Windows & MacOS

Hello, are there any caveats while uninstalling EPM windows components ? We have installed the Package Manager via SCCM which further installed the agent and adapter . On some of the computers we are not able to un-install these components from Add/Remove programs as well as CMD/PS using msiexec and GUID. user account in local admin group is being used to run these programs as admin. No agent protection is configured. Order of removal is PM agent. Adapter and then Package Manager . Tried deleting computer from EPM console before above steps as well. On some computers PM agent removal asks to close other open apps such as notepad. excel etc Adapter Version: 24.6.714.0Client Version: 24.5.361.0Package Manager Version: 24.6.697

Hi Team,Unable to run DISM or SFC commands on the user's system. I tried opening CMD as an Administrator, which prompts the BT pop-up. We approve, but it still doesn't allow me to proceed. I also attempted to open CMD from Task Manager but encountered the same issue.

The following articles were published last week. New Knowledge Base Articles: KB0021537 - EPM-W rule not matching Sublime Text Editor when using publisher in definition KB0021624 - EPM Cloud JIT Application Access walkthrough KB0021662 - When filtering Analytics in separate tabs they are not independantly honored KB0021663 - EPM-M configuration profile 2.2.1 - Sequoia vs Sonoma and lower KB0021682 - Package Manager unable to install EPM Client or Adapter due to time out KB0021683 - Sequoia pop-up when opening unsigned apps - "App Name" not opened

Has anyone seen or reported in various version of the software that the system tray icon randomly does not display?Some things I do to get the icon back, but doesn’t work 100% of the time is disable the Avecto service and end all PGSystemTray processes.  Re-enable the Avecto service and run the Privilege Management software from the start menu.  About 80-85% of the time the icon gets restored, however there are 10-15% of the time it looks like something is there but does not display properly. 

The following articles were published last week. New Knowledge Base Articles: Discovery policy template structure for EPM-W Endpoint Privilege Management for Mac off network setup with Password Safe Cloud COM class rule getting UAC instead of the expected EPM-W designated user message EPM-M endpoint not recieving policy - Error Domain=NSOSStatusErrorDomain Code=-67901

Hello Everyone ,We would like to implement a policy that blocks the execution of an application if it is from an external source, even if it has the same publisher and version as one available in the Company Portal/Intune. However, the policy should allow the installation of the same application (with the same publisher and version) if it is from the Company Portal or Intune.Our goal is to prevent the execution of any externally downloaded applications, while permitting installations from Intune or the Company Portal.Example:For Notepad++ version 8.7, the policy should block its execution if installed/downloaded from an external source, but allow installation if done through the Company Portal or IntuneCan this be achieved ?? if yes, how can this be implemented? Appreciate in advance!!Regards,Suresh

Hi guys, I’ve been assigned a case to block portable apps on a Windows desktop using EPM-W. What is the best way to target any portable apps on Windows? I have a portable application (FreeCommanderPortable.exe - this is just for testing, real-world apps can be anything) with the following criteria:It has a valid digital signature The .exe file can be originated from USB stick, internet download, or file sharing The .exe file can be moved to another folder/drive It doesn’t trigger UAC when run The file name can be changed to anythingI tried creating an application group rule that targets any application ("*"), but there were many false positives, as some legitimate applications sometimes depend on each other.The best configuration I can think of is to target if the publisher or the app name contains the string 'portable'. But not all portable applications have this string (e.g., if renamed).Has anyone faced a similar scenario?

Hi Team,Unable to get refresh policy option on the system tray icon after upgrading EPM cloud  adaptor version in 24.5.1037

EPM Windows: How does the AD group synchronization work for AD group filters in workstyle? Currently when we remove user from AD group, EPM policy is still being applied to that user, even though he is not part of the AD group which is added as filter in the EPM policy.

The following articles were published last week. New Knowledge Base Articles: Unable to run client project in debug mode after updating to Xcode 16 Endpoint utility - Endpointutility.exe explanation of commands

Naming consistency and transparency are aspects I really liked when BT changed to the new version formatting for release notes: Year, Major Version, and Minor Version. If we look at the sample here, with the exception of the new 24.5 MR2, we had consistency and knew the version we had. MR2 has, for some reason, snuck back, leaving us hanging in the unknown version 24.5.XYZ or 24.5.TRE. Who knows?😂What are you take on the naming? 

Anybody else encountered an issue with iisreset via commandline where the error coming up is “Access Denied” after running an elevated CMD?

Maybe I’m missing it but is there a way in Analytics v2 to filter out child process events to only show the parent process item. We used to have a ‘Match on Parent’ filter in v1. 

