Skip to main content

Windows & MacOS

A localized space to talk about EPM, specifically for Windows And Mac OS's.

  • 188 Topics
  • 507 Replies
188 Topics
D
dennedyApprentice
asked in Windows & MacOS
Proxy PAC file for EPM-W (cloud)

Does anyone know for the proxy settings for EPM described in https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sys_kb_id=ef0fc35b47534654b77b3ddbd36d43f8 , specifically the per user section, can a URL to a PAC file be used? I saw another KB about configuring the local Windows system account to use a script based proxy. https://beyondtrustcorp.service-now.com/csm?sys_kb_id=455587d0476f02d4b77b3ddbd36d43d1&id=kb_article_view&sysparm_rank=3&sysparm_tsqueryId=e7573b9847582e5cb77b3ddbd36d439f I think we’d prefer the first one as we know it will only affect the cloud adapter and not all services running as system.

2687
Paul
BeyondTrust Employee
B
bt101Veteran
asked in Windows & MacOS
ai.exe - bad Image error Managed Hook Exclusions

Hi All, we are seeing DLL related error pop-ups on multiple machines windows 10, 11 when users try to open MS Office apps - PowerPoint, excel , word they see ai.exe - Bad Image. We have managed hook exclusion for ai.exe as well as full path:  Xyz:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AI\ai.exe.EPP agent 24.3 . Is anyone else seeing these and were able to fix it.I had posted similar error for msedgewebview2.exe We still see that error but for ai.exe with increased copilot usage a lot many users are seeing this now 

1742
B
J
jbwood919Apprentice
asked in Windows & MacOS
JIT Admin request UI

It doesnt appears its possible to remove access to this from the user EPM app menu but just wanted to verify thanks.

3993
J
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Mar 10 - Mar 17)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022120 - DLL registration policies cause failures with error "The module was loaded but the call to dllregisterserver failed with error code 0x80070005" KB0022121 - EPM Policy Editor issue - Opening more than one instance, or browser tab, causes it to become unresponsive

470
GloriaB
BeyondTrust Employee
tclowater
BeyondTrust Employee
tclowaterBeyondTrust Employee
posted in Windows & MacOS
Bulk move computers to different computer groups with API methods

OverviewThis document provides guidance on how to use the Swagger UI for a no-code solution to moving computers to computer groups. IntroductionFor those who want to be able to bulk move computers in EPM SaaS, there is no GUI-provided way to do so. That said, we do provide the API method to assign computers to a group ID either as a one-off or in bulk via a CSV. As support will not provide break/fix support on troubleshooting code choices. The guidance here is based on using the Swagger UI provided with EPM - available with BeyondInsight on-prem, and EPM SaaS. Remember, with great API power comes with great API risks: Test. Test. Take snapshots of where things were for faster roll-back (e.g. download CVE of computers pre-change). Test before bulk moving production. Please. If the API isn’t returning the anticipated data or if the documentation is followed with challenging results? Yes, contact support. Want help structuring your code? No, that is outside the scope of support. Materials

1294
Josh Bristow
M
MichaelDVeteran
asked in Windows & MacOS
CIS Benchmark guides?

Hi all - we are starting to align more closely with Security around our EPM solution.  Is there a hardening guide around EMPfW/M? CIS benchmarks often do this around various products (Windows, mac, ubuntu, Browers etc); is there a guide that exists around EPM?  This would help us document our defined Technical Controls more easily than going through setting by setting and also ensure we are following security best practices around EMP.  

1174
Paul
BeyondTrust Employee
M
ManasviApprentice
asked in Windows & MacOS
Unable to Uninstall EPM Client

Hi Team,We are unable to uninstall EPM client on the endpoint getting an error while uninstalling the client.(Installed client using the Package Manager) Followed KB0017295 for the uninstallation process still getting the same error Is there any solution for how to uninstall client from endpoint? 

