Skip to main content

Windows & MacOS

A localized space to talk about EPM, specifically for Windows And Mac OS's.

  • 144 Topics
  • 425 Replies
144 Topics
B
Binoy_DeyNewcomer
asked in Windows & MacOS
Does full admin token prevent application control in screen sharing?

If any Process starts with admin rights added to token, then won’t it be possible to give control of that application while sharing screen in a Microsoft Team’s or Google Meet call?

922
A
B
bt101Veteran
asked in Windows & MacOS
EPM-Windows : On-demand rules trigger OS UAC prompts instead of EPM

Hello, on EPM Windows 24.3 client , when the client is first installed and computer is not restarted , we are seeing that on-demand rules (run as admin ) still trigger UAC. All other actions trigger EPM prompts. Also, the policy gets applied as expected but it cannot be refreshed. e.g. while deploying the policy is v.10 then the computers gets the policy v.10 but when we do refresh it gives message “check internet connectivity ..” If we update policy to v.11 it wont get applied. PMC console is reachable for the hosts. Once the computer is restarted , policy can be refreshed as well as the on-demand rules also start working. Policy has on-demand rules enabled . (On-demand integration setting is enabled to apply to run as admin option). We do not want to force users to restart their computers. Is there any workaround ? Running the PG Tray Icon file shows the icon in task tray ( by default it is not available before restart) but it cant refresh the policy for above mentioned reason. 

1611
J
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Oct 28 - Nov 4)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021683 - Sequoia pop-up when opening unsigned apps - "App Name" not opened KB0021694 - Error 1603 when installing CCH Axcess via an EPM-W elevated application rule KB0021703 - Changes to the EPM-W QuickStart policy to address Microsoft Narrator behavior KB0021710 - Remote PowerShell and EPM-W authentication message behavior

970
GloriaB
BeyondTrust Employee
Scatts
BeyondTrust Employee
ScattsBeyondTrust Employee
posted in Windows & MacOS
You asked, we listened….Policy Difference: EPM Cloud 24.6

You asked, we listened…. with over 200 votes in our Aha! Ideas portal, the most popular feature request for EPM, and it is here….Policy Difference. Users will be able to compare policy revisions, pinpoint changes, track who made them and when, solving for auditing and streamlining policy troubleshooting use cases. This feature presents differences between two policy revisions in an easy-to-read, text-based format, allowing for enhanced control over policy management. Save time and gain full visibility into policy changes with our intuitive policy revision comparison tool, scheduled to be released in EPM Cloud 24.6. Here is a sneak preview:  

67214
Scatts
BeyondTrust Employee
H
BeyondTrust Employee
HowardBeyondTrust Employee
posted in Windows & MacOS
Kick Start to EPM Windows & mac OS

Many organizations face the same challenging questions in their initial deployment of the EPM tool.Where do I even start with for the policy design? How can I use EPM to allow and block applications? How do I find local administrators privileges on the endpoints? How can I prevent users from running applications outside of these trusted folders (Windows, Program Files)EPM is designed with the flexibility to control and elevate applications, many of the above questions can be achieve with the out-of-the box QuickStart policy template that combines BeyondTrust best practices into a set of rules that make it easy to get started with proactive endpoint protection. Out-of-the-box, the user’s security level is immediately improved without degrading the user experience or by “locking them down”. This is designed to be successful even with very little knowledge of the applications installed in an environment before deployment. Workstyle purposeThe QuickStart Policy consists of six preconfigure

5113
M
Josh Bristow
Josh BristowVeteran
asked in Windows & MacOS
Windows11 24h2 support

Has anyone had issues with Windows11 24h2? The support matrix shows its not officially supported, but I’m curious if anyone running it has had issues. We’re currently running the 23.9 client and 23.8 cloud adapter

5403
N
BeyondTrust Employee
M
ManasviApprentice
asked in Windows & MacOS
EPM policy workstyle Account filter not functioning with Azure AD groups on Windows

Hi, Scenario 1: The account filter is not functioning for the workstyle we applied. We used an Azure AD group to block the application in this workstyle, but the account filter does not work for the "Block App" workstyle. Instead, it qualifies for other workstyles. To clarify, we have listed the "Block App" workstyle at the top and the other workstyles below it. Scenario 2: When we remove the account filter and apply a computer filter by adding a hostname entry, the created block application rule will function correctly. Is the EPM policy workstyle Account filter not functioning with Azure AD groups on Windows?

1857
J
B
bt101Veteran
asked in Windows & MacOS
EPM-W : How to uninstall EPM Windows agent, adapter, and package manager

Hello, are there any caveats while uninstalling EPM windows components ? We have installed the Package Manager via SCCM which further installed the agent and adapter . On some of the computers we are not able to un-install these components from Add/Remove programs as well as CMD/PS using msiexec and GUID. user account in local admin group is being used to run these programs as admin. No agent protection is configured. Order of removal is PM agent. Adapter and then Package Manager . Tried deleting computer from EPM console before above steps as well. On some computers PM agent removal asks to close other open apps such as notepad. excel etc Adapter Version: 24.6.714.0Client Version: 24.5.361.0Package Manager Version: 24.6.697

8485
D
M
ManasviApprentice
asked in Windows & MacOS
Unable to run DISM or SFC commands on user's system.

Hi Team,Unable to run DISM or SFC commands on the user's system. I tried opening CMD as an Administrator, which prompts the BT pop-up. We approve, but it still doesn't allow me to proceed. I also attempted to open CMD from Task Manager but encountered the same issue.

