would like to know when it will be available to PS Cloud customers.The update release notes show some updates for problems i am encountering. Thanks everyone

Hi there, currently i got some case request for one of my customers, their using 3 UVM 2016 in A/A deployment with BI version 25.1. they want to upgrade UVM 2016 to UVM 2022. is there any one that experiencing this upgrade scenario before ? because , i just planning  to add on new UVM 2022 as worker node first before enable the new UVM 2022 as an admin console before all UVM 2016 will be take down and dismantled. Thanks, and hope you are all have a great day a head.

Hi All,I need to test the functional account test on multiple system. Systems are more than 500 and all systems are non domain joined. I need to test password and create the report. Post that I will work with respective team to get it sorted. However currently testing one one system it is very difficult.I want to understand how can I do testing of functional account in bulk Is there any API available to do functional testing in bulk.I need help here please to understand how can I resolve this issue ?Regards,Immi

When we update RemoteSupport, we always have to update the consoles too. What happens if updates are installed automatically? Will the consoles still work then? That always has to happen promptly or at the same time. GOli

Password Safe on-prem: if an Access Policy has Approvers = 3, must all 3 approvers approve before access is granted? Is sequential (multi-level) approval supported?

When we export the list of users from password safe user management, there is a columns with the name “statusflag” which have different decimal values like 2, 4, 32, 64, etc.  What does this numbers refers to? I didn’t find any KB article describing these numbers or status of users against these values. 

We implemented Password Safe for our dedicated domain admin accounts in May/2024. At the time, we experienced some frequent lockout issues with these accounts, but nothing that couldn’t be explained or resolved by simple process changes for users (i.e. forgetting to sign out of systems before the password release expires). In Sept/2024, we saw an uptick in lockout frequency with these accounts that couldn’t be explained. Most of the lockout events occurred on the Windows machines users were in possession of rather than from accessing a remote VM like we saw in the past, (aside from some of our support staff who encountered lockouts from end user machines they had previously worked with and used their credentials to establish a remote support session via Teamviewer). Lockouts occur multiple times a day regardless of a reboot on the problem device. No processes are found running with dedicated admin account on the machine, yet ongoing lockout events on the account continue to register fr

We have the following BeyondTrust environment:Password Safe Production AppliancePassword Safe DR Appliance: EPM Linux Policy ServerAD Bridge Enterprise ConsoleDue to network management requirements, we are planning to change the IP addresses of the above BeyondTrust infrastructure, including Password Safe, EPM Linux, EPM Windows, and AD Bridge.What configuration changes, dependencies, or potential challenges we should expect after changing the IP addresses?If any changes are required for HA/DR, EPM agents, AD Bridge, DNS, certificates, firewall ports, licensing, or other BeyondTrust services.Is there any recommended procedure sequence for safely performing these IP changes.

Has anyone else encountered issues with the Rep Console app after updating to iOS and iPadOS 27? After updating, when trying to login via SAML, the Login button doesn’t do anything. We have the app setting to open external browser for passkey support and in iOS 26, it successfully would open Safari for the authentication. Now, the button just appears to be a dead button.

Hello, We are looking for a way to block nested RDP sessions inside a remote RDP jump. We tried adding mstsc.exe under Application Sharing Restrictions on the relevant Session Policy, but does not seem to work. For reference, in a similar solution by Fortinet (FortiPAM), there is the option of applying a Windows App Profile where you can block specific executables (see below).  Do you know if this is supported in general or I’ve missed something in our configuration? Thanks in advance.

Hi all,Environment:BeyondInsight / Password Safe on-premises, U-Series Appliance, version[26.3.x – confirm build] Deployment:[ Active-Passive HA ] Managed servers: Windows and Linux, spread across multiple VLANs RDP/SSH sessions go through the Password Safe session proxy, with recording and Change Password After Release enabledOur challenge: Admins can still bypass Password Safe and connect to servers directly with mstsc.exe or PuTTY. Those sessions aren't requested, approved or recorded. Our current setup:GPO adds regular accounts to local Administrators. Restricted Groups / GPP add domain groups containing admins' regular (non-privileged) accounts to the local Administrators group on servers. Servers are spread across multiple VLANs. Admin workstation VLANs can route to server VLANs, and inter-VLAN rules allow TCP 3389/22. Default RDP logon rights. Any member of local Administrators can log on through Remote Desktop.Questions:Does BeyondTrust have an official recommendation or harden

 Hi AllI have one requirement to change password of managed account on HPE Storceonce device. This devices supports password change only using Rest APIs. I know we can create custom plugin and from there we call APIs for password rotation. I wanted to understand if there is any other way , where in we can call Powershell script. This script I can write that can hit API and rotate password. Please let me if know if any solution is present.Regards,Imran Aliyani  

Hi all,We have deployed a BeyondTrust PRA Cloud instance through Pathfinder in one of our customers.Due to several users with personal accounts (e.g. Gmail), we are restricted in sharing with them the Microsoft My Apps link (with the Tenant ID) in order for them to click the BeyondTrust application.That’s ok; however, we observe that there is a minimum of three clicks for a user to reach the /console page (one on the Enterprise Application, one on the PRA application on Pathfinder, and then the Launch Privileged Web Access Console).I have selected the option to Redirect to the Privileged Web Access Console under Management > Site Configuration > HTTP, but I think this is for direct connections to the instance.No big deal, but just trying to figure out if there is a way to minimize the number of clicks for such a use case.Thanks all.

Is anyone aware if the API can be used to approve or deny JIT Application requests. It looks like the API is able to handle this for JIT Admin. If no, has there been any word on when this could be coming. I’m in the process of building a mobile app for the JIT App approvals and the front end is done, but the pesky API backend is not cooperating.

I am facing an issue while launching PS_Automate through CMD.Initially, there was no issue when I tested it with the default BIWebApp.ini file. However, after making a copy of the same file and renaming it to WAF.ini, I started receiving the following error when trying to launch PS_Automate:Error: Subscript used on non-accessible variable.My BeyondInsight/Password Safe version is 26.2.Could anyone please guide me on what might be causing this issue and how I can troubleshoot or resolve it? 

Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?

The release notes for 26.3 mention that JIT Admin notifications have been added so users know right away that they have been approved/denied without needing to constantly check the endpoint utility app. It explicitly says JIT Admin. Does anyone know offhand if those notifications have been added for JIT Application approvals? 

Hi. We have a default Group Policy for all support teams that gives access to all jump clients. The policy applies to all members of our tenant, using the tenant ID. Is there a way to exclude specific agents so that the policy does not apply to them? I want to set up a separate Group Policy only for one agent to have access to only a very limited number of jump clients, but I can’t if they are already a member of the default group because they are a tenant member.

Hello,I have a CloudShare Based Windows Server 2022 VM with EPM Client, Adapter and Package Manager installed. It is visible in Pathfinder as connected, up to date, with the right policy assigned. When I update policy at the endpoint it says the latest available version is present. I am using default Workstyles (High, Medium and Low Flexibility) and created one user (at the endpoint) for each Workstyle. I defined filters with the specific user names and SID’s in each workstyle. However, the policy seems to have no effect.I compared behaviour of High and Low Flexibility account. I tried installing basic software (e.g. 7-zip) - both are getting error: Access is denied. I tried running regedit - both run it, but have access denied to the same entries. I tried creating a new folder in Program Files, and got Access Denied. The Analytics tab in Pathfinder shows no activity at all. In short - everything acts if EPM was not there at all, although all connectivity seems to be fine.I suspect I m