Unanswered questions

Hi guys.I was looking in other topics that some people have in their PRA consoles the option to create an Web Jump connection type. But it doesn’t appear on my console as you can see in the print below.What is the requirements to enable this option?I didn’t find any documentation explaining this. 

I really bought into “If you can do it in powershell, you can run it in a powerrule” but I’m learning it’s really not that easy. What I want to do: If someone runs the “Hyper-V Manager” console, it automatically will add that user to the hyper-v administrators local group in Windows.I have a script that adds the user to the group, uploaded it, and targeted it with an app group to run, but it doesn’t do anything. I started looking into power rules more (EPM for Windows core scripting | EPM-WM) but quickly realized, it seems like there are special cmdlets you have to use? It’s very confusing.If anyone can point me in the right direction, I’d really appreaciate it.

Good day all,Forgive me if this is an obvious question, but I was not the one who set-up our PRA environment and the admin left our company leaving little documentation behind. I’m finding that when a vendor signs in, they have visibility into pretty much all of our devices with the PRA endpoint installed, even if they cannot sign into them (no credentials for the actual machine but they can get into the console) Looking at Asset Groups, I can see many users in them, but I cannot figure out where they are inheriting the permissions from to remove them. (See screenshot for a small snippet of what I am referring to) Any guidance on where to track this down to resolve it? I am now signed up for the Beyond Trust University and am learning the environment but am hoping to resolve this sooner rather than later.I wasn’t certain what information, or screenshots would be needed to understand the issue fully, so please feel free to ask any clarifying questions. Thank you all!-Michael 

I have multiple Database admins I need to give access to our database for. We have no resources for PAW or Internal Admin machines. Is it the purpose of Beyondtrust SQL server tunnels to be ran on BYOD device and have them tunnel SQL Studio traffic to my on prem SQL server? Has anyone done this? I believe I have the tunnel up. How do you use Management studio? My “Open datasource Client” is grayed out. How do the credentials work? Do the credentials I use for the tunnel work for everyone using the tunnel? Or do I need to create one tunnel per person? 

Hi Everyone!Is it possible to create a Jump Item in Privileged Remote Access (PRA) to access an IBM i (AS/400) system?The environment uses TN5250 over TLS (port 992), and I would like to know if PRA supports this type of connection natively or if an external TN5250 client needs to be integrated with PRA.If anyone has implemented this scenario or knows the limitations and best practices, I would appreciate any guidance. Thanks in advance

Hi Can we deploy jumpoints in Prod and DR site, if reachability is there? should it be in same VLAN?

Is there any way to change IP address of already onboarded assets to Beyondtrust password safe? everytime we have to delete the older asset and then re-onboard the asset.

Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?

Hello community. I have several AWS console access accounts and would like to provide access to clients in the same way shown in this video, where Password Safe injects the credential without the user knowing the password. I have already used RDS Application for delivering MSSQL and other applications, but according to this older video, it's not clear to me whether RDS Application is being used. Could you tell me which method is currently supported by Password Safe for accessing web consoles like AWS and Azure without exposing the password? I don't have PRA, where I know everything would be solved with Web Jump. I only have Password Safe without Workforce. Thank you very much."  

Hi , I have a few queries (mentioned below), I am not able to find relevant information in documentations. If someone know please let me know -1. which user has checked out account ? - I want to see who has checked out an account so that I can go ahead and ask them to check the account back in to passwordsafe.2. Email notification on usage of specific accounts. - Is there a way I can setup email notifications to be sent out to some DL on usage of some accounts(not all), like when the account is requested and password is changed.3.Who changed the last password ? - I would like to see the username of the user who changed or initiated the password change. I can see “changed by User” in password history but no detail on who the actual user was.

Hello everyone,After reinstalling the resource brokers in our environment, I began noticing intermittent failures during automatic password rotations on managed Linux and AIX systems.Error recorded in the resource broker logs and console:"The connection was closed by the server. Make sure you are connecting to an SSH or SFTP server."Error recorded in the managed systems' sshd logs:"Jul 28 04:30:43 Server01 sshderror: kex_exchange_identification: Connection closed by remote host"Both errors occurred at the same date and time.Has anyone else encountered this behavior?Could this be resolved using the "Enable legacy algorithms for SSH account management tasks" option found under Configuration > Privileged Access Management > Miscellaneous?According to KB0017016, "The option Enable legacy algorithms for SSH account management tasks enables legacy encryption, MAC, and key exchange (Kex) algorithms that were previously enabled in Password Safe".If anyone has experienced this, I would gr

Hello Beekeepers community!!!We currently add Active Directory (AD) users to local BT Group security groups for access management. However, we have identified a concern regarding user lifecycle management and audit compliance.At present, when a user account is disabled or becomes inactive in Active Directory, the user is not automatically removed from the local group(s) to which access was previously granted. As a result, the group membership does not accurately reflect the list of active users.For example:Local group: BT-PAM-ACCESS Total members displayed: 10 users Actual active users: 8 users Disabled users in AD: 2 usersEven though the 2 users are disabled in Active Directory, they continue to appear as members of the local group. During audits, we provide screenshots of the local group membership as evidence of access reviews. This results in audit evidence showing all 10 users, which can be misleading because it includes accounts that are no longer active.Concern: The current proc

Hi mates, I am in a trouble with Discovery Scan and each time it can surprise me with new issue.I can not scan Linux  and Linux based assets (like Palo Alto firewalls) with Discovery Scan. It  displays the error “NoValidTargets” error altought is was working properly yesterday and suddenly started to give this error.  There is not any Network connections issue. Appliance can connect to SSH ports of Linux machines. Credentials issue. I use root user and tested its password a few times, no fail while manually login. No service error. I checked with getc, teste, testc commands. I tried on new VMs and formerly scanned ones. All scans returned same error mentioned above.Everything is ok with Windows scans.

