November 5, 2024

Requirements

• We recommend a restart after this update.

New features and enhancements

• There are no new features or enhancements.

Issues resolved

• Resolved an issue where, after applying the Windows Update KB5040435 for Windows 11, RDP sessions experienced display artifacts, making the session unusable. Sessions are now usable with no artifacts.
• Resolved an issue affecting web Applications using PS Automate when using the latest Chrome and Edge web browsers where applications didn't work as expected. They are now working as expected.

Notes

• Direct upgrades to 24.1.1.1846 are supported from all previous versions.
• This release bundles version 24.1.0.1426 of the BeyondTrust Discovery Scanner. Corresponding release notes are available here: https://www.beyondtrust.com/docs/release-notes/beyondinsight-password-safe/index.htm
• .NET hosting bundle v8.0.4 is included.
• Session Monitoring Agent (pbsmd) has been updated to 24.2.45.
• Enhanced Session Monitoring Agent (pbpsmon) has been updated to 24.2.45.
• PS Automate has been updated to build 10925527552.
• BeyondTrust customers can download this release from their Password Safe Cloud portal by navigating to Configuration > Resource Zones and clicking Download Installer.
• The MD5 signature is: 4A6CFDAEC81689392C0D57FB7F0B99EC
• The SHA-1 signature is: 482F6B35A7E3983CE071B40DCF4BD81A01AFD3C7
• The SHA-256 signature is: B6226D6BE18BED730029B7B60A319ED5F7329B5485299EE13D68277725843ADA

November 5, 2024

Requirements

• We recommend a restart after this update.

New features and enhancements:

• There are no new features or enhancements.

Issues resolved:

• Resolved an issue where, after applying the Windows update KB5040435 for Windows 11, RDP sessions experienced display artifacts, making the session unusable. Sessions are now usable with no artifacts.
• Resolved an issue affecting web applications using PS Automate when using the latest Chrome and Edge web browsers where applications didn't work as expected. They are now working as expected.

Notes:

• Direct upgrades to 24.1.0.1835 are supported from all previous versions.
• .NET Core hosting bundle 6.0.29 is included.
• .NET hosting bundle updated 7.0.18 is included.
• Session Monitoring Agent (pbsmd) has been updated to 24.2.45.
• Enhanced Session Monitoring Agent (pbpsmon) has been updated to 24.2.45.
• PS Automate has been updated to build 10925527552.
• BeyondTrust customers can download this release from their Password Safe Cloud portal by navigating to Configuration > Resource Zones and clicking Download Installer.
• This release bundles version 23.2.1.1376 of the BeyondTrust Discovery Scanner. Corresponding release notes are available here: https://www.beyondtrust.com/docs/release-notes/beyondinsight-password-safe/index.htm.
• The MD5 signature is: 9E56BA2BF38D7C1F167BFAC7621C2720
• The SHA-1 signature is: 0C02A523AA555D8005D4BB646E20E5E8E6B78A4F
• The SHA-256 signature is: F189FC49D091A19842917991BF2FB6C72B7A80D8E93BAEF7417D645A842BC83F

November 5, 2024

Requirements

• We recommend a restart after this update.

New features and enhancements:

• There are no new features or enhancements.

Issues resolved:

• Resolved an issue where, after applying the Windows update KB5040435 for Windows 11, RDP sessions experienced display artifacts, making the session unusable. Sessions are now usable with no artifacts.
• Resolved an issue affecting web applications using PS Automate when using the latest Chrome and Edge web browsers where applications didn't work as expected. They are now working as expected.

Notes:

• Direct upgrades to 23.3.0.1797 are supported from all previous versions.
• .NET Core hosting bundle 6.0.29 is included.
• .NET hosting bundle 7.0.18 is included.
• Session Monitoring Agent (pbsmd) has been updated to 24.2.45.
• Enhanced Session Monitoring Agent (pbpsmon) has been updated to 24.2.45.
• PS Automate has been updated to build 10925527552.
• BeyondTrust customers can download this release from their Password Safe Cloud portal by navigating to Configuration > Resource Zones and clicking Download Installer.
• This release bundles version 23.2.1.1375 of the BeyondTrust Discovery Scanner. Corresponding release notes are available here: https://www.beyondtrust.com/docs/release-notes/beyondinsight-password-safe/index.htm.
• The MD5 signature is: 8E002FF0F38A2C3614F98E10FD57F5C5
• The SHA-1 signature is: CD2D615373D34FB5EB0529B4B0FA67C4874FEF6A
• The SHA-256 signature is: 3B9D10ED3D2D7997B4B4F5F29269E841D54085895E23EA463EF92FFCA60E74A4

October 3, 2024

Requirements

• .NET 4.7.2 or later
• IIS to be enabled on host

New features

• We've added a subscription for Active Directory Bridge.