1694
J
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Oct 21 - Oct 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021537 - EPM-W rule not matching Sublime Text Editor when using publisher in definition KB0021624 - EPM Cloud JIT Application Access walkthrough KB0021662 - When filtering Analytics in separate tabs they are not independantly honored KB0021663 - EPM-M configuration profile 2.2.1 - Sequoia vs Sonoma and lower KB0021682 - Package Manager unable to install EPM Client or Adapter due to time out KB0021683 - Sequoia pop-up when opening unsigned apps - "App Name" not opened

670
GloriaB
BeyondTrust Employee
C
Chris MorganApprentice
asked in Windows & MacOS
System Tray Icon disappearing randomly

Has anyone seen or reported in various version of the software that the system tray icon randomly does not display?Some things I do to get the icon back, but doesn’t work 100% of the time is disable the Avecto service and end all PGSystemTray processes.  Re-enable the Avecto service and run the Privilege Management software from the start menu.  About 80-85% of the time the icon gets restored, however there are 10-15% of the time it looks like something is there but does not display properly. 

3646
J
B
bt101Veteran
asked in Windows & MacOS
EPM-W : Allow uninstall of apps from add/remove programs

Hello! is there any way to allow users in high flex to uninstall any applications using Windows Add/Remove Programs option. This should be default behavior and we will add apps in a deny list which they should not be able to remove. Certain apps have additional protections and users wont be able to remove those even if we don’t have them in EPM deny list

5102
A
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Oct 13 - Oct 20)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: Discovery policy template structure for EPM-W Endpoint Privilege Management for Mac off network setup with Password Safe Cloud COM class rule getting UAC instead of the expected EPM-W designated user message EPM-M endpoint not recieving policy - Error Domain=NSOSStatusErrorDomain Code=-67901

740
GloriaB
BeyondTrust Employee
S
SureshMApprentice
asked in Windows & MacOS
Block the installation of App 'A', but allow it to run if it is installed via Intune or the Company Portal.

Hello Everyone ,We would like to implement a policy that blocks the execution of an application if it is from an external source, even if it has the same publisher and version as one available in the Company Portal/Intune. However, the policy should allow the installation of the same application (with the same publisher and version) if it is from the Company Portal or Intune.Our goal is to prevent the execution of any externally downloaded applications, while permitting installations from Intune or the Company Portal.Example:For Notepad++ version 8.7, the policy should block its execution if installed/downloaded from an external source, but allow installation if done through the Company Portal or IntuneCan this be achieved ?? if yes, how can this be implemented? Appreciate in advance!!Regards,Suresh

3946
Paul
BeyondTrust Employee
raymondus
raymondusApprentice
asked in Windows & MacOS
EPM Windows: How to target any portable apps?

Hi guys, I’ve been assigned a case to block portable apps on a Windows desktop using EPM-W. What is the best way to target any portable apps on Windows? I have a portable application (FreeCommanderPortable.exe - this is just for testing, real-world apps can be anything) with the following criteria:It has a valid digital signature The .exe file can be originated from USB stick, internet download, or file sharing The .exe file can be moved to another folder/drive It doesn’t trigger UAC when run The file name can be changed to anythingI tried creating an application group rule that targets any application ("*"), but there were many false positives, as some legitimate applications sometimes depend on each other.The best configuration I can think of is to target if the publisher or the app name contains the string 'portable'. But not all portable applications have this string (e.g., if renamed).Has anyone faced a similar scenario?

3997
A
M
ManasviApprentice
posted in Windows & MacOS
Unable to get refresh policy option in EPM-W

Hi Team,Unable to get refresh policy option on the system tray icon after upgrading EPM cloud  adaptor version in 24.5.1037

4673
A
S
SFARising Star
asked in Windows & MacOS
EPM Windows: How does the AD group synchronization work for AD group filters in workstyle?

EPM Windows: How does the AD group synchronization work for AD group filters in workstyle? Currently when we remove user from AD group, EPM policy is still being applied to that user, even though he is not part of the AD group which is added as filter in the EPM policy.

1996
S
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - KB Article Publications (Oct 6 - Oct 13)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: Unable to run client project in debug mode after updating to Xcode 16 Endpoint utility - Endpointutility.exe explanation of commands

2320
GloriaB
BeyondTrust Employee
J
Jens HansenVeteran
posted in Windows & MacOS
EPM Release notes: Version naming and consistency.

