Privileged Remote Access 20.1 Access Console User Guide

©2003-2020 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository TC:5/22/2020 institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

BeyondTrust

Table of Contents

BeyondTrust Access Console Install the Access Console Log into the PRA Access Console Access Console User Interface

4 5 6 8

Access Console User Interface 8 Change Settings and Preferences in the Access Console 9

Change Settings and Preferences in the Access Console Jump Interface: Use Jump Items to Access Remote Systems

9 Jump Interface: Use Jump Items to Access Remote Systems 12

Jump to a Jump Item 12 Use Jump Clients to Access Remote Endpoints 15

Use Jump Clients to Access Remote Endpoints Use Remote Jump for Unattended Access to Computers on a Separate Network

15 Use Remote Jump for Unattended Access to Computers on a Separate Network 19

Use Remote Jump for Unattended Access to Computers on a Separate Network 19 Use Local Jump for Unattended Access to Computers on Your Local Network 21

Use Local Jump for Unattended Access to Computers on Your Local Network Use RDP to Access a Remote Windows Endpoint Use VNC to Access a Remote Windows Endpoint Use a Protocol Tunnel Jump to Make a TCP Connection to a Remote System

Use Local Jump for Unattended Access to Computers on Your Local Network 21 23 27 Use a Protocol Tunnel Jump to Make a TCP Connection to a Remote System 29

Use Shell Jump to Access a Remote Network Device 32 Use a Web Jump to Access Web Services 35

Use a Web Jump to Access Web Services Access Toolset

35 39

Access Session Overview and Tools 39 Log Into Remote Systems Using Credential Injection from the Access Console 41 Control the Remote Endpoint with Screen Sharing 46

Control the Remote Endpoint with Screen Sharing Use Annotations to Draw on the Remote Screen of the Endpoint

46 Use Annotations to Draw on the Remote Screen of the Endpoint 49

View Multiple Monitors on the Remote Endpoint 51 File Transfer to and from the Remote Endpoint 53

File Transfer to and from the Remote Endpoint Open the Command Shell on the Remote Endpoint Using the Access Console View System Information on the Remote Endpoint Access the Registry Editor on the Remote Endpoint Session Management and Team Collaboration View Active Access Sessions Use the Dashboard to Administer Team Members Chat with Other Users

53 Open the Command Shell on the Remote Endpoint Using the Access Console 55 57 59 61 61 62 63

BeyondTrust

Chat with Other Users During a Shared Session 67 Use Extended Availability to Remain Accessible when Not Logged In 68 Invite an External User to Join an Access Session 69 Ports and Firewalls 70

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

BeyondTrust Access Console

This guide is designed to help you install the BeyondTrust access console onto your computer and understand the features of the solution. BeyondTrust Privileged Remote Access enables you to access remote endpoints by connecting to them through the Secure Remote Access Appliance.

Use this guide only after an administrator has performed the initial setup and configuration of the Secure Remote Access Appliance as detailed in the Secure Remote Access Appliance Hardware Installation Guide. Once BeyondTrust is properly installed, you can begin accessing your endpoints immediately. Should you need any assistance, please contact BeyondTrust Technical Support at www.beyondtrust.com/support.

SALES: www.beyondtrust.com/contact SUPPORT: www.beyondtrust.com/support DOCUMENTATION: www.beyondtrust.com/docs ©2003-2020 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository TC: 5/22/2020 institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Install the Access Console

In any web browser, go to the URL of your Secure Remote Access Appliance followed by /login and enter the username and password set by your administrator. You may be prompted to change your password the first time you log in. From the My Account page, download and install the BeyondTrust access console. The option defaults to the appropriate installer for your operating system.

Note: On a Linux system, you must save the file to your computer and then open it from its downloaded location. Do not

use the Open link that appears after downloading a file from some browsers.

When the installation wizard appears, follow the instructions to install the software. After installing the access console, you can choose Run BeyondTrust Access Console Now and/or Run at Startup. Then click Finish.

Note: If you choose Run BeyondTrust Access Console Now during installation, a login prompt appears on your screen.

Log into the PRA Access Console

After installing the BeyondTrust console, launch the access console from its directory location as defined during installation.

Note: By default, in Windows, you can access the console from Start Menu > All Programs > Bomgar > access.example.com, where access.example.com is the

access.example.com, where access.example.com is the hostname of the site from which you downloaded the console.

At the prompt, enter your username and password.

\

If two-factor authentication is enabled for your account, enter the code from the authenticator app.

\

\

\

\

\

\

\

\

Note: Users who were receiving email codes to log in will be \automatically upgraded to two-factor authentication (2FA), although they may continue to use email codes until they register an app. Once they begin to use 2FA, the email code option is permanently disabled.

Alternatively, if your administrator has configured a Kerberos server to enable single sign-on, you can log into the console without entering your credentials. The access console remembers the last used login mechanism, whether it used local credentials, Kerberos, or another security provider.

Invited users can also enter a session key to join a shared session on a one-time basis.

\

Check Enable Saved Logins to have the console save your username and password. This option can be enabled or disabled from /login > Management > Security. Once you log in, the console opens, and a BeyondTrust icon appears in your computer's system tray.

\

\

\

\

\

Once you log in, the console opens, and a BeyondTrust icon appears in your computer's system tray.

\

Note: If you forgot your password, go to /login and click the Forgot Your Password? link. This is an option that is set by your administrator. If you do not have this option, please contact your administrator.

\

Note: Your administrator may require you to be on an allowed network to log into the console. This network restriction may \apply the first time you log in or every time.

\

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

If you lose your connection, the access console attempts to reconnect for 60 seconds. If your connection is restored within this time, your access console reopens, restoring all of your open sessions. If the connection cannot be restored within this time, you are prompted to retry login or quit.

If you are logged into the access console in one location and then log in from another, your open sessions are maintained.

Note: To log in with an account already in use and forcibly

close the connection on the other system, the setting Terminate Session If Account Is In Use must be checked on the /login > Management > Security page.

After an upgrade or at first launch of the desktop access console, a What's New dialog appears automatically upon login for all non- invited users. This dialog may be viewed at any time through the Help menu (Help > What's New) and shows new release information for current and past releases. This is a roaming preference per account, so the dialog appears just once regardless where a user signs in from.

For more information about invited users, please see Invite an External User to Join an Access Session at https://www.beyondtrust.com/docs/privileged-remote-access/getting-started/access-console/access-invite.htm.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Access Console User Interface

Sessions-Manage multiple remote sessions at the same time.

Queues-Queues list sessions currently running as well as requests to share sessions with any member of a team. Details about the remote system being accessed appear in this section. Dashboard-Privileged users can view and monitor ongoing sessions and teammates of a lower role, providing administrative oversight to help manage staff. Jump Item Interface-Installed Jump Clients and Jump shortcuts appear here, grouped according to who can access them. User Chat-Chat with other logged in users. You also can share your screen with a team member without requiring a session.

Change Settings and Preferences in the Access Console

Click on File > Settings in the upper left-hand corner of the console to configure your preferences.

In general, you may configure the console settings according to your preferences. However, your BeyondTrust administrator may choose to manage your settings, enforcing those managed settings if desired.

If your BeyondTrust administrator has changed and applied the default settings, then you will see a Settings Changed alert the next time you log into your console. Click View Settings to open your settings window to view the changes, or simply click OK to acknowledge the changes.

\

\

\

\

Changing Settings

Note: These instructions assume you are allowed to choose the settings used in your console. Settings enforced by your administrator appear marked with an asterisk and grayed out, and they are not locally configurable. See your administrator or the administrative guide access console settings topic for more information.

Each console settings window includes a Restore Defaults button in the lower left-hand corner of the window which returns all of your settings to the BeyondTrust default settings or to the default settings applied by your administrator if any have been set. An alert dialog asks you to confirm that you wish to change to the defaults. Click Cancel if you wish to return to your locally saved preferences. Note that if any of the defaults are forced by your administrator, you are unable to configure them.

From the Global Settings section, you may choose to enable or disable spell check for chat. Currently, spell check is available for US English only.

Choose if you want the session menu icon to display, if the sidebar can be detached, and if the widgets on the session sidebar can be rearranged and resized.

\

\

SALES: www.beyondtrust.com/contact SUPPORT: www.beyondtrust.com/support DOCUMENTATION: www.beyondtrust.com/docs ©2003-2020 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository

BeyondTrust

Choose your alert settings for chat messages. When you receive a chat message, you can choose to hear a sound and to see the application icon flash.

If you would like to upload a custom sound for chat messages, click the […] button and select a WAV file on your computer. The file can be no larger than 1MB.

Choose if the team chat should include status messages, such as users logging in and out, or only chats sent between team members.

Choose if you want to hear an audible alert when another user requests to share a session with you. If you would like to upload a custom sound for shared sessions, click the […] button and select a WAV file on your computer. The file can be no larger than 1MB.

You also can choose to receive pop-up notifications for certain events. These notifications will appear independent of your console and on top of other windows. Set where you wish to see pop-ups and how long they should display.

