Skip to main content

Windows & MacOS

A localized space to talk about EPM, specifically for Windows And Mac OS's.

  • 178 Topics
  • 489 Replies
178 Topics
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Dec 30 - Jan 6)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021855 - EPM-W installation fails with error 1603 on Windows 24H2 ARM devices

850
GloriaB
BeyondTrust Employee
B
bt101Veteran
asked in Windows & MacOS
EPM Policy - Applying specific rules to User Groups

Hello,What is the best way to apply specific rule(s) to a group of users e.g. a team wants to have yes/no message for elevation for certain commands run in CMD. (others will have Password prompt). I see I can create a new workstyle and assign to AD based user group, but there is a possibility of many such requests and I will end up creating 50-100 workstyles. Alternatively, I can use the SG as designated user group in Password (authentication) Message, but I want yes/no prompt which doesn’t have designated user option. 

1133
C
BeyondTrust Employee
M
mlajoieTrailblazer
asked in Windows & MacOS
Make Admin on macOS

if a user is in high-flex, ia user can access the users & groups and then turn themselves into a local admin.  we’re going to block this access by doing the following but I was wondering if there was a better way?Remove from (Recommended) Restricted Functions: Type: System Preference pane; Filename: *;  Auth Request URI: system.preferences.accounts Remove from (Recommended) Restricted Functions: Type: System Preference pane; Filename: /System/Library/ExtensionKit/Extensions/UsersGroups.appex;  Auth Request URI: * Add to Blocked - Blocked Apps: Type: System Preference pane; Filename: *;  Auth Request URI: system.preferences.accounts Add to Blocked - Blocked Apps: Type: System Preference pane; Filename: /System/Library/ExtensionKit/Extensions/UsersGroups.appex;  Auth Request URI: *

1942
M
E
egemenApprentice
asked in Windows & MacOS
Poweshell script for creating EPM policies

Is there anyone worked on some kind of powershell script to generate policies, application groups etc.?Trying to create some policy automic policy making process. 

822
AdamS
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Dec 16 - Dec 23)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021840 - How to add and use a local AD connector in EPM Cloud KB0021847 - EPM-W client failing to install "Error 2738. Could not access VBScript run time for custom action" KB0021852 - EPM with SentinelOne on Windows 11 24H2 - Looping install popups KB0021855 - EPM-W installation fails with error 1603 on Windows 24H2 ARM devices KB0021862 - How to upgrade EPM-W on-prem (BI, GPO etc.)

900
GloriaB
BeyondTrust Employee
B
bt101Veteran
posted in Windows & MacOS
EPM - Windows - How the agent handles elevation ; OS Logging ; AV interaction

Hi All,I am trying to get more details on how EPM handles the privileges ( there are few helpful KB articles. Thanks BT team).Q.1 How the agent assigns elevated token? Is there a local admin user created by EPM or the defendpoint service assigns the elevated tokens to processes when requested.Q.2 How the  OS log ( and SIEM log monitoring will be affected) . In Widows Event Viewer I see two additional events per elevated action e.g. if I run an installer that needs elevated right I see1. ID 4688 The standard user account as subject who ran installer with elevated token.     I also see two additional EPM events -2. ID 4688 - Create process “PGMessageHostExt.exe” by creator “ DefendpointService.exe”3. ID 4733 Primary token assigned by DefendpointService.exe to the installer service. Token has standard user.I think event number 1 stays as is (with EPM / without EPM while user is local admin)Q3. How AV scanning is affected. As AV typically works at kernel level will it get priority in hooki

2054
B
J
jbwood919Apprentice
asked in Windows & MacOS
ARM

has anyone gotten the new pmw 24.7 arm64 client installed? the same method weve been using to install pmw x64 msi results in 1603 error. thanks.

54117
A
J
Jeffrey S.Apprentice
posted in Windows & MacOS
Visual Studio/Github users?

Hi All, Any Admins out there have users using Visual Studio 2022 connecting to Github Repos while on EPM? Did you guys have to do anything different to get it to work? 

753
Edward V
J
Jens HansenVeteran
posted in Windows & MacOS
Upgrade recommendation to EPM Client 24.5.361

A few things not mentioned in the release notes of the latest EPM Client:It might have been a mix of QuickStart Policy "flaws" or a EPM Client "bug" still unknown to me.However, I have seen a few customers out there that I have been working with who have had benefit from this.If you are running the EPM Client above 24.5.361 you can ignore this.From around EPM Client 21.x 22.x, a change happened in the EPM Client that made it look at the content of our application groups differently. It caused the EPM Client to miss reporting vital data of applications when launching. For example, a PowerShell script (*.PS1) would show reporting for powershell.exe and a command line containing the script_name.ps1. This prevents us from creating a rule for the PowerShell script that the EPM Client supports, as the metadata is for PowerShell and not the PowerShell script. This was also true for *.bat, *.com, *.vbs, and *.msi files, all of which would report the main process exe file associated with the la