Naming consistency and transparency are aspects I really liked when BT changed to the new version formatting for release notes: Year, Major Version, and Minor Version. If we look at the sample here, with the exception of the new 24.5 MR2, we had consistency and knew the version we had. MR2 has, for some reason, snuck back, leaving us hanging in the unknown version 24.5.XYZ or 24.5.TRE. Who knows?😂What are you take on the naming? 

2572
P
BeyondTrust Employee
J
JasperVeteran
asked in Windows & MacOS
iisreset.exe access denied error via elevated CMD

Anybody else encountered an issue with iisreset via commandline where the error coming up is “Access Denied” after running an elevated CMD?

3719
C
J
JasperVeteran
asked in Windows & MacOS
EPM filter not working for on-prem sync group to EntraID

I have a hybrid environment where my on-prem AD group accounts are created and then later on syncd to Entra ID. When I add one of the syncd groups, the filter does not get applied at all. Does anybody know how EPM checks for which group a user belongs to? I tried creating a separate Entra ID cloud group and added myself as a member, got the sync completed via the API, then added an account filter using this group, still does not get applied. What am I missing?

32615
Paul
BeyondTrust Employee
S
ScottieApprentice
posted in Windows & MacOS
Cloud EPM and SIEM Integration (Sentinel)

Good day everyone! So recently we have begun to ingest EPM log into MS Sentinel, and I have noticed a difference in the data we see in the console Analytics vs Sentinel. Firstly the integration was simple and straight forward.  Once configured we began to see information flow into Sentinel.  This is not a problem and seems to be working well, we used the CIM format.What we are seeing is good, but it is nowhere near the information we see in the console analytics.Example I will use is logons.  We can see logons in both the analytics and Sentinel, however there is information missing in the information we see in Sentinel, namely privilege. So in the analytics I can see and search on the client privilege, and status of the account (domain, local), but in Sentinel I am not.I just wanted to start a conversation with others who are using a SIEM with EPM or plan too int he near future.  We could compare experiences and possibly see what in store for the future from Beyond Trust.  Thanks, and

2194
James Allan
BeyondTrust Employee
Josh Bristow
Josh BristowVeteran
posted in Windows & MacOS
Analytics v2 - Parent Process question

Maybe I’m missing it but is there a way in Analytics v2 to filter out child process events to only show the parent process item. We used to have a ‘Match on Parent’ filter in v1. 

1986
Josh Bristow
S
BeyondTrust Employee
Stephen Langford-JonesBeyondTrust Employee
posted in Windows & MacOS
EPM-M macOS Sequoia known issues

Hey everyone, with the official release of macOS Sequoia on September 16th, the question about Endpoint Privilege Management and macOS Sequoia support has come in. We are working hard to resolve the issues found. Below is a list of known issues for the macOS Sequoia operating system. Wrong description of endpoint in PMC as "macOS 15.0.0"The PM SaaS Adapter does not correctly identify the macOS Sequoia systems. As a result, the computer OS description will show as "macOS 15.0.0" instead of macOS Sequoia in the portal.Workaround: NoneResolution: We plan to resolve this in EPM-M 24.5 MR2, planned for late September. We are updating our adapter to send the correct description.Knowledge base article: KB0021576 Applications open in the backgroundApplications on Sequoia are not displayed in the foreground when the EPM-M dialog is not completed in a timely manner. We have informed Apple via Feedback Assistant and awaiting a response.Workaround: The application will launch, and the user can cli

16394
T
BeyondTrust Employee
R
RJ.Apprentice
asked in Windows & MacOS
WPE policy signing (CERT_MODE=2)

Hi everyone,With ON-PREM BI/EPM-W it is my understanding that the WPE is generally planned to replace the MMC policy editor at some point, but that point hasn’t yet occurred. This is unlike PMCloud where MMC policy editor is deprecated and no longer supported.My organization uses CERT_MODE=2 to require the clients to only recognized code-signed policies. This is seen as a valuable control to reduce risks related to internal or external bad actors plausibility reverse engineering corporate policy XMLs and creating their own (overly permissive or malicious) policy.To the best of my knowledge BeyondTrust does not have a plan or timeline to add WPE-based code-signing. I figured policy signing would be added to WPE but now ~2 years after it’s introduction I see no indication of it coming.As CERT_MODE=2 only recognizes code-signed policies and WPE cannot provide code signing, this makes WPE unusable for my organization.BeyondTrust, respectfully - do you plan to add code-signing to WPE or do

2835
R

Badge Earners

  • BCA: Endpoint Privilege Management - Windows
    jchewhas earned the badge BCA: Endpoint Privilege Management - Windows
  • BCIE: Password Safe
    ravi.bisramhas earned the badge BCIE: Password Safe
  • BCIE: Privileged Remote Access
    ravi.bisramhas earned the badge BCIE: Privileged Remote Access
  • BCA: Endpoint Privilege Management - Windows
    omarmohy98has earned the badge BCA: Endpoint Privilege Management - Windows
  • BCIE: Password Safe
    Emre Yardimcihas earned the badge BCIE: Password Safe
Show all badges
Terms & ConditionsCookie settings