Choose if you want to automatically start screen sharing when you begin a session.

You can choose to open sessions as tabs in the console or to automatically detach sessions into new windows.

BeyondTrust

Set the default quality and size for a screen sharing session. When screen sharing starts, you can automatically enter full screen mode, which in turn can automatically collapse the chat bar.

Also when screen sharing starts, the remote system can automatically have its display, mouse, and keyboard input restricted, providing a privacy screen.

Select the default RDP display size for all RDP sessions.

For easier access to screenshots you capture from the console, set the default directory where you will save your console-captured remote screenshots.

For easier file transferring, set the default directory from which you wish to start browsing your local file system.

Set the number of lines to save in the command shell history.

Jump Interface: Use Jump Items to Access Remote Systems

The Jump interface appears in the bottom half of the access console, listing the Jump Items available to you. The list may contain both active and passive Jump Clients, as well as Jump shortcuts for Remote Jumps, Local Jumps, RDP sessions, VNC sessions, Protocol Tunnel Jumps, Shell Jumps, and Web Jumps.

Jump Items are listed in Jump Groups. If you are assigned to one or more Jump Groups, you can access the Jump Items in those groups, with the permissions assigned by your admin. Selecting a Jump Group and then clicking Create auto-selects that Jump Group in the Jump Item configuration window.

Your personal list of Jump Items is primarily for your individual use, although your team leads, team managers, and users with permission to see all Jump Items may have access to your personal list of Jump Items. Similarly, if you are a team manager or lead with appropriate permissions, you may see team members' personal lists of Jump Items. Additionally, you may have permission to access Jump Items in Jump Groups you do not belong to and personal Jump Items for non-team members.

\

Jump to a Jump Item

Browse through groups for the computer you wish to access. To facilitate browsing the Jump Items list, you may drag the columns into any order you wish, and then sort a column by clicking the column header. The access console remembers the column order and the sort order the next time the access console is launched. In addition to browsing for Jump Items, you can search based on multiple

the fields you are searching, click on the magnifying glass and check or uncheck any of the available fields. Searchable fields include Comments, Console User, Domain, FQDN, Group, Hostname/IP, Jump Method, Last Accessed, Name, Private IP, Public IP, Status, Tag, and Workgroup.

In addition to browsing for Jump Items, you can search based on multiple fields. Enter a string in the search field and then press Enter. To change the fields you are searching, click on the magnifying glass and check or uncheck any of the available fields. Searchable fields include Comments, Console User, Domain, FQDN, Group, Hostname/IP,

Once you have found the computer you wish to access, double-click the entry, or select the entry and click the Jump button. This attempts to start a session with the remote computer.

You may programmatically connect to a Jump Item directly from your systems management or ticketing tool. If your search results in only one Jump Item, the session starts immediately. If multiple Jump Items are returned, select one of the Jump Items listed in the selection window and click OK.

Note: For details about scripting, see Access Console Scripting and Client Scripting API at www.beyondtrust.com/docs/privileged-remote-access/how-to/integrations/api/client-script.

If a Jump Policy is applied to the Jump Item, that policy affects how and/or when a Jump Item may be accessed.

Schedule

If a Jump Policy enforces a schedule for this Jump Item, an attempt to access the Jump Item outside of its permitted schedule prevents the Jump from occurring. A prompt informs you of the policy restrictions and provides the date and time when this Jump Item is next available for access.

\

\

Notification

If a Jump Policy is configured to send a notification on session start or end, then an attempt to access a Jump Item alerts you that an email will be sent. You can choose to proceed with the Jump and send a notification, or you can cancel the Jump.

Ticket ID

If a Jump Policy requires entry of a ticket ID from your external ITSM or ticket ID system before the Jump can be performed, a dialog opens. In the dialog, enter the ticket ID you need, authorizing access to this Jump Item.

If a Jump Policy requires authorization before the Jump can be performed, a dialog opens. In the dialog, enter the reason you need to access this Jump Item. Then enter the date and time at which you wish authorization to begin, as well as how long you require access to the Jump Item. Both the request reason and the request time are visible to the approver and help them decide whether to approve or deny access.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

When you click OK, an email is sent to the addresses defined as approvers for this policy. This email contains a URL where an approver can see the request, add comments, and either approve or deny the request.

If a request was approved by one person, a second can access the URL to override approval and deny the request. If a request was denied, then any other approvers accessing the site can see the details but cannot override the denied status. If a user has already joined an approved session, that access cannot be denied. Although other approvers can see the email address of the person who approved or denied the request, the requester cannot. Based on the Jump Policy settings, an approved request grants access either to any user who can see and request access to that Jump Client or only to the user who requested access.

In the Jump interface, the Jump Item's details pane displays the status of any authorization requests as either pending, approved, approved only for a different user, or denied. When an approver responds to a request, a pop-up notification appears on the requester's screen alerting them that access has been either approved or denied. If the requester has a configured email address, an email notification is also sent to the requester.

When a user Jumps to a Jump Item which has been approved for access, a notification alerts the user to any comments left by the approver.

When approval has been granted to a Jump Item, that Jump Item becomes available either to any user who can see and request access to that Jump Item or only to the user who requested access. This is determined by the Jump Policy.

Note: While multiple requests may be sent for different times, the requested access times cannot overlap. If a request is

denied, then a second request may be sent for the same time.

Use Jump Clients to Access Remote Endpoints

To access an individual Windows, Mac, or Linux computer which is not on an accessible network, install a Jump Client on that system from the /login > Jump > Jump Clients page. Jump Clients appear in the Jump interface along with Jump Item shortcuts.

Use a Jump Client

To use a Jump Client to start a session, simply select the Jump Client from the Jump interface and click the Jump button.

Note: Jump Items can be set to allow multiple users to simultaneously access the same Jump Item. If set to Join Existing \Session, other users are able to join a session already underway. The original owner of the session receives a note indicating another user has joined the session, but is not allowed to deny them access. For more information on simultaneous Jumps, please see Jump Item Settings at www.beyondtrust.com/docs/privileged-remote-access/gettingstarted/admin/jump-items.htm.

Sort Jump Clients

Browse through groups for the computer you wish to access. To facilitate browsing the Jump Items list, you may drag the columns into any order you wish, and then sort a column by clicking the column header. The access console remembers the column order and the sort order the next time the access console is launched.

Search for a Jump Client

In addition to browsing for Jump Items, you can search based on multiple fields. Enter a string in the search field and then press Enter. To change the fields you are searching, click on the magnifying glass and check or uncheck any of the available fields. Searchable fields include Comments, Console User, Domain, FQDN, Group, Hostname/IP, Jump Method, Last Accessed, Name, Private IP, Public IP, Status, Tag, and Workgroup.

When you select a Jump Client, a details pane appears to the right of the Jump interface. Which details are shown here is determined by the Jump Client Statistics setting in the /login interface as well as by the remote operating system.

After a software update, Jump Clients update automatically. The number of concurrent Jump Client upgrades is determined by settings on the /login > Jump > Jump Clients page. If a Jump Client has not yet been updated, it is labeled as Upgrade Pending, and its version and revision number appear in the details pane. While you can modify an outdated Jump Client, you cannot Jump to it. Attempting a Jump does, however, move that Jump Client to the front of the upgrade queue.

Wake-On-Lan (WOL)

Wake-On-Lan (WOL) allows you to remotely turn on or wake up machines configured for WOL from BeyondTrust. In a configured environment, customers can power off their machine but still receive BeyondTrust support, if needed.

Note: WOL is not a BeyondTrust technology. The BeyondTrust software integrates with existing WOL systems. To use WOL through BeyondTrust, the system must have WOL enabled, and the network must allow WOL packets to be sent.

To enable support for WOL in BeyondTrust, turn on the WOL setting in the administrative /login interface under Jump > Jump Clients. When enabling the WOL option, keep the following items in mind:

l WOL does not work for wireless clients. A wired network connection is required.

l WOL is supported by the underlying system hardware, which is independent of the installed OS.

l WOL is supported only by active Jump Clients. Passive Jump Clients, Jumpoints, and Local Jump from representative consoles do not support WOL.

To wake an active Jump Client using WOL, right-click an existing Jump Client from within the rep console. Attempt to wake the system by clicking the Attempt to wake up Jump Client option.

\

The wake option is only available when selecting a single Jump Client. It is not available when multiple Jump Clients are selected.

WOL packets are sent from other Jump Clients residing on the same network as the target machine. When an active Jump Client is installed or checks-in, it registers its network information with the appliance, and the appliance uses this information to determine which Jump Clients are on the same network.

Jump Client Properties

Organize and manage existing Jump Items by selecting one or more Jump Items and clicking Properties.

Note: To view the properties of multiple Jump Items, the items selected must be all the same type (e.g., all Jump Clients, \all Remote Jumps, etc.).

Change a Jump Client's mode from the Connection Type dropdown. Active Jump Clients send statistics to the Secure Remote Access Appliance on a defined interval. Passive Jump Clients send statistics to the Secure Remote Access Appliance once a day or upon a manual check in.

