Group policies | PRA Pathfinder

What are Group policies?

Group policies define permissions and settings for groups of users, enabling administrators to standardize and streamline access control.

How are Group policies useful?

Group policies help ensure consistency in user permissions, simplify administrative tasks, and support secure and efficient management of user groups.

How do I access the Group Policies page?

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Users & Security.
    The User & Security page opens and the Users tab displays by default.
  3. Click the Group Policies tab.
    The Group Policies tab displays.

The Group Policies page

An image of BeyondTrust Privileged Remote Access interface showing the 'Users & Security' page with the 'Group Policies' tab selected. The page includes '+ Add' and 'Change Order' buttons, and a search bar labeled 'Search Group Policies.' A table lists six group policies: User, Auditor, Administrator, Require MFA, BeyondTrust Pathfinder User, and TestPolicy. Each policy entry includes icons for editing, copying, and deleting.
  1. Add: Adds a new group policy and change order of policy priority.

  2. Filter: Search for group policies using the Name field.

  3. Group Policies columns: The list of Group Policies columns.

    Group Policies columns
    • Name: Unique name of the group policy.
  4. Group Policies list options: Copy, edit or delete a group policy.

Add a new policy

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Users & Security.
    The User & Security page opens and the Users tab displays by default.
  3. Click the Group Policies tab.
    The Group Policies tab displays.
  4. Click Add.
    The Add New Policy page displays.
  5. For Policy Name, enter a unique name for the policy.
  6. For the Available Members, select a member to assign and click Add to move them to the Policy Members list.
    You can use the Search box to find existing members. You can select users from your local system or select users or entire groups from configured security providers. If an attempt to add a user from a configured security provider is invalid, the synchronization log error message appears here as well as in the log.
  7. Select the various group policy settings. See Group Policy settings.
  8. Click Save.

Copy a policy

To expedite the creation of similar policies, you can copy a policy with identical settings. You can then edit this new policy to meet your specific requirements.

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Users & Security.
    The User & Security page opens and the Users tab displays by default.
  3. Click the Group Policies tab.
    The Group Policies tab displays.
  4. Find the group policy you want to duplicate, and click Copy .
  5. The Add new policy page loads with the settings matching the original policy. Make any adjustments needed, then click Save.

Edit a policy

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Users & Security.
    The User & Security page opens and the Users tab displays by default.
  3. Click the Group Policies tab.
    The Group Policies tab displays.
  4. Find the group policy you want to edit, and click Edit .
  5. The Edit policy page loads. Make any adjustments needed, then click Save.
ℹ️

If you edit the group policy that is the default for the local provider, or has local administrator users, and remove administrator permissions, a warning message appears. Ensure other users have administrator permissions before proceeding.

Delete a policy

  1. Sign into app.beyondtrust.io.
    The BeyondTrust Home page displays.
  2. From the main menu, click Privileged Remote Access > Users & Security.
    The User & Security page opens and the Users tab displays by default.
  3. Click the Group Policies tab.
    The Group Policies tab displays.
  4. Find the group policy you want to remove, and click Delete .
  5. When prompted, click Yes.
### Account settings
General permissions
Access permissions
  • Allowed to access endpoints: Enables the user to use the access console in order to run sessions. If endpoint access is enabled, options pertaining to endpoint access will also be available.
  • Session management
    • Allowed to share sessions with teams which they do not belong to: Enables the user to invite a less limited set of user to share sessions, not only their team members. Combined with the extended availability permission, this permission expands session sharing capabilities.
    • Allowed to invite external users: Enables the user to invite third-party users to participate in a session, one time only.
    • Remove User from session after inactivity: Sets the time interval to remove a user from a session after inactivity. Values range from No Timeout to 24 hours.
    • Allowed to enable extended availability mode: Enables the user to receive email invitations from other users requesting to share a session even when they are not logged into the access console.
    • Allowed to edit the external key: Enables the user to modify the external key from the session info pane of a session within the access console.
    • Allowed to edit the external key: Enables the user to modify the external key from the session info pane of a session within the access console.
  • User to user screen sharing
    • Allowed to show screen to other users: Enables the user to share their screen with another user without the receiving user having to join a session. This option is available even if the user is not in a session.
    • Allowed to give control when showing screen to other users: Enables the user sharing their screen to give keyboard and mouse control to the user viewing their screen.
  • Jump Technology
    • Allowed Jump Item methods: Enables the user to Jump to computers using the following:
      • Jump Clients
      • Local Jump (Windows only)
      • Remote Jump
      • Remove VNC
      • Web Jump
      • Remote RDP
      • Shell Jump
      • Protocol Tunnel Jump
    • Jump Item Roles: A Jump Item Role is a predefined set of permissions regarding Jump Item management and usage. For each option, click Show to open the Jump Item Role in a new tab.
      • The Default role is used only when Use User's Default is set for that user in a Jump Group.
      • The Personal role applies only to Jump Items pinned to the user's personal list of Jump Items.
      • The Teams role applies to Jump Items pinned to the personal list of Jump Items of a team member of a lower role. For example, a team manager can view team leads' and team members' personal Jump Items, and a team lead can view team members' personal Jump Items.
      • The System role applies to all other Jump Items in the system. For most users, this should be set to No Access. If set to any other option, the user is added to Jump Groups to which they would not normally be assigned, and in the access console, they can see non-team members' personal lists of Jump Items.
      • The Endpoint automation role sets how a user can use endpoint automation.
        • Not allowed prevents them from seeing the Jump > Endpoint Automation tab altogether.
        • A User can create new automation jobs with these restrictions:
          • They are able to choose any existing Script Template but cannot edit the Script Template, Script Command, nor select or change the template accompanying Resources.
          • The Script Template, Script Command, Operating System, and Resources fields are unavailable.
          • They can run scripts only on Jump Items where their Jump Item Role includes the Start Sessions permission (set on the Jump > Jump Items Role page).
          • An Administrator has full access and ability to create Jobs, Scripts Templates, and Resources.
            ℹ️

            For more information, see Jump Item Roles and Endpoint Automation.

      • External tools
        • Enable static port and username for external tool sessions: This option accepts two values:
          • Enable: Ensures that the port and username generated for a user starting a session with a Jump item using external tools are preserved from session to session.
          • Disable: A new port number and username are randomly generated for that user every time they start a new session with each Jump item.
Session permissions
Availability settings
Memberships

©2003-2026 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.