Issue:

How to stop or start Policy Manager Server's service in Linux Server?

Resolution:

For Policy Manager 16.03 and ealier:

To stop : 

# /etc/init.d/fspms stop

To start : 

# /etc/init.d/fspms start

To check status : 

# /etc/init.d/fspms status

To restart : 

# /etc/init.d/fspms restart

For Policy Manager 16.10,

To stop : 

# systemctl stop fspms

To start : 

# systemctl start fspms

To check status : 

# systemctl status fspms

To restart : 

# systemctl restart fspms

Issue:

How to block or allow an application using Client Security or Server Security Application Control feature? How to create an Application Control exclusion rule via the Policy Manager Console? 

Resolution:

The WithSecure Application Control feature is included in Client Security and Server Security Premium subscriptions. 

To create an Application Control block rule via the Policy Manager Console policies:

1. Log in to Policy Manager Console
2. Select a Policy domain or host from from the Domain Tree
3. Go to the Settings tab
4. Go to the Windows > Application control settings page
5. Make sure Enable application control is enabled
6. Click 'Add Rule'
   1. If Add rule button is greyed out on the right side of the table, first Clone the default profile shown in the Profile being edited to create a custom profile that can be edited. Make sure to also select your cloned profile from the Host profile drop-down menu.
7. Enter a name and description for the rule
8. Select from the Event drop-down menu Run application
9. Select from the Action drop-down menu Block
10. Click Add condition and create a condition that fits the application
    1. Note: You can add several conditions by clicking the Add condition button. When a rule has several conditions, all conditions must be true for the application control rule to take effect. 
11. Click OK

Note: The rules in the application control profile as applied in priority order from the top down. So you you have a block rule for an application at the top, an allow rule for the same application below will not take effect.

To create an Application Control allow or exclusion rule via the Policy Manager Console policies:

1. Log in to Policy Manager Console
2. Select a Policy domain or host from from the Domain Tree
3. Go to the Settings tab
4. Go to the Windows > Application control settings page
5. Make sure Enable application control is enabled
6. Select from the Default rule applied to untrusted applications drop-down menu Block
7. Click 'Add Rule'
   1. If Add rule button is greyed out on the right side of the table, first Clone the default profile shown in the Profile being edited to create a custom profile that can be edited. Make sure to also select your cloned profile from the Host profile drop-down menu.
8. Enter a name and description for the allow rule
9. From the Event drop-down menu, select the event type that is shown in the Application Control block alert on the Policy Manager Console's Alerts tab
10. From the Action drop-down menu select Allow
11. Click Add condition
12. Enter a condition that matches the applications information shown in the Application Control block alert on the Policy Manager Console's Alerts tab
13. Click OK

More detailed instructions can be found in the Policy Manager user guide: Adding exclusion rules | Policy Manager | 16.10 | WithSecure User Guides 

If an Application Control rule does not work:

• Make sure you have selected the correct Host profile from the Application Control settings page
• Male sure that the rules are in correct order in the Exclusion rules list. The rules listed for the profile are applied in priority order from the top down 
• Make sure that you have in the rule selected the correct Event type. If you are creating an allow rule, check the event type from the block alert shown on the Alerts tab. 
• If you have used several conditions, remember that they work with the AND principle. Which means that all conditions must be true for the rule to trigger. If you have for example added two paths or two SHA-1 conditions, the rule cannot work since an application cannot have two paths or two SHA-1.

Issue:

After creating a scheduled scanning via the Policy Manager Console's Manual scanning > Scheduled scanning settings table and distributing the policy to the hosts, this does not change the scheduling setting for scheduled scanning in the local Client Security or Server Security Scanning settings page. The created task is not shown / visible at all in the local client settings.

Does the scheduled scanning task work even if it is not visible on the Scanning settings page in the local user interface? 

Resolution:

The Scheduled scanning settings page in the local user interface for Client Security and Server Security is meant for locally scheduling and it is a separate setting compared to the Scheduled scanning task that can be distributed as a policy from the Policy Manager Console.

The scanning tasks created as a policy from Policy Manager Console wont be visible in the local client user interface, but they can be checked from the Windows Task Scheduler. 

1. Search for and open Task Scheduler on the Windows host
2. Open the Task Scheduled Library folder from the left side of the application
3. Check the table for a Scheduled Task created by Author F-Secure Corporation

If you can see a Scheduled Task matching the one created as a policy from the Policy Manager Console, then the task has been created successfully.

