Date of Release: October 10, 2018

Product Name: BeyondTrust UVM-20 Security Management Appliance

Updated Version: 2.5.3

Superseded version: 2.5.2

Table of Contents

1. What's New in This Release

2. Known issues:

3. General Notes

4. Release availability

1. What's New in 2.5.3

=======================================================================

159981: [Config Wizard - PBSMC] Setting PBSMC SQL Settings Error - Bad Request

160789: [HA] 2.5.2 fix prevents HA from turning off mirroring

160972: 2.5.2 - UVM Installer fails if IIS takes too long to shut down

160973: 2.5.2 - Encountered an unknown option "featurename" with value "IIS-WebSockets"

161302: [ROLES] - COLD SPARE: When BI is updated on the Cold Spare, the Omniworker, Web Service and Manager engine service are turned back on

161493: 2.5.2 - Access code is not cleared during configuration wizard

161849: [ROLES] When toggling the ColdSpare Role the incorrect ThirdPartyPatch service is enabled/disabled

2. Known issues:

=======================================================================

48692 Certificates created on February 29th (leap year day) are invalid

50373 unable to bitlocker c:\ on 20 or 50 (TPM not enabled)

51919 all pages - Next button does not enable until unblur

52991 Favicon not present (MS Edge Only)

53195 Cannot press Enter to select buttons (space works)

53893 page jumps around when trying to scroll down - MS Edge

54055 disabled checkbox is ever so slightly different size than enabled

54061 when pressing tab through a page there is no indication of currently being on a radio button (network page)

55000 When on step 8, step 9 is valid so progress shows as 90% - but I have never been to step 9

56319 Home and End keys do not function for intended purpose within a text box (input box?)

56450 time picker does not allow input of two digits when specifying the time - Safari

61145 Appliance Discovery Tools returns "Error: The appliance did not respond" when changing the IP but IP change was successful

64222 Auto redirect to diagnostics when configuration wizard completes does not work on safari

64535 Password Safe portal error connecting to Active/Active SQL server

67795 eEye Digital Program Folder listing restored to Start Menu programs after BI update

82325 Diagnostics - There should be a warning if CAPS LOCK is on when logging in

82684 [BI Bug] - EventServer generating Service alerts on HA Secondary saying it was terminated unexpectedly

86920 [Notifications] - "Configure Notifications" or "View all notifications" pages do not allow clicking the previous page through the navigation menu

87815 [Config Wizard] - Machine reboot after rename is recorded as an unexpected shutdown and displays a prompt at next logon

92050 [config wizard] - unnecessary word wrap for Creating database line item

93400 [Header] - The username is no longer displayed when you click on the profile icon on the header

93723 [Config wizard] - new machine name in URL fields are not being applied to BI (REMEMConfig)

98220 [Azure] - Desktop shortcuts missing

98325 Syncit Update errors on non-configured UVM

100584 [Maintenance] - Backups - if the backup is taking a while and the page times out (user does not extend session) the backup progress indication is lost (backup still completes though)

100666 Time Zone, date and time picker in config wizard do not display a default value in Azure (deployed as UTC)

102856 [LCD] - plugging in another USB device when on a specific menu on the LCD screen will cause the LCD to bump back to the main screen

103150 Color Blind settings do not work

106346 change how EULA's are returned in Config Wizard - MIM potential with http injection

107570 [ConfigWiz] - Setup - Print This Page - Portrait Layout

107577 [Diagnostics] - Appliance Health - Shutting off the BeyondTrust UVM Service will shut off Diagnostics

107674 [Diagnostics] - Performance Counters - Underscore displays in selected counter

109607 [Diagnostics] - Dashboard graph shows nothing (no faded color of graph) when SQL Mem/Disk/CPU Usage is 0%

109827 [diagnostics] - BT Header does not always display on release notes page

111691 [Diagnostics] - Weekly CPU performance data may already contain data on new images

114122 [Configuration Wizard] - Microsoft and SQL Agreement pages structural formatting

117823 [BTTF] - Unable to RDP to UVM when FIPS is enabled

121816 Webpage login failures (correct username and wrong password) can set the locked flag

126248 CSP errors returned on HA page for exclamation mark image on toaster

135947 [Maintenance]- Change Product Serial Numbers - error message displays duplicate messages.

140221 [2014 R4 Image] - Invalid name space error returned on config wizard

140234 [Maintenance] Refreshing the Analytics And Reporting Web Service Endpoints fails on UVM's running SQL 2008R2

140444 BI database initialization fails on 2014R4 image (ssrs error)

142947 [Roles] Auto Update (SyncIT) - When turning the role to on ON state from OFF, the AutoUpdate URL is not changed back to default

146539 [Azure] 2.4.1 - Retina Agent is not renamed after configuration wizard is completed

146560 [Azure] 2.4.1 - Spectre/Meltdown card not showing UVM as patched, even though it is

149485 Unable to use Emergency Recovery tool when password has been set to blank

149703 HA and session archiving fail when SHA is disabled

151972 [diagnostics] - stopping the BTUpdater service results in it being displayed twice on the stopped services side

153143 [Diagnostics] - large white space area in log export card

153469 [AWS] Spectre/Meltdown card indicates that the necessary security patches.

154941 [CHROME] - Opening any page on UVM seems to cause a 'shake' effect, more-so on right side of page.

154950 [ROLES] - PBSMC - when Enabling the role, the spinner is not long enough and the pending state change page takes too long to return to normal

155472 [DIAGNOSTICS] - Performance counters: large numbers are right aligning. See screeny.

3. General Notes

=======================================================================

- The 2.5.3 installer is now the primary install package - it will upgrade 2.2.4 - 2.5.2 appliances.

- With this release, there is also a 2.5.0 Standalone Roles Editor Installer available for Software Installs.

4. Release availability

=======================================================================

- This update is available via BeyondTrust Updater or as a manual installer from the download tool.

- Shipping on new Appliance Images at the end of October 2018.

Date of Release: August 20, 2018

Product Name: BeyondTrust UVM-20 Security Management Appliance

Updated Version: 2.5.0

Superseded version: 2.4.6

Table of Contents

1. What's New in This Release

2. Known issues:

3. General Notes

4. Release availability

1. What's New in 2.5.0

=======================================================================

79038 2.5: Add PBSMC to the UVM

PBSMC Integration

Add a Role for PBSMC

Add toggle in PBSMC role for local or remote databsae

Refactor High Availability for multi DB mirroring

Add PBSMC database to HA mirroring

Ability to enable/disable PBSMC

Add reverse proxy to IIS for PBSMC

Add PBSMC database to Backup Restore process

Rename Database Access role to BeyondInsight Database Access

118805 2.5: Export log files to remote location for Splunk consumption

Add UI in Diagnostics for log file export process

Add schedule options for log export

Add mew logs to logs page and include with log export

102200 2.5: Design microservice architecture for future scheduler plugins

141670 Web-based Command Line Engine (Ping & IPConfig)

147521 [2.4.4] HA Blackout Start Time - fix endpoint call

145572 [Roles Editor] : Create Role Templates specific to Standalone Roles/Software installs.

149320 BI Event Forwarding and partial matches on certificate subject name

130388 [Maintenance] - Security Settings - Date/Time Settings - zone, date and time does get not applied

153910 Allow more logs files before rolling: Session Monitoring and HA Monitoring services.

153913 Add pop up for the "Suspend" button to warn that it's not meant for long term.

150772 Notify BI of error when: Manual Archiving and restoring and viewing session files leads to locked files and session retrieval errors.

146942 [HA] Detect the entry of IP addresses instead of hostname and inform the user that it isn't supported.

150430 [Roles] - Event Collector role has a misaligned radio button

142947 [Roles] Auto Update (SyncIT) - When turning the role to on ON state from OFF, the http://localhost/UpdaterServer URL is not changed back to default http://update.eye.com/UpdateServer

145354 [MAINTENANCE]- Security Settings - EVENT SERVICE SSL REQUIREMENT: Determine card functionality based on escalation 121017

145324 If there is an error when changing HA settings it doesn't get raised to the UI and appears to have been successful

145672 [Diagnostics] - Performance Counters - Investigate the values that can be used to match what Perfmon is using to measure. Looks to only allow up to 100%, not high value bytes etc..

143236 [Maintenance] -Security Settings - The Spectre/Meltdown card is not properly reflecting the correct state on 2008 images (Stream 1/2)

152481 [MAINTENANCE] - Backups -**Internet Explorer only** Cannot create new backup location

152620 [Roles] - Apply roles not functioning in Internet Explorer 11

137490 [LCD PANEL] - Enabling RDP from LCD panel does not enable console access

151251 [2.4.5][Config Wizard] - Offline (sandbox) licensing method for Print/Fax does not generate the Reference codes

2. Known issues:

=======================================================================

48692 Certificates created on February 29th (leap year day) are invalid

50373 unable to bitlocker c:\ on 20 or 50 (TPM not enabled)

51919 all pages - Next button does not enable until unblur

52991 Favicon not present (MS Edge Only)

53195 Cannot press Enter to select buttons (space works)

53893 page jumps around when trying to scroll down - MS Edge

54055 disabled checkbox is ever so slightly different size than enabled

54061 when pressing tab through a page there is no indication of currently being on a radio button (network page)

55000 When on step 8, step 9 is valid so progress shows as 90% - but I have never been to step 9

56319 Home and End keys do not function for intended purpose within a text box (input box?)

56450 time picker does not allow input of two digits when specifying the time - Safari

61145 Appliance Discovery Tools returns "Error: The appliance did not respond" when changing the IP but IP change was successful

64222 Auto redirect to diagnostics when configuration wizard completes does not work on safari

64535 Password Safe portal error connecting to Active/Active SQL server

67795 eEye Digital Program Folder listing restored to Start Menu programs after BI update

82325 Diagnostics - There should be a warning if CAPS LOCK is on when logging in

82684 [BI Bug] - EventServer generating Service alerts on HA Secondary saying it was terminated unexpectedly

86920 [Notifications] - "Configure Notifications" or "View all notifications" pages do not allow clicking the previous page through the navigation menu

87815 [Config Wizard] - Machine reboot after rename is recorded as an unexpected shutdown and displays a prompt at next logon

92050 [config wizard] - unnecessary word wrap for Creating database line item

93400 [Header] - The username is no longer displayed when you click on the profile icon on the header

93723 [Config wizard] - new machine name in URL fields are not being applied to BI (REMEMConfig)

98220 [Azure] - Desktop shortcuts missing

98325 Syncit Update errors on non-configured UVM

100584 [Maintenance] - Backups - if the backup is taking a while and the page times out (user does not extend session) the backup progress indication is lost (backup still completes though)

100666 Time Zone, date and time picker in config wizard do not display a default value in Azure (deployed as UTC)

102856 [LCD] - plugging in another USB device when on a specific menu on the LCD screen will cause the LCD to bump back to the main screen

103150 Color Blind settings do not work

106346 change how EULA's are returned in Config Wizard - MIM potential with http injection

107570 [ConfigWiz] - Setup - Print This Page - Portrait Layout

107577 [Diagnostics] - Appliance Health - Shutting off the BeyondTrust UVM Service will shut off Diagnostics

107674 [Diagnostics] - Performance Counters - Underscore displays in selected counter

109607 [Diagnostics] - Dashboard graph shows nothing (no faded color of graph) when SQL Mem/Disk/CPU Usage is 0%

109827 [diagnostics] - BT Header does not always display on release notes page

111691 [Diagnostics] - Weekly CPU performance data may already contain data on new images

114122 [Configuration Wizard] - Microsoft and SQL Agreement pages structural formatting

117823 [BTTF] - Unable to RDP to UVM when FIPS is enabled

121816 Webpage login failures (correct username and wrong password) can set the locked flag

126248 CSP errors returned on HA page for exclamation mark image on toaster

135947 [Maintenance]- Change Product Serial Numbers - error message displays duplicate messages.

