---
updatedAt: 2026-07-16T20:54:50.000Z
---

# Credential injection | PRA for Desktop

When accessing a Windows-based Asset via the access console, you can use credentials from a credential store to log into the endpoint or to run applications as an admin.

Before using credential injection, make sure that you have a credential store or password vault available to connect to BeyondTrust Privileged Remote Access.

> ℹ️
>
> This feature is not supported for ARM-based Windows systems.

## Install and configure the endpoint credential manager

Before you can begin accessing Assets using credential injection, you must download, install, and configure the BeyondTrust Endpoint Credential Manager (ECM). The BeyondTrust ECM allows you to quickly configure your connection to a credential store, such as a password vault.

> ℹ️
>
> The ECM must be installed on your system to enable the BeyondTrust ECM Service and to use credential injection in BeyondTrust Privileged Remote Access.

## System requirements

* Windows Vista or newer, 64-bit only
* .NET 4.5 or newer
* Processor: 2GHz or faster
* Memory: 2GB or greater
* Available Disk Space: 80GB or greater

1. To begin, download the BeyondTrust Endpoint Credential Manager (ECM) from [BeyondTrust Support](https://beyondtrustcorp.service-now.com/csm).
2. Start the BeyondTrust Endpoint Credential Manager Setup Wizard.
3. Agree to the EULA terms and conditions. Check the box if you agree, and then click **Install**.

   If you need to modify the ECM installation path, click the **Options** button to customize the installation location.

> ℹ️
>
> You are not allowed to proceed with the installation unless you agree to the EULA.

4. Click **Next** on the Welcome screen.
5. Choose a location for the credential manager, and then click **Next**.
6. On the next screen, you can begin the installation or review any previous step.
7. Click **Install** when you are ready to begin.
8. The installation takes a few moments. On the **Completed** screen, click **Finish**.

> ℹ️
>
> * To ensure optimal up-time, administrators can install up to three ECMs on different Windows machines to communicate with the same credential store. A list of the ECMs connected to the appliance site can be found at **/login > Status > Information > ECM Clients**.

## Install and configure the plugin

1. Once the BeyondTrust ECM is installed, extract and copy the plugin files to the installation directory (typically **C:\Program Files\BeyondTrust\ECM**).
2. Run the **ECM Configurator** to install the plugin.
3. The Configurator should automatically detect the plugin and load it. If so, skip to step 4 below. Otherwise, follow these steps:
   * First, ensure that the DLL is not blocked. Right-click on the DLL and select **Properties**.
   * On the **General** tab, look at the bottom of the pane. If there is a **Security** section with an **Unblock** button, click the button.
   * Repeat these steps for any other DLLs packaged with the plugin.
   * In the Configurator, click the **Choose Plugin** button and browse to the location of the plugin DLL.
4. Click the gear icon in the **Configurator** window to configure plugin settings.

## Configure a connection to your credential store

Using the ECM Configurator, set up a connection to your credential store.

1. Locate the BeyondTrust ECM Configurator you just installed using the Windows Search entry field or by viewing your **Start** menu programs list.
2. Run the program to begin establishing a connection.
3. When the ECM Configurator opens, complete the fields. All fields are required.

| Field Label   | Value                                                        |
| ------------- | ------------------------------------------------------------ |
| Client ID     | The ID for your credential store.                            |
| Client Secret | The secret key for your credential store.                    |
| Site          | The URL for your credential store instance.                  |
| Port          | The server port through which the ECM connects to your site. |
| Plugin        | Click the **Choose Plugin...** button to locate the plugin.  |

4. When you click the **Choose Plugin...** button, the ECM location folder opens.
5. Paste your plugin files into the folder.
6. Open the plugin file to begin loading.

> ℹ️
>
> If you are connecting to a password vault, more configuration at the plugin level may be needed. Plugin requirements vary based on the credential store that is being connected.

> 🚧 Important information
>
> To apply new settings in the configuration, restart the ECM service.

## Use credential injection to access endpoints

After the credential store has been configured and a connection established, the access console can begin using credentials in the credential store to log into endpoints.

1. Sign in to the Access Console.
2. Connect to an endpoint with an Asset installed as an elevated service on a Windows machine.
3. Click the **Play** button to begin screen sharing with the endpoint. If the endpoint is at the Windows login screen, the **Inject Credentials** button is highlighted.
4. Click the **Inject Credentials** button. A pop-up credential selection dialog appears, listing the credentials available from the ECM.
5. Select the appropriate credentials to use from the ECM. The system retrieves the credentials from the ECM and injects them into the Windows login screen.
6. The user is logged in to the endpoint.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/fa37438a35c92be8274f7b65df4bad0e1b236ca150bdd008795b031ec0872d38-credInjection.png",
        "",
        ""
      ],
      "align": "center",
      "sizing": "40% ",
      "border": true
    }
  ]
}
[/block]

## Check in and check out credentials

From the access console, you can easily access the Privileged Remote Access Vault in the **/login** interface to check out and check in credentials when necessary, either during a session or on your local machine.

To access the vault, click the **Actions** dropdown in the top navigation bar and select **View Vault Accounts**. You are taken directly to the **Vault > Accounts** page in the **/login** interface, once logged in.

You can then locate and check out or check in a Vault account.

If a credential is used to initiate a session, the name of that credential is displayed in the session queue. This allows users to easily check their active sessions to see which credential is in use and select it for subsequent sessions with the same endpoint.