Hello.We have a use case with non-domain account on a network device which has special characters # and \\.apic#fallback\\adminWhen a user launches SSH session from BIPS Webconsole the session fails. In PBSM logs it shows the username being used to authenticate to device is \admin . Are there any special characters like [ ] that we need to put the username in so that it is sent as-is. I tried [ ] and “ “ , didn’t work .It also has other domain accounts linked to the device 

I’d like to request that the configuration API be expanded to include console settings. We would like to push scripts into the Canned Scripts section. Ideally we would keep all our scripts in a central repo and then sync our BT appliance with it on a periodic basis. 

how BeyondTrust PRA would handle SSH access in Alibaba Cloud and specifically how credential injection would work. He wants to know whether PRA injects credentials or if Alibaba SSH keys would continue to be used.

Hello, I am trying to setup an Azure SQL Database for a new AA BT PWS environment. Is there any way to use a serverless SQL with own key material for TDE?Right now the installer just gets stuck and although I can run the connection check I get a small window stating “validation failed” after I click next on the database configuration step.Any recommendations?  Thanks!

Hi Everyone,I would like to raise a concern that we have noticed after upgrading to 25.3.3 related to clipboard restriction on shell sessions.launching shell jump (no jump client installed) does not restrict user clipboard even if the session policy restrict.tried applying session policy on both user level and jump item but still user can copy/past in both directions.Simulator in Session policy shows restriction but doesn’t really apply after connecting to shell session. anyone using 25.3.3 facing this issue ? Thanks.

Hi,I just wonder if anyone else experiencing an issue with PM Client Version 26.2.1.417 and PSADT (v3). What we see in our environment is that after we install 26.2.1.417, that afterwards we cannot deploy stuff anymore using PSADT v3 as Deploy-Application.exe is crashing.Therefore we are currently using PM Client 26.1.59 where we do not see this issue.Anyone else seeing same ?

Hi everyone, I’m quite new to BeyondTrust and am completing the Privileged Remote Access - BCIE course.I wanted to know the difference between a Remote RDP Jump Item vs Remote Jump Item.Is Remote RDP Jump similar to using a VM session?Thanks in advance!

From what I can tell, dedicated account mapping (e.g. KB0017035) the only option available is to map the exact same attribute in both domains. For example, employeedomain\user1 has attribute1 set to “user1”privilegeddomain\admin1 has attribute1 set to “user1”to drive the mapping via smart rules. However, that implies that modifying attribute1 in employeedomain to a different value, say, “user2” would grant user1 access to user2’s privileged resources, giving domain1 authority over a privileged domain’s access. What I want to be able to do is have privilegeddomain\admin1 attribute1 set to “user1”, and map that to employeedomain\user1’s name field (or samaccountname, or SID - something not modifiable without breaking the employeedomain\user1 account). Is that possible? 

Hi,We are experiencing an issue with the session termination behavior in PRA.We have configured the system so that when a session ends, the user's session on the target server should be logged off automatically. However, after ending a session and reconnecting, everything remains exactly as it was left previously, which indicates that the user session is not actually being logged off.Both the web console and the desktop console are running version 25.3.2.We found a KB article that appears to describe a similar issue, but it does not seem to apply to the version we are currently running.Additionally, we are currently applying the Session Policy through Group Policies. To rule out a policy inheritance issue, we also assigned the same Session Policy directly to the Jump Item, but the behavior remained exactly the same.If anyone has experienced a similar issue or knows why this might be happening, we would really appreciate any guidance or suggestions on what else we should verify.Thank yo

I would like to know which default browser BeyondTrust is integrated for the web jump method. Is there any default browser for this method, or does it utilize the browser from the Jumpoint server?

I have recently upgraded my Appliance version and BeyondInsight/Password Safe version with belowPassword Safe Appliance 4.4.1.1317 → 4.6.1.155 BeyondInsight 25.1.1.165 → 26.1.0.878Upgrade was successful. The following day, my users started receiving an SSO authentication failed error from their browsers. It seems like there was a token lifetime validation happening and it is now failing against my users. Clearing the browser cache and deleting the previous token somewhat helped but this is more of a manual intervention per user I am doing now. Has anybody encountered this and know how to resolve this?Microsoft.IdentityModel.Tokens.SecurityTokenExpiredException: IDX10223: Lifetime validation failed. The token is expired. ValidTo (UTC): '8/13/2026 9:26:02 PM', Current time (UTC): '8/13/2026 9:51:55 PM'. at Microsoft.IdentityModel.Tokens.ValidatorUtilities.ValidateLifetime(Nullable`1 notBefore, Nullable`1 expires, SecurityToken securityToken, TokenValidationParameters validationParameters

I want to export managed server list report and help to add two more column, the FA account , and FA account status (managed or not managed).I am working on password failure checking task, and there is one type of error is FA account password incorrect, so I'd like to know the server and FA mapping, and if the FA is managed or not.Need a single report in which managed system>managed system’s functional account > FA status (managed/not managed) status should be there.