Note: This feature is available only to customers who own an on-premises Secure Remote Access Appliance. \BeyondTrust Cloud customers do not have access to this feature.

Based on the options your administrator sets, these statistics may include the remote computer's logged-in console user, operating system, uptime, CPU, disk usage, and a screen shot from the last update.

Jump Items include a Comments field for a name or description, which makes sorting, searching, and identifying Jump Items faster and easier.

Further organize Jump Items by entering the name of a new or existing Tag. Even though the selected Jump Items are grouped together under the tag, they are still listed under the Jump Group in which each is pinned. To move a Jump Item back into its top-level Jump Group, leave this field blank.

To set when users are allowed to access this Jump Item, if a notification of access should be sent, or if permission or a ticket ID from your external ticketing system is required to use this Jump Item, choose a Jump Policy. These policies are configured by your administrator in the /login interface.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Choose an Endpoint Agreement to assign to this Jump Item. Depending on what is selected, an endpoint agreement is displayed. If there is no response, the agreement is automatically accepted or rejected.

If you no longer need access to a remote system, select the Jump Item and click Remove, or right-click on the Jump Item and select Remove from the menu. You may select multiple Jump Items to remove them all at the same time.

Note: If the remote user manually uninstalls a Jump Client, the deleted item is either marked as uninstalled or completely

removed from the Jump Items list in the access console. If the Jump Client cannot contact the Secure Remote Access Appliance at the time it is uninstalled, the affected item remains in its offline state. This setting is available at /login > Jump > Jump Clients. If a Jump Client goes offline and does not reconnect to the Secure Remote Access Appliance for 180 days, it is automatically uninstalled from the target computer and is removed from the Jump interface.

Use Remote Jump for Unattended Access to Computers on a Separate Network

Remote Jump enables a privileged user to connect to an unattended remote computer on a network outside of their own network. Remote Jump depends on a Jumpoint.

A Jumpoint acts as a conduit for unattended access to Windows computers on a known remote network. A single Jumpoint installed on a computer within a local area network is used to access multiple systems, eliminating the need to pre-install software on every computer you may need to access.

Note: Jumpoint is only available for Windows systems. Jump Clients are needed for remote access to Mac or Linux computers. To Jump to a Windows computer without a Jump Client, that computer must have Remote Registry Service enabled (disabled by default in Vista) and must be on a domain. You cannot Jump to a mobile device, though Jump Technology is available from mobile BeyondTrust consoles.

Create a Remote Jump Shortcut

To create a Remote Jump shortcut, click the Create button in the Jump interface. From the dropdown, select Remote Jump. Remote Jump shortcuts appear in the Jump interface along with Jump Clients and other types of Jump Item shortcuts.

Organize and manage existing Jump Items by selecting one or more Jump Items and clicking Properties.

Note: To view the properties of multiple Jump Items, the items selected must be all the same type (e.g., all Jump Clients, all Remote Jumps, etc.).To review properties of other types of Jump Items, please see the appropriate section in this guide.

Enter a Name for the Jump Item. This name identifies the item in the session tabs. This string has a maximum of 128 characters.

From the Jumpoint dropdown, select the network that hosts the computer you wish to access. The access console remembers your Jumpoint choice the next time you create this type of Jump Item. Enter the Hostname / IP of the system you wish to access.

Jump Items include a Comments field for a name or description, which makes sorting, searching, and identifying Jump Items faster and easier.

Move Jump Items from one Jump Group to another using the Jump Group dropdown. The ability to move Jump Items to or from different Jump Groups depends upon your account permissions.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Choose a Session Policy to assign to this Jump Item. The session policy assigned to this Jump Item has the highest priority when setting session permissions. The ability to set a session policy depends on your account permissions.

Use a Remote Jump Shortcut

To use a Jump shortcut to start a session, simply select the shortcut from the Jump interface and click the Jump button.

You must provide administrative credentials to the remote computer in order to complete the Jump. The administrative rights must be either a local administrator on the remote system or a domain administrator.

The client files are pushed to the remote system, and a session attempts to start.

Note: Jump Items can be set to allow multiple users to simultaneously access the same Jump Item. If set to Join Existing

Session, other users are able to join a session already underway. The original owner of the session receives a note indicating another user has joined the session, but is not allowed to deny them access. For more information on simultaneous Jumps, please see Jump Item Settings at www.beyondtrust.com/docs/privileged-remote-access/getting- started/admin/jump-items.htm.

Use Local Jump for Unattended Access to Computers on Your Local Network

Local Jump enables a privileged user to connect to an unattended remote computer on their local network. Within the local area network, the BeyondTrust user's computer can initiate a session to a Windows system directly without using a Jumpoint, if appropriate user permissions are enabled. A Jumpoint is needed only when the BeyondTrust user's computer cannot access the target computer directly.

Note: Local Jump is only available for Windows systems. Jump Clients are needed for remote access to Mac or Linux computers. To Jump to a Windows computer without a Jump Client, that computer must have Remote Registry Service enabled (disabled by default in Vista) and must be on a domain.

Create a Local Jump Shortcut

To create a Local Jump shortcut, click the Create button in the Jump interface. From the dropdown, select Local Jump. Local Jump shortcuts appear in the Jump interface along with Jump Clients and other types of Jump Item shortcuts.

Organize and manage existing Jump Items by selecting one or more Jump Items and clicking Properties.

Enter a Name for the Jump Item. This name identifies the item in the session tabs. This string has a maximum of 128 characters.

Enter the Hostname / IP of the system you wish to access.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Use a Local Jump Shortcut

To use a Jump shortcut to start a session, simply select the shortcut from the Jump interface and click the Jump button.

The client files are pushed to the remote system, and a session attempts to start.

Note: Jump Items can be set to allow multiple users to simultaneously access the same Jump Item. If set to Join Existing

Use RDP to Access a Remote Windows Endpoint

Use BeyondTrust to start a Remote Desktop Protocol (RDP) session with a remote Windows system. Because remote desktop protocol sessions are proxied through a Jumpoint and converted to BeyondTrust sessions, users can share or transfer sessions, and sessions can be automatically audited and recorded as your administrator has defined for your site. To use RDP through BeyondTrust, you must have access to a Jumpoint and must have the user account permission Allowed Jump Methods: RDP via a Jumpoint.

Create an RDP Shortcut

To create a Microsoft Remote Desktop Protocol shortcut, click the Create button in the Jump interface. From the dropdown, select Remote RDP. RDP shortcuts appear in the Jump interface along with Jump Clients and other types of Jump Item shortcuts.

Organize and manage existing Jump Items by selecting one or more Jump Items and clicking Properties.

Note: To view the properties of multiple Jump Items, the items selected must be all the same type (e.g., all Jump Clients, \all Remote Jumps, etc.).To review properties of other types of Jump Items, please see the appropriate section in this guide.

Provide the Username to sign in as, along with the Domain.

Select the Quality at which to view the remote screen. This cannot be changed during the remote desktop protocol (RDP) session. Select the color optimization mode to view the remote screen. If you are going to be primarily sharing video, select Video Optimized; otherwise, select Black and White (uses less bandwidth), Few Colors, More Colors, or Full Color (uses more bandwidth). Both Video Optimized and Full Color modes allow you to view the actual desktop wallpaper. To start a console session rather than a new session, check the Console

To start a console session rather than a new session, check the Console Session box.

To get more detailed information on the RDP session, check Session Forensics. For this feature to work, you need to select an RDP Service Account for the Jumpoint being used. When checking this setting, the following reminder displays:

Note: When RemoteApp or BeyondTrust Remote Desktop Agent is selected in the SecureApp section, the Console Session checkbox is unchecked. Remote applications cannot run in a console session on a RDP server.

When Session Forensics is checked, the following additional details are logged:

l Focused window changed event

l Menu opened event

l New window opened event

For more information on Session Forensics and RDP Service Account, please see Jumpoint: Set Up Unattended Access
to a Network > RDP Service Account at https://www.beyondtrust.com/docs/privileged-remote-access/gettingstarted/admin/jumpoint.htm.

To start a session with a remote application, configure the SecureApp section. The following dropdown options are available:

l None: When accessing a Remote RDP Jump Item, no application is launched.

l RemoteApp:The user can configure an application profile or command argument which executes and opens an application on a remote server. To configure, select the RemoteApp option and enter the following information.

oRemote App Name: Enter the name of the application you wish to connect to.

oRemote App Parameters: Enter the profile details or command line arguments needed to open the application.

l BeyondTrust Remote Desktop Agent: This option facilitates passing parameters through an agent in order to launch applications on a remote host. To configure, select the BeyondTrust Remote Desktop Agent option and enter the following information:

oExecutable Path: Enter the path of the application the agent will connect to.

oParameters: Enter any parameters that you could normally type from a command line when launching the app on the remote system.