Enhancements

• You can now install your chosen version of the Appliance Management software without performing incremental updates. Simply select the version you want to install from the Subscription Details drop-down list.
• On the Subscriptions page, the Version drop down list displays the locally-installed subscription version number.
• On the Client Subscription pages, we’ve updated the available options in the Versions drop-down:
  • Do Not Update (formerly 0.0.0): No changes are made to downstream clients.
  • `version.number`: Unlock the selected version to all downstream clients.

Issues resolved

• When you update the Endpoint Privilege Management: Web Policy Editor Bundle, BT Updater now stops the underlying services before installing.
• When you update Endpoint Privilege Management for Unix/Linux using BT Updater 3.3.0, the updater no longer creates any numbered folders and instead downloads all files directly in the C:\ProgramData\BeyondTrust\Pbsmc\Software folder.
• Some users who attempted to subscribe to AD Bridge received an incorrect error message stating they could not subscribe without first installing AD Bridge; however, the subscription was successful. That error message no longer displays erroneously.
• An issue where some correctly-updated users experienced a Warning: for BeyondInsight/Password Safe you are required to manually update to the same lock version on all BeyondTrust Updaters or it could result in a loss of service error message is resolved.
• Resolved an issue when the Appliance User Interface page was used to change the username and password, and the SALT and Encryption string displayed in the Updater log file.
• Now, upon subscription, EPM bundles auto-lock as expected.

September 26, 2023

Requirements:

Requires BeyondTrust Password Safe version 23.2.0 or later release.

New features and enhancements:

• Password Safe Terraform Provider has been removed from the Resource Kit, and is now available in the Terraform Registry.
• Signature verification files have been added to allow validation of the Ansible collection (see ).
• Updated Enhanced Session Utility.
• Updated Python API sample to support the latest changes in the BeyondInsight and Password Safe 23.2 release API.
• Updated Password Safe Cache.

ℹ️

Note

New versions of the Password Safe Cache are available for RHEL 8 and 9. There are no new versions for RHEL 7. The last supported version for RHEL 7 is 23.1.24.

Notes:

• The SHA-256 signature is: ebf3fd206d83b39a3bfa010444d33ddfd838fbfc756e17330fcc7a499eaec14c
• This release is available to download for BeyondTrust customers at https://beyondtrustcorp.service-now.com/csm.

September 26, 2023

New features and enhancements:

• .NET Core hosting bundles updated from 6.0.20 to 6.0.21.
• .NET hosting bundle updated from 7.0.9 to 7.0.10.

ℹ️

Note

A restart of the Resource Broker host may be required after this update.

Notes:

• Direct upgrades to 23.2.0.1741 are supported from all previous versions.
• BeyondTrust customers can download this release from their Password Safe Cloud portal by navigating to Configuration > Privileged Access Management Agents > Resource Zones and clicking Download Installer.
• This release bundles version 23.1.3.1310 of the BeyondTrust Discovery Scanner. Corresponding release notes are available here: https://www.beyondtrust.com/docs/release-notes/beyondinsight-password-safe/index.htm.
• The MD5 signature is: 52BCBA3265345F5F6BBAFE6E2B29CFEC
• The SHA-1 signature is: 18CD66CEC3E39BCFF880E1FB1B93FA11CEF06BBD
• The SHA-256 signature is: F10CEEE4957F379B1441417766424817139549BF100291BB8D62C94090D5393A

Sept 26, 2023

New features and enhancements:

None.

Issues resolved:

• Updated a third party component to the latest version as the previous version had a security warning against it.

Known issues:

• The installation dialogs have string substitution errors.