140221 [2014 R4 Image] - Invalid name space error returned on config wizard

140234 [Maintenance] Refreshing the Analytics And Reporting Web Service Endpoints fails on UVM's running SQL 2008R2

140444 BI database initialization fails on 2014R4 image (ssrs error)

142947 [Roles] Auto Update (SyncIT) - When turning the role to on ON state from OFF, the AutoUpdate URL is not changed back to default

146539 [Azure] 2.4.1 - Retina Agent is not renamed after configuration wizard is completed

146560 [Azure] 2.4.1 - Spectre/Meltdown card not showing UVM as patched, even though it is

149485 Unable to use Emergency Recovery tool when password has been set to blank

149703 HA and session archiving fail when SHA is disabled

151972 [diagnostics] - stopping the BTUpdater service results in it being displayed twice on the stopped services side

153143 [Diagnostics] - large white space area in log export card

153469 [AWS] Spectre/Meltdown card indicates that the necessary security patches.

154941 [CHROME] - Opening any page on UVM seems to cause a 'shake' effect, more-so on right side of page.

154950 [ROLES] - PBSMC - when Enabling the role, the spinner is not long enough and the pending state change page takes too long to return to normal

155472 [DIAGNOSTICS] - Performance counters: large numbers are right aligning. See screeny.

3. General Notes

=======================================================================

- The 2.5.0 installer is now the primary install package - it will upgrade 2.2.4, 2.3.4, 2.4.0, 2.4.1, 2.4.2 and 2.4.3 appliances.

- With this release, there is also a 2.5.0 Standalone Roles Editor Installer available for Software Installs.

4. Release availability

=======================================================================

- This update is available via BeyondTrust Updater or as a manual installer from the download tool.

- Shipping on new Appliance Images at the end of September 2018.

Date of Release: May 29, 2018

Product Name: BeyondTrust UVM-20 Security Management Appliance

Updated Version: 2.4.4

Superseded version: 2.4.1

Table of Contents

1. What's New in This Release

2. Known issues:

3. General Notes

4. Release availability

1. What's New in 2.4.4

=======================================================================

137327 2.4.3: [CONFIGURATION WIZARD] - email to licensing should be changed from [email protected] to [email protected]

137901 2.4.3: API key - Disable Register Partner button after use (to show that you already applied the key)

139257 2.4.3: Session files are not archived when initiated from the PasswordSafe Replay Session page

139929 2.4.3: [Roles] Analysis Services Role shown on UVM Without SQL

139991 2.4.3: [Installer] Installer Missing File needed for Session Archiving - logging 443 Errors in IIS Logs

140401 2.4.3: [Maintenance] Network and RDP - Cannot click the Update IP Settings button when making changes to IP information

140590 2.4.3: HA Roles Validation for SQL-less boxes

140597 2.4.3: [Installer] IISroot gets moved to drive with largest amount of free space (2.4.1/2.4.2)

140643 2.4.3: [Installer] Add the 2.4.2 actions to the 2.4.3 installer (BI Web.Config fix)

140806 2.4.3: Difficulty determining if PBPS is licensed if the local SQL Server is not running

141339 2.4.3: [ConfigWizard] Offline licensing not working - GetReferenceCodes call failing

147513 2.4.4: [auth] - invalid username returns exception in auth logs

147521 2.4.4: HA Blackout Start Time - fix endpoint call

2. Known issues:

=======================================================================

48692 Certificates created on February 29th (leap year day) are invalid

50373 unable to bitlocker c:\ on 20 or 50 (TPM not enabled)

51919 all pages - Next button does not enable until unblur

52991 Favicon not present (MS Edge Only)

53195 Cannot press Enter to select buttons (space works)

53893 page jumps around when trying to scroll down - MS Edge

54055 disabled checkbox is ever so slightly different size than enabled

54061 when pressing tab through a page there is no indication of currently being on a radio button (network page)

55000 When on step 8, step 9 is valid so progress shows as 90% - but I have never been to step 9

56319 Home and End keys do not function for intended purpose within a text box (input box?)

56450 time picker does not allow input of two digits when specifying the time - Safari

61145 Appliance Discovery Tools returns "Error: The appliance did not respond" when changing the IP but IP change was successful

64222 Auto redirect to diagnostics when configuration wizard completes does not work on safari

64535 Password Safe portal error connecting to Active/Active SQL server

67795 eEye Digital Program Folder listing restored to Start Menu programs after BI update

82325 Diagnostics - There should be a warning if CAPS LOCK is on when logging in

82684 [BI Bug] - EventServer generating Service alerts on HA Secondary saying it was terminated unexpectedly

86920 [Notifications] - "Configure Notifications" or "View all notifications" pages do not allow clicking the previous page through the navigation menu

87815 [Config Wizard] - Machine reboot after rename is recorded as an unexpected shutdown and displays a prompt at next logon

92050 [config wizard] - unnecessary word wrap for Creating database line item

93400 [Header] - The username is no longer displayed when you click on the profile icon on the header

93723 [Config wizard] - new machine name in URL fields are not being applied to BI (REMEMConfig)

98220 [Azure] - Desktop shortcuts missing

98325 Syncit Update errors on non-configured UVM

100584 [Maintenance] - Backups - if the backup is taking a while and the page times out (user does not extend session) the backup progress indication is lost (backup still completes though)

100666 Time Zone, date and time picker in config wizard do not display a default value in Azure (deployed as UTC)

102856 [LCD] - plugging in another USB device when on a specific menu on the LCD screen will cause the LCD to bump back to the main screen

103150 Color Blind settings do not work

106346 change how EULA's are returned in Config Wizard - MIM potential with http injection

107570 [ConfigWiz] - Setup - Print This Page - Portrait Layout

107577 [Diagnostics] - Appliance Health - Shutting off the BeyondTrust UVM Service will shut off Diagnostics

107674 [Diagnostics] - Performance Counters - Underscore displays in selected counter

109607 [Diagnostics] - Dashboard graph shows nothing (no faded color of graph) when SQL Mem/Disk/CPU Usage is 0%

109827 [diagnostics] - BT Header does not always display on release notes page

111691 [Diagnostics] - Weekly CPU performance data may already contain data on new images

114122 [Configuration Wizard] - Microsoft and SQL Agreement pages structural formatting

117823 [BTTF] - Unable to RDP to UVM when FIPS is enabled

121816 Webpage login failures (correct username and wrong password) can set the locked flag

126248 CSP errors returned on HA page for exclamation mark image on toaster

135947 [Maintenance]- Change Product Serial Numbers - error message displays duplicate messages.

140221 [2014 R4 Image] - Invalid name space error returned on config wizard

140234 [Maintenance] Refreshing the Analytics And Reporting Web Service Endpoints fails on UVM's running SQL 2008R2

140444 BI database initialization fails on 2014R4 image (ssrs error)

142947 [Roles] Auto Update (SyncIT) - When turning the role to on ON state from OFF, the AutoUpdate URL is not changed back to default

146539 [Azure] 2.4.1 - Retina Agent is not renamed after configuration wizard is completed

146560 [Azure] 2.4.1 - Spectre/Meltdown card not showing UVM as patched, even though it is

3. General Notes

=======================================================================

- The 2.4.4 installer is now the primary 2.4 install package - it will upgrade 2.3.4, 2.4.0, 2.4.1, 2.4.2 and 2.4.3 appliances. It replaces all prior 2.4.x installers, which should no longer be used.

- With this release, there is also a 2.4.4 Standalone Roles Editor Installer available for Software Installs.

4. Release availability

=======================================================================

- This update is available via BeyondTrust Updater or as a manual installer from the download tool.

- Shipping on new Appliance Images at the end of May 2017.

Date of Release: March 28, 2018

Product Name: Update242 (released via the BeyondTrust UVM-20 Security Management Appliance BTUpdater stream)

Updated Version: 2.4.2

Superseded version: 2.4.1

Table of Contents

1. What's New in This Release

2. Known issues:

3. General Notes

4. Release availability

1. What's New in 2.4.2

=======================================================================

138898 2.4.2: Fix the BeyondInsight Web.Config

2. Known issues:

=======================================================================

This update is not known to cause any known issues. It will not affect future BeyondInsight updates.

3. General Notes

=======================================================================

- This executable has been released over BTUpdater in place of a 2.4.2 UVM Appliance Software update.

- No binaries will be modified. The UVM Appliance Software will remain at 2.4.1.

- If downloaded over BTUpdater, the BTUpdater and UVM Maintenance screens will list the UVM at version 2.4.2.

- If installed manually, the BTUpdater and UVM Maintenance screens will show at 2.4.1.

- The update is safe to run multiple times, which may occur if manually updated as BTUpdater will still want to download and run it.

4. Release availability

=======================================================================

- This update is available via BeyondTrust Updater or as a manual installer.

- The manual installer has not been made widely available (via download tool) as it's use is being controlled. Run BTupdater or contact Technical Support if you require assistance.

- New Appliance Images are unaffected as they are preloaded with BI 6.4.

Date of Release: March 9, 2018

Product Name: BeyondTrust UVM-20 Security Management Appliance

Updated Version: 2.4.1

Superseded version: 2.4.0

Table of Contents

1. What's New in This Release

2. Known issues:

3. General Notes

4. Release availability

1. What's New in 2.4.1

=======================================================================

128574 2.4.1: Bug Fixes and Escalations

Remove Blink from EMET Tracking

Add startup and reboot/shutdown events to Health Monitoring

Test communication between FIPS and non-FIPS appliances

Modify EUS Header to downgrade x-frame-options to sameorigin

FIXED: Health monitoring events exceeding BI Connector Message field size of 256 chars

FIXED: SUPI 2.4 may encounter "file not found" error

135752 2.4.1: NFS Support

Add NFS Client to UVM

Add Support for NFS Fileshares to Session Archiving

134136 2.4.1: BT Bridge Integration

Improved License Caching

135717 2.4.1: Updated Licensing Monitor

Restored/Updated codebase

2. Known issues:

=======================================================================

48692 Certificates created on February 29th (leap year day) are invalid

50373 unable to bitlocker c:\ on 20 or 50 (TPM not enabled)

51919 all pages - Next button does not enable until unblur

52991 Favicon not present (MS Edge Only)

53195 Cannot press Enter to select buttons (space works)

53893 page jumps around when trying to scroll down - MS Edge

54055 disabled checkbox is ever so slightly different size than enabled

54061 when pressing tab through a page there is no indication of currently being on a radio button (network page)

55000 When on step 8, step 9 is valid so progress shows as 90% - but I have never been to step 9

56319 Home and End keys do not function for intended purpose within a text box (input box?)

56450 time picker does not allow input of two digits when specifying the time - Safari

