Unanswered questions

Hello Community,I have been asked to provide some clarification regarding the security controls available in BeyondTrust PRA for file transfers from unmanaged or personal endpoints to customer-managed systems.From a security perspective, the concern seems valid. Since PRA enables privileged remote access from virtually any internet-connected device, allowing unrestricted file transfers or simple copy/paste operations from personal computers to managed assets could introduce risks such as malware propagation, unauthorized data transfer, or policy violations.I am interested in understanding what security mechanisms PRA provides to mitigate these risks. For example:Are file transfer and clipboard redirection subject to granular policy controls? Can transfers be restricted, approved, or audited? Are files inspected, logged, or scanned before reaching the target system? Is there any integration with endpoint security or DLP solutions? What best practices are typically recommended to prevent

BeyondTrust is always doing something out of ordinary esp. introducing misleading button “Check-in” request, many people in our shop don’t know the implication behind “Check-in” which is equivalent to almost cancel a request. About to start work with some cases in our shop that needs at least 2 senior managers to approve but when everything is approved, the checkin button is easily making confusion to general users as the button so close to bring up session. I have reflected many times to BeyondTrust who is slow in response at all or never take inn customer feedback seriously. With other issues, we are planning to KO this product soon and may use other alternatives. Really don’t use BeyondTrust in the long run, rather to select others like Cyberark rather.

as it never shows approvers/auditors  how come such a bad report that is totally unusable at all Already shared to BeyondTrust who is too slow to take in as bad things Another point to let us plan to KO this product again.

Password Safe On-Prem (Active/Passive)Some users are based on a remote location with limited bandwidth. Due to this, their sessions keep disconnecting after 2-3 mins. The packet trace also confirms this.Is there any wayout for such users so their sessions don’t terminate in the case of packet loss?

I need to execute MSEDGE in kioskmode but the INI configuration only works when I test in the Remote Server, when I try to open the published application the browner opens in regular mode.I'm testing using the same command lines configured in the application.What am I doing wrong?

Hello!We are using PRA - jump client based connections as well as BYOT RDP (more hops). We have frequently noticed drastic lag /slowness when remote sessions are used for HD/4K video manipulation, 3D modelling other GPU-accelerated use cases. In certain cases Solidworks models don’t even show up in PRA. Bandwidth and remote computer resources are not a concern  as these are purpose built workstations. Anyone else has faced similar issues ? any suggestions to improve performance 

We are using BeyondTrust Password Safe, and we would like to understand the clipboard permission behavior during Password Safe sessions.Currently, users are prompted to allow clipboard access every time they start a session. We would like to know:Is it possible to enable clipboard access by default for all Password Safe sessions? Can this setting be configured globally or through a policy/Jump Policy? Are there any security considerations or best practices for enabling clipboard access by default?

Hi Everyone. A client is asking details around capacity planning for session recordings in PRA. I tried to dig out BT documents around this but couldn’t find any appropriate information. If anyone could help me out with this info, that would be great. Thanks!Average/Peak recording bitrate per session Average and peak data generated by each recorded session (Mbps or MB/min). Daily storage growth Daily storage consumption for session recordings. Please provide the calculation (Average recording size × Number of recorded sessions per day) or historical storage usage data over several days Capacity margin (preferably N-1)Please demonstrate that sufficient storage capacity is available even if one storage component fails (N-1 capacity).Confirmation that the 1 Gbps NIC is sufficientPlease confirm that the 1 Gbps network interface is adequate and will not become saturated under peak screen-sharing and session-recording workloads.  

Our current On prem environment has many API use cases, where we use APIs to add assets, managed systems, onboard AD groups e.t.c. using python script from AWS Lambda. And we also have many application teams retrieving managed account passwords, secret safes using APIs from a dedicated server or applications. Now the issue is, in on prem environment, we usually whitelist private IPs, like IP if the servers or IP range that AWS account uses. However, in SaaS environment private IP is not working, as it is only taking public IP [Understandably expected behaviour from SaaS]. Is there any solution for this ? because public IPs is not static and we cannot keep on modifying the rules for 100s of API registrations. How are other BT customers dealing with this ?

