Issue:

Can Policy Manager Server be upgraded directly to latest version, if there is one or several major version releases in between?  Can the Policy Manager Server be directly upgraded for example 13.x or 14.x to 16.x?

Resolution:

There is no limitations to upgrade Policy Manager from version 13.XX / 14.XX to 16.XX and it can be done directly, without needing to install the version between. 

Having said that, we do recommend that you create a full backup of Policy Manager data (h2db, preferences, and other files) before the upgrade. Consult Policy Manager Administrator’s Guide, "Backing up & restoring Policy Manager data" section for instructions on how to create a full backup.

Instructions for creating the backup can be found in the User Guide: Maintaining Policy Manager Server | Policy Manager | 16.10 | WithSecure User Guides 

As for the upgrade itself, simply run the latest Policy Manager installer on the server that has Policy Manager components installed. Policy Manager setup recommends that you upgrade the components that are installed on the computer. Continue with the default options to upgrade the installed components while keeping the existing configuration.

Issue:

Can Policy Manager Server coller BitLocker recovery keys from hosts which have Client Security or Server Security installed on them

Resolution:

Business Suite products Policy Manager Server, Client Security and Server Security do not have system drive encryption features, so it cannot collect the BitLocker recovery keys from the devices. 

Elements Security Center portal has this feature, so if you have Elements Agent installed on the devices with a Premium Elements Endpoint Protection subscription, you can collect the recovery keys from the devices and find them in the Elements Security Center portal on the device details page.  

Issue:

How to allow users to make settings changes locally in the Client Security or Server Security graphical user interface (GUI)?

Resolution:

To allow a local Client Security or Server Security user with administrator privileges to change the settings locally in the graphical user interface, you need to leave the setting unlocked in the Policy Manager policy that has been distributed to the host. 

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Expand the Windows settings section

Here you can open each settings section, for example Real-time scanning or Manual scanning. In the right side of most of the settings you can find a lock icon. When the lock is left in an unlocked state, it means that the local user is able to change this setting if it is available in the local Client Security or Server Security user interface and if the user has local administrator rights. 

Note: Not all settings are available in the local user interface. For example Device Control, Application Control and Web Content Control settings cannot be at all found in the local user interface of Client Security or Server Security.

Issue:

Does Linux Security 64 support installation on an Security-Enhanced (SELinux) Ubuntu distribution?

Resolution:

Linux Security 64 does not support Ubuntu distribution if it is running a SELinux system policy. You can find the supported SELinux distributions in the user guide:  System requirements | Linux Security 64 | Latest | WithSecure User Guides 

Issue:

How to change the time limit for Client Security and Server Security how quickly they consider the malware definition and engine updates (databases) to be old or very old? 

For example, if we have Client Security or Server Security installed in an isolated or offline environment, we do not want to have the user interface warning of old or very old databases as quickly. 

Resolution:

The time limit in days for how quickly a Client Security or Server Security client considers update databases to be old can be changed from the Policy Manager policy settings:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Open the Settings tab
4. Navigate to Windows > Centralized management 
5. In the Automatic updates section, modify the days value for:
   1. Time limit for considering update databases old (in days)
   2. Time limit for considering update databases very old (in days)
6. Distribute the policy (Ctrl + D)

The default value for old is 7 days, while the default value for very old is 30 days. 

Issue:

Will configuring settings locally on a Linux server with Atlant's atlantctl utility overwrite the settings created in the the Policy Manager's policy?

Resolution:

If a setting for the distributed policy is locked in the Policy Manager, then that setting is enforced and you cannot edit it locally with the atlantctl command-line utility. But, if the setting has not been locked in the policy, then the setting configured previously in the Policy Manager's policy will be overwritten by the local changed setting. 

Issue:

How to check the Policy Manager Server address, HTTP port and HTTPS port which was entered when exporting the Atlant installer from the Policy Manager Console?

Resolution:

Policy Manager (PM) address setting cannot be viewed by atlantctl get command.
Instead, here are some other ways to check their PM address, HTTP port and HTTPS port settings in Atlant.

/var/opt/f-secure/atlant/fsbg/setup/mgmt-mode.json
-> This will show PM address and HTTPS port

/etc/opt/f-secure/atlant/baseguard/updated.ini > [server::policymanager]
-> This will show PM address and HTTP port

Apart from the method mentioned above, it is also possible to check the PM address and its port directly from the process's parameter by running the command below.

# ps aux | grep fsma2
 

Issue:

When the Policy Manager Server forwards event logs to the syslog server, the log comes in UTC time format. Can it be changed to the Policy Manager Server's operating system time format? 

Resolution:

Regarding the syslog timestamp from Policy Manager Server — this is by design. Policy Manager Server always forwards event logs to the syslog server using UTC+0 timestamps, and there is currently no configuration option to change the timezone to local time (UTC+8 or any other).

As a workaround, we recommend configuring your syslog receiver or SIEM platform to apply a timezone offset when ingesting the logs. Most syslog solutions support converting UTC timestamps to a local timezone on the receiving side.

Issue:

Can I use environment variables for defining exclusions in Linux for Elements Linux Protection or Linux Security 64?

Example: $HOME/build

Resolution:

Environment values are not supported in exclusions nor in any settings in Linux. Wildcards can be used for on-access scanning exclusions for Elements Linux Protection and Linux Security 64.

To use the example above, /home/*/build would be nearly equivalent to the example provided.

Issue:

After changing the port number for the modules in the registry and restarting the Policy Manager Server, I can see that logging in to the Policy Manager Console using the new port number works.

Also, the managed hosts can reach the Policy Manager Server using the new port number too.

Why the status monitor still shows the old port numbers in use, and the status is not functioning?

Resolution:

Changing the port number for the modules in the registry does not update the port numbers in the Status Monitor automatically.

You need to update the port number for the modules by doing the following:

1. Open the Status Monitor
2. Click on "Configure" button
3. Enter the new port number(s) for the module(s)