61145 Appliance Discovery Tools returns "Error: The appliance did not respond" when changing the IP but IP change was successful

64222 Auto redirect to diagnostics when configuration wizard completes does not work on safari

64535 Password Safe portal error connecting to Active/Active SQL server

67795 eEye Digital Program Folder listing restored to Start Menu programs after BI update

82325 Diagnostics - There should be a warning if CAPS LOCK is on when logging in

82684 [BI Bug] - EventServer generating Service alerts on HA Secondary saying it was terminated unexpectedly

86920 [Notifications] - "Configure Notifications" or "View all notifications" pages do not allow clicking the previous page through the navigation menu

87815 [Config Wizard] - Machine reboot after rename is recorded as an unexpected shutdown and displays a prompt at next logon

92050 [config wizard] - unnecessary word wrap for Creating database line item

93400 [Header] - The username is no longer displayed when you click on the profile icon on the header

93723 [Config wizard] - new machine name in URL fields are not being applied to BI (REMEMConfig)

98220 [Azure] - Desktop shortcuts missing

98325 Syncit Update errors on non-configured UVM

100584 [Maintenance] - Backups - if the backup is taking a while and the page times out (user does not extend session) the backup progress indication is lost (backup still completes though)

100666 Time Zone, date and time picker in config wizard do not display a default value in Azure (deployed as UTC)

102856 [LCD] - plugging in another USB device when on a specific menu on the LCD screen will cause the LCD to bump back to the main screen

103150 Color Blind settings do not work

106346 change how EULA's are returned in Config Wizard - MIM potential with http injection

107570 [ConfigWiz] - Setup - Print This Page - Portrait Layout

107577 [Diagnostics] - Appliance Health - Shutting off the BeyondTrust UVM Service will shut off Diagnostics

107674 [Diagnostics] - Performance Counters - Underscore displays in selected counter

109607 [Diagnostics] - Dashboard graph shows nothing (no faded color of graph) when SQL Mem/Disk/CPU Usage is 0%

109827 [diagnostics] - BT Header does not always display on release notes page

111691 [Diagnostics] - Weekly CPU performance data may already contain data on new images

114122 [Configuration Wizard] - Microsoft and SQL Agreement pages structural formatting

117823 [BTTF] - Unable to RDP to UVM when FIPS is enabled

121816 Webpage login failures (correct username and wrong password) can set the locked flag

126248 CSP errors returned on HA page for exclamation mark image on toaster

3. General Notes

=======================================================================

- The 2.4.1 installer is the primary 2.4 install package - it will upgrade 2.3.4 appliances AND 2.4.0. It replaces the 2.4.0 installer, which should no longer be used.

4. Release availability

=======================================================================

- This update is available via BeyondTrust Updater or as a manual installer from the download tool.

- Shipping on new Appliance Images in April 2017.

Date of Release: January 19, 2018

Product Name: BeyondTrust UVM-20 Security Management Appliance

Updated Version: 2.4.0

Superseded version: 2.3.4

Table of Contents

1. What's New in This Release

2. Known issues:

3. General Notes

4. Release availability

1. What's New in 2.4.0

=======================================================================

45059 2.4: Role Changes

Add a role for PBEPP/Blink

Separate PBPS Portal, PBPS in BI and the Omni-worker (new role)

Create Separate HA Role - manage HAAdmin password

Modify Retina Agent name in Retina role

Manage the PBW Event Service via the Event Collector

Add spinner while roles tiles are loading

Ensure backward compatibility of Templates when roles change

Change ConfigWizard to reflect new Roles

Regenerate the pre-defined templates to reflect the new role structure

77748 2.4: New Roles Editor that allows for Software Installs (w/single sign-on)

Re-architect the Roles Editor so it can be installed by itself outside of a UVM

Migrate existing roles from /RolesEditor to /Roles

Migrate all external calls from /RolesEditor/ to /Roles/

Need to add footer, move version/date to footer and replace with Appliance Name

Define Distribution Plan for Standalone Roles Editor (versioning, install and updates)

Port Template functionality to new Role Editor Service

Integrate with BI authentication in a stand alone setting

Abstract Authentication service for reuse with roles editor on appliance

Modify Notifications functionality to make it optional

Develop a Capabilities Service for evaluating install environment

Add code signing

Roles Editor needs it's own web.config

Add NetCore DataProtection to RolesEditorAppPool

Make Radius work on UVM

Handle appliance configured state with standalone in mind

Handle Role Editor state when in HA Secondary mode

92167 2.4: Add BT Analyser to Diagnostics

Add BTAnalyser card to Diagnostics

Ensure installation of BTAnalyser to UVM

Add Generate Now button to BTAnalyser card in Diagnostics

93606 2.4: Completely disable HTTP on Appliance

Configure and Test a no HTTP setup

Upgrade WMF on Appliance to facilitate future automation options.

118227 2.4: Security Improvements

Protection Mechanism Failure (hsts)

Strip Server, X-Powered-By and X-AspNet-Version from Header

Add "Secure" Attribute to all Cookies

External Control of Filenames or Path by User

Add HTTP Strict Transport Security (HSTS) Header as a configurable option

Check Session Destruction on Server & Expire All Cookies

Prevent username enumeration

retake ownership of default/root website (add to solution for future updates)

Pass the hash, haadmin

Remove internal network addresses from client side code (also Widget updates)

Implement the anti-forgery library in .net

Verify Headers meet security expectations

Add X-Frame-Options:DENY to all Appliance sites

31740 2.4: UVM API Layer Improvements (External & Internal/Cross-Product)

Implement BI Component from Core Team (BTBridge)

Test Automation considerations

Integration with BT prodctcs installed on the UVM.

HA: Move the HA functionality from the Event Service into the UVM's API

Once Bt 'Contract DLL' has the license check - use it for checking the Password Safe bit

102656 2.4: Regular Release Maintenance: Bug fixes, Patches & BI Update

Release Maintenance: Dead Code Cleanup, Reference Checks, Re-sharper Recommendations

Documentation Updates for 2.4 release

Ability to customize the Notification email on the UVM(To be sent from something other then [email protected])

When a backup is restored the roles are not applied

Investigate WinRM's failure to work on appliances

114321 2.4: BeyondInsight 6.4 support

Supercharger: Test URL Rewriting (TFS 116922)

Supercharger: Install and configure BI

Supercharger: Test Active/Active & UVM integration points

107535 2.4: Upgrade C++ Tooling on UVM

31755 2.4: Appliance Support Package

[Diagnostics] Appliance Logs improvements

Broken Authorization - Anonymous download of logs

2. Known issues:

=======================================================================

48692 Certificates created on February 29th (leap year day) are invalid

50373 unable to bitlocker c:\ on 20 or 50 (TPM not enabled)

51919 all pages - Next button does not enable until unblur

52991 Favicon not present (MS Edge Only)

53195 Cannot press Enter to select buttons (space works)

53893 page jumps around when trying to scroll down - MS Edge

54055 disabled checkbox is ever so slightly different size than enabled

54061 when pressing tab through a page there is no indication of currently being on a radio button (network page)

55000 When on step 8, step 9 is valid so progress shows as 90% - but I have never been to step 9

56319 Home and End keys do not function for intended purpose within a text box (input box?)

56450 time picker does not allow input of two digits when specifying the time - Safari

61145 Appliance Discovery Tools returns "Error: The appliance did not respond" when changing the IP but IP change was successful

64222 Auto redirect to diagnostics when configuration wizard completes does not work on safari

64535 Password Safe portal error connecting to Active/Active SQL server

67795 eEye Digital Program Folder listing restored to Start Menu programs after BI update

82325 Diagnostics - There should be a warning if CAPS LOCK is on when logging in

82684 [BI Bug] - EventServer generating Service alerts on HA Secondary saying it was terminated unexpectedly

86920 [Notifications] - "Configure Notifications" or "View all notifications" pages do not allow clicking the previous page through the navigation menu

87815 [Config Wizard] - Machine reboot after rename is recorded as an unexpected shutdown and displays a prompt at next logon

92050 [config wizard] - unnecessary word wrap for Creating database line item

93400 [Header] - The username is no longer displayed when you click on the profile icon on the header

93723 [Config wizard] - new machine name in URL fields are not being applied to BI (REMEMConfig)

98220 [Azure] - Desktop shortcuts missing

98325 Syncit Update errors on non-configured UVM

100584 [Maintenance] - Backups - if the backup is taking a while and the page times out (user does not extend session) the backup progress indication is lost (backup still completes though)

100666 Time Zone, date and time picker in config wizard do not display a default value in Azure (deployed as UTC)

102856 [LCD] - plugging in another USB device when on a specific menu on the LCD screen will cause the LCD to bump back to the main screen

103150 Color Blind settings do not work

106346 change how EULA's are returned in Config Wizard - MIM potential with http injection

107570 [ConfigWiz] - Setup - Print This Page - Portrait Layout

107577 [Diagnostics] - Appliance Health - Shutting off the BeyondTrust UVM Service will shut off Diagnostics

107674 [Diagnostics] - Performance Counters - Underscore displays in selected counter

109607 [Diagnostics] - Dashboard graph shows nothing (no faded color of graph) when SQL Mem/Disk/CPU Usage is 0%

109827 [diagnostics] - BT Header does not always display on release notes page

111691 [Diagnostics] - Weekly CPU performance data may already contain data on new images

114122 [Configuration Wizard] - Microsoft and SQL Agreement pages structural formatting

117823 [BTTF] - Unable to RDP to UVM when FIPS is enabled

121816 Webpage login failures (correct username and wrong password) can set the locked flag

126248 CSP errors returned on HA page for exclamation mark image on toaster

3. General Notes

=======================================================================

- The 2.4.0 installer is the primary 2.4 install package. It now contains a standalone sub-package for the Roles Editor which has been versioned the same as the UVM Software. This installer is available for use with software installs and will eventually move to a separate BTUpdater subscription.

4. Release availability

=======================================================================

- This update is available as a manual installer from the download tool.

- A separate release will be made available for installing the Roles & Authentication components to a software install. Do not use this installer.

- This update will be made available via BTUpdater at the end of February 2018.

- Shipping on new Appliance Images in February 2018.

September 26, 2023

Requirements:

Requires BeyondTrust Password Safe version 23.2.0 or later release.

New features and enhancements:

• Password Safe Terraform Provider has been removed from the Resource Kit, and is now available in the Terraform Registry.
• Signature verification files have been added to allow validation of the Ansible collection (see ).
• Updated Enhanced Session Utility.
• Updated Python API sample to support the latest changes in the BeyondInsight and Password Safe 23.2 release API.
• Updated Password Safe Cache.

ℹ️

Note

New versions of the Password Safe Cache are available for RHEL 8 and 9. There are no new versions for RHEL 7. The last supported version for RHEL 7 is 23.1.24.

Notes:

• The SHA-256 signature is: ebf3fd206d83b39a3bfa010444d33ddfd838fbfc756e17330fcc7a499eaec14c
• This release is available to download for BeyondTrust customers at https://beyondtrustcorp.service-now.com/csm.

September 26, 2023

New features and enhancements:

• .NET Core hosting bundles updated from 6.0.20 to 6.0.21.
• .NET hosting bundle updated from 7.0.9 to 7.0.10.

ℹ️

Note

A restart of the Resource Broker host may be required after this update.

