Unanswered questions

Hello All, I was referring this KBA article -Knowledge Article - Customer Support (KB0016945)In this its explained about the column ‘Mapped to User’. Do we know how this mapping is established. Is it something in Smart rule which helps in setting this mapping. Thanks,Prasad  

Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?

The release notes for 26.3 mention that JIT Admin notifications have been added so users know right away that they have been approved/denied without needing to constantly check the endpoint utility app. It explicitly says JIT Admin. Does anyone know offhand if those notifications have been added for JIT Application approvals? 

Hi there, currently i got some case request for one of my customers, their using 3 UVM 2016 in A/A deployment with BI version 25.1. they want to upgrade UVM 2016 to UVM 2022. is there any one that experiencing this upgrade scenario before ? because , i just planning  to add on new UVM 2022 as worker node first before enable the new UVM 2022 as an admin console before all UVM 2016 will be take down and dismantled. Thanks, and hope you are all have a great day a head.

Hi. We have a default Group Policy for all support teams that gives access to all jump clients. The policy applies to all members of our tenant, using the tenant ID. Is there a way to exclude specific agents so that the policy does not apply to them? I want to set up a separate Group Policy only for one agent to have access to only a very limited number of jump clients, but I can’t if they are already a member of the default group because they are a tenant member.

Has anybody here ever implemented Qualys scanning against their PS on-premises appliances? Is it possible to create a local account for Qualys on our on-prem appliances for Qualys scanning or is this not allowed?

Hello,I have a CloudShare Based Windows Server 2022 VM with EPM Client, Adapter and Package Manager installed. It is visible in Pathfinder as connected, up to date, with the right policy assigned. When I update policy at the endpoint it says the latest available version is present. I am using default Workstyles (High, Medium and Low Flexibility) and created one user (at the endpoint) for each Workstyle. I defined filters with the specific user names and SID’s in each workstyle. However, the policy seems to have no effect.I compared behaviour of High and Low Flexibility account. I tried installing basic software (e.g. 7-zip) - both are getting error: Access is denied. I tried running regedit - both run it, but have access denied to the same entries. I tried creating a new folder in Program Files, and got Access Denied. The Analytics tab in Pathfinder shows no activity at all. In short - everything acts if EPM was not there at all, although all connectivity seems to be fine.I suspect I m

Hello Beekeepers community!!!We currently add Active Directory (AD) users to local BT Group security groups for access management. However, we have identified a concern regarding user lifecycle management and audit compliance.At present, when a user account is disabled or becomes inactive in Active Directory, the user is not automatically removed from the local group(s) to which access was previously granted. As a result, the group membership does not accurately reflect the list of active users.For example:Local group: BT-PAM-ACCESS Total members displayed: 10 users Actual active users: 8 users Disabled users in AD: 2 usersEven though the 2 users are disabled in Active Directory, they continue to appear as members of the local group. During audits, we provide screenshots of the local group membership as evidence of access reviews. This results in audit evidence showing all 10 users, which can be misleading because it includes accounts that are no longer active.Concern: The current proc

Is there any way to change IP address of already onboarded assets to Beyondtrust password safe? everytime we have to delete the older asset and then re-onboard the asset.

In BeyondTrust Password Safe, Cloud  why are some manually added assets unable to change the assigned workgroup? The option appears unavailable & disabled.  

Hi all,Just want to check, does anyone have the official slide deck for the BeyondTrust Password Safe solution from BeyondTrust?Thanks.

I have created a daily backup for my PS using Windows File shares and was pointed to one of my Windows File Share using a domain service account. This one works fine. My only concern is that we keep receiving alerts about NTLM login failure/SMB session failure for the service account since it was running from the U-series appliance (non-domain joined) and connecting to the windows file share in the domain using the domain service account. Even though the daily alerts keep popping up with those failures, we still have the completed backups. I was wondering if you guys have any better option with this backup and minimize these kinds of alerts?

Hi Team,We are planning to implement a BeyondTrust Password Safe Cold Spare DR appliance in AWS West while our production environment is running in AWS East.Could anyone share the implementation steps, prerequisites, and best practices for setting up a Cold Spare appliance?Specifically looking for guidance on:Prerequisites before enabling Cold Spare Hostname/DNS requirements SSL certificate requirements Backup and restore process Validation/testing after setup DR activation procedure during a regional outage Failback process once the production region is restored Any lessons learned or common issues to avoidAny documentation, implementation guides, or real-world experiences would be greatly appreciated.Our production environment consists of an HA pair in AWS US East (10.209.66.xxx/ 10.209.66.xxx) and a Cold Spare appliance in AWS US West (10.207.12.xxx). The Cold Spare KB states that a Temporary Appliance Name must differ from the primary hostname, while the U-Series Business Continuit

How to export Secret Safe from 24.X On prem to 26.1 Cloud?I m able to export the folder names, secret names but not keys, credentials and files. how can we do this in bulk.

Dear Team, Could you please advise on the best approach to onboard accounts that are managed in an IBM LDAP Directory Server and used on standalone AIX systems

We need to evaluate Mikron remote access solution at Molex:Key areas to cover:Identify PRA use cases that might applyUnderstand architecture and discovery potencial solution with BTDocument current Mikron use cases and architecture.Validate PLC/OT device connectivity and vendor remote-access requirements.

We need to onboard Linux systems that use a graphical interface, such as GNOME. What options do I have to do this so that I can also record sessions, just like with RDP? It must also be supported by BT.Regards Arno 

Hello All!We recently upgraded PRA from 24.3.4 → 25.2.2 → 25.3.5 . After the upgrade 100+ Ubuntu 24.04 headless devices are no longer accessible. We have used the standard linux installer in these machines and were able to do screen share using PRA over the years. Remote users need to be able to see the login screen as there are different user profiles (IT, engineer etc)Has anyone seen similar issues after upgrades? Support team is basically asking us to use headless installer  which is of not any help. When we use headless installer it doesn’t even show Screen Share tab in PRA console.For our existing standard client which is now broken, in the logs I see PRA creating a new virtual display and is switching between the GDM x0 and PRA-created virtual display. Any suggestions ? 

I really bought into “If you can do it in powershell, you can run it in a powerrule” but I’m learning it’s really not that easy. What I want to do: If someone runs the “Hyper-V Manager” console, it automatically will add that user to the hyper-v administrators local group in Windows.I have a script that adds the user to the group, uploaded it, and targeted it with an app group to run, but it doesn’t do anything. I started looking into power rules more (EPM for Windows core scripting | EPM-WM) but quickly realized, it seems like there are special cmdlets you have to use? It’s very confusing.If anyone can point me in the right direction, I’d really appreaciate it.

We have multiple Password Safe appliances behind load balancer. Appliances are not directly accessible, users must use load balancer.When user receives a forgot password email, it contains a password reset link with appliance hostname instead of load balancer address. Please advise what configuration change is needed, for password reset email to have an URL with load balancer address instead of appliance local hostname.

Anyway of being able to mass delete users in PRA? E.g. if not authenticated in X amount of days?GUI doesn’t have check boxes to select multiple users to perform bulk tasks. There’s a 5+ sec gap when deleting individual users one buy one and whilst waiting for the user table to refresh, quite tedious!  No automated settings I’m aware of for internal users, whereas vendor users have this option -Will implementing SCIM (SAML only currently) address this or will it only disable users rather than delete?​​​​​​​