Skip to main content

Security Research

A dedicate space to talk about Security Research.

23 Topics
M
Mohan UpadhayaApprentice
asked in General
PRA Blank Screen

Hi All, I am seriosly Stumped here and not sure if anyone has been througth this experience.  we have PS and PRA integrated. when I jump into a Server, I get the session started successfully but nothing displays on screen that looks like windows. All I get is a blank white screen, with the session running in the backgrround. I tested this on two different machines plus a cloud PC. we use Beyond Trust CLoud products. I have looked through FW and any other point where the traiffc could be blocked, but I dont see issues with the network . nothin seems obvious but I get a blank screen for any VM I conenct to . 

123
M
P
Pritish189Newcomer
asked in General
Automation of elevation report in EPM PMC

Hi everyone, Does anyone know how to automate downloading and sending elevation report in EPM PMC ?Can it be done using API? If yes, then how?If there is any KB articles related to this, please share.

81
H
BeyondTrust Employee
V
vinothNewcomer
asked in General
Unable to login Support portal

The service portal logs out immediately after logging in via SSO, preventing access to open cases.

81
P
BeyondTrust Employee
W
way2qk4u2cApprentice
asked in Endpoint Security
Local admin rights required in an AD-HOC way

Hi All,  Currently I’m going through the EPM install / onboard process and was wondering if there is a way to give users local admin rights to install applications on the fly. Some installers just have so many commands to whitelist that this isn’t feasible during a 1 time install. I was hoping for like a “just in time” setup to raise full admin however, the on-prem version doesn’t include JIT setup only the cloud does. How have others accomplish this without the need to whitelist every individual command line? 

494
tclowater
BeyondTrust Employee
J
Jain GeorgeNewcomer
asked in General
How to Block Snipping tool in BT

Hi ,I have set a rule to Block snipping tool in the Deny List.With the criteria Publisher matches Microsoft Corporationand Product Description matches snippingtool.exebut it didnt work.Is there any suggestions pls 

441
H
BeyondTrust Employee
A
Arif HussainApprentice
asked in Network and Remote Access Security
Support Required for BeyondTrust PAM Session Issue

We are currently running our operations through BeyondTrust PAM for each asset. However, some team members are facing an issue where the session is not visible and does not display anything. I have attached a screenshot for your reference. Could you please guide us on how to resolve this issue at the earliest? Your prompt assistance would be greatly appreciated, as this is impacting our operations

1015
N
J
Jain GeorgeNewcomer
asked in Endpoint Security
Admin Promt not prompting for credentials

Hi,Could someone please help with the issue not prompting for creds when opening admin terminal.BT version is 25.2

921
Lindsay Gallant
BeyondTrust Employee
M
mlinkeyApprentice
asked in General
Password Safe API linking managed account to Managed System

We are looking to create a script that will use the Password Safe API calls to link a managed account to a managed system.  Not finding many examples on this.  Trying to follow the API doc’s but it is not clear in those which API calls to use.  Wondering if someone has does this already and willing to share some information how they did it?  Can easily get the list of managed systems, but not sure which call is the correct to link the managed account

2864
rhagerm
S
Sathyanarayanan BNewcomer
posted in General
Possibility to extend active session

Idea is to have an option to extend already submitted active session up to the default time limit. Currently there's no such option and the only way is to terminate current session and start a new one.https://beyondtrust-public.ideas.aha.io/ideas/T2PSM-I-1817Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,Thanks & Regards,Sathya

711
tclowater
BeyondTrust Employee
S
Sathyanarayanan BNewcomer
posted in General
MFA support for shared managed accounts

We currently use shared Role Identities as managed accounts to reduce the number of Admin accounts and as a way to enforce RBAC. As those accounts are not owned by specific users, they cannot be registered for MFA by individual users, and therefore the MFA requirement had to be disabled on the managed assets for the Role Identities, which is less secure (in case a Role ID is compromised) and against our policies.We would very much like to see a feature added to Password Safe allowing it to respond to 3rd party MFA challenges automatically, when establishing privileged sessions with the shared Role Identities.https://beyondtrust-public.ideas.aha.io/ideas/T2PSM-I-1808 Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,Thanks & Regards,Sathya

461
tclowater
BeyondTrust Employee
M
mjamasiApprentice
asked in General
Onboarding SA MS SQL account into password safe

I need help on Onboarding SA MS SQL account into password safe.

633
C
M
maulik shahRising Star
asked in General
download password histroy

Hi All ,Thanks in advance for your input in this question, I have some managed system local account as managed account in password safe. this password managed as per policy. the requirement is to keep the password history of any rotation while managed system in production and post decom. I can get current password but getting whole history would be nice. Does anyone have any insight ? Regards,Maulik

841
J
BeyondTrust Employee
M
maulik shahRising Star
asked in General
psrun2 for domain account

Hi ,  My experience with psrun is hit and miss , I am new in to api tooling and recently I managed to extract passwords for manage accounts password for managed systems.  It worked once and the same command set rejected second time .  Also documentation did not have enough info on domain managed accounts password capability description or mentioned.does any one have any experience in this area. regards,Maulik    

332
M
R
RidwaanKApprentice
asked in General
Fortigate firewall management with svc functional account

Hi CommunityHave a question does anyone manage fortigate devices using a svc functional account domain account .If so how was it done as TACACS is not supported as confirmed by Howard 

522
Paulo144
P
BeyondTrust Employee
PACBeyondTrust Employee
posted in Endpoint Security
BT25-01 advisory for EPM-W

Regarding CVE-2025-0889https://nvd.nist.gov/vuln/detail/CVE-2025-0889A vulnerability has been discovered in Privilege Management for Windows that allows for a local authenticated attacker to elevate privileges.Prior to 25.2, a local authenticated attacker can elevate privileges via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process. Further details about this CVE can be found here:https://www.beyondtrust.com/trust-center/security-advisories/bt25-01 There is also a Support KB, How can the BT25-01 advisory for EPM-W be addressed?, here:https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0022083 

290
P
BeyondTrust Employee
R
Rohit NikamApprentice
asked in General
How to enable Toggle Clipboard feature for Shell Jump in Web console of PRA

We are unable to find an option like 'Toggle Clipboard' for Shell Jump in the web console. Could you please assist us in enabling this feature?