Notes:

• Direct upgrades to 23.2.0.1741 are supported from all previous versions.
• BeyondTrust customers can download this release from their Password Safe Cloud portal by navigating to Configuration > Privileged Access Management Agents > Resource Zones and clicking Download Installer.
• This release bundles version 23.1.3.1310 of the BeyondTrust Discovery Scanner. Corresponding release notes are available here: https://www.beyondtrust.com/docs/release-notes/beyondinsight-password-safe/index.htm.
• The MD5 signature is: 52BCBA3265345F5F6BBAFE6E2B29CFEC
• The SHA-1 signature is: 18CD66CEC3E39BCFF880E1FB1B93FA11CEF06BBD
• The SHA-256 signature is: F10CEEE4957F379B1441417766424817139549BF100291BB8D62C94090D5393A

Sept 26, 2023

New features and enhancements:

None.

Issues resolved:

• Updated a third party component to the latest version as the previous version had a security warning against it.

Known issues:

• The installation dialogs have string substitution errors.

Notes:

• Direct upgrades to this version are supported from versions 20.1.0 and later releases.
• This release is available by download from the BeyondTrust Client Portal at https://beyondtrustcorp.service-now.com/csm.
• There is a product dependency on having the .NET 6 Hosting package installed.
• The MD5 signature is: 021a37e59237b143a56e0eb7d6e66470
• The SHA-1 signature is: 8b894002b204ebb31e57bc2634e9d70947382a9c
• The SHA256 signature is: 16b6eb84671e015bda6142882eaa636c4f9bea0b652e6c2a0a00aad71466082a

Sept. 26, 2023

Requirements:

• Requires version 23.1.3.1308 or later release of BeyondTrust Discovery Agent.
• A restart might be required after installing this update.

New features and enhancements:

General

• Workforce Passwords is a new add-on product that provides enterprise-scale visibility to employee business application password management, leveraging the power of BeyondTrust Password Safe 23.2 and later releases, as follows:
  • Allows users to store their credentials for URLs they access, in secure Personal Folders within Secrets Safe, that only the owner of the folder can access and view.
  • Provides mapping of URLs to the stored credentials. Both 1:1 mapping and mapping many credentials to 1 URL is supported.
  • Users can perform Create, Read, Update, and Delete (CRUD) operations within their personal folder for credentials and URL associations. These actions are audited.
  • Users can use Password Safe password policies and password generator for creating new passwords for URLs.
  • Provides a browser extension allowing users to retrieve credentials for their URLs.
• Enhanced auditing of Smart Rule management actions to capture Smart Rule content details and to provide before and after audit details when Smart Rules are edited. Previous releases only captured the create and edit action, without providing any details. Enhanced audit details are useful for SOX compliance auditing.
• Improved navigation between Smart Rule creation and Smart Rule grid by adding the ability to preview the results of a Smart Rule in-line. This allows the user to test and validate the rule at the time of creation or update so that necessary adjustments can be made at that time.
• Added Download all option to Groups and Users grids. This action downloads a CSV file containing grid data based on selected filters.
• Added support for Microsoft SQL Server 2022. Customers can configure BeyondInsight 23.2 and later releases with MS SQL Server 2022 as its external database.
• Added Run a New Discovery Scan quick link to the Scans page.
• Made minor adjustments to the create and edit forms for creating and editing a discovery management scan credential. Specifically, the layout has been slightly modified and the Description field has been renamed to Credential Name.
• On the Create New Directory Query form, set the default value of the Name field for the Basic Filter to * .
• Improved Dark Mode styling in the App Menu.
• Improved verbiage around local user password policy compliance. The password policy error text in releases prior to 23.2 is confusing when characters that are not permitted are used.
• Removed support for deprecated FireEye connector.
• Removed deprecated Asset Risk data point from multiple areas in the BeyondInsight user interface.
• Removed reports and user interface elements referencing the deprecated BeyondInsight Ticket system.
• Removed deprecated Clarity Malware Analysis from Clarity Analytics and Configuration areas in the BeyondInsight user interface.
• .NET hosting bundle v3.1.23 is no longer included.
• .NET hosting bundle updated from v6.0.19 to v6.0.21.
• .NET hosting bundle v7.0.10 has been added.

Analytics & Reporting

• Added a new Password Safe report called Inactive Managed Accounts, which shows a list of accounts that are inactive or have not been accessed by requester in X days.
• Improved existing Service Account Usage report by adding new parameters for Service Name and Service Account is Managed All/Y/N. This allows admins to discover and report on all service accounts, regardless if the account is under management or not, and also to report on service accounts running with interactive log on permissions.

Password Safe

• Added functionality that simplifies the onboarding of remote applications as follows:

  • Added the ability to use a Managed System Smart Group for associating the application with domain linked accounts.
  • Added a new Smart Rule action that provides the ability to assign applications to managed accounts. In releases prior to 23.2, this was a manual process for each managed account.

• Added support for SAP HANA database platform.

• Oracle database platform now supports the Unlock accounts on password change global setting.

• Added URL property to all Secrets Safe secret types to allow the storing of URLs in Secrets Safe.

• New Ansible integration, which enables developers to securely access their managed accounts and DevOps secrets from Password Safe.

• Additional user audit event added to Secrets Safe:

• ReadSecret is generated when the encrypted content is accessed.

• Read event is generated when the base details and metadata is accessed.

Password Safe Cloud

• Added the ability to subscribe to reports in BeyondInsight and Password Safe Cloud, allowing users to schedule reports to run automatically and make the report available for download.
• Added the ability to run reports on specific dates and date ranges, allowing users to report on particular time periods in the past. In releases prior to 23.2, users could report only on relative date ranges, which meant the report contained data from that point in time until present, resulting in a large report containing unnecessary information.
• Added support for custom Password Safe Cloud hostnames in Password Reset emails:
  • If a customer has a custom hostname defined for their Password Safe Cloud deployment, then any URLs contained in the Password Reset emails will use this, as opposed to the “customerkey” DNS name.
  • In releases prior to 23.2, when customers received the reset password email for first login, it contained the randomized hostname and not the custom hostname configured, leading them to believe the custom hostname didn't exist.

API

Updated APIs for Remote Applications:

• GET Applications
• GET Applications/{id}
• GET ManagedAccounts/{accountID}/Applications
• POST ManagedAccounts/{accountID}/Applications/{applicationID}

Updated APIs for Workforce Passwords and Secrets Safe:

• POST Secrets-Safe/Folders/{folderId:guid}/secrets
• POST Secrets-Safe/Folders/{folderId:guid}/secrets/text
• POST Secrets-Safe/Folders/{folderId:guid}/secrets/file
• PUT Secrets-Safe/Secrets/{secretId:guid}/
• GET Secrets-Safe/Secrets
• GET Secrets-Safe/Secrets/{secretId:guid}
• GET Secrets-Safe/Folders/{folderId:guid}/secrets
• GET Secrets-Safe/Secrets/{secretId:guid}/text
• GET Secrets-Safe/Secrets/{secretId:guid}/file

New APIs for Report Subscriptions:

• GET Subscriptions/delivery
• POSTSubscriptions/delivery/download 

Issues resolved:

• Resolved an issue where searching in the Authentication Type drop down in the Create New Credential form when creating an MS SQL Server discovery credential always returned No options found error.
• Resolved an issue where creating a scan using the Scan Wizard and adding a new MS SQL Server credential using the Create New Credential link resulted in the UI displaying the following error: An error occurred creating the scan....
• Resolved an issue where attempting to add a new credential to a scheduled scan resulted in an error stating that a credential needs to be selected and the credential is not added.
• Resolved an issue where using and then clearing a custom credential in the Scan Wizard caused errors and job creation failure.
• Resolved an issue in the Scan Wizard, where Select All on the credentials list did not respect the boundaries of the search criteria, and thus prompted validation for all keys, not just the ones matching the search.
• Resolved an issue in the Scan Wizard, where validation keys were sometimes requested even if no credentials were selected.
• Resolved an issue where, after saving a change to the target Smart Rule when editing a scheduled scan, an unsaved changes warning popped up when attempting to navigate away from the Targets tab.
• Resolved an issue where changing the scan from Recurring to Immediate on the Schedule tab for a scheduled scan resulted in an error stating Nullable object must have a value, and the changes were not saved. The Immediate option was removed for scheduled scans as it is not valid for this type of scan.
• Resolved an issue where the max user limit on detailed discovery scans was not communicated to the scanner.
• Resolved an issue where SSH keys were not being captured when scanning an asset. When viewing the Advanced Details of the asset from the Assets page, and clicking the information icon for the user in the Users grid, the SSH Key Count field might have been zero, even if SSH keys existed for that user.
• Resolved an issue where, after upgrading to the 23.1 release, any existing access policy which had location restrictions enabled with X-Forwarding set to All showed the X-Forwarded for field as blank and disabled.
• Resolved an issue with session replay in Firefox where viewing an active session, terminating it, and then trying to replay the session from Completed Sessions resulted in an error stating An error occurred while trying to fetch the session keystrokes.
• Resolved an issue where editing an existing functional account with an assigned DSS key incorrectly required the DSS key to be re-uploaded when saving any change to the functional account, even though an already been uploaded message was displayed.
• Resolved an issue where, in some cases, when upgrading the Web Policy Editor to 23.4, the JRE folder became corrupted, causing the Web Policy Editor to not load and Error 500 showing in dev tools.
• Resolved an issue where an incorrect session node hostname/address was being used for RDP sessions after upgrading to the 23.1 release.
• Corrected field labels on the settings for managed accounts and managed systems to read as Default Release Duration from Release Duration to match the label as shown for Manage Account Settings action in a Smart Rule.
• Resolved an issue where it was possible to edit an access policy that was created in the past and change its recurrence to One Time. This is not a valid scenario.
• Resolved an issue where Quick Launch was not available when the access policy end date was the current day and multi-day checkout was enabled.
• Resolved an issue where if the Auto-select access policy for Quick Launch setting is enabled and there are two or more access policies available, the shortest policy is not auto-selected.
• Resolved an issue where the Playback Speed dropdown does not open when viewing a completed session in full screen mode.
• Resolved an issue where password rotation of a Salesforce platform managed account was failing.
• Resolved an issue where password rotation of a Workday platform managed account was failing.
• Resolved an issue where after creating a new Managed System Quick Group, it would not appear in the Smart Group filter until the page was reloaded.
• Resolved a text wrapping issue where a very long approve or deny comment would not be fully visible in the request details form.
• Resolved an issue where if a user attempted to use Quick Launch to access an account where they already had an approved request, they would receive an Account is already available error message, instead of reusing the existing request.
• Resolved an issue where if the maximum concurrent request limit is reached, the conflicting request details were not displayed.
• Resolved an issue where replaying an RDP session, in the 23.1 release, could display An unexpected error has occurred message and fail to replay the session, if the session was using a large screen resolution or multiple monitors. Prior to the 23.1 release, when this error occurred, the session replay would freeze for a moment, and then continue without crashing. The 23.2 release allows for larger data packets during replay.
• Resolved an issue where the Allow use for Secrets Safe option was not enabled by default when creating a new password policy.
• Resolved an issue where when specifying the password for a functional account, if the password contained certain special characters (ex: €), an incorrect validation error was shown.
• Increased the allowed field length for the functional account password to 256 characters from 128 to accommodate the increase in the Jira Cloud ticketing system API key length.
• The minimum password request time has been lowered to 1 minute from 5 minutes, to be consistent between the user interface and the API.
• Resolved an issue where Smart Rules with Dedicated Account mapping actions were not properly triggered when a user logged on for the first time.
• When accessing the Secrets Safe user interface, the default selected folder had been changed from All Secrets to the first team shared folder found under All Secrets. If the user is enabled for Workforce Passwords, this will be their Personal Folder.
• Resolved an issue where certain actions in a Smart Rule could only be added once. Now, multiple instances of the affected actions can be added in a single Smart Rule.
• Resolved validation inconsistencies with scan credential creation using Public Key Authentication Type.
• Improved auditing of manual asset creation and editing actions to show more details about what was created and changed.
• Improved display of details for Selection Criteria in Smart Rule Details area.
• Improved Reporting Gateway service resilience when multiple Endpoint Privilege Management Reporting jar files are present, ensuring the proper jar file is chosen and the proper settings are sent.
• Resolved an issue where the RetinaCSAppPool went into a stopped state on the passive node in an HA setup, ensuring that it is restarted if it enters a stopped state.
• Resolved an issue where the Next Scan Start date/time for a scheduled scan that is in a remote time zone does not display the correct value in the Scheduled Scans grid.
• Resolved an issue where duplicate Attributes could not be added across distinct Attribute Types.
• Resolved an issue where scheduled sync jobs for AD user groups performed by the system were visible in User Audits. Now only manual sync jobs appear in User Audits.
• Resolved a filtering issue on the Directory Credentials grid Title field, where filtering by the underscore character was returning all credentials. It will now return the expected results.
• Resolved an issue where the Endpoint Endpoint Privilege Management Events grid could not be viewed by users with Read Only permissions to the Endpoint Endpoint Privilege Management feature.
• Resolved an issue where Endpoint Endpoint Privilege Management Event Collector, Reporting Gateway, and Web Policy Editor service logs were recording too many informational messages as warnings.
• Resolved an issue where the Discard Changes message was not shown after canceling the Create Policy process in Web Policy Editor.
• Resolved an issue with Endpoint Endpoint Privilege Management event processing where failures occurred if an asset had more than one associated Operating System record.
• Resolved an issue where a broken 500 Error page was appearing after a failed Azure AD or OKTA SAML login.
• Resolved an issue where SAML redirect was not using the incoming host address as it should.
• Resolved an issue where user receiveed an HTTP 500 error when attempting to access SAML pages, after upgrading to the 23.1 release.
• Resolved an issue where the logged in user might not display in the Profile and Preferences dialog in the BeyondInsight console, when logged in using SAML.
• Resolved an issue with RADIUS authentication failing with an error when using naming attribute Alternate Directory Attribute and LDAP domain with non-standard Base DN.
• Resolved an issue with RADIUS configuration not loading when a filter that requires text input was set for that alias.
• Resolved an issue with TOTP descriptions not showing correctly in some authenticator apps.
• Resolved an issue where users with the Auditor role did not have access to Entitlement by User Password Safe report.
• Resolved an issue with duplicate entries on the Service Account Usage report.
• Resolved an issue where the Password Update Activity reports might exclude content about functional accounts with no workgroup.
• Resolved an issue where scheduled scans created by a user having a NULL first name could not be deleted.
• Resolved an issue with the PUT Addresses/{id} API call creating a new address rather than updating the existing one.
• Resolved an issue with No Updates logging excessive rows to the database during Smart Rule processing that onboards managed systems when Endpoint Endpoint Privilege Management is used as the change agent.
• Resolved an issue with X-XSS-Protection header setting for the HTTP response not being set correctly.
• Resolved an issue where Firefox users were always seeing the Skip to Main Content keyboard navigation aid on the screen.
• Resolved a number of minor user interface layout issues.
• Resolved a number of keyboard navigation and screen reader functionality bugs.
• Resolved a localization bug where certain labels were not being translated upon language preference change by user.
• Resolved an issue where the auto generation of a password in Secrets Safe could fail, if there were more than 10 password policies.
• Resolved an issue where selecting a domain for a Resource Zone would not work if the domain has already been added to the system via a directory query.
• Resolved an issue where the hostname or host override values were not being displayed in the Session Node selector when viewing the advanced details of a request.
• Resolved an issue where attempting an Admin Session when FIPS is enabled on the appliance fails.
• Resolved an issue where viewing a session replay using Firefox had excessive flickering.
• Deactivated access policies no longer appear as an option when creating a request an access request in the Password Safe web portal.
• The wrong Resource Broker is no longer automatically selected on the Direct Connect Access form in Password Safe Cloud.

Known issues:

• After upgrading BeyondInsight, it is not possible to change the date or time on a Scheduled Scan that has a Schedule Type set to One Time. After changing the Start Time or Start Date and clicking Save Schedule, the following error occurs: Cannot update a scan schedule from recurring to one time or immediate.
  • Workaround: Delete and recreate the Scheduled Scan to enter the appropriate date and time details. A fix is planned in an upcoming release.
• Running the Endpoint Endpoint Privilege Management - Event Rollup report with the Include Excluded parameter checked might result in the following error and the report might not complete: The report cannot execute due to an invalid parameter.
  • Workaround: Avoid checking the Include Excluded parameter on this report. A fix is planned in an upcoming release.
• Attempting to subscribe to the Discovery Report accessed from the Active/Completed Scans grid results in an empty Create a New Subscription dialog and a 500 error is seen in dev tools.
  • Workaround: You can subscribe to the report from the Analytics & Reporting area of BeyondInsight. Subscribing to the report from the Active/Completed Scans grid is not a valid starting point to set up a subscription. This action will be removed from this location in an upcoming release.
• When using the Workforce Passwords browser extension, if a user has thousands of credentials stored for the same website, there can be a delay before the auto-fill indicator appears on the Log In page.
• Maintenance Expiry Warning banner might fail to appear in the 30 days before the expiry of the maintenance agreement. Once the agreement expires, the alert banner appears.
• Using the API, it is possible to rename a Secrets Safe folder to be a duplicate of an already existing folder under the same parent. This is not permitted in the user interface. A fix is planned in an upcoming release.
• When using the API to create a Secrets Safe folder with the same name as an existing folder, it fails with a 400 - DuplicateFolderName error instead of a 409 - Folder already exists error.
• Using the Workforce Passwords browser extension along with the BeyondInsight web console at the same time with two different user accounts might result in the extension user details being applied to the web console session when signing out of the browser extension.
  • Workaround: Log out of the BeyondInsight web console, as well as the browser extension, and either use the same account for both, or don’t use them at the same time.
• In Analytics & Reporting, the Event List and Events By Hour reports from the Endpoint Privilege Management UNIX Linux folder might give an error in the SSRS log when running. The error might indicate a problem with the [PowerBroker UL Accept Reject Time] dimension.
  • Workaround: Use the Pivot Grid to navigate the data, or choose a different report to review the data.
• If you attempt to edit a new functional account immediately after creating it, an erroneous There are one or more invalid fields validation error displays.
  • Workaround: Click Discard Changes and edit the functional account again.
• If a MacOS managed account is locked out when a password rotation is attempted, the rotation fails but is reported as successful.
• If a FireEye connector was created in a prior release of BeyondInsight, and remains after upgrading, it is no longer valid and cannot be used or updated. The following error displays: Object reference not set to an instance of an object.
  • Workaround: Delete the connector.
• If an audit of type PMR Database Settings exists, and a call is made to the PAPI GetUserAudits for all audits and all details, an error might result.
  • Workaround: None at this time, other than to alter the criteria passed to the API to avoid that audit type.
• If you attempt to manually create a MongoDB managed system with a different instance name and same DNS name and port as one which already exists, the creation fails with a uniqueness validation error.
  • Workaround: Use a discovery scan and Smart Rule to onboard the database managed system.
• Downloading the client certificate from the Configuration > System > Downloads area might fail with an error in some on-premises installations. Error message Keyset does not exist\r\n is seen in dev tools.
  • Workaround: Use the BeyondInsight Configuration utility to generate the certificate.

ℹ️

Note

Issues discovered after release can be found within our product Knowledge Base.

Notes:

• Direct upgrades to 23.2 are supported from BeyondInsight version 21.3 or later releases.
• This release is available to download for BeyondTrust customers from https://beyondtrustcorp.service-now.com/csm using BeyondTrust BT Updater.
• The MD5 signature is: c12466f856d5b4d0837d7c9a17062f18
• The SHA-1 signature is: 602dc72c59725bee64bec589fbbae5527b4bb4fd
• The SHA-256 signature is: 49164507e470d8bcab5bc621f641914ffe8698398c1fb55b0b7695f352062b88

New features and enhancements

This is a maintenance release. There are no new features or enhancements with this release.

ℹ️

Note

See the BeyondInsight and Password Safe 24.2.0 release notes for a complete list of our 24.2.0 new features and enhancements.

Issues resolved

Known issues

ℹ️

Note

Issues discovered after release can be found within our Customer Portal.

Notes

• Direct upgrades to 24.2.1 are supported from BeyondInsight versions 22.2.3 or greater.
• BeyondInsight 24.2.1 supports SQL Server 2016 SP2 or greater.
• This release is available by download for BeyondTrust customers at (https://beyondtrustcorp.service-now.com/csm) and by using the BeyondTrust BT Updater.
• The MD5 signature is: f52eda445beb6055296c47ece4eff7ad
• The SHA-256 signature is: bdf2b35773f636d8d742a78627090d095f5960cfc681e11c6c444427d109e553

Deprecation notice

Team Passwords public API endpoints have been deprecated and are no longer present in the 24.2.1 release. You must update scripts to use the corresponding Secrets Safe API endpoints instead.

BeyondInsight 24.2.1 still supports the following features, however these are planned to be removed in the next release:

• Analytics & Reporting > Clarity: Clarity and related reports and configuration.
• About > BeyondInsightAnalysis

The Password Safe platforms Cloud - Azure and Cloud - Office 365 will be removed in the 24.3 release. Customers should transition to using the Microsoft Entra ID platform, which offers additional functionality.

ℹ️

Note

For a list of supported platforms for the latest version of BeyondInsight and Password Safe, see Supported Platforms.

Supported Platforms for previous versions of BeyondInsight and Password Safe can be found in the BeyondInsight, Password Safe, and U-Series Appliance Documentation Archive.

New features

Increased security with Passwordless FIDO2 Authentication

Password Safe now supports Passwordless FIDO2 authentication, which allows local BeyondInsight users to authenticate more securely using a security key or a biometric method, such as a fingerprint or face recognition.

Enable the Passwordless FIDO2 Authentication option from the Configuration > Authentication Management > Authentication Options page in BeyondInsight.

Once enabled for your instance, users can then configure FIDO2-certified authenticators for their account. Administrators can also see/remove any authenticators that a user may have configured.

Automatically synchronize Microsoft Entra ID groups on a scheduled basis

Microsoft Entra ID group membership no longer requires manual synchronization for individual groups. Users can now enable global group synchronization and schedule it to occur automatically on a daily, weekly, or monthly basis.

Enable and schedule group synchronization from the Configuration > Role Based Access > Microsoft Entra ID Group Synchronization page.

