Log in to Remote Systems Using Credential Injection from the iOS Representative Console

When accessing a Windows-based Jump Client via the mobile representative console, you can use credentials from a credential store to log in to the endpoint or to run applications as an admin.

Before using credential injection, make sure that you have a credential store available to connect to BeyondTrust Remote Support, such as a password vault.

System Requirements

  • Windows Vista or newer, 64-bit only
  • .NET 4.5 or newer
  • Processor: 2 GHz or faster
  • Memory: 2 GB or greater
  • Available Disk Space: 80 GB or greater

Before you can begin accessing Jump Items using credential injection, you must download, install, and configure the BeyondTrust Endpoint Credential Manager (ECM).

The ECM must be installed on your system to enable the BeyondTrust ECM Service and to use credential injection in BeyondTrust Remote Support.

  1. To begin, download the BeyondTrust Endpoint Credential Manager (ECM) from BeyondTrust Support . Start the BeyondTrust Endpoint Credential Manager Setup Wizard.

    BeyondTrust ECM EULA

  2. Agree to the EULA terms and conditions. Mark the checkbox if you agree, and click Install.

    If you need to modify the ECM installation path, click the Options button to customize the installation location.

You are not allowed to proceed with the installation unless you agree to the EULA.

  1. Click Install.


  2. BeyondTrust ECM Destination Folder

  3. Choose a location for the credential manager and click Next.
  4. On the next screen, you can begin the installation or review any previous step.

    ECM Installation

  6. Click Install when you are ready to begin.

    ECM Installation Complete

  8. The installation takes a few moments. On the screen, click Finish.

    To ensure optimal up-time, administrators can install up to five ECMs on different Windows machines to communicate with the same site on the BeyondTrust Appliance B Series. A list of the ECMs connected to the B Series Appliance site can be found at /login > Status > Information > ECM Clients.

    When multiple ECMs are connected to a BeyondTrust site, the B Series Appliance routes requests to the ECM that has been connected to the B Series Appliance the longest.

Configure a Connection to Your Credential Store

Using the ECM Configurator, set up a connection to your credential store.

ECM Configurator exe File

  1. Locate the BeyondTrust ECM Configurator you just installed using the Windows Search entry field or by viewing your Start menu programs list.
  2. Run the program to begin establishing a connection.

    ECM Configurator Interface

  4. When the ECM Configurator opens, complete the fields. All fields are required.

    Enter the following values:
    Field Label Value
    Client ID The Admin ID for your credential store.
    Client Secret The Admin secret key for your credential store.
    Site The URL for your credential store instance.
    Port The server port through which the ECM connects to your site.
    Plugin Click the Choose Plugin... button to locate the plugin.
  1. When you click the Choose Plugin... button, the ECM location folder opens.
  2. Paste your plugin files into the folder.
  3. Open the plugin file to begin loading.

If you are connecting to a password vault, more configuration at the plugin level may be needed. Plugin requirements vary based on the credential store that is being connected.

Use Credential Injection to Access Endpoints

After the credential store has been configured and a connection established, BeyondTrust Remote Support can begin using credentials in the credential store to log in to endpoints.

  1. Go to your Jump Items list.
  2. Tap the Jump Item you wish to access.

Jump Item List

  1. Tap Jump.

    Credential Store

  3. Tap Credential Store.
  4. Tap the credentials you wish to use to access the system.
  5. Tap Continue.

    Run as

  7. From within the session, tap the Start button to start screen sharing.
  8. Tap the Special Actions option. Tap Run as....

    CTRL-ATL-DEL Login Screen

  10. Tap Windows Security (Ctrl-Alt-Del).

    Key icon

  12. Tap the Key icon. The Key icon allows the system to view your stored credentials to gain entry into the endpoint.

Choose from Favorite Credentials for Injection

After a representative has used a set of credentials to log in to an endpoint, the system stores the user's preferred credentials for the endpoint and the context in which they were used (to login, to perform a special action, to elevate, or to push) in the B Series Appliance database. The next time the user wants to use credentials to access the same endpoint, the credential injection menu makes a recommendation for which credentials to use. The credentials are displayed at the top of the credentials list, followed by any remaining credentials. If no credential history exists for an endpoint, the B Series Appliance simply displays all the possible credentials.

The credential list recommends no more than five credentials.