Skip to main content

Windows & MacOS

A localized space to talk about EPM, specifically for Windows And Mac OS's.

  • 77 Topics
  • 269 Replies
77 Topics
J
Jens HansenVeteran
posted in Windows & MacOS
EPM Release notes: Version naming and consistency.

Naming consistency and transparency are aspects I really liked when BT changed to the new version formatting for release notes: Year, Major Version, and Minor Version. If we look at the sample here, with the exception of the new 24.5 MR2, we had consistency and knew the version we had. MR2 has, for some reason, snuck back, leaving us hanging in the unknown version 24.5.XYZ or 24.5.TRE. Who knows?😂What are you take on the naming? 

1352
P
BeyondTrust Employee
2 months ago
J
JasperRising Star
asked in Windows & MacOS
iisreset.exe access denied error via elevated CMD

Anybody else encountered an issue with iisreset via commandline where the error coming up is “Access Denied” after running an elevated CMD?

2379
C
2 months ago
J
JasperRising Star
asked in Windows & MacOS
EPM filter not working for on-prem sync group to EntraID

I have a hybrid environment where my on-prem AD group accounts are created and then later on syncd to Entra ID. When I add one of the syncd groups, the filter does not get applied at all. Does anybody know how EPM checks for which group a user belongs to? I tried creating a separate Entra ID cloud group and added myself as a member, got the sync completed via the API, then added an account filter using this group, still does not get applied. What am I missing?

16815
Paul
BeyondTrust Employee
2 months ago
M
mlajoieApprentice
asked in Windows & MacOS
Windows Terminal Shortcust

Hello.  I’m working on a way to elevate wt.exe.  If I right-click on the windows flag and select Terminal (Admin) or if I right-click on it from within the start menu, I am presented with a BT authentication message (as designed).  I enter my admin creds and it takes me to the Windows UAC.  It is hitting the application group “(Recommended) Add Basic Admin - Restricted LOLBAS” How can I pass the token through?

972
Paul
BeyondTrust Employee
2 months ago
S
ScottieApprentice
posted in Windows & MacOS
Cloud EPM and SIEM Integration (Sentinel)

Good day everyone! So recently we have begun to ingest EPM log into MS Sentinel, and I have noticed a difference in the data we see in the console Analytics vs Sentinel. Firstly the integration was simple and straight forward.  Once configured we began to see information flow into Sentinel.  This is not a problem and seems to be working well, we used the CIM format.What we are seeing is good, but it is nowhere near the information we see in the console analytics.Example I will use is logons.  We can see logons in both the analytics and Sentinel, however there is information missing in the information we see in Sentinel, namely privilege. So in the analytics I can see and search on the client privilege, and status of the account (domain, local), but in Sentinel I am not.I just wanted to start a conversation with others who are using a SIEM with EPM or plan too int he near future.  We could compare experiences and possibly see what in store for the future from Beyond Trust.  Thanks, and

1935
James Allan
BeyondTrust Employee
2 months ago
Josh Bristow
Josh BristowVeteran
posted in Windows & MacOS
Analytics v2 - Parent Process question

Maybe I’m missing it but is there a way in Analytics v2 to filter out child process events to only show the parent process item. We used to have a ‘Match on Parent’ filter in v1. 

1306
Josh Bristow
2 months ago
S
BeyondTrust Employee
Stephen Langford-JonesBeyondTrust Employee
posted in Windows & MacOS
EPM-M macOS Sequoia known issues

Hey everyone, with the official release of macOS Sequoia on September 16th, the question about Endpoint Privilege Management and macOS Sequoia support has come in. We are working hard to resolve the issues found. Below is a list of known issues for the macOS Sequoia operating system. Wrong description of endpoint in PMC as "macOS 15.0.0"The PM SaaS Adapter does not correctly identify the macOS Sequoia systems. As a result, the computer OS description will show as "macOS 15.0.0" instead of macOS Sequoia in the portal.Workaround: NoneResolution: We plan to resolve this in EPM-M 24.5 MR2, planned for late September. We are updating our adapter to send the correct description.Knowledge base article: KB0021576 Applications open in the backgroundApplications on Sequoia are not displayed in the foreground when the EPM-M dialog is not completed in a timely manner. We have informed Apple via Feedback Assistant and awaiting a response.Workaround: The application will launch, and the user can cli

12364
T
BeyondTrust Employee
2 months ago
R
RJ.Apprentice
asked in Windows & MacOS
WPE policy signing (CERT_MODE=2)

Hi everyone,With ON-PREM BI/EPM-W it is my understanding that the WPE is generally planned to replace the MMC policy editor at some point, but that point hasn’t yet occurred. This is unlike PMCloud where MMC policy editor is deprecated and no longer supported.My organization uses CERT_MODE=2 to require the clients to only recognized code-signed policies. This is seen as a valuable control to reduce risks related to internal or external bad actors plausibility reverse engineering corporate policy XMLs and creating their own (overly permissive or malicious) policy.To the best of my knowledge BeyondTrust does not have a plan or timeline to add WPE-based code-signing. I figured policy signing would be added to WPE but now ~2 years after it’s introduction I see no indication of it coming.As CERT_MODE=2 only recognizes code-signed policies and WPE cannot provide code signing, this makes WPE unusable for my organization.BeyondTrust, respectfully - do you plan to add code-signing to WPE or do