Notes:

• Direct upgrades to this version are supported from versions 20.1.0 and later releases.
• This release is available by download from the BeyondTrust Client Portal at https://beyondtrustcorp.service-now.com/csm.
• There is a product dependency on having the .NET 6 Hosting package installed.
• The MD5 signature is: 021a37e59237b143a56e0eb7d6e66470
• The SHA-1 signature is: 8b894002b204ebb31e57bc2634e9d70947382a9c
• The SHA256 signature is: 16b6eb84671e015bda6142882eaa636c4f9bea0b652e6c2a0a00aad71466082a

Sept. 26, 2023

Requirements:

• Requires version 23.1.3.1308 or later release of BeyondTrust Discovery Agent.
• A restart might be required after installing this update.

New features and enhancements:

General

• Workforce Passwords is a new add-on product that provides enterprise-scale visibility to employee business application password management, leveraging the power of BeyondTrust Password Safe 23.2 and later releases, as follows:
  • Allows users to store their credentials for URLs they access, in secure Personal Folders within Secrets Safe, that only the owner of the folder can access and view.
  • Provides mapping of URLs to the stored credentials. Both 1:1 mapping and mapping many credentials to 1 URL is supported.
  • Users can perform Create, Read, Update, and Delete (CRUD) operations within their personal folder for credentials and URL associations. These actions are audited.
  • Users can use Password Safe password policies and password generator for creating new passwords for URLs.
  • Provides a browser extension allowing users to retrieve credentials for their URLs.
• Enhanced auditing of Smart Rule management actions to capture Smart Rule content details and to provide before and after audit details when Smart Rules are edited. Previous releases only captured the create and edit action, without providing any details. Enhanced audit details are useful for SOX compliance auditing.
• Improved navigation between Smart Rule creation and Smart Rule grid by adding the ability to preview the results of a Smart Rule in-line. This allows the user to test and validate the rule at the time of creation or update so that necessary adjustments can be made at that time.
• Added Download all option to Groups and Users grids. This action downloads a CSV file containing grid data based on selected filters.
• Added support for Microsoft SQL Server 2022. Customers can configure BeyondInsight 23.2 and later releases with MS SQL Server 2022 as its external database.
• Added Run a New Discovery Scan quick link to the Scans page.
• Made minor adjustments to the create and edit forms for creating and editing a discovery management scan credential. Specifically, the layout has been slightly modified and the Description field has been renamed to Credential Name.
• On the Create New Directory Query form, set the default value of the Name field for the Basic Filter to * .
• Improved Dark Mode styling in the App Menu.
• Improved verbiage around local user password policy compliance. The password policy error text in releases prior to 23.2 is confusing when characters that are not permitted are used.
• Removed support for deprecated FireEye connector.
• Removed deprecated Asset Risk data point from multiple areas in the BeyondInsight user interface.
• Removed reports and user interface elements referencing the deprecated BeyondInsight Ticket system.
• Removed deprecated Clarity Malware Analysis from Clarity Analytics and Configuration areas in the BeyondInsight user interface.
• .NET hosting bundle v3.1.23 is no longer included.
• .NET hosting bundle updated from v6.0.19 to v6.0.21.
• .NET hosting bundle v7.0.10 has been added.

Analytics & Reporting

• Added a new Password Safe report called Inactive Managed Accounts, which shows a list of accounts that are inactive or have not been accessed by requester in X days.
• Improved existing Service Account Usage report by adding new parameters for Service Name and Service Account is Managed All/Y/N. This allows admins to discover and report on all service accounts, regardless if the account is under management or not, and also to report on service accounts running with interactive log on permissions.

Password Safe

• Added functionality that simplifies the onboarding of remote applications as follows:

  • Added the ability to use a Managed System Smart Group for associating the application with domain linked accounts.
  • Added a new Smart Rule action that provides the ability to assign applications to managed accounts. In releases prior to 23.2, this was a manual process for each managed account.

• Added support for SAP HANA database platform.

• Oracle database platform now supports the Unlock accounts on password change global setting.

• Added URL property to all Secrets Safe secret types to allow the storing of URLs in Secrets Safe.

• New Ansible integration, which enables developers to securely access their managed accounts and DevOps secrets from Password Safe.

• Additional user audit event added to Secrets Safe:

• ReadSecret is generated when the encrypted content is accessed.

• Read event is generated when the base details and metadata is accessed.