The option to Inject Credentials will be available when the BeyondTrust Remote Desktop Agent type is selected. This option facilitates passing parameters as well as credentials through an agent in order to launch applications on a remote host. The first set of credentials are in the Jump definition and are the credentials for the user account you'll use to log into the remote system. There is a secondary prompt for additional credentials, either manually provided or from a password vault. These secondary credentials are made available to the command line you define through the %USERNAME% and %PASSWORD% macros (additional macros shown below). This allows you to pass additional credentials to the application you are launching (e.g., SQL Server Management Studio). To configure, select the BeyondTrust Remote Desktop Agent: option and enter the following information: Enter the Executable Path and Parameters as described above.

l Target System: Enter the name of the system running the application.

l Credential Type: Enter the credential type as defined by the credential management system. (e.g. SQL)

BeyondTrust

Note: The BeyondTrust Remote Desktop Agent option requires a BeyondTrust Remote Desktop Agent to be \preconfigured on the target system. This agent can be downloaded from the My Account page in the /login interface. It is neither version nor site-specific, and thus the same agent may be used for as many applications as the admin wishes to support. Once the agent is installed, you can then use BeyondTrust to create RDP Jump Items that are configured to use the BeyondTrust Remote Desktop Agent option to launch any application installed on the remote system.

Note: SecureApp relies on publishing applications using Microsoft RDS RemoteApps. Please refer to the Microsoft documentation for publishing applications.

For more information about contained database users, please see Contained Database Users - Making Your Database
Portable at docs.microsoft.com/en-us/sql/relational-databases/security/contained-database-users-making-your-databaseportable.

Jump Items include a Comments field for a name or description, which makes sorting, searching, and identifying Jump Items faster and easier.

Use an RDP Shortcut

To use a Jump shortcut to start a session, simply select the shortcut from the Jump interface and click the Jump button.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

You are prompted to enter the password for the username you specified earlier.

Your remote desktop protocol (RDP) session now begins.

Note: When starting an RDP session, the RDP keyboard will automatically match the language you have set in the access

console. This functionality is available for Windows-based access consoles only.

Begin screen sharing to view the remote desktop. You can send the Ctrl-Alt-Del command, capture a screenshot of the remote desktop, share clipboard contents, use Alt and Shift commands, and perform key injection. You also can share the RDP session with other logged-in BeyondTrust users, following the normal rules of your user account settings.

Note: Jump Items can be set to allow multiple users to simultaneously access the same Jump Item. If set to Start New

Session, then a new independent session starts for each user who Jumps to a specific RDP Jump Item. The RDP configuration on the endpoint controls any further behavior regarding simultaneous RDP connections. For more information on simultaneous Jumps, please see Jump Item Settings at www.beyondtrust.com/docs/privileged-remote- access/getting-started/admin/jump-items.htm.

Use VNC to Access a Remote Windows Endpoint

Use BeyondTrust to start a VNC session with a remote Windows system. Because VNC sessions are proxied through a Jumpoint and converted to BeyondTrust sessions, users can share or transfer sessions, and sessions can be automatically audited and recorded as your administrator has defined for your site. To use VNC through BeyondTrust, you must have access to a Jumpoint and must have the user account permission Allowed Jump Methods: Remote VNC via a Jumpoint.

Create a VNC Shortcut

To create a VNC shortcut, click the Create button in the Jump interface. From the dropdown, select Remote VNC. VNC shortcuts appear in the Jump interface along with Jump Clients and other types of Jump Item shortcuts.

Organize and manage existing Jump Items by selecting one or more Jump Items and clicking Properties.

Note: By default, the VNC server listens on port 5900, which is, therefore, the default port BeyondTrust attempts. If the remote VNC server is configured to use a different port, add it after the hostname or IP address in the form of : or : (e.g., 10.10.24.127:40000).

Use a VNC Shortcut

Jump Items include a Comments field for a name or description, which makes sorting, searching, and identifying Jump Items faster and easier.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

When establishing the connection to the VNC server, the system tries to determine if there are any credentials associated. If so, it prompts you to enter them.

Your VNC session now begins. Begin screen sharing to view the remote desktop. You can send the Ctrl-Alt-Del command, capture a screenshot of the remote desktop, and share clipboard text contents. You also can share, transfer or record the VNC session, following the normal rules of your user account settings.

Note: Jump Items can be set to allow multiple users to simultaneously access the same Jump Item. If set to Join Existing

Use a Protocol Tunnel Jump to Make a TCP Connection to a Remote System

Using a Protocol Tunnel Jump, make a TCP connection from your system to an endpoint on a remote network. Because the connection occurs through a Jumpoint, the administrator can control which users have access, when they have access, and if the sessions are recorded.

Create a Protocol Tunnel Jump Shortcut

To create a Protocol Tunnel Jump Shortcut, click the Create button in the Jump interface. From the dropdown, select Protocol Tunnel Jump. Protocol Tunnel Jump shortcuts appear in the Jump interface along with Jump Clients and other types of Jump Item shortcuts.

Note: Protocol Tunnel Jump shortcuts are enabled only if their Jumpoint is configured for the Protocol Tunnel Jump method on the /login > Jump > Jumpoint page.

Enter a Name for the Jump Item. This name identifies the item in the session tabs. This string has a maximum of 128 characters.

Specify a Local Address. The default address is 127.0.0.1. If you need to connect to multiple systems on the same remote port at the same time, you can enable that connection by changing each Protocol Tunnel Jump Shortcut's address to a different address within the 127.x.x.x subrange.

In Local Port, specify the port that will listen on the user's local system. If you leave this as automatic, the access console allocates a free port.

In Remote Port, specify the port to connect to on the remote system. This is dictated by the type of server you are connecting to. You can define multiple pairs of TCP Tunnels as necessary for your

Jump Items include a Comments field for a name or description, which makes sorting, searching, and identifying Jump Items faster and easier.

Organize and manage existing Jump Items by selecting one or more Jump Items and clicking Properties.

BeyondTrust

Use a Protocol Tunnel Jump Shortcut

To use a Protocol Tunnel Jump shortcut to start a session, simply select the shortcut from the Jump interface and click the Jump button.

A session appears in your access console. Click the Protocol Tunneling button to establish the connection.

If screen recording is enabled, a prompt appears, informing you that your desktop will be recorded. Click OK to continue. If you click Cancel, the Protocol Tunnel will not be created.

If screen recording is enabled, an indicator appears at the top of your session screen.

l No more than 256 simultaneous connections can be handled.

l All TCP connections must originate from the endpoint and must be accepted by the listening user's system. The application's protocol cannot require that the user's system make a separate connection back to the endpoint.

Stipulations to Correct Functioning

l Any TCP connections that the endpoint is to make back to the user's system must be made over tunnels already defined within the Protocol Tunnel Jump Item properties.

BeyondTrust

l Operating systems typically disallow non-elevated processes from listening on ports less than 1024. Therefore, the local port must generally be greater than 1024. The endpoint software connects to the server by connecting to the local port on which the access console (a non-elevated process) is listening.

l The endpoint software cannot make connections to any system on the remote network other than the one specified in the Protocol Tunnel Jump Item properties.

l The protocol must be agnostic toward the hostname that the endpoint used to connect to the server. Otherwise, other means must be made to satisfy the protocol's requirements, such as mapping a hostname to 127.0.0.1 in the hosts file or applying special configuration to the endpoint client.

l If the tunnel definition has a local port that is different than the remote port (namely, when the local port must be greater than 1024 because the server's port is less than 1024), the protocol must be agnostic toward the port that the endpoint client used to connect to the server.

l Any protocol which goes beyond the case of making a single TCP connection from the endpoint client to the user's system requires the administrator's understanding their specific protocol and the stipulations listed above.

Use Shell Jump to Access a Remote Network Device

With Shell Jump, quickly connect to an SSH-enabled or Telnet-enabled network device to use the command line feature on that remote system. For example, run a standardized script across multiple systems to install a needed patch, or troubleshoot a network issue. Administrators may enable command filtering to help prevent users from inadvertently using harmful commands on SSHconnected endpoints.

Create a Shell Jump Shortcut

To create a Shell Jump shortcut, click the Create button in the Jump interface. From the dropdown, select Shell Jump. Shell Jump shortcuts appear in the Jump interface along with Jump Clients and other types of Jump Item shortcuts.

Note: Shell Jump shortcuts are enabled only if their Jumpoint is configured for open or limited Shell Jump access. \

Organize and manage existing Jump Items by selecting one or more Jump Items and clicking Properties.

Enter a Name for the Jump Item. This name identifies the item in the session tabs. This string has a maximum of 128 characters.

Port automatically switches to the default port for the selected protocol but can be modified to fit your network settings.

Jump Items include a Comments field for a name or description, which makes sorting, searching, and identifying Jump Items faster and easier.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

To set when users are allowed to access this Jump Item, if a notification of access should be sent, or if permission or a ticket ID from your external ticketing system is required to use this Jump Item, choose a Jump Policy. These policies are configured by your administrator in the /login interface. Choose a Session Policy to assign to this Jump Item. The session policy assigned to this Jump Item has the highest priority when setting session permissions. The ability to set a session policy depends on your account permissions.