Hi, currently I have trouble to onboard Microsoft SQL Management Studio 2022 application into ps_automate. I read almost all documentations and articles regarding to this issue but they had been created for Microsoft SQL Management Studio 2019. I have trouble to configure ini file,  because of AppWindowControlID field value is missing in AutoIt > Summary >  Advanced (Class).  

I have both my app registration (Microsoft EntraID) and IdP settings setup according to KB0019022; however, on the mac, whenever I try to authenticate via MFA from a message, I receive the error “The identity provider is unavailable” and it fails. The same app registration works fine for Windows. I have the Mac re-direct and verified the OIDC url is reachable. Anyone else run across this? 

Currently i have created a local account on all of our DMZ servers and they are administrators. This works So So is there a more streamlined way to accomplish this task.I want to manage the administrator as well as all local accounts in the Administrator Group.

Hi all,we're scoping a Password Safe and Privileged Remote Access deployment for a public-sector customer whose target virtualisation platform is Proxmox VE – so plain QEMU/KVM.The portal offers appliance images for Nutanix, Hyper-V, VMware and OpenShift, but nothing for KVM / libvirt. Since Nutanix AHV and OpenShift Virtualization both run on top of KVM, my assumption is that a suitable qcow2/raw build exists somewhere – it's just not published.So:1. Is there a KVM / libvirt appliance image (qcow2 or raw) for Password Safe or PRA that I've missed?2. Has anyone actually imported the Nutanix or OpenShift build into Proxmox? Any gotchas – boot mode, virtio, networking?3. Is Proxmox / KVM considered supported, or at least tolerated, from a support perspective? That's the part that matters most here.Disk format conversion is trivial, my concern is what's baked into the appliance and whether we'd end up outside a supported configuration.Any experience appreciated – thanks!

Hello Team,We are currently working on project to discover Amazon RDS hosted databases and managed accounts from those DB’s.I found out below nice article explaining step by step process. AWS RDS Oracle Database - Password Safe Discovery for Managed Accounts | CommunityHowever, the first step suggests using Resource Zone for resource broker configuration. (Seems to be only for Password Safe cloud).We are using On-Premises Password safe (Version 25.1). So based on this in above document, we would like to know from which step we need to follow the instructions.Thanks,Prasad

Hi Everyone!Is it possible to create a Jump Item in Privileged Remote Access (PRA) to access an IBM i (AS/400) system?The environment uses TN5250 over TLS (port 992), and I would like to know if PRA supports this type of connection natively or if an external TN5250 client needs to be integrated with PRA.If anyone has implemented this scenario or knows the limitations and best practices, I would appreciate any guidance. Thanks in advance

Hello For PRA SaaS , we would need to allow from internal jumpoints to PRA SaaS on port 443 mainly right? and from PRA to AD on 636 ? For protocol tunnel, how is the network communication?  From enduser IP to PRA on port 443, communication will be established? and from there jumpoint will try to establish session on the protocol tunnel port mentioned to the services?

I have two assets hosting a database cluster:Server 1 hosts DB01 which load balances to 4 database servers Server 2 hosts DB02 which load balance to 4 database serversI ran a scan on both servers. The results showed that Server 1 discovered 0 databases, while Server 2 discovered DB02.How can I confirm whether this behavior is expected?Additionally, I have a few questions:How can I verify that there is already a link/relationship between the two cluster nodes without performing a failover test? From the database side, there is supposed to be a floating hostname that redirects connections to the active node. However, during discovery, we only detected the hostname of one of the databases instead of the floating hostname. Is this the expected behavior? How will password rotation be handled in this clustered setup? 