Password Safe Cloud

• Added the ability to subscribe to reports in BeyondInsight and Password Safe Cloud, allowing users to schedule reports to run automatically and make the report available for download.
• Added the ability to run reports on specific dates and date ranges, allowing users to report on particular time periods in the past. In releases prior to 23.2, users could report only on relative date ranges, which meant the report contained data from that point in time until present, resulting in a large report containing unnecessary information.
• Added support for custom Password Safe Cloud hostnames in Password Reset emails:
  • If a customer has a custom hostname defined for their Password Safe Cloud deployment, then any URLs contained in the Password Reset emails will use this, as opposed to the “customerkey” DNS name.
  • In releases prior to 23.2, when customers received the reset password email for first login, it contained the randomized hostname and not the custom hostname configured, leading them to believe the custom hostname didn't exist.

API

Updated APIs for Remote Applications:

• GET Applications
• GET Applications/{id}
• GET ManagedAccounts/{accountID}/Applications
• POST ManagedAccounts/{accountID}/Applications/{applicationID}

Updated APIs for Workforce Passwords and Secrets Safe:

• POST Secrets-Safe/Folders/{folderId:guid}/secrets
• POST Secrets-Safe/Folders/{folderId:guid}/secrets/text
• POST Secrets-Safe/Folders/{folderId:guid}/secrets/file
• PUT Secrets-Safe/Secrets/{secretId:guid}/
• GET Secrets-Safe/Secrets
• GET Secrets-Safe/Secrets/{secretId:guid}
• GET Secrets-Safe/Folders/{folderId:guid}/secrets
• GET Secrets-Safe/Secrets/{secretId:guid}/text
• GET Secrets-Safe/Secrets/{secretId:guid}/file

New APIs for Report Subscriptions:

• GET Subscriptions/delivery
• POSTSubscriptions/delivery/download 

Issues resolved:

• Resolved an issue where searching in the Authentication Type drop down in the Create New Credential form when creating an MS SQL Server discovery credential always returned No options found error.
• Resolved an issue where creating a scan using the Scan Wizard and adding a new MS SQL Server credential using the Create New Credential link resulted in the UI displaying the following error: An error occurred creating the scan....
• Resolved an issue where attempting to add a new credential to a scheduled scan resulted in an error stating that a credential needs to be selected and the credential is not added.
• Resolved an issue where using and then clearing a custom credential in the Scan Wizard caused errors and job creation failure.
• Resolved an issue in the Scan Wizard, where Select All on the credentials list did not respect the boundaries of the search criteria, and thus prompted validation for all keys, not just the ones matching the search.
• Resolved an issue in the Scan Wizard, where validation keys were sometimes requested even if no credentials were selected.
• Resolved an issue where, after saving a change to the target Smart Rule when editing a scheduled scan, an unsaved changes warning popped up when attempting to navigate away from the Targets tab.
• Resolved an issue where changing the scan from Recurring to Immediate on the Schedule tab for a scheduled scan resulted in an error stating Nullable object must have a value, and the changes were not saved. The Immediate option was removed for scheduled scans as it is not valid for this type of scan.
• Resolved an issue where the max user limit on detailed discovery scans was not communicated to the scanner.
• Resolved an issue where SSH keys were not being captured when scanning an asset. When viewing the Advanced Details of the asset from the Assets page, and clicking the information icon for the user in the Users grid, the SSH Key Count field might have been zero, even if SSH keys existed for that user.
• Resolved an issue where, after upgrading to the 23.1 release, any existing access policy which had location restrictions enabled with X-Forwarding set to All showed the X-Forwarded for field as blank and disabled.
• Resolved an issue with session replay in Firefox where viewing an active session, terminating it, and then trying to replay the session from Completed Sessions resulted in an error stating An error occurred while trying to fetch the session keystrokes.
• Resolved an issue where editing an existing functional account with an assigned DSS key incorrectly required the DSS key to be re-uploaded when saving any change to the functional account, even though an already been uploaded message was displayed.
• Resolved an issue where, in some cases, when upgrading the Web Policy Editor to 23.4, the JRE folder became corrupted, causing the Web Policy Editor to not load and Error 500 showing in dev tools.
• Resolved an issue where an incorrect session node hostname/address was being used for RDP sessions after upgrading to the 23.1 release.
• Corrected field labels on the settings for managed accounts and managed systems to read as Default Release Duration from Release Duration to match the label as shown for Manage Account Settings action in a Smart Rule.
• Resolved an issue where it was possible to edit an access policy that was created in the past and change its recurrence to One Time. This is not a valid scenario.
• Resolved an issue where Quick Launch was not available when the access policy end date was the current day and multi-day checkout was enabled.
• Resolved an issue where if the Auto-select access policy for Quick Launch setting is enabled and there are two or more access policies available, the shortest policy is not auto-selected.
• Resolved an issue where the Playback Speed dropdown does not open when viewing a completed session in full screen mode.
• Resolved an issue where password rotation of a Salesforce platform managed account was failing.
• Resolved an issue where password rotation of a Workday platform managed account was failing.
• Resolved an issue where after creating a new Managed System Quick Group, it would not appear in the Smart Group filter until the page was reloaded.
• Resolved a text wrapping issue where a very long approve or deny comment would not be fully visible in the request details form.
• Resolved an issue where if a user attempted to use Quick Launch to access an account where they already had an approved request, they would receive an Account is already available error message, instead of reusing the existing request.
• Resolved an issue where if the maximum concurrent request limit is reached, the conflicting request details were not displayed.
• Resolved an issue where replaying an RDP session, in the 23.1 release, could display An unexpected error has occurred message and fail to replay the session, if the session was using a large screen resolution or multiple monitors. Prior to the 23.1 release, when this error occurred, the session replay would freeze for a moment, and then continue without crashing. The 23.2 release allows for larger data packets during replay.
• Resolved an issue where the Allow use for Secrets Safe option was not enabled by default when creating a new password policy.
• Resolved an issue where when specifying the password for a functional account, if the password contained certain special characters (ex: €), an incorrect validation error was shown.
• Increased the allowed field length for the functional account password to 256 characters from 128 to accommodate the increase in the Jira Cloud ticketing system API key length.
• The minimum password request time has been lowered to 1 minute from 5 minutes, to be consistent between the user interface and the API.
• Resolved an issue where Smart Rules with Dedicated Account mapping actions were not properly triggered when a user logged on for the first time.
• When accessing the Secrets Safe user interface, the default selected folder had been changed from All Secrets to the first team shared folder found under All Secrets. If the user is enabled for Workforce Passwords, this will be their Personal Folder.
• Resolved an issue where certain actions in a Smart Rule could only be added once. Now, multiple instances of the affected actions can be added in a single Smart Rule.
• Resolved validation inconsistencies with scan credential creation using Public Key Authentication Type.
• Improved auditing of manual asset creation and editing actions to show more details about what was created and changed.
• Improved display of details for Selection Criteria in Smart Rule Details area.
• Improved Reporting Gateway service resilience when multiple Endpoint Privilege Management Reporting jar files are present, ensuring the proper jar file is chosen and the proper settings are sent.
• Resolved an issue where the RetinaCSAppPool went into a stopped state on the passive node in an HA setup, ensuring that it is restarted if it enters a stopped state.
• Resolved an issue where the Next Scan Start date/time for a scheduled scan that is in a remote time zone does not display the correct value in the Scheduled Scans grid.
• Resolved an issue where duplicate Attributes could not be added across distinct Attribute Types.
• Resolved an issue where scheduled sync jobs for AD user groups performed by the system were visible in User Audits. Now only manual sync jobs appear in User Audits.
• Resolved a filtering issue on the Directory Credentials grid Title field, where filtering by the underscore character was returning all credentials. It will now return the expected results.
• Resolved an issue where the Endpoint Endpoint Privilege Management Events grid could not be viewed by users with Read Only permissions to the Endpoint Endpoint Privilege Management feature.
• Resolved an issue where Endpoint Endpoint Privilege Management Event Collector, Reporting Gateway, and Web Policy Editor service logs were recording too many informational messages as warnings.
• Resolved an issue where the Discard Changes message was not shown after canceling the Create Policy process in Web Policy Editor.
• Resolved an issue with Endpoint Endpoint Privilege Management event processing where failures occurred if an asset had more than one associated Operating System record.
• Resolved an issue where a broken 500 Error page was appearing after a failed Azure AD or OKTA SAML login.
• Resolved an issue where SAML redirect was not using the incoming host address as it should.
• Resolved an issue where user receiveed an HTTP 500 error when attempting to access SAML pages, after upgrading to the 23.1 release.
• Resolved an issue where the logged in user might not display in the Profile and Preferences dialog in the BeyondInsight console, when logged in using SAML.
• Resolved an issue with RADIUS authentication failing with an error when using naming attribute Alternate Directory Attribute and LDAP domain with non-standard Base DN.
• Resolved an issue with RADIUS configuration not loading when a filter that requires text input was set for that alias.
• Resolved an issue with TOTP descriptions not showing correctly in some authenticator apps.
• Resolved an issue where users with the Auditor role did not have access to Entitlement by User Password Safe report.
• Resolved an issue with duplicate entries on the Service Account Usage report.
• Resolved an issue where the Password Update Activity reports might exclude content about functional accounts with no workgroup.
• Resolved an issue where scheduled scans created by a user having a NULL first name could not be deleted.
• Resolved an issue with the PUT Addresses/{id} API call creating a new address rather than updating the existing one.
• Resolved an issue with No Updates logging excessive rows to the database during Smart Rule processing that onboards managed systems when Endpoint Endpoint Privilege Management is used as the change agent.
• Resolved an issue with X-XSS-Protection header setting for the HTTP response not being set correctly.
• Resolved an issue where Firefox users were always seeing the Skip to Main Content keyboard navigation aid on the screen.
• Resolved a number of minor user interface layout issues.
• Resolved a number of keyboard navigation and screen reader functionality bugs.
• Resolved a localization bug where certain labels were not being translated upon language preference change by user.
• Resolved an issue where the auto generation of a password in Secrets Safe could fail, if there were more than 10 password policies.
• Resolved an issue where selecting a domain for a Resource Zone would not work if the domain has already been added to the system via a directory query.
• Resolved an issue where the hostname or host override values were not being displayed in the Session Node selector when viewing the advanced details of a request.
• Resolved an issue where attempting an Admin Session when FIPS is enabled on the appliance fails.
• Resolved an issue where viewing a session replay using Firefox had excessive flickering.
• Deactivated access policies no longer appear as an option when creating a request an access request in the Password Safe web portal.
• The wrong Resource Broker is no longer automatically selected on the Direct Connect Access form in Password Safe Cloud.