Use a Shell Jump Shortcut

To use a Shell Jump shortcut to start a session, simply select the shortcut from the Jump interface and click the Jump button. If attempting to Shell Jump to an SSH device without a cached host key, you receive an alert that the server's host key is not cached and that there is no guarantee that the server is the computer you think it is. If you choose Save Key and Connect, then the key is cached on the Jumpoint's host system so that future attempts to Shell Jump to this system do not result in this prompt. Connect Only starts the session without caching the key, and Abort ends the Shell Jump session. When you Shell Jump to a remote device, a command shell session immediately starts with that device. If you are Shell Jumping to a provisioned SSH device with an unencrypted key or with an encrypted key whose password has been cached, you are not prompted for a password. Otherwise, you are required to enter a password. You can then send commands to the remote system. Administrators may configure command filtering on Shell Jump items to block some commands and allow others, in an effort to prevent the user from inadvertently using a command that may cause undesireable results. In the event a user attempts to use a command that matches an expression that is not allowed, they will receive a prompt and will not be allowed to execute the command.

BeyondTrust's command filter uses extended regular expressions, which are not to be confused with egrep. For more information, please see details at docs.microsoft.com/en-us/cpp/standard-library/regular-expressions-cpp.

Configure Shell Prompt Filtering:

1. Log into the /login interface as a user with permissions to configure Jump Items and Session Policies.
2. Browse to Jump > Jump Items and scroll down to the Shell Jump Filtering section.
3. In the Recognized Shell Prompts text box, enter regexes to match the command shell prompts found on your endpoint systems, one per line. Note: Line breaks, or newlines, are not allowed within the command prompt patterns entered. If an endpoint system uses a multi-line prompt, enter an expression that matches only the final line of the prompt in the text box.
4. Click Save. Note: Once you have entered the regexes you wish to use, you can test a shell prompt to determine if it matches any of the regexes in the list. This allows you to test your regexes without starting a session. Enter the expression in the Shell Prompt text box and click the Check button. You will receive a notice stating whether or not the shell prompt you entered matches one of the regexes in the list.

Configure Command Filtering:

1. Browse to Users & Security > Session Policies and either create a new policy or edit an existing one. SALES: www.beyondtrust.com/contact SUPPORT: www.beyondtrust.com/support DOCUMENTATION: www.beyondtrust.com/docs ©2003-2020 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository TC: 5/22/2020 institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

BeyondTrust

Note: You can also configure this for users and/or group policies.

2. Locate the Command Shell settings in the Permissions section.

3. Because you will use command filtering with Shell Jump items, select the Allow radio button to allow the use of the command shell.

4. Choose from Allow all commands, Allow the command patterns below, or Deny the command patterns below and specify in the text box which regex patterns you wish to allow or block.

Note: Once you have entered the command patterns you wish to allow or block, you can test commands in the Command Tester text box. This allows you to test your command filters without starting a session. This allows you to test your command filters without starting a session. You will receive a notice stating whether or not the command entered would be allowed to run on the remote system based on the regexes specified in the list.

The two possible messages are:

l The entered command shall be allowed based on your selections.

l The entered command shall not be allowed based on your selections.

Use Credential Injection with SUDO on a Linux Endpoint

To use credential injection with SUDO, an administrator must configure one or more functional accounts on each Linux endpoint to be accessed via Shell Jump. As the process for configuring the sudoers file is complex and varies by platform, please refer to your platform's documentation for details on completing this process. Each functional account must:

l Have the account credentials stored in the Endpoint Credential Manager

l Have one or more entries in /etc/sudoers granting the functional account access to one or more commands to be executed as root without requiring a password (NOPASSWD).

An administrator must create a Shell Jump Item for the endpoint.

Next, an administrator must configure the endpoint credential manager and/or password vault to grant users access to the appropriate functional accounts for that Jump Item.

When a user Jumps to the Shell Jump Item, they can choose from the list of functional accounts available for that endpoint. Each functional account has its own set of commands that can be executed using SUDO, as configured by the administrator on the endpoint. The credentials for the account are passed from the Endpoint Credential Manager to the endpoint.

Note: Jump Items can be set to allow multiple users to simultaneously access the same Jump Item. If set to Join Existing Session, other users are able to join a session already underway. The original owner of the session receives a note indicating another user has joined the session, but is not allowed to deny them access. For more information on simultaneous Jumps, please see Jump Item Settings at www.beyondtrust.com/docs/privileged-remote-access/gettingstarted/admin/jump-items.htm.

Use a Web Jump to Access Web Services

With the proliferation of infrastructure components that have moved to web-based interfaces for configuration, IT administrators are faced with an increasingly complex security management situation. With privileged access to web-based resources, it is a challenge to control, audit, and enforce proper authentication without negatively affecting business productivity. IT administrators need a way to effectively control and audit resources managed via web interfaces, including:

l Externally hosted IaaS (Infrastructure as a Service) servers such as Amazon AWS, Microsoft Azure, IBM Softlayer, and Rackspace.

l Internally hosted servers managed by hypervisor software such as VM Ware vSphere, Citrix XenServer, and Microsoft Hyper- V.

l Modern core network infrastructure that leverage web-based configuration interfaces.

The identity and access management capabilities vary significantly between IaaS, hypervisor providers, and core infrastructure systems, and many do not offer native multifactor authentication support, thereby missing that additional layer of security. These inconsistencies across systems create opportunities for business vulnerabilities, such as misuse of accounts and access, leading to leaks of sensitive data. BeyondTrust Web Jump is the extra layer of security for authenticating to these systems.

IMPORTANT!

Web Jump does not support Flash. Be sure to consult your hypervisor documentation and update it to a version that supports HTML5.

Note: The Web Jump Item is an add-on for Privileged Remote Access that requires additional purchase. \

Create a Web Jump Shortcut

Note: Before creating Web Jump shortcuts, ensure that your user account has the ability to access Web Jumps by navigating to Users & Security > User Settings > Jump Technology.

Note: Web Jump Items are available for use only from the desktop access console. \

To create a Web Jump shortcut, click the Create button in the Jump interface. From the dropdown, select Web Jump. Web Jump shortcuts appear in the Jump interface along with Jump Clients and other types of Jump Item shortcuts.

Organize and manage existing Jump Items by selecting one or more Jump Items and clicking Properties.

BeyondTrust

Enter a Name for the Jump Item. This name identifies the item in the session tabs. This string has a maximum of 128 characters.

From the Jumpoint dropdown, select the network that hosts the computer you wish to access.

Type the URL for the web site you wish to access.

Check Verify Certificate if you want the site certificate to be validated before the connection is made. If this box is checked and issues are found with the certificate, the session does not start.

IMPORTANT!

If you want to use credential injection, first select the Username Format:

l Default: This is the default value for new and existing Web Jump items. The username is not modified before injection into the web page and is used in the stored format. For the endpoint credential manager (ECM), the credential may be in either UPN or DLLN format. For Vault, the username will always be in UPN format.

l Username Only: Independently of the format stored in either Vault or ECM (username@domain or domain\username), the domain is removed and only the username is used.

Under Login Form Detection, provide information for the three options, as needed:

l Username Field: This setting specifies the hint for the username field on the login page. If no username field is found, then injection fails. An error message is shown to the user stating the username field could not be found. Password Field: This setting specifies the hint for the password field on the login page. If no password field is found, then

Password Field: This setting specifies the hint for the password field on the login page. If no password field is found, then injection fails. An error message is shown to the user stating the password field could not be found. Submit Button: This setting specifies the hint for the submit button on the login page. If no such button is found, then injection

Further organize Jump Items by entering the name of a new or existing Tag. Even though the selected Jump Items are grouped together under the tag, they are still listed under the Jump Group in which each is pinned. To move a Jump Item back into its toplevel Jump Group, leave this field blank.

Note: If these three fields are left empty, the system will auto-detect and use the necessary information already stored for login.

BeyondTrust

Jump Items include a Comments field for a name or description, which makes sorting, searching, and identifying Jump Items faster and easier.

Use a Web Jump Shortcut

To use a Jump shortcut to start a session, simply select the shortcut from the Jump interface and click the Jump button.

Once a connection is made to the web site, click the screen sharing button. The web site's login interface becomes available. If you click a link to download a file from the web site, a prompt appears in your chat window asking you to accept or decline the download. If you accept, a window opens on your computer allowing you to choose a download location. Uploading files to the web site works similarly, opening a window to allow you to choose which file to upload.

Note: Popups open in the same window, redirecting the current page. Once you have completed the task on the popup, \click the back button to return to the previous page.

Tip: You can copy and paste text to and from the website by using the copy/paste controls of your operating system.

Use Credential Injection

When integrating BeyondTrust PRA with a password vault system, you can seamlessly access your web site accounts without viewing the login screen or entering any credentials using credential injection.

