Skip to main content

Windows & MacOS

A localized space to talk about EPM, specifically for Windows And Mac OS's.

  • 131 Topics
  • 401 Replies
131 Topics
J
JiaweiNewcomer
asked in Windows & MacOS
Blocking PowerShell execution policies for Windows computers

Hello! Is there a way to block the PowerShell command such as Set-ExecutionPolicy on a local device using BeyondTrust Privilege Management?

781
H
BeyondTrust Employee
J
JasperRising Star
asked in Windows & MacOS
Windows Store Apps definition

I had been trying to define Windows Store Apps as my Windows 11 devices keep getting these executables targeted under Default - Any Application which is generally Blocked under my definition. c:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.sechealthui_8wekyb3d8bbwe.appxc:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.ui.xaml.appxc:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.vclibs.appx I tried to use “Application Name” of “Microsoft.SecHealthUI” and “Application Publisher” of “Microsoft Corporation” (based on the analytics logs) but is not getting triggered. Under my definition, I used the filter “Windows Store Pkg Name” to point to the “Application Name” from the log and the “Windows Store Publisher” pointing to the Application Publisher, also based on the log. Amy I doing something wrong with my definition?  

1425
C
BeyondTrust Employee
Y
Yuvaraj NApprentice
asked in Windows & MacOS
To block installation of applications downloaded from external source or internet.

Hi All,We have a requirement to block the installation of applications downloaded from internet and it should pop up a block message asking users to reach to SD team for installation. Kindly provide the steps or idea to implement the same.Thanks in advance.

1383
N
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Feb 10 - Feb 17)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021759 - EPM Cloud error - Sorry the credentials you supplied cannot be used to login KB0022038 - EPM-W Cloud policy refresh using EndpointUtility error - Received unexpected status code 500 KB0022052 - Analytics full raw data not sent to Splunk

280
GloriaB
BeyondTrust Employee
Nikow
NikowApprentice
asked in Windows & MacOS
Uninstall TailScale App

Does anyone have experience with uninstalling the TailScale app on macOS?Tail from TailScale is a network extension which the user is not allowed to remove. Therefore the whole uninstallation is not possible.  

2343
P
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Feb 3 - Feb 10)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022000 - Sophos blocks elevation of Remote Support via EPM-W - Sophos is terminating this process KB0022011 - Error "InvalidUser=1 error" "Credentials could not be used" when logging into EPM Cloud with PingOne

310
GloriaB
BeyondTrust Employee
tclowater
BeyondTrust Employee
tclowaterBeyondTrust Employee
posted in Windows & MacOS
EPM Saas : Packages, Policies, and Preferable Practices

IntroductionThe overall goal is to provide a framework for confident change management process that keeps users happy, administrators happy, and avoid confidence disruptions that can plague deployments and operations teams for a long while after an issue occurs. 🤐 Preferable PracticesWhen it comes to maintaining a production environment, while ensuring proper testing is occurring, the following is a Preferable Practices guide. The aim of this is to provide an overview of potential structures for segregating testing from production and highlight use cases for staging rollouts with computer groups with a focus on stability, confidence, and operational procedures. > Best Practices are set by each organization and may have different requirements so, please follow your Best Practices as outlined by the change control policies of your organization! Computer GroupsThe core component for this structure is based on Computer Groups in EPM SaaS. Each computer group is assigned a policy with a

1710
tclowater
BeyondTrust Employee
M
mlajoieRising Star
asked in Windows & MacOS
Windows Terminal Shortcust

Hello.  I’m working on a way to elevate wt.exe.  If I right-click on the windows flag and select Terminal (Admin) or if I right-click on it from within the start menu, I am presented with a BT authentication message (as designed).  I enter my admin creds and it takes me to the Windows UAC.  It is hitting the application group “(Recommended) Add Basic Admin - Restricted LOLBAS” How can I pass the token through?