2125
R
2 months ago
N
BeyondTrust Employee
NeilBeyondTrust Employee
posted in Windows & MacOS
(PMC) Using Package Manager to Handle Initial EPM Cloud Deployments

Did you know that when you’re initially deploying EPM-W or EPM-M, you can simply deploy Package Manager and it will handle installing the other Privilege Management components (Client and Console Adapter) for you? The configuration for Package Manager is set at the Computer Group level, so the computer does not need to be listed in the PM Console first. During the installation of Package Manager, we specify which Computer Group we want the endpoint to reside within the install string. In other words, if Package Manager is installed first, it will list the computer in the PM Console immediately after install, so there is no need for the Console Adapter installed first as long as Package Manager is present on the endpoint. The endpoint should show up in the console after Package Manager checks in, and the Computer will show "Awaiting Updates" until the EPM Client and Console Adapter are fully installed. With this in mind, we recommend using Package Manager for handling the installation f

2414
L
2 months ago
dan-snelson
dan-snelsonNewcomer
posted in Windows & MacOS
BeyondTrust EPM: Racing Stripes

A collection of racing stripes for BeyondTrust Endpoint Privilege Management on macOS  Racing Stripes The following racing stripes proved helpful in our initial deployment and ongoing support of BeyondTrust Endpoint Privilege Management for macOS.Continue reading …

1232
LukeV
BeyondTrust Employee
2 months ago
MikeK
MikeKTrailblazer
posted in Windows & MacOS
Leveraging EPM for elevation logs

Recently I began a to take a journey to leverage EPM as a logging method for those pesky “Workstation Admin Exceptions” for users who feel EPM agent gets in their way while doing work. Essentially, I have a policy that has everything set to Passive so that EPM can detect the elevations and log them for me, but not affect the end user’s ability to “Run as Administrator”. I am curious if anyone else has done something like this as well, and if I am going down the track.  I still have a few things to cover, but I wanted to get a feel what others have done to capture those delicate metrics to needed.

2638
MikeK
2 months ago
Josh Bristow
Josh BristowVeteran
posted in Windows & MacOS
Policy Creator - New Option Idea

I would love to see something like this added to the policy creation section. Think of steps that would be removed by no longer needing to download an existing revision, create a blank policy, and finally importing your revision over the blank. It’s a small thing but when you do it all the time, it’s not so small.

45414
Josh Bristow
2 months ago
S
ssethurajanApprentice
asked in Windows & MacOS
Package Manager Installation

Despite trying multiple time the package manager does not install the client and adapter on a windows workstation.Configured Computer Group - enabled Package Manager and Computer status in PMC console is awaiting updates for both adapter and client.Location : C:\Program Files\Avecto has only package manager folder.Any recommendations to resolve this problem? 

2464
Devin Churchill
BeyondTrust Employee
2 months ago
A
Akshay SharmaVeteran
asked in Windows & MacOS
Custom access for applications not allowed for everyone.

Hey all, There are some applications that are only allowed for exceptional users ( for example - pentesting tools ). So in order to access them they have to be added in the AD group for access. If the user needs the same application access for only 3-4 days for project purpose, having ServiceNow integration available for us cannot make those applications available over this integration as well as over the JIT feature .  So is there any integration that can make this custom access possible.?  

863
A
2 months ago
dan-snelson
dan-snelsonNewcomer
posted in Windows & MacOS
BeyondTrust EPM: Flexibilities

Easily assign macOS computers to a BeyondTrust Endpoint Privilege Management High, Medium or Low Workstyle Flexibility via a Jamf Pro Script ParameterWorkstyle FiltersWhile BeyondTrust Endpoint Privilege Management for Windows policy Workstyles can be filtered based on Microsoft Entra ID groups — as of this writing — macOS policy Workstyles cannot.For macOS, each users’ account must be added to an existing local group for every Mac in your fleet.Continue reading …

1933
J
2 months ago
B
BeyondTrust Employee
BrandonBeyondTrust Employee
posted in Windows & MacOS
PM Cloud Onboarding Guides Now Available Within the PM Console

