Windows & MacOS

Hi AllWe are facing one issue in our policy for windows assets. our requirement is1.when user will try to elevate itself by executing any exe file using "run as different user" (shift+right click+run as different user) user should get the EPM message asking for reason.2. We have created on application group and rule and added it high flexibility work style.3. when user is trying to run the CMD file as different users, user is not getting EPM message to ask for reason. here what I did on my LAB.create on application group and added eclipse.exe in it create the rule under high flex policy , and used the group. I have placed this rule at top so that it gets enforced and not overridden by other rules . Placed it above Add Admin -High flex I have added below rulesmessage : All Message(yes/no),Access Token : Add Basic Admin Rights,Raise event : on Enabled: Enable When I am opening eclipse , by double clicking , I am getting EPM prompt asking Yes/No this is working as expected. However when I

OverviewThis document provides guidance on how to use the Swagger UI for a no-code solution to moving computers to computer groups. IntroductionFor those who want to be able to bulk move computers in EPM SaaS, there is no GUI-provided way to do so. That said, we do provide the API method to assign computers to a group ID either as a one-off or in bulk via a CSV. As support will not provide break/fix support on troubleshooting code choices. The guidance here is based on using the Swagger UI provided with EPM - available with BeyondInsight on-prem, and EPM SaaS. Remember, with great API power comes with great API risks: Test. Test. Take snapshots of where things were for faster roll-back (e.g. download CVE of computers pre-change). Test before bulk moving production. Please. If the API isn’t returning the anticipated data or if the documentation is followed with challenging results? Yes, contact support. Want help structuring your code? No, that is outside the scope of support. Materials

Want to create 2 policies-one for Mac and one for  Windows users.Where All applications should be blocked from installation unless they're on a whitelist (using the publisher's information). However, users should still be able to change settings like Time, Region, and Network.When a user requests an application that's not on the whitelist, an email shd be sent to our Helpdesk. And a technician will then approve or deny the request.

The following articles were published last week. New Knowledge Base Articles: KB0021490 - Analytics unlicensed event error - Details unavailable: Computer requires a licensed policy for event details KB0022817 - Analytics is slow or times out after upgrade to EPM Cloud 25.6 MR1

Hi all,Has anyone else seen massive performance issues during logon with Agent Protection enabled (on Windows 11 endpoints in my case)?I have a customer that has been seeing problems for a while, and I also got my own environment set up and running in the last week and see the same thing.Basically, after a clean logon to the device (happening on multiple, not isolated to 1 or 2), it just takes forever to get a usable desktop. For me, it can take a minute or more for even the taskbar to show.To test, I created an identical EPM policy to my production policy, but with AgentProtectionState=0. When I flick my machine over to the associated Computer Group it is responsive again during logon (reboot, log on; taskbar loads almost instantly, apps load, desktop responsive…. normal operation).Running latest versions of agent and client (leveraging Package Manager for that and double-checked manually).The customer that raised it has been having issues for several months, so I feel this is a semi-

Hi everyone! I am trying to filter a workstyle to only the built-in local admin.I dont think wildcards can be used in the SID field and using just the username is not super reliable.. but seems to be the only option...  Anyone done this and have any tips?

The following articles were published last week. New Knowledge Base Articles: KB0021482 - Windows PowerShell (Admin) from start menu WinX menu does not match expected EPM-W on-demand rule KB0022376 - EPM-M limitation with Network Link Conditioner tool KB0022803 - Application definiton does not 'paste' after being successfully copied in Chrome KB0022810 - Windows Terminal prompts UAC instead of EPM-W message KB0022817 - Analytics is slow or times out after upgrade to EPM Cloud 25.6 MR1

Hi all -- MS released an update for Autopilot (2508) and since then, we are seeing our builds crash. If we remove EPMfW, build completes successfully. Is anyone else seeing this?  We just started seeing this on Monday, Aug. 25

Hi Everyone, We are an on-prem BeyondInsight appliance EPM customer for almost 2 years now and need to upgrade our agents as well as our server appliance.  Migrated over from Powerbroker. Someday in the future may go to cloud but not in the works yet.Currently on 23.9.225 for our agents and BI Server is at 23.1.0.2407.  I was told two different things by support, EPM support stated that the agent and server are independent of each other and can be updated separately whenever, and I was also told that the Server needed to updated first by BeyondInsight support.  Just looking for some guidance or experience on upgrading to the latest version on-prem.  We have close to 12,000 pc’s, so I would like it to go smoothly without much interruption.  Thanks for any help!

Hello Everyone.This issue is related to the Challenge/Response option on the EPM message.When we enable the Challenge/Response option on the EPM message, we are not receiving the expected EPM prompt while uninstalling certain applications such as Forcepoint, Cisco, and Symantec.However, when the Challenge/Response option is not enabled, the EPM prompt appears correctly during the uninstallation process.have anyone faced the same issue? 