Automate the onboarding of AWS Credentials

Administrators can now create a Smart Rule to discover and onboard AWS IAM users into Password Safe for credential management, without the need to perform a discovery scan.

Create a Managed Account Smart Rule with the new Amazon IAM Query condition for the selected the Amazon Cloud Managed System, set to re-run every X hours, and assign the Manage Account Settings action.

Synchronize K8s secrets and Password Safe secrets

The Kubernetes External Secrets Operator (ESO) now includes a Password Safe extension to retrieve secrets managed by Password Safe and synchronize them into K8s secrets. This ensures applications can continue to leverage K8s secrets without changing their applications or workflows.

New reports

Custom Attributes

A new report that lists assets and their custom attributes was added to the Assets folder for both on-premises and cloud.

Database User List

The Database User List is now available in the Account folder in Password Safe Cloud. It was previously only available in on-premises installs.

Enhancements

Increased security for SAML authentication

Password Safe now has a Force Re-authentication option when configuring a SAML identity provider in BeyondInsight. Enabling this option requires users to re-authenticate with the identity provider for each BeyondInsight session, even if they already have a valid session.

Enable the Force Re-authentication option for the identity provider from the Configuration > Authentication Management > SAML Configuration page.

Increased security for Discovery Agents

Discovery Agents can now be configured to use OAuth authentication for communications with BeyondInsight by leveraging the existing Installer Activation Keys feature.

Configure a key from the Configuration > Authentication Management > Installer Activation Keys page for use when setting up Discovery Agents with OAuth authentication.

Improved UI accessibility

Accessibility improvements made in many areas of the BeyondInsight and Password Safe UI:

• Improved page responsiveness based on screen resolution
• Appropriate screen reader cues added to input fields, drop-downs, and grids:
  • Input fields can now indicate their invalid state or error messages to screen readers via ARIA tags.
  • Searchable input fields and drop-downs now announce the number of results available and announce every time the number of results change.
  • Areas in grids that have the focus are now announced.
• Improved Session Replay Viewer progress bar to support keyboard interactions and added ARIA properties.

Report updates

Run reports for exact dates and date ranges

On-premises users can now quickly determine what actions were performed during specific time periods by running reports for exact dates and ranges.

More auditing information in the Password Release Activity report

The Password Release Activity report now includes the reason for the password release. The reason, ticket number, ticket system, and approver are now included when SIEM events are forwarded.

GET Users API now supports inactive users

The Password Safe GET Users API now has the ability to return users that are flagged as inactive. Releases prior to 24.2.0 only supported returning active users.

Encrypt secrets with an external hardware security module (HSM)

Password Safe now supports encryption of the Secrets Safe vault using an external HSM configuration. This builds on existing support for HSM encryption of the Password Safe vault and system credentials.

Remove dependency on IUser\_REM account

The on-premises BeyondTrust Discovery Agent can now be configured to communicate via certificate or OAuth authentication, as is done in Password Safe Cloud. If set up this way, the BeyondTrust Discovery Agent does not require the account, and it can be removed.

Password complexity, use and lifetime restrictions

Changed local user default password policy minimum length from 14 characters to 16 characters. Upon upgrade, this change takes effect only when the policy is edited.

Last login information message to users

Password Safe now displays the user's last login in the Profile and Preferences box.

Customizable SQL Server Port

The SQL Server Port is now customizable on various configuration pages.

Better insights with X-Forwarded-For IP

The X-Forwarded-For header ensures the source client IP address is included in User Audit details for both API and web console interactions.

Removed deprecated TeamPasswords PAPI endpoints

Legacy TeamPasswords public API endpoints have been removed:

• POST TeamPasswords/Folders
• GET TeamPasswords/Folders
• PUT TeamPasswords/Folders/{folderId}
• DELETE TeamPasswords/Folders/{folderId}
• GET TeamPasswords/Folders/{folderId}
• POST TeamPasswords/Folders/{folderId}/Credentials
• PUT TeamPasswords/Credentials/{id}
• GET TeamPasswords/Credentials/
• DELETE TeamPasswords/Credentials/{id}
• GET TeamPasswords/Credentials/{id}
• GET TeamPasswords/Folders/{folderId}/Credentials

Terminate and cancel session option in Active Sessions

Password Safe Portal users with appropriate permissions can terminate an active or locked session and cancel the related request.

Support storing SSH host keys in PEM files

You can now store the ssh-dss, ssh-rsa, ssh-ed25519 and ecdsa-sha2-nistp256/384/521 host keys in PEM files identified by registry values. This can be useful to ensure that a cluster of nodes behind a load balancer all share the same SSH host keys.

.NET 8 runtime version

BeyondInsight and Password Safe Cloud's resource broker is now deployed with the .NET 8.0.8 hosting bundle.

Dedicated Account Smart Rule improvements

Dedicated Account Smart Rules now allow:

• Actions
  • Set attributes on each account
• Filters
  • Managed System Smart Group (new filter)
  • Assigned Attributes
  • Platforms

Quickly see "Disabled at Rest" status

A new column has been added to show if Managed Accounts are enabled for the "Disabled at Rest" mode.

Refreshed UI and improved UX

In the Analytics and Reporting > Report Subscription wizard and the Configuration > Analytics and Reporting > Configuration wizard, the user interface and user experience have been reviewed for consistency and correct layout.

Filter approvals by request ID

The Approvals grid can now be filtered using the Request ID column.

Easier selection of Password Safe node, directory, and resolution filters

Filters are now multi-selectable drop-downs and are pre-populated with all available nodes, a number of standard RDP resolutions, and available directories.

View authentication status at a glance

Administrators can now use the Agents grid to see which Endpoint Privilege Management endpoint agents are using OAuth and which are still using certificate-based authentication.

Issues resolved

Known issues

Notes

• Direct upgrades to 24.2.0 are supported from BeyondInsight versions 22.2.3 or later releases.
• BeyondInsight 24.2.0 supports SQL Server 2016 SP2 or higher.
• This release is available by download for BeyondTrust customers (https://beyondtrustcorp.service-now.com/csm) and by using the BeyondTrust BT Updater.
• The MD5 signature is: aa5c3665679bb8b91ba179029a0711f2
• The SHA-256 signature is: b32e3703a8cad701fe6487e611c278edfcf27ffb026baa0142777b5d71d8ff73
• The ECM Plugin for Password Safe has been updated to version 24.1.3.

Deprecation notices

Team Passwords Public API Endpoints have been deprecated and are no longer present in the 24.2 release. You must update scripts to use the corresponding Secrets Safe API endpoints instead.

BeyondInsight 24.2.0 still supports the following features, but these are planned to be removed in the next release:

• Analytics & Reporting > Clarity: Clarity and related reports and configuration.
• About > BeyondInsight Analysis

The Password Safe platforms Cloud - Azure and Cloud - Office 365 are being removed in the 24.3 release. Instead, customers should transition to using the Microsoft Entra ID platform, which offers additional functionality.

New features and enhancements

Configuration

• SAML Configuration has been updated so that incoming SAML communications (Assertions, Response) can no longer be signed using SHA1 by the Identity Provider (IdP). This is disabled for security purposes.

ℹ️

Note

Incoming SAML communications (Assertions, Response) must be signed using SHA-256 or higher by the IdP. SHA1 is no longer be accepted.Ensure your IdP has been updated in BeyondInsight accordingly.
Failure to update your IdP prior to upgrading BeyondInsight and Password Safe to version 24.1.1 may prevent users from logging in using SAML.

• Added a new option to the Configuration page: Identity Security Insights > Connect to Identity Security Insights.
  • Enabling this connector key allows Password Safe to forward discovery scan events to Identity Security Insights. This provides visibility into possible attack paths, identity-based threats, and identity hygiene issues.

Developer Platform

• All components and services using .NET 6/7 have been updated to .NET 8.

Analytics & Reporting

• Added a Retrieval Reason column to the Password Safe > Activity report to display the comments for any release request listed in the report.

Password Safe

• Changed API Authentication Failure email notification logic so that new deployments of BeyondInsight and Password Safe do not send email notifications when API authentication failures occur.
• Updated the bundled ECM Password Safe Plugin to version 24.1.2.
• Added Change Password after Release and Enable API Access options to the Disable at Rest onboarding Smart Rule action.

Password Safe Cloud

• Renamed the Update column on Resource Broker grids to Update Available.
• Added links to release notes in the Update Available column on Resource Brokers grids, for resource brokers that can be updated or are being updated.
• Added a DNS Name filter to the Resource Zones > Brokers grid when accessing that area from a specific resource broker.

Issues resolved

• Resolved a foreign key constraint issue with the daily sync job (relating to the Change Queue fact table and Managed Account dimension table).
  • Now, the sync job handles the data in a way that avoids this constraint issue.
• Increased security around Smart Rule editing.
• Resolved an issue where updating an existing SAML configuration prompted the user to include the IdP certificate.
  • Now, the certificate is only required on the Create page.
• Resolved an issue in the Web Policy Editor, where sometimes a Save button appeared on the policy editing page, which caused the editor to hang when used.
  • Now, only the appropriate Save & Unlock button appears, and the editor works without hanging.
• Resolved an issue in the Activation Key generated command line text that prevented OAuth communications with Endpoint Privilege Management agents in Password Safe Cloud environments.
  • New users created using the API now respect the TOTP Two-Factor Authentication restrictions as set in BeyondInsight configuration, the same as manually created users do.
• Resolved an issue affecting proper generation of user audits of Secrets Safe activity.
• IP and X-Forwarded-For authentication rules are now evaluated on every API call instead of only on authentication/sign-in.
• Resolved an issue with the IP Allow List, where attempting to enable network restrictions would fail if at least one resource broker exists that has not yet been upgraded to at least version 24.1.0.
• Resolved an issue with the IP Allow List where, upon resource broker validation, if a large number of resource brokers were not in the allow list, the notification message was taking up the entire screen.
  • The notification message has been adjusted and scrollbars added for proper visibility.
• Improved the performance for Managed Account onboarding Smart Rules for some scenarios.
• Resolved an issue where a Secrets Safe secret could not be deleted if the ownership is assigned to Entire Team.
• Resolved an issue where upgrades from versions 23.1.1 and earlier would reset the TOTP configuration settings.
• Resolved an issue where a Password Mismatch email notification was incorrectly sent when a Password Test failed against a Windows system because it was unreachable or failed to connect.
• Resolved an issue where scans were not updating the IP address for managed systems when the IP address is reverted to a previous IP.
• Resolved an issue where the Events grid in Managed Account Advanced Details was slow to populate.
• Resolved an issue where Smart Rule processing would fail due to propagation actions being applied to accounts that were not inserted into the database.
  • Now, managed accounts that are not onboarded do not cause the propagation action to fail.
• Increased the timeout for HttpClient used to proxy Endpoint Privilege Management requests.
  • Now, exports from Privilege Management Reporting within BeyondInsight succeed even with very large data sets.

Known issues

• When establishing a connection between the Workforce Passwords extension and your Password Safe instance, if there is a space at the end of the URL in the extension, a DNS address could not be found error occurs.
  • Workaround: Avoid adding any extra spaces at the end of the URL when using the Workforce Passwords extension. This issue is being resolved for an upcoming release.

ℹ️

Note

Issues discovered after release can be found within our product Knowledge Base.

