Skip to main content

Windows & MacOS

A localized space to talk about EPM, specifically for Windows And Mac OS's.

  • 94 Topics
  • 320 Replies
94 Topics
D
DanielApprentice
asked in Windows & MacOS
Opening admin command prompt as another user?

We’re running EPM in a mostly windows environment. Some support/admin users have secondary accounts that have all their elevated AD credentials, like domain admin for example. When we try to run an elevated command prompt it opens it as admin of the current/primary user account. They need to be able to open an admin CMD as the second user that has the elevated AD credentials. Any suggestions on how to pull that off? The users are all in a high flex workstyle. Thanks. 

256
D
9 hours ago
M
MichaelDRising Star
asked in Windows & MacOS
EPMfM Awaiting Update from 24.5.2.3 to 24.7.0.1

Good morning -- I have our Client & Adapter updates enabled in our environment and it should be updating the clients to the latest version of both the adapter and the client. However, my client has stayed on version 24.5.2.3 when 24.7.0.1 is available.  In the update section, it does see we have two devices “awaiting update”.  Am I missing something or isn’t this suppose to occur when the machine checks in?   The machine is online and the console see that it last spoke about 30 minutes ago.  Have I misunderstood and or misconfigured something? I’m new to the management space on the EMPfM side so forgive my slowness. 

205
J
13 hours ago
M
mlajoieApprentice
asked in Windows & MacOS
Apple Mail

Good morning.  We don’t allow the use of mail.app on our enterprise devices so we’ve put a block on it.  No big deal - it was working exactly how we intended.  Now, however, after upgrading to Sequoia, we’re seeing MailCacheDelete.appexauto-launching to delete the cache and EPM is seeing mail.app being opened, causing a block.  While this, generally, isn’t bad, it does cause a bad user experience.  Now, the user gets, seemingly, random blocks for mail.app when they didn’t even launch it.I’d like to block and suppress the message for just this deletion process.  I’d also like to have it continue to provide a blocked message when a user tries to open it manually.Any thoughts on how best to accomplish this? Sample logs:com.beyondtrust.endpointsecurity: [com.beyondtrust.endpointsecurity:EndpointSecurity] Blocking 23252 /System/Applications/Mail.app/Contents/PlugIns/MailCacheDelete.appex/Contents/MacOS/MailCacheDelete2025-01-06 13:53:50.286695-0600 0x699701 Default 0x0

362
M
2 days ago
J
JayRobApprentice
asked in Windows & MacOS
Auditing software usage with EPM without precluding rule matches lower in hierarchy?

I’m interested in auditing certain software and/or commands using EPM, but if I create an audit rule with an application that matches what I’m looking for high in my Workstyle hierarchy, rules that would match lower down will not fire, and if I create it low in the hierarchy the inverse is true. I understand that this is pretty foundational behavior for EPM, but I feel like i’m missing something simple here, or it’s just not possible. It seems like if i want this data, whether it be simply for visibility, or for measuring expected impact of a planned change, I could do one of the following…LOG ALL THE THINGS!!! Update all of my rules to raise a local even and report events, then filter what I want in my SIEM. The downside is that this would be expensive, and result in a lot of noise in the EPM console. Not really an option. Duplicate Groups and Rules!!! Create duplicate “logging” application groups + rules with raise a local event and report events enabled for any rules we aren’t alre

282
J
3 days ago
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Jan 6 - Jan 13)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021898 - EPM-W and BITS transfer - How to allow installation KB0021899 - How to block users from accessing Users & Groups with EPM-M KB0021900 - EPM-M and third party system extensions KB0021923 - Elevation Method or Authorization Method column missing in exported Analytics csv file KB0021937 - EPM-W block message replaced by Windows 11 message - This app has been blocked by your system administrator

200
GloriaB
BeyondTrust Employee
4 days ago
N
naidu_jstsApprentice
asked in Windows & MacOS
Block delete /Applicaitons & install specific /Applications

How to Block Delete from /Applications in MAC? how to allow Install specific apps in /Applications in MAC?Is there a common configuration for all versions of MAC, as we see its behaving different on every version of MAC.

202
N
5 days ago
D
dennedyApprentice
asked in Windows & MacOS
Possible to update group assignment through local script?

Starting to use PM Cloud now and looking to see if it is possible to update group assignment using a local scripting job. We used to do this before with stopping services, changing some registry keys, and starting services. This is helpful if we want group membership to change dynamically based on something that might not be in AD.

385
J
7 days ago
M
ManasviApprentice
asked in Windows & MacOS
Alternative Port for port 445 (Beyondinsight EPM-W)

Hi,Is their any alternative for the port 445 to manage discovery scans for asset in BI-EPM.

353
Paul
BeyondTrust Employee
7 days ago
M
ManasviApprentice
asked in Windows & MacOS
Block Rule Not Working

Hi Team, "We have configured a policy in EPM-MAC to block the installation of unknown applications. However, when attempting to install an unknown application, the block action does not prevent standard users from proceeding with the installation. When we configure the policy to either 'Allow' or 'Request EPM Message,' it functions as expected, based on the action set (Allow/Request). The issue appears only for the 'Block' action within the application rule, as it is not being enforced properly."Is their any suggestions why it is happening with the policy?

