Hi Beyond Trust community,

I have a couple of Beyond Trust - Endpoint Privilege Management suggestions that I would like to share please:

We recently found many devices had become disconnected from the EPM Console due to them being deleted. This was likely due to inactivity, where many machines were built in advance of a laptop migration and kept in storage. From the machines, it was not obvious there was a problem until some devices started to show symptoms that were fixed in an earlier policy revision. When the machine is checked, it still had an old policy revision listed. This means even our latest block rules were not working on these devices.

To mitigate this issue, we would find the following agent features extremely useful:

Feature Request: Ability to check policy name and revision in the Windows Registry / file or WMI etc.
Reason: We can keep an active deployment that checks for the revision and if it falls behind we can have an automatic remediation.

How we are currently evaluating the issue:

We have found that if the following file has a date modified that is older that the last policy revision creation date, then it most likely has this issue:

C:\ProgramData\Avecto\IC3 Adapter\Context\ConfigurationInfo.machine

 

Feature Request: Agent command line to reconnect a computer that has been deleted from the Console without needing to reinstall it or use other tools provided by Beyond Trust.
Reason: Needing to reinstall requires the user to reboot and using additional tools adds further complications. Having the ability to run a command which recreates the computer in the console without needing to reinstall means we can automate this without reinstalling if an issue is detected.

How we are currently working around the issue:

We have a deployment which targets the devices with old ConfigurationInfo.machine files. This deployment will reinstall the agent but we have found that it is not done cleanly sometimes unless we put reboots in between. These reboots mean we need to inform the user and is not ideal.

Summary
The main issue we have is that we mainly work outside of the EPM Console for remediation of workstation issues (for example with SCCM or Intune), so we need the ability to evaluate and perform the repair actions without checking the console. For other applications, we have seen this kind of auto-remediation built in, but for EPM it will remain broken until it gets manually remediated.