Note: Web Jump supports multi-step authentication, in which the username and password are not requested on the same \browser page. Web Jump also supports scenarios in which a user connects to an unauthenticated portion of a website, but then attempts to enter an area using basic authentication. Furthermore, Web Jump supports sites that contain CAPTCHAs, by allowing the users to complete the CAPTCHA without ending the credential injection process. Once interaction with a CAPTCHA is complete, the user clicks the key icon in the access console to complete credential injection.

Note: For seamless credential injection on a VMware console, some configuration is required.

1. Go to the computer hosting the Jumpoint.

2. Go to the computer hosting the Jumpoint.

3. Download and install the client integration plugin from the VMware URL specified above.

4. Using admin permissions, open Windows services (services.msc) on the Jumpoint host.

5. Right-click on the BeyondTrust Jumpoint and select Properties.

6. On the Log On tab under Local System account, check Allow service to interact with desktop.

7. Click OK.

8. On the user's local system - the one where the access console is installed - start a Web Jump with the VMware URL specified above.

9. Select Use Windows Credentials.

10. This causes a prompt on the Jumpoint host system to allow services to interact with an external program. Give the service permission.

11. A VMware credential injection prompt is displayed. Uncheck the box asking if you want the prompt to be displayed whenever the program is called. Click Accept.

12. You can now start Web Jumps to the VMware console using Windows credentials without a prompt.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Access Toolset

Access Session Overview and Tools

BeyondTrust

Session Tools

At the bottom right of the session window is information about the remote system. Also, if your administrator has enabled the XML API, you may designate an external key for use in session reports. Any custom session attributes enabled by your administrator will appear in a Custom Info tab. Click Copy to copy all information to your clipboard.

Another option that your administrator may choose to enable is the ability to log out the Windows user automatically or lock the remote computer when the session closes. When you have been working on an unattended system, for example, locking the computer is recommended to prevent unauthorized users from viewing private information. Set the action to take from the dropdown at the bottom of the pane.

Log Into Remote Systems Using Credential Injection from the Access Console

When accessing a Windows-based Jump Item via the access console, you can use credentials from a credential store to log into the endpoint or to run applications as an admin.

Before using credential injection, make sure that you have a credential store or password vault available to connect to BeyondTrust Privileged Remote Access.

Note: Credential injection is not available for Mac Jump Clients.

Install and Configure the Endpoint Credential Manager

Before you can begin accessing Jump Items using credential injection, you must download, install, and configure the BeyondTrust Endpoint Credential Manager (ECM). The BeyondTrust ECM allows you to quickly configure your connection to a credential store, such as a password vault.

System Requirements

l Windows Vista or newer, 64-bit only

l.NET 4.5 or newer

1. To begin, download the BeyondTrust Endpoint Credential Manager (ECM) from BeyondTrust Support at beyondtrustcorp.service-now.com/csm.

2. Start the BeyondTrust Endpoint Credential Manager Setup Wizard.

3. Agree to the EULA terms and conditions. Mark the checkbox if you agree, and then click Install.

If you need to modify the ECM installation path, click the Options button to customize the installation location.

\

\

Note: You are not allowed to proceed with the installation \unless you agree to the EULA.

\

\

\

\

\

\

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

4. Click Next on the Welcome screen.
5. Choose a location for the credential manager, and then click Next.
6. On the next screen, you can begin the installation or review any previous step.
7. Click Install when you are ready to begin. SALES: www.beyondtrust.com/contact SUPPORT: www.beyondtrust.com/support DOCUMENTATION: www.beyondtrust.com/docs ©2003-2020 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository TC: 5/22/2020 institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.

BeyondTrust

8. The installation takes a few moments. On the screen, click Finish.

\

\

\

Note: To ensure optimal up-time, administrators can install up to five ECMs on different Windows machines to communicate with the same site on the Secure Remote Access Appliance. A list of the ECMs connected to the appliance site can be found at /login > Status > Information > ECM Clients.

Note: When multiple ECMs are connected to a BeyondTrust site, the Secure Remote Access Appliance routes requests to the ECM that has been connected to the appliance the longest.

Configure a Connection to Your Credential Store

3. When the ECM Configurator opens, complete the fields. All fields are required.

4. Locate the BeyondTrust ECM Configurator you just installed using the Windows Search entry field or by viewing your Start menu programs list.

2. Run the program to begin establishing a connection.

BeyondTrust

Enter the following values:

5. Paste your plugin files into the folder.

6. Open the plugin file to begin loading.

Note: If you are connecting to a password vault, more configuration at the plugin level may be needed. Plugin \requirements vary based on the credential store that is being connected.

IMPORTANT!

After the credential store has been configured and a connection established, the access console can begin using credentials in the credential store to log into remote systems.

1. Log into the access console.

2. Jump to a remote system with a Jump Item installed as an elevated service on a Windows machine.

3. Click the Play button to begin screen sharing with the remote system. If the remote system is at the Windows login screen, the

4. Click the Play button to begin screen sharing with the remote system. If the remote system is at the Windows login screen, the Inject Credentials button is highlighted.

5. Click the Inject Credentials button. A pop-up credential selection dialog appears, listing the credentials available from the

6. Click the Inject Credentials button. A pop-up credential selection dialog appears, listing the credentials available from the ECM.

7. Select the appropriate credentials to use from the ECM. The system retrieves the credentials from the ECM and injects them into the Windows login screen.

8. The representative is logged into the remote system.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Choose from Favorite Credentials for Injection

After you have used a set of credentials to log into an endpoint, the system stores your preferred credentials for the endpoint and the context in which they were used (to log in, to perform a special action, to elevate, or to push) in the appliance database. The next time you use a credential to access the same endpoint, the credential injection menu makes a recommendation for which credentials to use. The credentials are displayed at the top of the credentials list, followed by any remaining credentials. If no credential history exists for an endpoint, the appliance simply displays all possible credentials.

The credential list recommends no more than five credentials.

Control the Remote Endpoint with Screen Sharing

From the session window, click the Screen Sharing button to request control of the remote computer if screen sharing does not automatically start. Options may be available below the button depending on your account settings. Click the gear button to view options.

Once you have started a session, the access console immediately starts screen sharing with the endpoint. Depending on the system, you may have full control or view only privileges while screen sharing with the system.

Screen Sharing Options

l Leaving all options unchecked requests full screen sharing, which grants view and control of the remote system's entire desktop and all applications.

l If you check View Only, you may see but not control the remote screen.

l Privacy Screen starts the session with remote view and control of the endpoint disabled. Privacy screen is not available when supporting Windows 8.

BeyondTrust

Screen Sharing Tools

Stop screen sharing.

While viewing the remote computer, start or stop control of the remote keyboard and mouse.

If your permissions allow, you can disable the remote user's screen view and mouse and keyboard input. The end user's view of the privacy screen clearly explains that the BeyondTrust user has disabled the end user's view. The end user can regain control at any time by pressing Ctrl+Alt+Del.

Alternatively, disable the end user's mouse and keyboard input while still allowing them to view the screen. When input is restricted, an orange border appears around the end user's monitors, and a message indicates that the BeyondTrust user has mouse and keyboard control. The end user can regain control at any time by pressing Ctrl+Alt+Del.

Restricted endpoint interaction is available only when accessing macOS or Windows computers. Restricted customer interaction is available only when supporting Windows computers. In Windows Vista and above, the endpoint client must be elevated. On Windows 8, this feature is limited to disabling the mouse and keyboard.

Annotation tools allow easier collaboration during shared sessions. A number of tools are available, including shapes and free drawing.

Reboot the remote system in either normal or safe mode with networking, or shut down the remote system.

Send a Ctrl-Alt-Del command to the remote computer.

Perform a special action on the remote system. Based on remote operating system and configuration, available tasks will vary. Canned scripts available to the user appear in a fly-out menu. With the Run As special action on a Windows® system, you may select credentials from an Endpoint Credential Manager. Use of the Endpoint Credential Manager requires a separate services agreement with BeyondTrust. Once a services agreement is in place, you may download the required middleware from the BeyondTrust Support Portal.

Access a dropdown of available smart card readers on your local system. Use the virtual smart card to perform administrative actions, running programs in another user context or even logging in as another user. The appropriate virtual smart card drivers must be installed on both your local system and the remote system, with their services running.

To restart iOS device screen sharing. For details, see Supporting Apple iOS Devices at www.beyondtrust.com/docs/privileged-remote-access/getting-started/access-console/apple-ios/index.htm. When supporting an Apple OS X 10.10+ system attached to an Apple iOS 8.0.1+ mobile device, click this button to begin or end view-only screen sharing on the attached iOS device. Note that this button is not visible unless you are in a standard screen sharing access session with an Apple OS X Yosemite system, and that the button is not enabled unless an Apple iOS 8.0.1+ device is connected to the OS X Yosemite system being supported.