Known issues:

• After upgrading BeyondInsight, it is not possible to change the date or time on a Scheduled Scan that has a Schedule Type set to One Time. After changing the Start Time or Start Date and clicking Save Schedule, the following error occurs: Cannot update a scan schedule from recurring to one time or immediate.
  • Workaround: Delete and recreate the Scheduled Scan to enter the appropriate date and time details. A fix is planned in an upcoming release.
• Running the Endpoint Endpoint Privilege Management - Event Rollup report with the Include Excluded parameter checked might result in the following error and the report might not complete: The report cannot execute due to an invalid parameter.
  • Workaround: Avoid checking the Include Excluded parameter on this report. A fix is planned in an upcoming release.
• Attempting to subscribe to the Discovery Report accessed from the Active/Completed Scans grid results in an empty Create a New Subscription dialog and a 500 error is seen in dev tools.
  • Workaround: You can subscribe to the report from the Analytics & Reporting area of BeyondInsight. Subscribing to the report from the Active/Completed Scans grid is not a valid starting point to set up a subscription. This action will be removed from this location in an upcoming release.
• When using the Workforce Passwords browser extension, if a user has thousands of credentials stored for the same website, there can be a delay before the auto-fill indicator appears on the Log In page.
• Maintenance Expiry Warning banner might fail to appear in the 30 days before the expiry of the maintenance agreement. Once the agreement expires, the alert banner appears.
• Using the API, it is possible to rename a Secrets Safe folder to be a duplicate of an already existing folder under the same parent. This is not permitted in the user interface. A fix is planned in an upcoming release.
• When using the API to create a Secrets Safe folder with the same name as an existing folder, it fails with a 400 - DuplicateFolderName error instead of a 409 - Folder already exists error.
• Using the Workforce Passwords browser extension along with the BeyondInsight web console at the same time with two different user accounts might result in the extension user details being applied to the web console session when signing out of the browser extension.
  • Workaround: Log out of the BeyondInsight web console, as well as the browser extension, and either use the same account for both, or don’t use them at the same time.
• In Analytics & Reporting, the Event List and Events By Hour reports from the Endpoint Privilege Management UNIX Linux folder might give an error in the SSRS log when running. The error might indicate a problem with the [PowerBroker UL Accept Reject Time] dimension.
  • Workaround: Use the Pivot Grid to navigate the data, or choose a different report to review the data.
• If you attempt to edit a new functional account immediately after creating it, an erroneous There are one or more invalid fields validation error displays.
  • Workaround: Click Discard Changes and edit the functional account again.
• If a MacOS managed account is locked out when a password rotation is attempted, the rotation fails but is reported as successful.
• If a FireEye connector was created in a prior release of BeyondInsight, and remains after upgrading, it is no longer valid and cannot be used or updated. The following error displays: Object reference not set to an instance of an object.
  • Workaround: Delete the connector.
• If an audit of type PMR Database Settings exists, and a call is made to the PAPI GetUserAudits for all audits and all details, an error might result.
  • Workaround: None at this time, other than to alter the criteria passed to the API to avoid that audit type.
• If you attempt to manually create a MongoDB managed system with a different instance name and same DNS name and port as one which already exists, the creation fails with a uniqueness validation error.
  • Workaround: Use a discovery scan and Smart Rule to onboard the database managed system.
• Downloading the client certificate from the Configuration > System > Downloads area might fail with an error in some on-premises installations. Error message Keyset does not exist\r\n is seen in dev tools.
  • Workaround: Use the BeyondInsight Configuration utility to generate the certificate.