1333
P
BeyondTrust Employee
P
BeyondTrust Employee
PACBeyondTrust Employee
posted in Windows & MacOS
BT25-01 advisory for EPM for Windows

Regarding CVE-2025-0889https://nvd.nist.gov/vuln/detail/CVE-2025-0889A vulnerability has been discovered in Privilege Management for Windows that allows for a local authenticated attacker to elevate privileges.Prior to 25.2, a local authenticated attacker can elevate privileges via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process. Further details about this CVE can be found here:https://www.beyondtrust.com/trust-center/security-advisories/bt25-01 There is also a Support KB, How can the BT25-01 advisory for EPM-W be addressed?, here:https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0022083 

1494
P
BeyondTrust Employee
Y
Yuvaraj NApprentice
asked in Windows & MacOS
How to block UAC prompt while installing or uninstalling an application?

We have whitelisted the applications under low flexibility. When tried to install or uninstall any whitelisted application, UAC is prompted. Suggest any step to stop UAC prompt.

1804
Y
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Feb 24 - Mar 3)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022066 - Files able to be moved to paths not defined in EPM-W content control KB0022077 - EPM Cloud not authenticating after changing OIDC settings from Azure B2B to another provider KB0022079 - Unable to connect to Hyper-V virtual machines while using EPM-W policy KB0022084 - EPM-M JIT application request stuck in pending status

350
GloriaB
BeyondTrust Employee
P
BeyondTrust Employee
Phillip LBeyondTrust Employee
published in Windows & MacOS
Customer Success Quarterly - 2025-Q1 - EPM
Customer Success Quarterly - 2025-Q1 - EPM

 Greetings! I'm Phillip Lehner, the Senior Director of Education at BeyondTrust, and I'm thrilled to lead our efforts in delivering exceptional learning experiences. I'm excited to share how we're elevating your journey with a new, streamlined method of accessing training: Success Included with BeyondTrust University.      At BeyondTrust University, we believe our customers deserve nothing short of excellence in the tools they use. That’s why we’ve launched 'Success Included' — to elevate your learning experience and ensure you achieve success with BeyondTrust’s solutions.  Success Included is an education program that makes foundational knowledge accessible to customers at no additional cost. It features easy-to-follow, self-paced eLearning courses that empower system administrators to configure and manage BeyondTrust products using industry best practices. Our goal is to equip learners with the knowledge needed to maximize the value of their investment with BeyondTrust. Because your

830
P
BeyondTrust Employee
MikeK
MikeKVeteran
posted in Windows & MacOS
EPM and Windows Autopilot

As technology advances so must we advance with it.My organization recently started down the path of Windows Autopilot for device enrollment into EntraID.Its been an interesting journey so far and we are only still in the development phase and internal closed testing. I’ve noticed a few things that might just be configurational issues with how we have Autopilot currently configured. One key thing that I’ve noticed recently was the EPM Token Elevation isn’t currently being elevated on my test system. After some googling there appears to be some enhanced lockdown and least privileged access that Autopilot does, which also affects the token elevation. I am curious what others have seen or noticed when going down this route and leveraging both systems.

1142
MikeK
J
JiaweiApprentice
asked in Windows & MacOS
Blocking PowerShell execution policies for Windows computers

Hello! Is there a way to block the PowerShell command such as Set-ExecutionPolicy on a local device using BeyondTrust Privilege Management?

1641
H
BeyondTrust Employee
J
JasperVeteran
asked in Windows & MacOS
Windows Store Apps definition

I had been trying to define Windows Store Apps as my Windows 11 devices keep getting these executables targeted under Default - Any Application which is generally Blocked under my definition. c:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.sechealthui_8wekyb3d8bbwe.appxc:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.ui.xaml.appxc:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.vclibs.appx I tried to use “Application Name” of “Microsoft.SecHealthUI” and “Application Publisher” of “Microsoft Corporation” (based on the analytics logs) but is not getting triggered. Under my definition, I used the filter “Windows Store Pkg Name” to point to the “Application Name” from the log and the “Windows Store Publisher” pointing to the Application Publisher, also based on the log. Amy I doing something wrong with my definition?  

1945
C
BeyondTrust Employee
Y
Yuvaraj NApprentice
asked in Windows & MacOS
To block installation of applications downloaded from external source or internet.

Hi All,We have a requirement to block the installation of applications downloaded from internet and it should pop up a block message asking users to reach to SD team for installation. Kindly provide the steps or idea to implement the same.Thanks in advance.