The Adoption Assurance team is excited to announce that product onboarding guides are now available within the Privilege Management Console for all PM Cloud customers!Although these guides were designed with new users in mind, they are available on-demand for anyone with PM Console access. GIFs, pictures, tooltips and written instructions have been combined to create a guide experience that is concise, and accessible to users of all levels of expertise. Topics covered include Policy Set Up, Organizing Computers, User Creation, Installation and more. To access the in-product onboarding guides, simply open the Knowledge Center from within the PM Console by clicking the floating “?” icon (which is visible from anywhere within the console). Once you have opened the Knowledge Center, select your topic of interest from those that are listed to launch the corresponding guide! We hope that you find these guides both helpful, and informative! Moving forward, our team will be actively seeking ou

1130
B
BeyondTrust Employee
2 months ago
A
Akshay SharmaVeteran
asked in Windows & MacOS
Task manager acting abnormally

In PMFW , we are seeing cases where after upgrading from windows 10 to windows 11 .  the task manager when opened normally does not open instead it asks for admin privileges  and give Level 2 admin elevation prompts to access Task manager. How can we fix this with help of beyondtrust.

2194
A
2 months ago
J
Jeffrey S.Newcomer
posted in Windows & MacOS
Visual Studio/Github users?

Hi All, Any Admins out there have users using Visual Studio 2022 connecting to Github Repos while on EPM? Did you guys have to do anything different to get it to work? 

461
A
2 months ago
S
ssethurajanApprentice
asked in Windows & MacOS
EPM-W PMC Package Manager

Are there any documentation/KB available for the mass deployment of EPM-W Package Manager?

2215
M
2 months ago
A
anorwoodNewcomer
asked in Windows & MacOS
Anyone working with non-persistent VMs?

Working on a solution using WMI filters and trying to test on non-persistent VMs with a test policy - but not finding the VMs are showing up under assets (under today versus last 90 days).   Names of the VMs are reused so am seeing stale instances - but not current session.   The VMs are destroyed upon log off and re-created once they are logged into again.  We currently deploy XML files with the images to ensure policies are applied immediately.  Have tried using command line updates to force check in - but perhaps there is a better way?  

911
P
BeyondTrust Employee
2 months ago
John Trask
Community Manager
John TraskCommunity Manager
posted in Windows & MacOS
Community Sections Merged: EPM - Windows & Mac

Hi All,  We have heard your feedback and have merged the individual Windows and Mac sub-sections into one new combined Windows & MacOS sub-section. We have also created a few new Tags as well to help you classify your post.  New Tags: Windows, MacOS, Windows & MacOS Thank you all for the feedback!

805
Josh Bristow
2 months ago
N
Nervous-EquivalentApprentice
asked in Windows & MacOS
MacOS 15 - Screen & System Audio Recording

After moving to MacOS 15 I had a user notice that their Privacy and Security > Screen & System Audio Recording permissions for Microsoft Edge were disabled. This is a High Flex user, but they are unable to re-enable those permissions for Edge in the Screen & System Audio Recording settings page. They get a stock MacOS Admin prompt popup when they attempt to do so, and no record of the event in Analytics. Does anyone know how to allow High Flex users to edit settings in Privacy and Security > Screen & System Audio Recording? Edit: Not sure how to delete posts yet but turns out EPM wasn’t working at all after MacOS 15 because the admin accounts required for EPM to work were removed during the update. Repushing the client fixed the problem.

4112
S
BeyondTrust Employee
3 months ago
P
postuserApprentice
asked in Windows & MacOS
Whitelisting Onedrive & MS teams in Windows Medium Flex policy

How to whitelist the two events below on Windows Medium Flex policy?   

1552
Paul
BeyondTrust Employee
3 months ago
dan-snelson
dan-snelsonNewcomer
posted in Windows & MacOS
BeyondTrust EPM: Inspector

 Leverage swiftDialog to display a user-friendly message about the health of BeyondTrust Endpoint Privilege Management for Mac, while capturing various under-the-hood settings behind-the-scenesInspirationDuring a recent case with BeyondTrust Support, we were asked to obtain the output of several elevated Terminal commands from the affected user’s Mac.Having previously written a similar solution for CrowdStrike Falcon, creating a health inspector for BeyondTrust EPM seemed like the obvious solution.Continue reading …

621
Lindsay Gallant
BeyondTrust Employee
3 months ago
S
ssethurajanApprentice
asked in Windows & MacOS
EPM-W Non Domain Joined

Does EPM-W support installing agents on non-domain joined machines?Currently, they use local personal accounts to login to the system -how to apply the policies to these specific users?

751
LukeV
BeyondTrust Employee
3 months ago

Badge Earners

  • BCIE: Privileged Remote Access
    Bruceyhas earned the badge BCIE: Privileged Remote Access
  • BCIE: Remote Support
    Bruceyhas earned the badge BCIE: Remote Support
  • BCA: Privileged Remote Access
    linehas earned the badge BCA: Privileged Remote Access
  • BCA: Password Safe
    linehas earned the badge BCA: Password Safe
  • BCA: Password Safe
    MedBouhas earned the badge BCA: Password Safe
Show all badges
Terms & ConditionsCookie settings