Privileged Remote Access 24.1 Available Features

The BeyondTrust mobile access console uses iOS 3D Touch Support capabilities offered by the iPhone 6S and 6S Plus devices to start sessions faster and more efficiently. By tapping and holding the BeyondTrust Access Console icon on your iOS device, you can quickly access the three most viewed Jump Items, and you can seamlessly transition between active sessions.

Advanced Web Access enables administrators to appropriately manage privileged access controls over assets that utilize modern web technology in a secure, scalable, and controlled manner. The auditing capability gives your organization the visibility it needs to adhere to both internal security policies and any applicable industry compliance requirements.

BeyondTrust Protocol Tunneling extends the remote connectivity and auditing capabilities of proprietary and/or 3rd party applications, such as integration control systems or custom database tools. BeyondTrust simplifies this complex task into a consumable process that removes the need for an intricate VPN solution.

BeyondTrust Vault is an on-appliance credential store that enables your users to access privileged credentials and inject them directly into an endpoint. Eliminate the need for users to memorize or manually track passwords, increasing productivity and security. Add privileged credentials to Vault manually, or try the built-in Discovery tool to automatically find and protect AD and local credentials.

The Vault Accounts tab in the Access Console enables users to check in and out Vault accounts that the administrator has defined. This enables users to leverage Vault accounts for session activity or locally on their own device, improving user experience and productivity by enabling access to Jump Items and Vault accounts from one location.

Protect against common user mistakes during SSH sessions by applying basic filtering to the input at the command line. For devices or B Series Appliances where agents are not practical or possible, command filtering provides an extra layer of control for administrators who need to provide access to that endpoint.

When accessing a Windows-based Jump Client, perform credential injection into the login screen as well as the Run As special action. Additionally, gain access to SQL Server using credentials from your endpoint credential manager.

Vault users can now search the credential list when Jumping into a remote system. To leverage this new functionality, a user must only begin typing an account name and the Credential Store presents the matching credentials to the user. This search functionality is limited to credentials that are available in the access console.

Network and protocol enhancements allow for direct peer-to-peer connections. A direct connection between a user and an endpoint bypasses the B Series Appliance, thus enhancing the performance of screen sharing, file transfer, and remote shell.

A web-based BeyondTrust Access Console that uses HTML5 to provide access to endpoints. The privileged web access console removes the requirement of having to download and install the BeyondTrust access console client.

View in-depth system information in an easily navigable interface. Interact with services and processes and uninstall software without requiring screen sharing.

Upload an image of your company logo to display on the public-facing web pages of your Privileged Remote Access site. This logo is visible when someone accepts an access invite, goes to the public recording page, responds to an extended availability message, or responds to a request for Jump approval.

Enables Raspberry Pi secure access to allow privileged users to connect to more types of unattended systems, perform administrative actions, and secure who has access to manage these devices. May work on any Raspberry Pi device that runs Raspberry Pi OS, but only certified against Pi 3B+ and Pi 4B. Supported Operating Systems:

• Raspberry Pi OS Desktop (2020-08-20-raspios-buster-armhf)
• Raspberry Pi OS Lite (2020-08-20-raspios-buster-armhf-lite)

The Bring Your Own Tools functionality enables you to leverage your existing native RDP tool for Remote RDP Jump Shortcuts, while maintaining the benefits of the audit trail and session recordings. This setting enables Remote RDP Jump Shortcuts to include existing native RDP functionality, expanding Jump Item capabilities and improving user experience.

We have improved security and user experience when accessing non-domain linked endpoints via RDP. This new functionality allows administrators to directly associate non-domain linked accounts discovered via Jump Clients to RDP Jump Items for that endpoint. The associated API functionality for this feature is also available, allowing administrators to more easily scale and automate the associated administrative tasks.

Users can select their external tool of choice when initiating an RDP or Shell Jump session. Additionally, users can now set the order of their preferred tools for easy selection.

Privileged Remote Access can now proxy the Microsoft SQL Server protocol, enabling credential injection and improved auditing capabilities for Privileged Remote Access customers. There is a new setting under Protocol Tunnel Jump items for Database Tunneling.

This set of APIs enables Privileged Remote Access administrators to automate and orchestrate administrative tasks within /login and the Access Console. There are specific methods exposed via an API that enable a programmatic way to create, list, update, and delete certain configuration items in Privileged Remote Access. For example, administrators can use the API to create local user accounts or delete Jump Clients that have been offline for a specified number of days. Other enabled use cases include tasks for managing Jump Groups, Jump Items, Vendor Groups and Users, Group Policies, Vault Accounts, Vault Account Groups, and Personal Vault Accounts.

The Group Policy Configuration APIs (GET, POST, and PATCH) have been enhanced to allow administrators to read and set the access permission settings.

The Configuration API documentation can be found under /login > Management > API Configuration.

Privileged Remote Access administrators can now benefit more easily from the automation and onboarding improvements that come with the usage of existing Configuration APIs. In this release, these administrators now have prebuilt scripts that enable automation use cases more simply for specific situations, particularly Jump Item management and automation with AWS, AD, and Azure.

Create multiple user accounts for the /appliance interface. Set rules regarding account lockouts and password requirements. SAML can also be used to log directly into /appliance.

Exert control over access console availability to specific users by restricting when users are able to log in.

Users can traverse Organizational Units (OUs) within the targeted Active Directory Domain when using the Vault Discovery functionality. Vault Discovery allows administrators to discover credentials in the specified network. Administrators can then import credentials into Vault, enabling users to inject and use the discovered credentials within Privileged Remote Access sessions. Being able to traverse the OU's provides greater flexibility, while saving time and resources. Instead of running a general discovery to the domain, admins can specifically target the OUs of the teams and credentials that they wish to manage with Vault, decreasing the amount of managed credentials in Vault, and making it easier to use and control the most important credentials.

Create Jump Item Roles to easily assign sets of Jump Item permissions to users.

Disable recordings at the Jump Policy level. If this option is checked, sessions started with this Jump Policy are not recorded, even if recordings are enabled on the Configuration > Options page. This affects screen sharing, user recordings for Protocol Tunnel Jump, and command shell recordings.

View details of each session. Session reports include basic session information along with links to session details, chat transcripts, and video recordings. Also included are details regarding the Access Approver Name, Email Address, and Comments for sessions that require approval. Additionally, the session report contains the Request Reason for sessions that require users to specify a reason for their access request.

Allow your organization to meet its GDPR initiatives with pseudonymization and consent support in BeyondTrust. BeyondTrust administrators can respond to Right to Erasure requests by searching for specific criteria supplied by the requester. Once reviewed, the results can be anonymized with an automatically generated term or a custom replacement.