Notes

• Direct upgrades to 24.1.1 are supported from BeyondInsight versions 22.2 or later releases.
• BeyondInsight 24.1.1 supports SQL Server 2016 SP2 or higher.
• This release is available by download for BeyondTrust customers (https://beyondtrustcorp.service-now.com/csm) and by using the BeyondTrust BT Updater.
• The MD5 signature is: cfee455464f5589b49d2143872441f55
• The SHA-1 signature is: 1bdcef294a47e6e201a62b5edaafcd435d3deaab
• The SHA-256 signature is: ce70c722ba9c99e4b3e791a94eef88d5ce8b22ef6cebe286c0ac0c7f9abf2756

Deprecation notice

BeyondInsight 24.1.1 still supports the following features that are planned to be removed in upcoming releases:

• Team Passwords Public API Endpoints: Planned for the 24.2 release. You must update scripts to use the corresponding Secrets Safe API endpoints.
• Analytics & Reporting > Clarity: Clarity and related reports and configuration. Release to be determined.
• About > BeyondInsight Analysis: Release to be determined.

New features and enhancements

Configuration

• SAML Configuration has been updated so that incoming SAML communications (Assertions, Response) can no longer be signed using SHA1 by the Identity Provider (IdP). This is disabled for security purposes.

ℹ️

Note

Incoming SAML communications (Assertions, Response) must be signed using SHA-256 or higher by the IdP. SHA1 is no longer be accepted.Ensure your IdP has been updated in BeyondInsight accordingly.
Failure to update your IdP prior to upgrading BeyondInsight and Password Safe to version 24.1 may prevent users from logging in using SAML.

• New Configuration > Authentication Management > Installer Activation Keys page for configuring Endpoint Privilege Management agents to use OAuth authentication.
  • Agents that support OAuth communication is expected in upcoming releases of Endpoint Privilege Management for Windows and Endpoint Privilege Management for Mac.
  • Refer to the Release Notes for those products, once they are released, to confirm which versions support OAuth communication.

General

• Improved user experience around toast messages, including time-based auto-dismiss of all notification types, pause and resume actions to control the auto-dismiss in real time, and a notification center to view previous warning and error notifications that were not dismissed.
• Added the ability to reactivate scheduled scans that were deactivated.
• Increased the upper limit of the scanner minutes to run input in the Scan Restrictions section of the Scan Wizard from 60 to 2880 (equivalent to 48 hours).
• Added the Scan Restrictions inputs to the Edit Scheduled Scans area, so that scan restrictions can be edited for a scheduled scan.
• Added support for the Workforce Passwords Browser Extension to detect the web browser’s language, and use it if it’s one that is supported.
• Added support for Workforce Passwords Browser Extension to give the user the choice to leverage their current session if they currently are logged into BeyondInsight in another browser tab.
  • This also resolves previously mentioned known issues with SAML, Windows SSO, and Smart Card login methods for the Workforce Passwords Browser Extension.
• Added View Results row action to Smart Rules grid for processed Smart Rules.
• Added warnings to Directory Queries Create and Edit interfaces to remind users that making changes to Directory Queries can have significant impacts if those queries are used by on-boarding Smart Rules. The warning also alerts the user when they have made edits but not tested them before saving.
• Updated the social media icons on the BeyondInsight Log in and About pages.
• Modified the BeyondInsight and Password Safe installer to prevent attempted installation on Windows Server 2012 or older versions.
• Renamed the Domain/Domain Controller field to Base DN on the LDAP User and Group Add and Edit forms.
• Added support to allow the manual entry of a Base DN in the dropdown if the Fetch does not return the one that is required.
• Updated Azure Active Directory references to Microsoft Entra ID across BeyondInsight and Password Safe user interface.
• Updated from Angular 15 to Angular 17.
• Removed references to deprecated Mac Address field from BeyondInsight and Analytics & Reporting.
• Removed references to deprecated Asset Risk field from BeyondInsight and Analytics & Reporting.

Analytics & Reporting

• Added new Active Users report to show BeyondInsight and Password Safe web console user logins. This report can also show users who have never logged in.
• Added new SSH Keys report to show discovered and authorized SSH Keys found on assets during the latest scan.
• Removed deprecated Endpoint Privilege Management Registry Monitoring report.

Password Safe

• Added Disable at Rest functionality for Microsoft Active Directory and Entra ID managed accounts, providing new Just-in-Time capabilities.
• Added ability to import credentials from a .csv file for Secrets Safe and Workforce Passwords.
• Added email notifications for failed Propagation Action events.
• Propagation Action events are now included in Event Forwarder connectors.
• Added Account Status availability details for Privileged Remote Access (PRA) and Endpoint Credential Manager integrations, so PRA users can identify if accounts are not available.
• Improved support for Cloud managed systems with Privileged Remote Access and Endpoint Credential Manager integrations.
• Updated Password Safe product image in the left sidebar menu and dashboard tile.
• Added ability to filter by Archive status on the Completed Sessions grid.
• Updated the Twitter/X platform image in the BeyondInsight UI.
• Added Secret ID value to various screens in Secrets Safe.
• Added kiosk-mode support to PS_Automate. Additionally, several keyboard shortcuts (i.e: open new window, open browser task manager) are now blocked.
• Implemented a block to prevent the use of the WinSCP client when it is configured in SCP mode. WinSCP in SCP mode causes performance issues when used in conjunction with Password Safe sessions. Use WinSCP in SFTP mode or an alternative SCP client.
• Updated the Parameters UI control in the Applications configuration screen, to improve the readability when there are multiple parameters.
• Updated verbiage in Password Safe from ‘Domain’ to ‘Directory’ for consistency with other product areas.
• Updated grid column filters in Password Safe to be multi selectable dropdowns for Directory, Platform, Node and Resolution columns.
• Added browser spell check capability for various fields (ex: Managed Account and System Description, etc).
• Added ability to approve and deny requests directly from the Approvals grid.
• Added ability to check in a request directly from the Requests grid.
• Added color icons to values in the Account Status column in Password Safe to improve visibility.

Password Safe Cloud

• Added IP Allow List configuration, providing the ability to restrict which IPs and ranges are permitted to connect to a Password Safe Cloud instance.

Issues resolved

Analytics & Reporting

• Resolved an issue in Endpoint Privilege Management reports where toggling the Include Excluded parameter caused the Event Title parameter dropdown to clear.
  • The Event Title parameter is no longer affected by changes to the Include Excluded parameter, allowing the reports to run more easily.
• Resolved an issue in a number of reports where the system did not consistently enforce required parameters to populate before allowing the user to run the report.
  • Now the restrictions are properly enforced, protecting users from inadvertently running reports with incomplete parameter selection.
• Resolved an issue where the Subscription list was not refreshed after editing an existing subscription.
  • The Subscription list now reflects the new information immediately after editing is complete.
• Removed the Download Reports option from the Subscription list for on-premises configurations.
  • Now that action, which is not supported on-premises, can’t be attempted.
• Resolved a previous known issue in which the Reviewed Sessions report may not correctly identify the Reviewed By and Reviewed Date for reviewed sessions.
  • Now the Reviewed parameter, when set to Yes, consistently returns the Reviewed rows as expected.
• Updated the Password Safe > Entitlement by Group report to improve report performance by reducing overall processing time.
• Aligned the permissions required to own and edit subscriptions between cloud and on-premises configurations of Analytics & Reporting.

Configuration

• Resolved a cloud specific session timeout issue where configured session timeout values of more than 20 minutes were not being respected.
  • Administrators can now configure up to a 60 minute timeout, which will be respected by the product web interface in both cloud and on-premise configurations.
• Resolved an issue where some edits to Smart Rule criteria may give an error indicating that “One of the Smart Rule parameters is invalid. Please review and try again.”
  • The condition that caused this error is no longer possible, so an administrator will not encounter this error when creating or editing Smart Rules. This may speed up the task of creating or editing Smart Rules.
• Resolved an issue where the character limit warning on the Role Based Access > Password Policy > Default Password Policy text input fields was not removed after the text input was updated using the Reset to Defaults action.
  • The character limit warning is now cleared when the Reset to Defaults action is taken in this area.
• Resolved an issue in User Management with password validation.
  • Now, if trying to set a password that contains a mix of special characters that are allowed or not allowed, the validation accurately guides the user to remove the characters that are not allowed.
• Resolved a previous known issue which caused the Name column in the Groups grid of the User Management configuration screen to be repeated.
  • Now the Name column only appears once as would be expected.
• Resolved an issue where a user may not be able to update their password if the password policy is edited to decrease the max length of a password to a shorter value than the length of the user’s current password.
  • Now, a user can update their password even if their current password length exceeds the upper limit on the policy.
• Resolved an issue in the System Event Viewer and User Audits grids where the row focus and checkmark do not update when viewing details in the right panel by clicking the Info button in the row.
  • Viewing the details in the right panel without selecting a new row first, now clears the focus from the previously selected row and places an indicator around the button to show that it’s the one being viewed in the right panel.
• Resolved an issue in the Add New Group form with new inline credential creation, where now the Credential dropdown updates immediately with the newly created credential.
  • The user no longer needs to close and re-open the panel to use the new credential during group creation.
• Updated the Scan Agents selection grid in the Set Scanner Properties area of the Smart Rules Create and Edit pages.
  • Now, deleted agents are not available for selection, and the Apply Changes option remains visible even if there are a large number of agents in the grid.
• Resolved an issue in LDAP search in user and group management, where a Fetch action after an invalid entry to the Base DN field was failing to show an error to the user.
  • An error is now shown if the input is invalid, so the user is alerted to any possible data input errors.
• Resolved a display issue in Configuration > Address Groups where imported IPs do not appear in the user interface until the page is refreshed.
  • The imported IPs now appear immediately.
• Resolved an issue that was preventing the removal of the built in Administrator user from custom user groups.
  • The built-in Administrator account can now be removed from custom user groups.
• Resolved some time zone and start time issues with the Support > Advanced Purge Options.
  • The job now runs at the time shown in the UI.
• Resolved sensitive information leak on the Discovery Credential configuration screen.

Endpoint Privilege Management

• Resolved a previous known issue which affected the editing of extremely large policies in the Endpoint Privilege Management Policy Editor.
  • Using Endpoint Privilege Management Policy Editor version 23.1.0 or later, policies larger than 20 MB can be created, edited, and saved.
• Updated the BeyondInsight user interface to ensure that links to Endpoint Privilege Management Policy Editor remain in English even if the user has selected another language.
  • This is an indicator that the Endpoint Privilege Management Policy Editor itself is not localized to languages other than English.
• Resolved an issue causing excessive logging in the Privilege Management Reporting Event Collector Service.
  • Now, after restarting, the service log level is set to Warning, which reduces the noise in the log file and makes troubleshooting easier.
• Updated the logic that shows and hides the Privilege Management Reporting card in the Configuration area.
  • Now, the Configuration card appears when Privilege Management Reporting UI is installed, rather than relying on Privilege Management Reporting database is installed. This allows for easier configuration in environments where the database is remote.