511
James Allan
BeyondTrust Employee
8 days ago
M
MichaelDRising Star
asked in Windows & MacOS
Rotating Challenge Response 'key' on a daily basis - EPMfW/M

Has anyone implemented a solution that changes the Challenge Response “key” on a frequent basis (Ideally daily).   We have CyberArk, so theoretically could store in their vault but looking to see what options might be available. 

243
Paul
BeyondTrust Employee
9 days ago
E
egemenApprentice
asked in Windows & MacOS
Epm-W delete policy

For EPM Windows, is there any way to remove the policy on endpoint agent.I want the turn them into first no policy “monitoring” state in certain conditions. thinking about changing the smart rule. I gave empty smart rule to the machine but latest policy on it remains there.Can I do it on smart rules or something without and rdp? Or I always need to delete the xml under Program Data?

203
J
11 days ago
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Dec 30 - Jan 6)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021855 - EPM-W installation fails with error 1603 on Windows 24H2 ARM devices

280
GloriaB
BeyondTrust Employee
11 days ago
B
bt101Trailblazer
asked in Windows & MacOS
EPM Policy - Applying specific rules to User Groups

Hello,What is the best way to apply specific rule(s) to a group of users e.g. a team wants to have yes/no message for elevation for certain commands run in CMD. (others will have Password prompt). I see I can create a new workstyle and assign to AD based user group, but there is a possibility of many such requests and I will end up creating 50-100 workstyles. Alternatively, I can use the SG as designated user group in Password (authentication) Message, but I want yes/no prompt which doesn’t have designated user option. 

413
C
BeyondTrust Employee
14 days ago
M
mlajoieApprentice
asked in Windows & MacOS
Make Admin on macOS

if a user is in high-flex, ia user can access the users & groups and then turn themselves into a local admin.  we’re going to block this access by doing the following but I was wondering if there was a better way?Remove from (Recommended) Restricted Functions: Type: System Preference pane; Filename: *;  Auth Request URI: system.preferences.accounts Remove from (Recommended) Restricted Functions: Type: System Preference pane; Filename: /System/Library/ExtensionKit/Extensions/UsersGroups.appex;  Auth Request URI: * Add to Blocked - Blocked Apps: Type: System Preference pane; Filename: *;  Auth Request URI: system.preferences.accounts Add to Blocked - Blocked Apps: Type: System Preference pane; Filename: /System/Library/ExtensionKit/Extensions/UsersGroups.appex;  Auth Request URI: *

1042
M
22 days ago
E
egemenApprentice
asked in Windows & MacOS
Poweshell script for creating EPM policies

Is there anyone worked on some kind of powershell script to generate policies, application groups etc.?Trying to create some policy automic policy making process. 

572
AdamS
BeyondTrust Employee
25 days ago
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Dec 16 - Dec 23)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021840 - How to add and use a local AD connector in EPM Cloud KB0021847 - EPM-W client failing to install "Error 2738. Could not access VBScript run time for custom action" KB0021852 - EPM with SentinelOne on Windows 11 24H2 - Looping install popups KB0021855 - EPM-W installation fails with error 1603 on Windows 24H2 ARM devices KB0021862 - How to upgrade EPM-W on-prem (BI, GPO etc.)

100
GloriaB
BeyondTrust Employee
25 days ago
B
bt101Trailblazer
posted in Windows & MacOS
EPM - Windows - How the agent handles elevation ; OS Logging ; AV interaction

Hi All,I am trying to get more details on how EPM handles the privileges ( there are few helpful KB articles. Thanks BT team).Q.1 How the agent assigns elevated token? Is there a local admin user created by EPM or the defendpoint service assigns the elevated tokens to processes when requested.Q.2 How the  OS log ( and SIEM log monitoring will be affected) . In Widows Event Viewer I see two additional events per elevated action e.g. if I run an installer that needs elevated right I see1. ID 4688 The standard user account as subject who ran installer with elevated token.     I also see two additional EPM events -2. ID 4688 - Create process “PGMessageHostExt.exe” by creator “ DefendpointService.exe”3. ID 4733 Primary token assigned by DefendpointService.exe to the installer service. Token has standard user.I think event number 1 stays as is (with EPM / without EPM while user is local admin)Q3. How AV scanning is affected. As AV typically works at kernel level will it get priority in hooki

784
B
28 days ago
J
jbwood919Apprentice
asked in Windows & MacOS
ARM

has anyone gotten the new pmw 24.7 arm64 client installed? the same method weve been using to install pmw x64 msi results in 1603 error. thanks.