ℹ️

Note

Issues discovered after release can be found within our product Knowledge Base.

Notes:

• Direct upgrades to 23.2 are supported from BeyondInsight version 21.3 or later releases.
• This release is available to download for BeyondTrust customers from https://beyondtrustcorp.service-now.com/csm using BeyondTrust BT Updater.
• The MD5 signature is: c12466f856d5b4d0837d7c9a17062f18
• The SHA-1 signature is: 602dc72c59725bee64bec589fbbae5527b4bb4fd
• The SHA-256 signature is: 49164507e470d8bcab5bc621f641914ffe8698398c1fb55b0b7695f352062b88

September 26, 2024

New features

Dependency management

Dependency management provides visibility into the underlying frameworks that support's a product suite. The frameworks are updated by the Security Update Package Installer (SUPI) as part of the monthly Supporting Software update, which automatically:

• removes unnecessary .NET frameworks, freeing up resources and reducing potential security risks.
• processes new additions and upgrades.
• processes removals without dependent products.

ℹ️

Note

For removals with dependencies, guidance is provided directly within the product(s) that must be updated to allow for the safe removal of the dependency. You can run the removal again after you upgrade the dependent product(s).

Enhancements

SUPI service upgrade

• We've upgraded the SUPI service from .NET 6 to .NET 8.

Known Issues:

• If a 4.0/SUPI 3.2 box has multiple updates that include "cumulative" subscriptions, the packages that would be skipped are incorrectly included in the Estimated Time Required. This can significantly overstate the estimate.

Notes:

• Upgrade to .NET 8.0.0 or later (available through BT Updater via Supporting Software SUPI subscription).

September 26, 2024

Requirements

• .NET 8.0.0 or later (available through BT Updater via Supporting Software SUPI subscription)
• SUPI 3.2 (available through BT Updater)
• BeyondInsight 24.1

New features

Dependency management provides visibility into the underlying frameworks that supports BeyondTrust’s product suite. The frameworks are updated by the Security Update Package Installer (SUPI) as part of the monthly Supporting Software update, which automatically:

• removes unnecessary .NET frameworks, freeing up resources and reducing potential security risks.
• processes new additions and upgrades.
• processes removals without dependent products.

ℹ️

Note

For more information, see Manage product dependencies.

Enhancements

OAuth authentication is available as an authentication method when configuring the Discovery Agent on the Features page.

Set the event service (local or remote) and the authentication method.

• New appliance on version 4.3: The only authentication method is OAuth Authentication.
• Appliance on an earlier version: The authentication method is Certificate + User Authentication. If you are working on BeyondInsight 24.1 and database version 24.2.0.150 or later, then you can select OAuth Authentication.
• Appliance upgraded from an earlier version to 4.3: Displays both authentication types.

ℹ️

Note

For more information, see Configure U-Series Appliance features

Issues resolved

Known issues

Notes

• Security Management Appliance Installer 4.3 is dependent on BeyondInsight 24.1.
• Security Management Appliance package in BT Updater is dependent on BeyondInsight 24.1.
• This update is available through BT Updater or as a manual installer from the download tool.