Hello,I’ve got a couple of questions from our customer that I couldn’t find answers in the documentation and I hope one of you could know the answers.They want to buy EPM-L with Pathfinder and asked how long BT keeps logs and how much can be stored in the BT cloud. They also wanted to know when/if EPM will be hosted in Europe rather than US. Finally there is an issue of automation of endpoint installation. Is there a ready-to-use method of adding multiple endpoints to EPM?I’ll be grateful if you could help me clarify this issues.

 We are experiencing an issue where the Support Desk (Challenge/Response) prompt disappears within 1–3 seconds, preventing users from entering a response code and elevating applications.EnvironmentEPM-M Version: 26.1.0.120 OS: macOS Tahoe 26.4 Users sometimes receive a "Deadline Reached" notificationWe reviewed KB0020349, but the issue is documented as fixed in 23.7.1+, and our clients are already on 26.1.0.120.A comparison between working and affected devices showed no significant differences other than hardware (M2 vs M3 Pro and different Mac models).BeyondTrust advised that newer macOS versions may limit the prompt display time to approximately 10–14 seconds and suggested Challenge/Response or JIT Application Requests as workarounds. However, in our case, the prompt disappears in only 1–3 seconds, which seems abnormal.  As soon as message gets disappeared, users get attached message :- BeeKeepers, please let me know :- Has anyone seen this behavior on EPM-M 26.1 ? Are there any know

Dear Team,We need to retrieve the scanned user account details for servers, either through the BeyondTrust Password Safe REST API or from the Analytics & Reports section in the Password Safe portal.Could anyone please provide guidance on the appropriate API endpoint or the relevant report that can be used to extract this information? If there is any documentation or recommended approach available, kindly share it for reference.Your support on this would be greatly appreciated.

After installing the BeyondTrust EPM agent in Windows, on a few support user’s machine, the service desk team is unable to copy and paste any text from their machine to a remote session machine. They are using Team viewer for the remote session.We have already  followed this KB article  and create customer token and separate rule for team viewer:-  https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0021340&source=community  This issue occurs across applications such as Word, Notepad, and other tools. The issue is completely blocking the support user’s ability to perform work in remote sessions. List of apps/functions tried : Windows UAC, Word, Notepad, Browser. After uninstalling EPM agents, the issue was resolved. Client version :-  26.1.59.0Adaptor version :- 26.1.1495.0OS :- Microsoft Windows 11 Enterprise Please share your experience on this. If you have any solution please let us know.

We are installing a new PRA , onpremise installation and on Asser Management menu , we are missing gateway tab.

Hi,Is there a way to send a notification to all users currently logged into Password Safe Cloud to inform them of an upcoming brief outage?I'm not referring to the Logon Banner, which is displayed prior to authentication. Instead, I'm looking for a way to notify users who are already logged in and actively using the platform.Any suggestions would be appreciated.

Hi community,I'm deploying AD Bridge in a production environment, and the client has a high-availability infrastructure where server restarts are not permitted.Is it possible to install the AD Bridge agent without requiring a server reboot after the installation?I look forward to your response.Thank you.

We are looking to build an automated BeyondTrust Password Safe onboarding process via API, driven by user provided details in a ServiceNow form and lookups against our CMDB.To facilitate this, I’m looking for a way to bulk export the available (and mandatory) fields for the below for every Platform:Creation of an Asset Creation of a Managed System Creation of a Managed Account Population of the ‘Manage Assets Using Password Safe’ Smart Rule Action Population of the ‘Managed Account Setting’ Smart Rule ActionWe need the details for each platform so that we can create branching to provide the right details in the relevant API calls for each platform.The intention is then to map each of the available fields in BeyondTrust to a field in another data source (in the ServiceNow form or CMDB) so that we can populate the API calls for onboarding.I understand Smart Rules can’t be created via API, so we’d instead be looking to pre-create the required ‘Manage Assets Using Password Safe’ and ‘Manag