3193
N
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Feb 10 - Feb 17)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021759 - EPM Cloud error - Sorry the credentials you supplied cannot be used to login KB0022038 - EPM-W Cloud policy refresh using EndpointUtility error - Received unexpected status code 500 KB0022052 - Analytics full raw data not sent to Splunk

310
GloriaB
BeyondTrust Employee
Nikow
NikowApprentice
asked in Windows & MacOS
Uninstall TailScale App

Does anyone have experience with uninstalling the TailScale app on macOS?Tail from TailScale is a network extension which the user is not allowed to remove. Therefore the whole uninstallation is not possible.  

4163
P
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Feb 3 - Feb 10)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022000 - Sophos blocks elevation of Remote Support via EPM-W - Sophos is terminating this process KB0022011 - Error "InvalidUser=1 error" "Credentials could not be used" when logging into EPM Cloud with PingOne

330
GloriaB
BeyondTrust Employee
tclowater
BeyondTrust Employee
tclowaterBeyondTrust Employee
posted in Windows & MacOS
EPM Saas : Packages, Policies, and Preferable Practices

IntroductionThe overall goal is to provide a framework for confident change management process that keeps users happy, administrators happy, and avoid confidence disruptions that can plague deployments and operations teams for a long while after an issue occurs. 🤐 Preferable PracticesWhen it comes to maintaining a production environment, while ensuring proper testing is occurring, the following is a Preferable Practices guide. The aim of this is to provide an overview of potential structures for segregating testing from production and highlight use cases for staging rollouts with computer groups with a focus on stability, confidence, and operational procedures. > Best Practices are set by each organization and may have different requirements so, please follow your Best Practices as outlined by the change control policies of your organization! Computer GroupsThe core component for this structure is based on Computer Groups in EPM SaaS. Each computer group is assigned a policy with a

2100
tclowater
BeyondTrust Employee
M
mlajoieTrailblazer
asked in Windows & MacOS
Windows Terminal Shortcust

Hello.  I’m working on a way to elevate wt.exe.  If I right-click on the windows flag and select Terminal (Admin) or if I right-click on it from within the start menu, I am presented with a BT authentication message (as designed).  I enter my admin creds and it takes me to the Windows UAC.  It is hitting the application group “(Recommended) Add Basic Admin - Restricted LOLBAS” How can I pass the token through?

3484
M
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Jan 27 - Feb 3)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021958 - How to turn off JIT admin console for EPM-W on-prem KB0021997 - EPM-W COM class elevation rule fails when 'EnableSvchostMitigationPolicy' is involved KB0021999 - How to configure AWS S3 bucket to work with EPM Cloud SIEM KB0022009 - JIT admin session won't end stuck on "in progress" status

320
GloriaB
BeyondTrust Employee
M
ManasviApprentice
asked in Windows & MacOS
Unable to upgrade EPM client and Adaptor version EPM-M

we encountered difficulties upgrading the EPM client and adapter version on endpoints via Jamf. When the latest version was pushed to the endpoints through Jamf, it did not successfully override the existing versions of the client and adapter.

902
E
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Jan 20 - Jan 27)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021465 - EPM-M sudo error - This sudo command requires identity provider authentication, which is an unsupported configuration KB0021643 - Endpoint utility - Endpointutility.exe explanation of commands KB0021958 - How to turn off JIT admin console for EPM-W on-prem

420
GloriaB
BeyondTrust Employee
D
DanielApprentice
asked in Windows & MacOS
Opening admin command prompt as another user?

We’re running EPM in a mostly windows environment. Some support/admin users have secondary accounts that have all their elevated AD credentials, like domain admin for example. When we try to run an elevated command prompt it opens it as admin of the current/primary user account. They need to be able to open an admin CMD as the second user that has the elevated AD credentials. Any suggestions on how to pull that off? The users are all in a high flex workstyle. Thanks. 

6509
B
M
ManasviApprentice
asked in Windows & MacOS
How to block dmg file installation in EPM-M

Hi Team,How to block dmg file installation in EPM-M we are unable to block installation for dmg file as well as package installer. The blocking rule is ineffective for application installations, whereas the actions related to allowing or requesting installations are functioning as intended.

591
J

Badge Earners

Show all badges
Terms & ConditionsCookie settings