1003
P
BeyondTrust Employee
D
DarklordNewcomer
asked in General
Ollama Prompts ?

Does anyone else face issue with running Ollama on thier mac ? I am getting multiple prompts when I try to run it and the issue is when you launch the ollama application it requests access from BT. This is causing issues with my API programming as I need it to authenticate

311
P
BeyondTrust Employee
L
lineVeteran
posted in General
Documentation about PRA remote app and remote desktop agent

I need documentation about PRA remote app and remote desktop agent. Need to integrate SQL Server on PRA and inject credential

503
L
S
BeyondTrust Employee
ShaunDennisBeyondTrust Employee
asked in General
New copilot ARM devices

Looking for some insight from our customers that are using the new copilot ARM devices. Specifically around the use of smart card devices.Do these devices actually have physical smart card readers? 

551
J
P
BeyondTrust Employee
peytondisbrowBeyondTrust Employee
posted in General
BeyondTrust Trust Portal

November 2024 – We are excited to announce that BeyondTrust recently launched its online Trust Portal, building on the foundation of our Trust Center launched earlier this year.   What is a Trust Portal? A Trust Portal allows our customers to conduct their security review and assess our posture in a self-service fashion leading to simplification, automation, and consolidation. We encourage you to get the information you need to conduct your review and complete due diligence activities with just a few clicks.   Through our portal, we are dedicated to showcasing our unwavering commitment to security, privacy, and compliance and how we work to protect our customers and their data, affirming our position as a world-class cybersecurity partner.  Resources are available enabling you to learn about our robust security posture and access compliance documentation (such as SOC 2 reports, completed industry questionnaires, and penetration test summary reports) to streamline your security review p

20
P
BeyondTrust Employee
Fabien Landais
Fabien LandaisRising Star
asked in Endpoint Security
PM Cloud Webhook for Teams

HI, I would like to configure a webhook with Microsoft Teams to be able to receive a notification when a JIT approval is arriving in PM Cloud.Indeed, at this time, no notification for these events is not valuable. I try to re use the Identity Insight documentation about Teams Webhook but it doesn’t work and I don’t receive anything.Do you have info about the Content Type and authorization fields ?

2893
Josh Bristow
N
Nagapriya JRising Star
asked in General
AD Port Connectivity issues from servers to Domain Controllers

We have followed this BT KB Article - KB0016985 : How to confirm AD connectivity - Prerequisites required by Password Safe for Active Directory connections on to solve the issues of AD Connectivity. 2024-11-08 16:06:26.354 +00:00 [Debug] ()  Starting BTTestADGroupResolutionTool 1.2.1.0 2024-11-08 16:07:42.855 +00:00 [Debug] ()  Starting BTTestADGroupResolutionTool 1.2.1.0 2024-11-08 16:08:31.147 +00:00 [Information] ()  Attempting connectionless LDAP query 2024-11-08 16:08:33.711 +00:00 [Information] ()  Successfully got a response? True 2024-11-08 16:08:33.712 +00:00 [Debug] ()  LDAP ping took 00:00:02.5639690 2024-11-08 16:08:33.712 +00:00 [Information] ()  About to do lookup for the entered user 2024-11-08 16:08:33.713 +00:00 [Debug] ()  GetPrincipalForDomain-> usessl:True, domainname:UGX1ADDC01N01,adusername:srv_bt_BindAcc 2024-11-08 16:08:33.713 +00:00 [Debug] ()  GetPrincipalForDomain-> using the ADCred setup for the domain UGX1ADDC01N01 2024-11-08 16:08:33.715 +00:00 [Info

1321
J
BeyondTrust Employee
James
BeyondTrust Employee
JamesBeyondTrust Employee
posted in Identity Security
AD CS misconfigurations that can lead to domain admin

Abuse of Active Directory Certificate Services has been on the rise since 2021, with a growing number of techniques to abuse misconfigured template or vulnerable services. These are fairly common in enterprise environments and can provide attackers with a path to easily authenticate as a domain administrator from any standard domain account.I can highly recommend the posts by Raul Carmona and colleagues on ADCS attack paths:https://www.beyondtrust.com/blog/entry/esc1-attacks https://www.beyondtrust.com/blog/entry/esc4-attacksWe also have a webinar on the topic which includes an explanation and a demo of how these attacks work:https://www.beyondtrust.com/webinars/iam-leaders-and-ad-admins-are-ad-cs-misconfigurations-and-similar-issues-giving-every-user-a-path-to-your-domain-adminA few questions for discussion:Is this an area that you are actively looking into? Do you need assistance or education in these areas to help you understand them better? Have you uncovered these vulnerabilities

610
James
BeyondTrust Employee

Badge Earners

  • BCA: Password Safe
    shivabillahas earned the badge BCA: Password Safe
  • BCA: Endpoint Privilege Management - Linux
    Sarah Fadelhas earned the badge BCA: Endpoint Privilege Management - Linux
  • BCA: Remote Support
    Furqanhas earned the badge BCA: Remote Support
  • BCA: Privileged Remote Access
    Furqanhas earned the badge BCA: Privileged Remote Access
  • BCA: Remote Support
    IanSeylerhas earned the badge BCA: Remote Support
Show all badges
Terms & ConditionsCookie settings