1703
tclowater
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Dec 2 - Dec 9)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021821 - PMR Database error - The database collation cannot be changed if a schema-bound object depends on it KB0021822 - Local passwords not rotating after upgrade to Endpoint Privilege Management for Mac 24.5.3 KB0021825 - Is it possible to filter by local AD workgroups in WPE? KB0021826 - EPM Cloud JIT Admin Access information and walkthrough

350
GloriaB
BeyondTrust Employee
N
BeyondTrust Employee
NeilBeyondTrust Employee
posted in Windows & MacOS
Using JIT Admin

Howdy folks, It’s been a little over a week since the new JIT Admin feature was released and so I wanted to share a little bit of what I’ve learned while using it.  What is JIT Admin?JIT Admin is a new feature in EPM (SaaS) 24.7, where a standard user can submit a JIT Admin request directly to the Privilege Management Console. Once approved, the standard user is put directly into the BUILTIN\Administrators group on their system, becoming a ‘true’ admin for a specified amount of time.This feature is available on both Windows and Mac.  How do I enable JIT Admin?​@Jens Hansen made a nice GIF in his post here which is probably the quickest way to see how simple it is to enable JIT admin within PMC. I’ll add documentation at the bottom, but at a high level, enabling JIT admin requires three things:“JIT Admin Access Integration” is enabled under Configuration > Just-in-Time (JIT) Access Settings > Admin Access tab JIT admin is activated on a workstyle via policy OS > Workstyles >

5562
N
BeyondTrust Employee
M
ManasviApprentice
asked in Windows & MacOS
Unable to capture logs using CaptureConfig

Hi Team, We are unable to run the CaptureConfig tool without entering administrative credentials.When launching the tool on the user's system, it opens successfully; however, upon execution, an EPM message prompt appears, and requesting the entry of admin credentials.To clarify, the user does have administrative privileges, yet the tool still requires admin credentials to run.  

752
M
M
ManasviApprentice
asked in Windows & MacOS
Configure a non-default SQL Server port for the U-Series Appliance.

Hi team,Is it possible to change the default  SQL port to a customized port in the BeyondInsight configuration tool.  

312
C
BeyondTrust Employee
M
ManasviApprentice
asked in Windows & MacOS
Upgrade package manager

Hi Team, The EPM agent was installed manually on the endpoints using the Jamf file. The EPM console has now been upgraded to the latest Build Version 24.7, but the agents installed on the endpoints are still on the older version. If we want to upgrade the agents on all endpoints using the package manager, do we need to remove the existing agents installed manually through the Jamf file, or will the package manager upgrade and replace them automatically when we push the new package to the endpoints? Product: Endpoint Privilege management -Mac

1405
MikeK
MikeK
MikeKVeteran
posted in Windows & MacOS
Powershell script shortcut?

I am curious if anyone else in the community has attempted to leverage PowerShell to bulk create xml files for application group items based on results from exporting analytics?I have recently began working towards setting up my organization with a test policy to provide more restrictive settings and exceptions and currently trying to do these in bulk through web policy editor is not very fun. I know there are likely enhancements coming in this regard, but without a tentative release date I have a mountain of work ahead of myself as the sole individual administering the application for an organization.This got me thinking more along the lines of bulk creation to import the settings into the PMC policy leveraging PowerShell and CSV exports from analytics.  Reason I bring this up, I have over 150k unique applications from 26k publishers that will eventually be in the policy in various high, medium, low, block process, with leveraging JIT as a means for unknown applications pumped through

2273
MikeK
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Nov 25 - Dec 2)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021792 - Wrong application type displayed in EPM reports

170
GloriaB
BeyondTrust Employee
P
Philip HoranApprentice
asked in Windows & MacOS
Elevate cmd.exe / PowerShell.exe for Developers

I am interested to learn how other customers are elevating cmd.exe / PowerShell.exe to allow developers to install/test applications.

1753
P
M
ManasviApprentice
asked in Windows & MacOS
Unable to run CaptureConfig Tool on macOS

Hi,Unable to install and run the CaptureConfig Tool on the macOS endpoint. To Clarify :Added the Privilege Management application group to the policy, and the CaptureConfig app definition has been created within that group, but we still cannot install the CaptureConfig Tool on the macOS endpoint.The Capture Config tool was downloaded from PMC console. To clarify, the PMC console has been upgraded to the latest build version(24.7) and we are currently downloading the latest version of the Capture Config tool.(24.7.0.1) However, the agent still shows an old version of EPM(23.7.1.1) As observed this issue is on the mac OS version 15.0 who has upgraded OS with Sonoma to sequin The version of macOS installed on this endpoint is: macOS 15.0 