Issue:

No matter if a single host or policy domain is selected from the Policy Manager Console Domain tree, every time when firewall profile settings are changed, the Distribute policies preview shows that the settings are being changed on Root level.

Resolution:

All firewall profiles are shared by all the policies. If you edit a firewall profile in one policy, it will affect all policies that are using that firewall profile. 

The firewall profiles are therefore always modified at root level. 

If you only change which firewall profile a policy uses, then the Distribute policies preview will show for example: Root > Policy domain > Hostname

Issue:

We currently have Client Security and / or Server Security installed with a standard license keycode. We have bought a Premium subscription, how can we migrate, upgrade or change the standard license keycode to a premium keycode on the devices? 

Resolution:

Client Security and Server Security clients that have been installed with a standard license keycode can be upgraded to the new premium license keycode with the upgrade feature on the Policy Manager Console's Installation tab.

Follow these steps:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Installation tab
4. In the Installed products summary table, click upgrade for the product you want to upgrade to premium
5. Select the .jar file and click OK
6. In the installation / upgrade wizard, enter you new premium license keycode
7. On the Configure communication with Policy Manager Server step, make sure you select the same host identification method that was chosen during installation
8. After clicking Finish, distribute the policy (Ctrl + D)

Issue:

How to check product version from Policy Manager?

Resolution:

The Policy Manager Server and Console version is shown when you launch Policy Manager Console. You can also see it from the About page:

1. Log in to the Policy Manager Console
2. Click Help > About Withsecure Policy Manager Console

A window will appear which lists the Policy Manager Console and Server version numbers separately.

To view the Client Security and Server Security versions:

1. Log in to the Policy Manager Console
2. Select root from the domain tree
3. Go to the Status tab
4. Select the Summary page

Here you can see the Product section which shows the product names and versions. 

Issue:

Can Policy Manager Server be upgraded directly to latest version, if there is one or several major version releases in between?  Can the Policy Manager Server be directly upgraded for example 13.x or 14.x to 16.x?

Resolution:

There is no limitations to upgrade Policy Manager from version 13.XX / 14.XX to 16.XX and it can be done directly, without needing to install the version between. 

Having said that, we do recommend that you create a full backup of Policy Manager data (h2db, preferences, and other files) before the upgrade. Consult Policy Manager Administrator’s Guide, "Backing up & restoring Policy Manager data" section for instructions on how to create a full backup.

Instructions for creating the backup can be found in the User Guide: Maintaining Policy Manager Server | Policy Manager | 16.10 | WithSecure User Guides 

As for the upgrade itself, simply run the latest Policy Manager installer on the server that has Policy Manager components installed. Policy Manager setup recommends that you upgrade the components that are installed on the computer. Continue with the default options to upgrade the installed components while keeping the existing configuration.

Issue:

Can Policy Manager Server coller BitLocker recovery keys from hosts which have Client Security or Server Security installed on them

Resolution:

Business Suite products Policy Manager Server, Client Security and Server Security do not have system drive encryption features, so it cannot collect the BitLocker recovery keys from the devices. 

Elements Security Center portal has this feature, so if you have Elements Agent installed on the devices with a Premium Elements Endpoint Protection subscription, you can collect the recovery keys from the devices and find them in the Elements Security Center portal on the device details page.  

Issue:

Does Linux Security 64 support installation on an Security-Enhanced (SELinux) Ubuntu distribution?

Resolution:

Linux Security 64 does not support Ubuntu distribution if it is running a SELinux system policy. You can find the supported SELinux distributions in the user guide:  System requirements | Linux Security 64 | Latest | WithSecure User Guides 

Issue:

How to allow users to make settings changes locally in the Client Security or Server Security graphical user interface (GUI)?

Resolution:

To allow a local Client Security or Server Security user with administrator privileges to change the settings locally in the graphical user interface, you need to leave the setting unlocked in the Policy Manager policy that has been distributed to the host. 

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Expand the Windows settings section

Here you can open each settings section, for example Real-time scanning or Manual scanning. In the right side of most of the settings you can find a lock icon. When the lock is left in an unlocked state, it means that the local user is able to change this setting if it is available in the local Client Security or Server Security user interface and if the user has local administrator rights. 

Note: Not all settings are available in the local user interface. For example Device Control, Application Control and Web Content Control settings cannot be at all found in the local user interface of Client Security or Server Security.