Hey everyone, with the official release of macOS Sequoia on September 16th, the question about Endpoint Privilege Management and macOS Sequoia support has come in. We are working hard to resolve the issues found. Below is a list of known issues for the macOS Sequoia operating system. Wrong description of endpoint in PMC as "macOS 15.0.0"The PM SaaS Adapter does not correctly identify the macOS Sequoia systems. As a result, the computer OS description will show as "macOS 15.0.0" instead of macOS Sequoia in the portal.Workaround: NoneResolution: We plan to resolve this in EPM-M 24.5 MR2, planned for late September. We are updating our adapter to send the correct description.Knowledge base article: KB0021576 Applications open in the backgroundApplications on Sequoia are not displayed in the foreground when the EPM-M dialog is not completed in a timely manner. We have informed Apple via Feedback Assistant and awaiting a response.Workaround: The application will launch, and the user can cli

Hi everyone,With ON-PREM BI/EPM-W it is my understanding that the WPE is generally planned to replace the MMC policy editor at some point, but that point hasn’t yet occurred. This is unlike PMCloud where MMC policy editor is deprecated and no longer supported.My organization uses CERT_MODE=2 to require the clients to only recognized code-signed policies. This is seen as a valuable control to reduce risks related to internal or external bad actors plausibility reverse engineering corporate policy XMLs and creating their own (overly permissive or malicious) policy.To the best of my knowledge BeyondTrust does not have a plan or timeline to add WPE-based code-signing. I figured policy signing would be added to WPE but now ~2 years after it’s introduction I see no indication of it coming.As CERT_MODE=2 only recognizes code-signed policies and WPE cannot provide code signing, this makes WPE unusable for my organization.BeyondTrust, respectfully - do you plan to add code-signing to WPE or do

Did you know that when you’re initially deploying EPM-W or EPM-M, you can simply deploy Package Manager and it will handle installing the other Privilege Management components (Client and Console Adapter) for you? The configuration for Package Manager is set at the Computer Group level, so the computer does not need to be listed in the PM Console first. During the installation of Package Manager, we specify which Computer Group we want the endpoint to reside within the install string. In other words, if Package Manager is installed first, it will list the computer in the PM Console immediately after install, so there is no need for the Console Adapter installed first as long as Package Manager is present on the endpoint. The endpoint should show up in the console after Package Manager checks in, and the Computer will show "Awaiting Updates" until the EPM Client and Console Adapter are fully installed. With this in mind, we recommend using Package Manager for handling the installation f

A collection of racing stripes for BeyondTrust Endpoint Privilege Management on macOS  Racing Stripes The following racing stripes proved helpful in our initial deployment and ongoing support of BeyondTrust Endpoint Privilege Management for macOS.Continue reading …

Recently I began a to take a journey to leverage EPM as a logging method for those pesky “Workstation Admin Exceptions” for users who feel EPM agent gets in their way while doing work. Essentially, I have a policy that has everything set to Passive so that EPM can detect the elevations and log them for me, but not affect the end user’s ability to “Run as Administrator”. I am curious if anyone else has done something like this as well, and if I am going down the track.  I still have a few things to cover, but I wanted to get a feel what others have done to capture those delicate metrics to needed.

I would love to see something like this added to the policy creation section. Think of steps that would be removed by no longer needing to download an existing revision, create a blank policy, and finally importing your revision over the blank. It’s a small thing but when you do it all the time, it’s not so small.

Despite trying multiple time the package manager does not install the client and adapter on a windows workstation.Configured Computer Group - enabled Package Manager and Computer status in PMC console is awaiting updates for both adapter and client.Location : C:\Program Files\Avecto has only package manager folder.Any recommendations to resolve this problem? 

Hey all, There are some applications that are only allowed for exceptional users ( for example - pentesting tools ). So in order to access them they have to be added in the AD group for access. If the user needs the same application access for only 3-4 days for project purpose, having ServiceNow integration available for us cannot make those applications available over this integration as well as over the JIT feature .  So is there any integration that can make this custom access possible.?  

Easily assign macOS computers to a BeyondTrust Endpoint Privilege Management High, Medium or Low Workstyle Flexibility via a Jamf Pro Script ParameterWorkstyle FiltersWhile BeyondTrust Endpoint Privilege Management for Windows policy Workstyles can be filtered based on Microsoft Entra ID groups — as of this writing — macOS policy Workstyles cannot.For macOS, each users’ account must be added to an existing local group for every Mac in your fleet.Continue reading …

The Adoption Assurance team is excited to announce that product onboarding guides are now available within the Privilege Management Console for all PM Cloud customers!Although these guides were designed with new users in mind, they are available on-demand for anyone with PM Console access. GIFs, pictures, tooltips and written instructions have been combined to create a guide experience that is concise, and accessible to users of all levels of expertise. Topics covered include Policy Set Up, Organizing Computers, User Creation, Installation and more. To access the in-product onboarding guides, simply open the Knowledge Center from within the PM Console by clicking the floating “?” icon (which is visible from anywhere within the console). Once you have opened the Knowledge Center, select your topic of interest from those that are listed to launch the corresponding guide! We hope that you find these guides both helpful, and informative! Moving forward, our team will be actively seeking ou

Are there any documentation/KB available for the mass deployment of EPM-W Package Manager?

Working on a solution using WMI filters and trying to test on non-persistent VMs with a test policy - but not finding the VMs are showing up under assets (under today versus last 90 days).   Names of the VMs are reused so am seeing stale instances - but not current session.   The VMs are destroyed upon log off and re-created once they are logged into again.  We currently deploy XML files with the images to ensure policies are applied immediately.  Have tried using command line updates to force check in - but perhaps there is a better way?