BeyondTrust

While screen sharing, capture a screenshot of the remote screen or screens at their full resolution, saved in PNG format. Save the image file to your local system or to your clipboard. The capture action is recorded in the chat log with a link to a locally saved image. The link remains active even after the customer has left the session, but it does not persist in the BeyondTrust session report. You can adjust the directory where screenshots are saved by going to the File > Settings > Tools menu in the access console. This feature works on Mac, Windows, and Linux.

Manually send the contents of your clipboard to the remote computer. This tool icon is not visible if you are permitted to automatically send the contents of your clipboard or if you are disallowed to send clipboard information to the remote system.

Manually receive the contents of your clipboard from the remote computer. This tool icon is not visible if you are permitted to automatically receive the contents of your clipboard or if you are disallwoed to receive clipboard information from the remote system.

Select an alternate remote monitor to display. The primary monitor is designated by a P.

View the remote screen at actual or scaled size.

Select the color optimization mode to view the remote screen. If you are going to be primarily sharing video, select Video Optimized; otherwise select between Black and White (uses less bandwidth), Few Colors, More Colors, or Full Color (uses more bandwidth). Both Video Optimized and Full Color modes allow you to view the actual desktop wallpaper.

View the remote desktop in full screen mode or return to the interface view. When in full screen mode, special keys are passed through to the remote system. This includes but is not limited to modifier keys, function keys, and the Windows Start key. Note that this does not apply to the Ctrl-Alt-Del command.

Use Annotations to Draw on the Remote Screen of the Endpoint

Use annotation tools to collaborate with other users during shared sessions. Annotations provide an interactive way of communicating visually, reducing potentially frustrating situations and speeding processes.

While in annotation mode you can still use your mouse to move or control items on the remote desktop. Holding down the Shift key temporarily suspends annotation mode.

Enabling Annotations

Clicking on any of the dropdown menu items turns the Annotations mode on. The following tools and functions are available:

l Virtual Pointer

l Pen

l Rectangle drawing tool

l Ellipse drawing tool

l Eraser

l Undo

l Clear

l Red, Black, or White colors

\

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

You can select your tool from the Annotations dropdown menu or by right-clicking inside the remote screen area. If you click on the areas outside of the remote screen, the dropdown menu does not display.

Annotations appear on the remote screen to draw attention to specific points of interest or highlight areas as needed.

To turn off Annotations, select No Tool from the dropdown menu, or click Esc.

All annotations are deleted from the customer's screen when the session terminates.

BeyondTrust

View Multiple Monitors on the Remote Endpoint

BeyondTrust supports remote desktops configured to use multiple monitors. When you first connect to a remote desktop, you will see the primary monitor in the Screen Sharing tab. If additional monitors are configured, a Display icon will appear active in the Screen Sharing toolbar, and a Displays tab will appear in the bottom right corner of the console.

Using the Display Icon

Select the Display icon to see all the displays attached to the remote computer. In this view, the remote monitors are represented by rectangles rather than thumbnail images. The position of each rectangle corresponds to the position configured for each monitor on the remote desktop.

If the remote computer has no additional monitors attached, the Display icon will be inactive.

BeyondTrust

Using the Displays Tab

Select the Displays tab to see thumbnail images of all the displays attached to the remote computer. The position of each thumbnail image corresponds to the position configured for each display on the remote desktop.

The monitor currently displayed in the Screen Sharing tab will be highlighted.

The primary monitor appears in the Screen Sharing window by default. To change your view, click on the thumbnail of the monitor you wish to see. You can also select View All to show all the displays attached to the remote computer in the Screen Sharing window.

If the session is in grayscale mode, the remote monitors are represented by rectangles rather than thumbnail images. The position of each rectangle corresponds to the position configured for each monitor on the remote desktop.

Note: The refresh cycle of the thumbnail image is about three seconds in ideal conditions but can lag depending on connection speed and data transfer.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

File Transfer to and from the Remote Endpoint

During a session, privileged users can transfer, delete or rename files and even entire directories both to and from the remote computer, or from the remote device and to or from the device SD card. You do not have to have full control of the remote computer in order to transfer files. Depending upon the permissions your administrator has set for your account, you may be allowed only to upload files to the remote system or to download files to your local computer. File system access may also be restricted to certain paths on the remote or local system, thereby enforcing that uploads or downloads occur only in certain directories. Transfer files by using the upload and download buttons or by dragging and dropping files. Right clicking on a file brings up a context sensitive menu from where you can, among other things, create a new directory; rename, open, or delete the file; or download it directly to your machine.

File Transfer Tools

Stop access to the remote device's file system when it is no longer needed.

Go up a directory in the selected file system.

Refresh your view of the selected file system.

Create a new directory.

Rename a directory or file.

Delete a directory or file. Note that deleting a file or folder permanently deletes it. It is not sent to the recycle bin. Show hidden files.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Select one or more files or directories and then click the appropriate button to upload the files to the remote system or download to your local system. You can also drag and drop files to transfer.

If a file of the same name already exists in the location to which you are attempting to transfer a file, choose whether to respond by automatically overwriting the existing file, canceling the transfer, or prompting for each file of identical name. Note that if the content of the files is identical, the upload will be skipped and will result in a warning message.

Preserving file information will keep the file's original timestamp. If this option is disabled, the file's timestamp will reflect the date and time when it was transferred.

If automatic file transfer is enabled, transfers will begin as soon as the upload or download button is clicked or a file is dragged from one file system to the other.

If automatic file transfer is not enabled, select from the transfer manager the files you wish to transfer and then click the Start button to begin the transfer.

From the transfer manager, select a file and then click the Details button to view information such as the date and time of the transfer, the origin and destination of the files, and the number of bytes transferred.

Select one or more files from the transfer manager and then click Cancel to stop the transfer from completing.

Clear all information from the transfer manager.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Open the Command Shell on the Remote Endpoint Using the Access Console

Remote command shell enables privileged users to open a virtual command line interface on remote computers. Users can then type locally but have the commands executed on the remote system. You can work from multiple shells. Note that scripts available to the user may also be executed on the remote computer from the screen sharing interface.

Your administrator can also enable remote shell recording so that a video of each shell instance can be viewed from the session report. If shell recording is enabled, a transcript of the command shell is also available.

Command Shell Tools

Stop command prompt access when it is no longer needed.

Open a new shell to run multiple instances of command prompt, or close individual shells without relinquishing command prompt access. Shells are tabulated at the bottom of the screen.

If permitted, access a dropdown of previously written scripts. When you select a script to run, you will see a prompt with a brief description of the script. When you click Yes, the script will run in the active command shell.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Access tools to use within the command prompt. Paste the contents of your clipboard either by selecting it from the menu or simply by right-clicking in the terminal window. Copy a log of the current shell to your clipboard or save it to your computer. To copy a portion of the text, simply select it. Clear any lines not currently in sight, or clear all content from the terminal. Tools can also be accessed by pressing Ctrl+right- click within the terminal window.

Select the size at which to view the display. Choose from 80x50, 80x25, or any size.

View System Information on the Remote Endpoint

Privileged users may view a complete snapshot of the remote device's or computer's system information to reduce the time needed to diagnose and resolve the issue. The system information available varies depending on the remote operating system and configuration. Users with appropriate permissions may also kill processes; may start, stop, pause, resume, and restart services; and may uninstall programs.

Because the large amount of data that can be pulled may result in slow transmission times, you can choose to start your view with only the Overview tab or to pull data for all tabs. If you choose to start with Overview Only, you can gather data from the other tabs by going to the section you need to view and clicking the Refresh button at the top of that section.

BeyondTrust

System Information Tools

Stop pulling information about the remote system. Stopping will leave the last updated information available to view but will not pull current data.

Refresh your view of system information or pull information for tabs to which you did not initially request access. Refresh can take place for individual sections or for all sections of the selected tab.

Auto-refresh a category of system information.

Copy the information to your clipboard. Copy individual sections or all sections of the selected tab.

Save a text file of the system information to your local computer. You can save individual sections or all sections of the selected tab.

End a running process on the remote system.

Uninstall an app on the remote system.

Start a stopped service on the remote system.

Resume a paused service on the remote system.

Pause a running service on the remote system.

Restart a running service on the remote system.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Access the Registry Editor on the Remote Endpoint

Access a remote Windows registry without requiring screen sharing. While in the virtual registry editor, you can add new keys, delete keys, edit keys, search, and import or export keys.

Registry Editor Tools

Refresh the registry. Import registry entries from a file. Export registry entries to a file. Create a new registry key. Create a new registry value. Modify the selected registry value.

BeyondTrust

Rename the selected registry entry.

Delete the selected registry entry.

Search the registry.

Find next.

PRIVILEGED REMOTE ACCESS 20.1

ACCESS CONSOLE USER GUIDE

Session Management and Team Collaboration

View Active Access Sessions

Session queues provide information about and access to currently running sessions. The Personal queue contains sessions you are currently running, as well as invitations for you to join a shared session. You also have queues for any teams of which you are a member. If another user requests any member of a team to join a session, that invitation appears in the team queue. When no specific team is selected, team managers and leads can also see which team members have sessions running. Click the star to the left of a team name to mark that queue as a favorite. If a team chat message is sent, an orange chat bubble appears in place of the star. Sort your queues by several criteria, including the length of time the session has been running, the computer name, external key, etc. You can also search for an active session. Click on an item in queue to view its details. Click it again to close the details pane. The access console remembers the column order and the sort order of the session queue the next time the access console is launched. You can run multiple sessions simultaneously. At the top of the access console, a tab exists for each session you have open.