3054
M
A
AngelaNewcomer
asked in Windows & MacOS
How to switch between the policy distribution models for EPM-W

Can someone please assist with how to switch between policy distribution models?I am trying to prepare for the EPM-W lab assessment, and one of the items states: Explain how to switch between the policy distribution models.I have searched my notes from the training, the BeyondTrust Knowledge Base, support documentation, and all online resources I could find, including this forum, but I have not found any information on how to switch between the different policy distribution models.Can someone provide information on how that would be done or where I can locate specific information on this?Thank you in advance.

691
P
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Jan 27 - Feb 3)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021958 - How to turn off JIT admin console for EPM-W on-prem KB0021997 - EPM-W COM class elevation rule fails when 'EnableSvchostMitigationPolicy' is involved KB0021999 - How to configure AWS S3 bucket to work with EPM Cloud SIEM KB0022009 - JIT admin session won't end stuck on "in progress" status

300
GloriaB
BeyondTrust Employee
M
ManasviApprentice
asked in Windows & MacOS
Unable to upgrade EPM client and Adaptor version EPM-M

we encountered difficulties upgrading the EPM client and adapter version on endpoints via Jamf. When the latest version was pushed to the endpoints through Jamf, it did not successfully override the existing versions of the client and adapter.

702
E
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Jan 20 - Jan 27)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021465 - EPM-M sudo error - This sudo command requires identity provider authentication, which is an unsupported configuration KB0021643 - Endpoint utility - Endpointutility.exe explanation of commands KB0021958 - How to turn off JIT admin console for EPM-W on-prem

310
GloriaB
BeyondTrust Employee
D
DanielApprentice
asked in Windows & MacOS
Opening admin command prompt as another user?

We’re running EPM in a mostly windows environment. Some support/admin users have secondary accounts that have all their elevated AD credentials, like domain admin for example. When we try to run an elevated command prompt it opens it as admin of the current/primary user account. They need to be able to open an admin CMD as the second user that has the elevated AD credentials. Any suggestions on how to pull that off? The users are all in a high flex workstyle. Thanks. 

3079
B
M
ManasviApprentice
asked in Windows & MacOS
How to block dmg file installation in EPM-M

Hi Team,How to block dmg file installation in EPM-M we are unable to block installation for dmg file as well as package installer. The blocking rule is ineffective for application installations, whereas the actions related to allowing or requesting installations are functioning as intended.

431
J
M
MichaelDRising Star
asked in Windows & MacOS
EPMfM Awaiting Update from 24.5.2.3 to 24.7.0.1

Good morning -- I have our Client & Adapter updates enabled in our environment and it should be updating the clients to the latest version of both the adapter and the client. However, my client has stayed on version 24.5.2.3 when 24.7.0.1 is available.  In the update section, it does see we have two devices “awaiting update”.  Am I missing something or isn’t this suppose to occur when the machine checks in?   The machine is online and the console see that it last spoke about 30 minutes ago.  Have I misunderstood and or misconfigured something? I’m new to the management space on the EMPfM side so forgive my slowness. 

1165
J
M
mlajoieRising Star
asked in Windows & MacOS
Apple Mail

Good morning.  We don’t allow the use of mail.app on our enterprise devices so we’ve put a block on it.  No big deal - it was working exactly how we intended.  Now, however, after upgrading to Sequoia, we’re seeing MailCacheDelete.appexauto-launching to delete the cache and EPM is seeing mail.app being opened, causing a block.  While this, generally, isn’t bad, it does cause a bad user experience.  Now, the user gets, seemingly, random blocks for mail.app when they didn’t even launch it.I’d like to block and suppress the message for just this deletion process.  I’d also like to have it continue to provide a blocked message when a user tries to open it manually.Any thoughts on how best to accomplish this? Sample logs:com.beyondtrust.endpointsecurity: [com.beyondtrust.endpointsecurity:EndpointSecurity] Blocking 23252 /System/Applications/Mail.app/Contents/PlugIns/MailCacheDelete.appex/Contents/MacOS/MailCacheDelete2025-01-06 13:53:50.286695-0600 0x699701 Default 0x0

632
M
J
JayRobApprentice
asked in Windows & MacOS
Auditing software usage with EPM without precluding rule matches lower in hierarchy?