20616
A
29 days ago
J
Jens HansenVeteran
posted in Windows & MacOS
Upgrade recommendation to EPM Client 24.5.361

A few things not mentioned in the release notes of the latest EPM Client:It might have been a mix of QuickStart Policy "flaws" or a EPM Client "bug" still unknown to me.However, I have seen a few customers out there that I have been working with who have had benefit from this.If you are running the EPM Client above 24.5.361 you can ignore this.From around EPM Client 21.x 22.x, a change happened in the EPM Client that made it look at the content of our application groups differently. It caused the EPM Client to miss reporting vital data of applications when launching. For example, a PowerShell script (*.PS1) would show reporting for powershell.exe and a command line containing the script_name.ps1. This prevents us from creating a rule for the PowerShell script that the EPM Client supports, as the metadata is for PowerShell and not the PowerShell script. This was also true for *.bat, *.com, *.vbs, and *.msi files, all of which would report the main process exe file associated with the la

1313
tclowater
BeyondTrust Employee
1 month ago
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Dec 2 - Dec 9)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021821 - PMR Database error - The database collation cannot be changed if a schema-bound object depends on it KB0021822 - Local passwords not rotating after upgrade to Endpoint Privilege Management for Mac 24.5.3 KB0021825 - Is it possible to filter by local AD workgroups in WPE? KB0021826 - EPM Cloud JIT Admin Access information and walkthrough

260
GloriaB
BeyondTrust Employee
1 month ago
N
BeyondTrust Employee
NeilBeyondTrust Employee
posted in Windows & MacOS
Using JIT Admin

Howdy folks, It’s been a little over a week since the new JIT Admin feature was released and so I wanted to share a little bit of what I’ve learned while using it.  What is JIT Admin?JIT Admin is a new feature in EPM (SaaS) 24.7, where a standard user can submit a JIT Admin request directly to the Privilege Management Console. Once approved, the standard user is put directly into the BUILTIN\Administrators group on their system, becoming a ‘true’ admin for a specified amount of time.This feature is available on both Windows and Mac.  How do I enable JIT Admin?​@Jens Hansen made a nice GIF in his post here which is probably the quickest way to see how simple it is to enable JIT admin within PMC. I’ll add documentation at the bottom, but at a high level, enabling JIT admin requires three things:“JIT Admin Access Integration” is enabled under Configuration > Just-in-Time (JIT) Access Settings > Admin Access tab JIT admin is activated on a workstyle via policy OS > Workstyles >

1582
N
BeyondTrust Employee
1 month ago
M
ManasviApprentice
asked in Windows & MacOS
Unable to capture logs using CaptureConfig

Hi Team, We are unable to run the CaptureConfig tool without entering administrative credentials.When launching the tool on the user's system, it opens successfully; however, upon execution, an EPM message prompt appears, and requesting the entry of admin credentials.To clarify, the user does have administrative privileges, yet the tool still requires admin credentials to run.  

612
M
1 month ago
M
ManasviApprentice
asked in Windows & MacOS
Configure a non-default SQL Server port for the U-Series Appliance.

Hi team,Is it possible to change the default  SQL port to a customized port in the BeyondInsight configuration tool.  

282
C
BeyondTrust Employee
1 month ago
M
ManasviApprentice
asked in Windows & MacOS
Upgrade package manager

Hi Team, The EPM agent was installed manually on the endpoints using the Jamf file. The EPM console has now been upgraded to the latest Build Version 24.7, but the agents installed on the endpoints are still on the older version. If we want to upgrade the agents on all endpoints using the package manager, do we need to remove the existing agents installed manually through the Jamf file, or will the package manager upgrade and replace them automatically when we push the new package to the endpoints? Product: Endpoint Privilege management -Mac

865
MikeK
1 month ago
MikeK
MikeKTrailblazer
posted in Windows & MacOS
Powershell script shortcut?

I am curious if anyone else in the community has attempted to leverage PowerShell to bulk create xml files for application group items based on results from exporting analytics?I have recently began working towards setting up my organization with a test policy to provide more restrictive settings and exceptions and currently trying to do these in bulk through web policy editor is not very fun. I know there are likely enhancements coming in this regard, but without a tentative release date I have a mountain of work ahead of myself as the sole individual administering the application for an organization.This got me thinking more along the lines of bulk creation to import the settings into the PMC policy leveraging PowerShell and CSV exports from analytics.  Reason I bring this up, I have over 150k unique applications from 26k publishers that will eventually be in the policy in various high, medium, low, block process, with leveraging JIT as a means for unknown applications pumped through

1563
MikeK
1 month ago

Badge Earners

  • BCSE: Privileged Remote Access
    Kragballehas earned the badge BCSE: Privileged Remote Access
  • BCA: Password Safe
    kgujashas earned the badge BCA: Password Safe
  • BCIE: Password Safe
    kgujashas earned the badge BCIE: Password Safe
  • BCIE: Password Safe
    Vinoth Rajahas earned the badge BCIE: Password Safe
  • BCA: Remote Support
    Pablo Salashas earned the badge BCA: Remote Support
Show all badges
Terms & ConditionsCookie settings