BeyondTrust

Use the Dashboard to Administer Team Members

The dashboard feature enables privileged users to view and monitor ongoing sessions, enabling administrative oversight to help manage staff. Based on roles assigned from the Teams page of the administrative interface, team leads can monitor team members of a given team, and team managers can monitor both team leads and team members of that team.

If a user is a team manager or team lead of one or more teams, selecting one of those queues causes the dashboard pane to appear beneath the queue selection pane on the Home tab of the console. In this pane appear any logged-in team members of a lower role for the selected team.

Select a user from the dashboard pane to view any sessions they may be running. A team manager or team lead can take over a session from another user of that team by selecting the appropriate session from the queue and clicking the Take Over button. This transfers ownership of that session to the team manager or team lead, with the original user remaining in the session as a participant.

It is also possible for a team manager to join a session in progress by clicking the Join button. The behavior is similar to joining a session via session invitation, except that no invitation is required.

Additionally, if configured in the /login interface, a team manager or team lead can monitor team members of a lower role even if there are no ongoing sessions, as long as those user are logged into the console.

An icon signifying monitoring is displayed in the corner of the user's desktop to indicate that monitoring is taking place. When the user moves the cursor near this icon, it moves to another corner to prevent obscuring the screen. Select the user whose screen you wish to view and then click the Monitor button. This opens a new tab in your console, displaying the user's console. To gain control of the user's computer, click the Enable Mouse/Keyboard Control button. \

To gain control of the user's computer, click the Enable Mouse/Keyboard Control button.

Within a team, a user can administer only others with roles lower than their own. Note, however, that roles apply strictly on a team-by-team basis, so that a user may be able to administer another user in one team but not be able to administer that same user in another team.

BeyondTrust

Chat with Other Users

From the Home tab of the console, you can chat with other logged-in users. If you are a member of one or more teams, select whichever team you would like to chat with from the list of queues at the left of the Home tab. You can chat with all members of that team or chat with just that one.

Click the arrow icon at the top left of the sidebar to collapse the sliding sidebar. If the sidebar is collapsed, hover over the arrow by the hidden window to reveal it. Click the pin icon that replaced the arrow icon at the top left of the sidebar to re-pin the sliding sidebar.

When typing, misspelled words will be underlined in red. Right-click to view spelling suggestions or to ignore that spelling for the current console login.

In the settings, you can choose if the team chat should include status messages, such as users logging in and out, or only chats sent between team members.

BeyondTrust

Share your Screen with Another User

If your administrator has enabled this permission, you can share your screen with another user without the receiving user having to join a session. This option is available even if you are not in a session.

From a team queue, select a user, and click Show Screen. If working with more than one monitor, you can select which one to share or which apps will be visible to the other user. Once you have made your selection, the receiving user will get a notification with the option to accept or decline the invitation.

A Show Screen window appears, showing the name of the user that is now viewing your screen. This window contains a chat box and the options to stop screen sharing, grant the receiving user control, and select which monitor and which apps to share. You can stop sharing your screen but keep this window open, or you can close the sharing session completely. If you leave the Show Screen window open, you can restart sharing your screen.

\

\

BeyondTrust

Share My Screen Tools

Sharing User

Temporarily stop sharing your screen with another user. This pauses screen sharing but does not close the Show Screen window, allowing you to restart screen sharing.

(Re)start screen sharing.

Grant mouse and keyboard control to the user viewing your screen.

Select the monitor to share with another user. The primary monitor will be designated by a P.

Select which apps to share with the user viewing your screen.

End the screen sharing session. This closes the user screen sharing interface.

Viewing User

The user sharing their screen with you has granted you keyboard and mouse control.

Turn on a virtual pointer, visible on the sharing user's screen.

Capture a screenshot of the sharing user's screen at its full resolution.

View the remote screen at actual or scaled size.

View the remote desktop in full screen mode or return to the interface view.

End screen sharing session. This closes the user screen sharing interface. \

Share a Session with Other Users

Invite another user to join a session by clicking the Share button in the session tools. By default, only teams to which you belong will be listed.

You can select a user listed in the teams displayed to invite them to join the session.

If you select Any User, the invitation is sent to the team queue so that any single user in the selected team can join the session. You can send multiple invitations if you want more users from the team to join your session.

Users are listed here only if they are logged into the console or have extended availability enabled.

If you are permitted to share sessions with users who are not members of your teams, additional teams are displayed, provided that they contain at least one member logged in or with extended availability enabled.

When you invite a user with extended availability enabled, they receive an email notification.

If you have sent an invitation and it is still active, you may revoke the invitation by selecting it from the Cancel Invitation menu. Only the session owner can send invitations. Invitations do not time out as long as you remain the session owner. Multiple active invitations cannot exist for the same user to join the same session.

An invitation is made inactive when one of the following events occurs:

l The inviting user cancels the invitation

l The session ends

l The invited user accepts the invitation

l The invited user declines the invitation

Chat with Other Users During a Shared Session

The session chat window serves as a running log of everything that happens throughout the session, including files transferred and tools used.

If one or more users are sharing the session, you can chat with the other users. When an additional user joins a shared session, they are able to see the entire chat history.

When typing, misspelled words will be underlined in red. Right-click to view spelling suggestions or to ignore that spelling for the current console login.

Messages appear as plain text in the chat input area. You can add or edit BBCode tags within a message to add text formatting. Formatting will be applied once the message has been sent.

\

Note: It is possible to reposition the different widget sections displayed on the sidebar, like the chat window, the session \info pane, etc. When hovering over the title bar of a section, the cursor turns into a closed hand, allowing you to drag and reposition that section on the sidebar.

Use Extended Availability to Remain Accessible when Not Logged In

With extended availability, privileged users can receive email invitations to share sessions, even if they are not logged into the console. When sending an invitation, you may invite fellow team members. If permitted, you may also invite users from teams to which you do not belong.

If your account is configured for extended availability, you can enable or disable the functionality from the File menu of the access console.

If you have extended availability enabled, you will see a notification when you log into the console. From this dialog, you can easily disable extended availability to avoid distraction while in a session, for example.

\

\

\

\

\

Email Notification & Invitation

Note: BeyondTrust does not pull email addresses from external LDAP directory stores. The email address must be configured in BeyondTrust in one of two ways:

1. An administrator can add an email address to a user account by going to /login > Users & Security > Users and editing the account.

2. The user can set their own email address by going to the /login > My Account page.

The notification includes the URL of the site as well as a link to quickly disable extended availability mode.

The appliance also sends an email notification when you are invited to a session. This allows you to join a session even if you are not currently logged into the console. The email notification includes links to accept or decline the invitation, as well as to decline the invitation while disabling extended availability mode.

Invite an External User to Join an Access Session

Within a session, a user can request an external user to participate in a session one time only. The inviting user should click on the Share Session button and then select Invite External User.

A dialog opens asking the user to select a session policy. These policies are created in the administrative interface and determine the level of permission the external user will have. When you select a policy, the full description displays below.

Enter the invited user's name. This name will appear in the chat window and in reports. Next, enter comments about why this user has been invited. Click Create Invitation, and a new dialog containing the invitation URL appears.

You can invite more than one external user to a session.

The external user will have access only to the session tab and has a limited set of privileges. The external user can never be the session owner. When the inviting user leaves the session, the external user is logged out.

Ports and Firewalls

BeyondTrust solutions are designed to work transparently through firewalls, enabling a connection with any computer with internet connectivity, anywhere in the world. However, with certain highly secured networks, some configuration may be necessary.

\

l Ports 80 and 443 must be open for outbound TCP traffic on the remote system's and local user's firewalls. More ports may be available depending on your build. The diagram shows a typical network setup; more details can be found in the Appliance Hardware Installation Guide.

l Internet security software such as software firewalls must not block BeyondTrust executable files from downloading. Some examples of software firewalls include McAfee Security, Norton Security, and Zone Alarm. If you do have a software firewall, you may experience some connection issues. To avoid such issues, configure your firewall settings to allow the following executables, wherein {uid} is a unique identifier consisting of letter and numbers:

obomgar-scc-{uid}.exe

obomgar-scc.exe

obomgar-pac-{uid}.exe

obomgar-pac.exe

obomgar-pec-{uid}.exe

obomgar-pec.exe

For assistance with your firewall configuration, please contact the manufacturer of your firewall software.

l Example firewall rules based on appliance location can be found at www.beyondtrust.com/docs/privileged-remoteaccess/getting-started/deployment/dmz/firewall-rules.htm.

If you should still have difficulty making a connection, contact BeyondTrust Technical Support at www.beyondtrust.com/support.