1501
tclowater
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Nov 18 - Nov 25)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021743 - EPM-M tray icon missing after install KB0021759 - EPM Cloud error - Sorry the credentials you supplied cannot be used to login KB0021765 - EPM-W test connection error - An error occurred while making the HTTP request to https://... KB0021766 - EPM-W test connection error - There was no endpoint listening at https://... KB0021767 - EPM-W test connection error - Could not establish secure channel for SSL/TLS with authority KB0021772 - EPM-W test connection error - An error occurred while receiving the HTTP response to https://... KB0021773 - EPM-W test connection error - The remote server returned an error: 503 Server Unavailable KB0021775 - EPM-W test connection error - The requested service, 'https://' could not be activated... KB0021776 - EPM-W test connection error - '100' is an unex

400
GloriaB
BeyondTrust Employee
B
bt101Veteran
asked in Windows & MacOS
EPM Windows - msedgewebview2 error

 Hi All,We got below MS edge WebView runtime related error message on one of the Windows 11 machines. It was right after a reboot which was possibly caused by another device driver. We rebooted the machine multiple times again to see if it reappears. We are working with support on this but I wanted to check if anyone else has seen this type of error .The error code seems to be indicating signature verification failure, which should not be the case. There are similar errors with other DLLs on various forums and solutions indicate an issue with either the DLL/app or MS Edge and WebView. I have general idea that pghook.dll will be injected in app processes for EPM to functionEPM agent version 24.3.349 

1785
S
J
Jens HansenVeteran
posted in Windows & MacOS
JIT Admin Request.

I was running over the documentation and could not find how to enabled the JIT Admin request, so here a short GIF of how to enable. 

21915
tclowater
BeyondTrust Employee
J
BeyondTrust Employee
JoeReillyBeyondTrust Employee
posted in Windows & MacOS
Using EndpointUtility.exe

EPM Windows introduced EndpointUtility.exe in versions 22.3 and higher.The utility tool helps in a variety of ways including log gathering, troubleshooting or forcing a policy update on an endpoint. This can be run both locally, or remotely.To successfully run EndpointUtility.exe pending the action, the tool should be run elevated from a CMD line. A rule can simply be added to the “(Default) Privilege Management Tools” application group within Web Policy Editor. Further details on criteria can be found in the below KB article.The more common arguments for EndpointUtility are for log gathering, performing a connection test or forcing a policy update. PGCapture:Local: C:\Program Files\Avecto\Privilege Guard Client\EndpointUtility.exe /cc <Path to folder> <Desired file name>*Remotely: Enter-PSSession -ComputerName <machine name> -Credential DOMAIN\usernameC:\Program Files\Avecto\Privilege Guard Client\EndpointUtility.exe /cc <Path to folder> <Desired file name&g

4122
J
J
JasperVeteran
asked in Windows & MacOS
allowing users to run installer packages from a specific network folder

We have a network folder location that contains some applications used by a mixture of non-privileged users . Some of these install source files have .MSI while some have .EXE. When my users run it, they get filtered into the catch all app group instead of the app definition I created. I just used \\networkshare\folder1\* with no publishers, drive is network and App requires elevation (UAC). I know this is not very secure but that is the only way I know that would allow my users to run the install themselves without asking help from our deskside support. This application group by the way sits above the priority list before the catch all and is also using rule filter for those specific users only. My problem is that it does not get triggered from that definition. Has somebody got any similar definition in place that I can follow that works?

461
J
B
bt101Veteran
posted in Windows & MacOS
EPM - Mac : Rollout : How do you handle new apps e.g. Homebrew that require Policy Changes

Hello All, I am curious to know how other users are going about rolling out EPM to Mac OS users who are currently admins. As an example, lets say we roll it out to 100 users with Quick start policy. Suddenly 10+ users want to install HomeBrew . I can tell them just input your password “n” number of times for now , while I work with Mac Sysadmin team to distribute the script via JAMF (not sure if they would want to have QA team test it which will add another couple weeks to it). How other EPM admins are managing it ? What if it happens with multiple new applications around same time - 5 different apps and 50+ users want it installed, like right now. Couple of things I am doing: - Get inventory of all apps across the devices that will get EPM and make sure these apps will work smoothly  - Looks for KBs to tweak the policy - Thinking of starting with discovery mode/monitoring - this will cover existing apps/settings etc that need elevated rights - thinking of 30-60 days - and then move to

2067
B
M
ManasviApprentice
asked in Windows & MacOS
Upgrade Endpoint Privilege Management for Windows 24.7

Hi Team,How to upgrade Endpoint Privilege Management for Windows from version 24.6.716 to the new version 24.7.

1531
J

Badge Earners

  • BCA: Password Safe
    kapadawahas earned the badge BCA: Password Safe
  • BCIE: Password Safe
    Avishka Vithanagehas earned the badge BCIE: Password Safe
  • BCIE: Password Safe
    MircoAhas earned the badge BCIE: Password Safe
  • BCA: Privileged Remote Access
    rrueschXalienthas earned the badge BCA: Privileged Remote Access
  • BCSE: Privileged Remote Access
    daphas earned the badge BCSE: Privileged Remote Access
Show all badges
Terms & ConditionsCookie settings