The following articles were published last week. New Knowledge Base Articles: KB0021723 - HP PC Hardware Diagnostics prompts with UAC after EPM-W message KB0022759 - PMR Reports is missing or disappears after upgrade via BTUpdater to 25.1 KB0022795 - OneDrive errors when in EPM policy "OneDrive can't be run using full administrator rights" KB0022806 - Error upgrading EPM-W with Package Manager - Exit Code 1603, please check Installation logs. KB0022809 - EPM-W - Copy and Paste to secure location triggers UAC after upgrade to 25.4 and above

The following articles were published last week. New Knowledge Base Articles: KB0022750 - How to upgrade EPM-W or EPM-M when in Pathfinder or Cloud KB0022760 - How are EPM workstyles and rules evaluated? - Examples of QuickStart policy logic KB0022763 - What is the best way to manage VDI or short lived endpoints in EPM Cloud or Pathfinder? KB0022769 - 1603 Error when upgrading via Package Manager on previously allowlisted Autodesk products KB0022778 - Poly Lens installation fails with error status 1603

I’m working on a solution to onboard a local user account created during the Jamf provisioning of Mac assets to Password Safe Cloud. I have EPM-M installed on the endpoints and they are connected to Password Safe. When I run discovery scans on the endpoints, the local accounts are not discovered. I have looked over the KBs related, and nothing seems to explicitly say “Here is what you need to do” when it comes to local account management. To test, I added a test functional account to the local admin group on a test Mac. This is an Active Directory service account, and it fails to login. As far as I can tell, the account needs to actually log into the Mac in order to be locally cached and thus login as a functional account. But having to locally log into each asset is not scalable. Has anyone had success with an AD group being used for your functional account? What am I missing to complete this set up? 

The following articles were published last week. New Knowledge Base Articles: KB0022522 - Unable to integrate AWS S3 Bucket SIEM into EPM Cloud results in error: Failed to validate Settings KB0022750 - How to upgrade EPM-W or EPM-M when in Pathfinder or Cloud KB0022754 - Package Manager not authenticating after install on macOS - Unauthorized, Invalid Request Header, 401 errors

Hi everyone,I have a question as I'm preparing for this. I've been looking into the BeyondTrust EPM on-prem solution, and it says that it pre-bundled if deployed through the UVM appliance. My question is, If I only want the on-prem EPM solution and don't want Password Safe at all, how can we achieve that? I know we can disable the Password Safe features, but that only disables the functionality, the Password Safe section still appears in the admin console. Do you have any other methods you can suggest, such as a way to completely remove or hide it? Thanks

HelloOne feature of On-Prem EPM which I have not yet found a clear explanation in the documentation is how Global Priority actually works in on prem EPM. While I understand that it has to be configured when there is a default organization - a detailed explanation on  how it works (in relation to organizations) appears to be missing.

The following articles were published last week. New Knowledge Base Articles: KB0022715 - Where is the package manager adapter file downloaded from?

I just switched from a local server to a hosted solution. In the past I was able to install a Jump Client on machines and set it so I could connect without anyone accepting the connections. When I set it up not, I am missing something, and the client needs to accept before I can connect. Can someone tell me where I need to make the change so I can create a Jump Client that will allow me to connect without anyone accepting? Thanks for any help. Kevin

I have exhausted my exam attempts for Endpoint Privilege Management - Windows: Administration Exam? How can I get another attempts for this?

When upgrading EPM by deploying the latest version and allowing it to upgrade silently, we have seen that the fingerprint reader and camera stop working until a reboot is performed. Has anyone seen this issue before?Ideally we want to upgrade the agent silently with no reboot, without affecting the fingerprint reader and camera. If there is no alternative, we will need to prompt the user to reboot.We used the same upgrade method for the last upgrades we did and didn’t see this issue before.Thanks.

Installation of BT EPM on VDIs(Persistent and Non-Persistent) - What’s the process, does master image report to cloud console or only child images report? also what is the duplication that can happen

We all appreciate the new feature of having a dedicated Event Logs file for BeyondTrust Privilege Management Events. However, consider this: the default log size is just 1028KB—only enough to store approximately 100 to 300 events, which is far too small.I've submitted a feature request to increase the default log size to 20MB. I also suggested either merging the IC3 Adapter logs into the same log file or add switch that can turn some of the excessive auditing off, as they tend to flood the logs the Application event logs, or creating a better strategy for managing their volume.https://beyondtrust-public.ideas.aha.io/ideas/T2EPM-I-2132Application Event LogsBeyondTrust Privilege Management Logs 

Is it possible to point different policy to the same endpoint if I have multiple environment? I have a Prod and a Test Environment. At the moment, I install the Production Package Manager on endpoint 1 if I want to deploy the prod policy but if I want to do a test or play around with some policies from Test environment, I have to uninstall the Prod app installed on endpoint 1 and install it the Test instance definition for the Test PkgMgr. Is there an easier way to do this instead of doing the uninstall/reinstall pkg? I have seen one time from the vendor support showing me two different policies running from one machine. You can view this when you refresh your BT policy and it showed the two different Active policies at the top. I believe that would be adding the policy xml on the same folder where it sits inside the DPC Cache folder.