I’m interested in auditing certain software and/or commands using EPM, but if I create an audit rule with an application that matches what I’m looking for high in my Workstyle hierarchy, rules that would match lower down will not fire, and if I create it low in the hierarchy the inverse is true. I understand that this is pretty foundational behavior for EPM, but I feel like i’m missing something simple here, or it’s just not possible. It seems like if i want this data, whether it be simply for visibility, or for measuring expected impact of a planned change, I could do one of the following…LOG ALL THE THINGS!!! Update all of my rules to raise a local even and report events, then filter what I want in my SIEM. The downside is that this would be expensive, and result in a lot of noise in the EPM console. Not really an option. Duplicate Groups and Rules!!! Create duplicate “logging” application groups + rules with raise a local event and report events enabled for any rules we aren’t alre

1392
J
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Jan 6 - Jan 13)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021898 - EPM-W and BITS transfer - How to allow installation KB0021899 - How to block users from accessing Users & Groups with EPM-M KB0021900 - EPM-M and third party system extensions KB0021923 - Elevation Method or Authorization Method column missing in exported Analytics csv file KB0021937 - EPM-W block message replaced by Windows 11 message - This app has been blocked by your system administrator

660
GloriaB
BeyondTrust Employee
N
naidu_jstsRising Star
asked in Windows & MacOS
Block delete /Applicaitons & install specific /Applications

How to Block Delete from /Applications in MAC? how to allow Install specific apps in /Applications in MAC?Is there a common configuration for all versions of MAC, as we see its behaving different on every version of MAC.

622
N
D
dennedyApprentice
asked in Windows & MacOS
Possible to update group assignment through local script?

Starting to use PM Cloud now and looking to see if it is possible to update group assignment using a local scripting job. We used to do this before with stopping services, changing some registry keys, and starting services. This is helpful if we want group membership to change dynamically based on something that might not be in AD.

705
J
M
ManasviApprentice
asked in Windows & MacOS
Alternative Port for port 445 (Beyondinsight EPM-W)

Hi,Is their any alternative for the port 445 to manage discovery scans for asset in BI-EPM.

643
Paul
BeyondTrust Employee
M
ManasviApprentice
asked in Windows & MacOS
Block Rule Not Working

Hi Team, "We have configured a policy in EPM-MAC to block the installation of unknown applications. However, when attempting to install an unknown application, the block action does not prevent standard users from proceeding with the installation. When we configure the policy to either 'Allow' or 'Request EPM Message,' it functions as expected, based on the action set (Allow/Request). The issue appears only for the 'Block' action within the application rule, as it is not being enforced properly."Is their any suggestions why it is happening with the policy?

1531
James Allan
BeyondTrust Employee
M
MichaelDRising Star
asked in Windows & MacOS
Rotating Challenge Response 'key' on a daily basis - EPMfW/M

Has anyone implemented a solution that changes the Challenge Response “key” on a frequent basis (Ideally daily).   We have CyberArk, so theoretically could store in their vault but looking to see what options might be available. 

453
Paul
BeyondTrust Employee
E
egemenApprentice
asked in Windows & MacOS
Epm-W delete policy

For EPM Windows, is there any way to remove the policy on endpoint agent.I want the turn them into first no policy “monitoring” state in certain conditions. thinking about changing the smart rule. I gave empty smart rule to the machine but latest policy on it remains there.Can I do it on smart rules or something without and rdp? Or I always need to delete the xml under Program Data?

523
J
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Dec 30 - Jan 6)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021855 - EPM-W installation fails with error 1603 on Windows 24H2 ARM devices

740
GloriaB
BeyondTrust Employee

Badge Earners

  • BCA: Endpoint Privilege Management - Windows
    Hakasehas earned the badge BCA: Endpoint Privilege Management - Windows
  • BCA: Endpoint Privilege Management - Mac
    Hakasehas earned the badge BCA: Endpoint Privilege Management - Mac
  • BCA: Remote Support
    Hakasehas earned the badge BCA: Remote Support
  • BCA: Endpoint Privilege Management - Mac
    joselopezhas earned the badge BCA: Endpoint Privilege Management - Mac
  • BCA: Password Safe
    gnajerahas earned the badge BCA: Password Safe
Show all badges
Terms & ConditionsCookie settings