Password Safe

• Resolved an issue where null date values were displaying incorrectly in the Managed Account Details view.
  • Now, if the dates for Last Changed or Next Change are null, the field displays -- instead of an invalid date.
• Resolved handling of ssh_proxy\prompts configuration for SSH sessions.
• To prevent false negative password changes, all built-in custom platforms with single-word regex expressions have been updated to look for exact matches.
• Clarified the force termination help text for access policies so that is more about its intended usage.
  • Now, the help text displays "Forcibly closes the RDP session when the requested time expires".
• Resolved an issue in Password Safe where an application was showing as associated with all linked systems when it was set to Run on a Different System and No Association was selected.
  • Now the application only appears for the managed system that the domain managed account is linked to.
• Resolved an issue in the Password Safe public API where GET UserGroups/{userGroupId}/Users times out when auditdetails page has many rows in the database.
• Resolved an issue in Password Safe where a favorite record for a domain account linked to a managed system remains after the link has been removed.
  • Now when the two are unlinked the favorite no longer displays.
• Resolved an issue that occurred when a Dedicated Account Smart Rule was removed. Previously a reset was required to remove this data from the database.
  • The data is now automatically removed when the Smart Rule is removed.
• Resolved an issue where when a functional account is a directory account, the Test Agent was performing the test against all managed systems that the functional account was associated with.
  • Now, Test Agent only performs the test against the directory managed system.
• Resolved an issue in the Password Safe Public API where specifying an empty string for the ApplicationRegistrationIDs parameter to the POST UserGroups API returns HTTP error code 500 ‘Internal Server Error’.
  • This now returns a 201 - Success.
• Improved error messaging in access policies when attempting to create a schedule with a timeframe set to less than 30 minutes.
  • The error message no longer states "Schedule duration must be more than 30 min".
• Resolved an issue where the default Privileged Access Management policy does not contain a section for the First Character Value.
  • This section is now added with any character permitted as the first character.
• Resolved an issue where it was not possible to change the First Character Value setting from the default value of Any Character Permitted when creating or editing a Password Safe password policy.
  • It is now possible to successfully modify this setting.
• Resolved an issue where users without any access to Password Safe were able to successfully log in.
  • Previously, users would log in to the console and be unable to see any data. Now they are prevented from logging in successfully.
• Resolved an issue where when attempting to modify Selection Criteria parameters in Smart Rules using an invalid parameter, a non meaningful error message was displaying.
  • Now, when attempting to save a Smart Rule where an invalid parameter has been selected the following message displays: "One of the Smart Rule parameters is invalid".
• Optimized database queries that were taking too long to complete to improve their performance.

Secrets Safe

• Log entries are now included in the System Event Viewer.
• Resolved an issue in the Secrets Safe public API where secrets created before the time specified were being incorrectly returned when using the AfterDate parameter.
  • Now these secrets are not returned.
• Resolved an issue where the Secrets Safe feature permission could not be successfully managed by groups that had the minimum required permissions of User Account Management.
  • Now these groups are able to successfully add and remove the Secrets.
• Resolved an issue where user's personal folders were being orphaned in the database if the user was deleted.
  • Now when a user is deleted from BeyondInsight their personal folder is removed as well.
• Resolved an issue in Secrets Safe where line returns were being dropped when being copy and pasted into the Notes field.
• Resolved an issue in the Secrets Safe Public API where creating a secret via POST Secrets-Safe/Folders/{folderId:guid}/secrets returns a response with an empty string for the FolderPath property.
  • This now returns the correct FolderPath property.
• Resolved an issue where the owner of personal folder secrets can be changed.
• Resolved an issue in Secrets Safe where the group folder name was not automatically updated when the Active Directory group name changes.
  • The folder name now updates when a group sync is triggered in BeyondInsight.
• Resolved an issue in Secrets Safe where read audit logs for a secret were being generated incorrectly when access was denied due to insufficient permissions.
• Improved error messaging in Secrets Safe when attempting to create a duplicate folder.
  • The error now explicitly states that the folder name already exists.
• Removed extraneous ID and credentialID entries from the Secrets Safe user audit details.

Other

• Improved RoleType validation for user and group creation via API.
• Improved filtering in Asset Advanced Details > Services grid.
  • Now, the Status column can be filtered by additional options that may appear.
• Resolved an issue that was preventing accurate sorting of the Last Login column of the Asset Advanced Details > Users grid.
  • Now, that column can be sorted.
• Resolved an issue affecting the removal of tiles when customizing Dynamic Dashboards.
  • Now, tiles added to custom dashboards can be removed.
• Resolved an issue with inconsistent tile sizes in the Dynamic Dashboard.
  • Now, tiles appear the same size even when there are only a few of them.
• Improved performance in the Plugin Event Server in cases where a large number of events are present.
• Resolved an issue in Public API GET UserAudits method where it was incorrectly returning data when the date range was set to future dates.
  • Now, only the expected results are returned.
• Updated API query string length validation.
• Removed unused Angular.js file and project references.
• Resolved an issue where upgrading BeyondInsight caused the startup type of Disabled Omniworker and Manager Engine services to change to Automatic (Delayed).
  • Now, upgrading BeyondInsight respects role settings for these services as expected.
• Resolved a number of minor UI issues around form field validation, file uploads, appropriately display of discard modals, long content tool tips, translated text layout, and standardized use of recurrence UI control.

Workforce Passwords

• Resolved a permission issue with running the browser extension in Firefox, where the user had to configure extra steps before they could use the extension.
  • Now the Firefox extension works without any extra configuration steps required by the user.
• Resolved an issue where using the browser extension along with the BeyondInsight web console at the same time with two different user accounts resulted in the extension user details applying to the web console session when signing out of the browser extension.
  • Now, the logged in users remain separate.

Known issues

• In the Configuration > Propagation Actions grid, applying a filter to the Last Change Date column has no effect, and all rows are returned.
  • This is being resolved in a future release.
• When using the Web Policy Editor, on the first attempted edit of a user’s session, occasionally (more often in Incognito mode), an additional button save action may appear on the policy editing page. When this occurs, the Save and Save & Unlock buttons do not work as expected and can cause the editor to hang.
  • Workaround: Avoid incognito mode. If a Save button appears, discard changes and attempt the create or edit again. The issue should not occur a second time during the user’s session.
• On the Sessions grid in the Password Safe, the column picker contains a duplicate Status column entry, which can be ignored.
  • This is being resolved in a future release.
• When editing the ownership of a secret, navigating away from the page does not prompt with an unsaved changes warning. Ensure you have saved the ownership changes prior to navigating away. This is being addressed in a future release.
• When configuring an IP Allow List rule with an IP Range, there is no validation which prevents a user from entering a From IP Address value which is higher than the To IP Address value. Attempting to save a rule with this misconfiguration displays a generic error message.
  • Workaround: Ensure that when configuring IP Range rules that the From IP Address value is lower than the To IP Address.
• If a Workforce Passwords Browser Extension is in use while the Password Safe instance is upgraded, its extension cache may need to be manually refreshed so that new features appear. This can be achieved by logging out of the extension, then pressing Shift-F5 on the extension log in page when signing back in.
  • Workaround: This can be avoided by not actively using the extension during upgrades.
• When importing a secrets CSV file, if a field contains a comma in the value, then the import fails with a “Wrong number of arguments” error on the offending line.
  • Workaround: Manually edit the CSV file to remove the comma.
• When modifying the ownership of a secret, if all users are de-selected you are still permitted to save without an error. This results in the secret’s ownership being assigned to Entire Team.
  • A save validation is being added in a future release.
• It is possible to create a request against an asset that is marked as inactive. However, this request is not visible in the Requests grid in Password Safe.
  • Workaround: Clear the inactive flag from the asset.
• If a ticket is supplied when creating a request and the ticket validation fails, only a generic validation error is shown to the user. This may be insufficient to troubleshoot the error.
  • Additional details are available in the logs and System Event Viewer. Error messaging is being improved in a future release.
• If you attempt to enable IP Allow network restrictions and at least one Resource Broker exists that has not yet been upgraded to 24.1, then the Save will fail with an Internal Server Error message.
  • Workaround: Upgrade all Resource Brokers to 24.1 (or remove unused Resource Brokers) prior to enabling IP Allow network restrictions.

ℹ️

Note

Issues discovered after release can be found within our product Knowledge Base.

Notes:

• Direct upgrades to 24.1 are supported from BeyondInsight versions 22.2 or later releases.
• BeyondInsight 24.1 supports SQL Server 2016 SP2 or higher.
• This release is available by download for BeyondTrust customers (https://beyondtrustcorp.service-now.com/csm) and by using the BeyondTrust BT Updater.
• The MD5 signature is: c6c24a48eb14521a9ae58c46e5fcd5cf
• The SHA-1 signature is: 4e0c177cc634871d07255220f5e89066c448faf8
• The SHA-256 signature is: 248f3d64925c78d4b491efa1dd35f9de7127a5191ade4bb848e9f6b681b2653b

ℹ️

Note

Incoming SAML communications (Assertions, Response) can no longer be signed using SHA1 by the Identity Provider. This is disabled for security purposes.

Deprecation notice

BeyondInsight 24.1 still supports the following features, but these are planned to be removed in upcoming releases:

• Team Passwords Public API Endpoints: Planned for the 24.2 release. You must update scripts to use the corresponding Secrets Safe API endpoints.
• Analytics & Reporting > Clarity: Clarity and related reports and configuration. Release to be determined.
• About > BeyondInsight Analysis: Release to be determined.
• Email notifications for failed API Authentications: Release to be determined.

December 20, 2024

Requirements:

• There is a product dependency on having the .NET 8 Hosting package installed.
• OAuth authorization is dependent on having BI version 24.2.0.
• The new Central Policy message to retrieve all scheduled scans is dependent on BI version 24.3.0 and higher.
• A reboot of the system may be required.

New features and enhancements:

• Add new privilege level for users with SUDO access of "ALL"
• Removed abilibty to migrate from Retina to Phoenix.
• Added support of the Zypper software package manager for SUSE Linux for software enumeration.
• Add support for enumerating MSSQL databases on Linux targets
• Added support for new Central Policy message to request all scheduled scans from BI, instead of just the updated ones.Added support for configuration of SSH authentication ciphers and methods.
• Added getting target description for a Windows target from the registry.

Issues resolved:

• Resolved an error condition where a hung scan could occur in getting the target domain information. Added timeouts around the registry access and added a timeout to the remote command.
• Modified the code path which resulted in the Job Queue Status node being skipped for the Central Policy EngineInfo XML.
• Resolved a condition where getting the service startup type locally caused a hung scan by adding a timeout around the API call.
• Resolved an error in address resolution parsing when the target machine name contains a '#'.
• Added timeouts around additional registry access in DCOM enumeration.

Known issues:

• PowerShell doesn't properly send the command line options for btdiscovery.cmd to the program. This command must be run in a standard windows command shell.

Notes:

• SSH Session encryption using the SHA1 cipher is deprecated. SHA256 or higher should be used.
• This release is available by download from the BeyondTrust Client Portal.
• The MD5 signature is: 64001ce5a2d89a86788a517882f67edd
• The SHA-1 signature is: bc92a956ad9689b35c0c336e76de87e9fe34092e
• The SHA256 (exe) signature is: b58d981906c93190bca5e9de765f328d9c4202f5f29779de41f67ab5ea198d09
• The SHA256 (msi) signature is: 7004b223a8394994b8272227f66cee92205b25cfa7f9429e66b66ee688e73b83