Issue:

Policy Manager Server temporarily loses contact to the Active Directory (AD) Server. This causes the AD user accounts to be at some times unable to log in to Policy Manager Console. 

User gets error: com.fsecure.fsa.SessionStartException: Cannot connect to the server: authorization failed because the specified user credentials are invalid.

Resolution:

1. Verify Connection and Address:

   • Ensure proper network connectivity exists between the Policy Manager Server and the Active Directory server.
   • Double-check the LDAPS address configured in the Policy Manager Server. The address in the error message ("LDAPS://EXAMPLEADDRESS.COM") should match the actual server address.

2. Update Active Directory Address Using H2 Console (if address mismatch):

   Important: Back up your registry before making any changes. Refer to the F-Secure Policy Manager documentation for instructions on registry backup: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_F3496EC8C79842E1B5A479E8D195E8A5-16.00-en

   Enable H2 Console:

   1. Close the Policy Manager Console (if open).
   2. Stop the Policy Manager Server service.
   3. Open the Registry Editor (regedit).
   4. Locate the appropriate registry key based on your Policy Manager version:
      • For Policy Manager 15: HKEY_LOCAL_MACHINE\SOFTWARE(Wow6432Node)\Data Fellows\F-Secure\Management Server 5\additional_java_args
      • For Policy Manager 16: HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\additional_java_args
   5. Edit the "additional_java_args" value.
   6. Add the following parameter: -Dh2ConsoleEnabled=true
   7. Close the Registry Editor and start the F-Secure Policy Manager Server service.

   Open H2 Console:

   1. Open a web browser (Internet Explorer or Firefox).

   2. Navigate to https://<PolicyManagerServerIP>:<AdminPort>.

      • Replace <PolicyManagerServerIP> with the actual IP address of the Policy Manager Server.
      • Replace <AdminPort> with the configured administration port (default: 8080). You can use localhost if accessing from the Policy Manager Server itself.

   3. Select the domain.

   4. Execute the following SQL statement:

      SQL

      SELECT * FROM ACTIVE_DIRECTORY_SERVERS;
      

   5. Click the edit button (pen icon) for the relevant entry.

   6. Update the "LDAPS Address" field with the correct address.

   7. Save the changes.

The Policy Manager Server should automatically start using the updated LDAPS address after saving the changes in the H2 Console.

Additional Notes:

• This article provides a general guideline. Refer to the F-Secure Policy Manager documentation for detailed instructions specific to your version.
• If the issue persists after following these steps, contact F-Secure Support for further assistance.

Issue:

After a scheduled scan of Client Security or Server Security host, Policy Manager Console Alerts page's description field shows "Malicious code found in file. No action taken" 

Resolution:

If the infections without any action taken are either items inside an compressed archive (ZIP, RAR, 7z, CAB) or temporary files, scan engine will not extract the file from archive just to deleted instead it will be reported as infected and no action taken. In case of temporary files it could be that item was already removed by system when the engine tried to delete it. 

You can also open the full scanning report and check of the following is shown for the file: "Skipped – potentially unwanted applications are not removed automatically"

WithSecure endpoint protection software does not automatically remove Potentially Unwanted Applications. It will detect them but the decision to remove and the actions are left for the administrator. 

Issue:

The Policy Manager Console runs slow and sometimes it's unable to connect to the Policy Manager Server

Resolution:

Make sure your Policy Manager Server and Policy Manager Console are the same versions, otherwise the connection will not work.

If both Policy Manager Sever and Policy Manager Console are the same versions, the performance issues could be due to having a very high number of alerts, or a very high volume of scanning reports being kept in the Policy Manager Server. This would slow down the console. 

You may remove some of the alerts or scanning reports to improve the performance.

If the above mentioned steps do not help, please proceed with the following:
Policy Manager 15.x and earlier:

1. Stop the F-Secure Policy Manager Server service.
2. Backup the H2DB folder (…\F-Secure\Management Server 5\data\h2db). DO NOT proceed further without having a working H2DB backup in place.
3. Run the database maintenance tool (…\F-Secure\Management Server 5\bin\fspms-db-maintenance-tool.exe) and follow the on-screen instructions to optimize the database.
4. Start the F-Secure Policy Manager Server service.
5. Log in to the Policy Manager Console.

In case the issue remains, you can execute the H2DB recovery tool (…\F-Secure\Management Server 5\bin\fspms-db-recover.bat) in the Windows command prompt to repair the H2DB.
Note: Make sure to stop the F-Secure Policy Manager Server service before running the tool.

If necessary, you can refer to the read me file (..\F-Secure\Management Server 5\bin\README-recover-db.txt) on how to execute the H2DB recovery tool.

Policy Manager 16.x and above :

1. Stop the WithSecure Policy Manager Server service (net stop wspms).
2. Back up the H2DB folder (`C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\h2db\`). DO NOT proceed without a working H2DB backup.
3. Run the database maintenance tool (`C:\Program Files\WithSecure\Policy Manager\Policy Manager Server\bin\fspms-db-maintenance-tool`) and follow the on-screen instructions to optimize the database.
4. Start the WithSecure Policy Manager Server service(net start wspms).
5. Log in to the Policy Manager console.

If the problem persists, you can run the H2DB recovery tool (C:\Program Files\WithSecure\Policy Manager Server\bin\fspms-db-recover.bat) in the Windows command prompt to repair the H2DB database.

Note: Make sure you stop the WithSecure Policy Manager Server service before running the tool.

If necessary, you can refer to the read me file (C:\Program Files\WithSecure\Policy Manager Server\bin\README-recover-db.txt) for instructions on how to run the H2DB recovery tool.

Once you have finished repairing the H2DB using the tool, you can proceed to take the repaired H2DB into use, restarting the F-Secure Policy Manager Server service after doing so.
Try to login to the Policy Manager Console again after the service has been started.

Issue:

Trying to send emails through MSG results in the following Non-Delivery Report (NDR) message:
SMTP Protocol Returned a Permanent Error 550 5.7.0 Blocked – see https://ipcheck.proofpoint.com/?ip=<ip.address.goes.here>

Resolution:

The sending IP-address has been blocked by Proofpoint Dynamic Reputation (PDR). This can be double-checked by visiting the page https://ipcheck.proofpoint.com
The section About Proofpoint® Dynamic Reputation (PDR) contains more information about the function as well as a link to an FAQ-page with common questions and answers, for example what to do to prevent this from happening.

To get the situation investigated quicker, open a support ticket with F-Secure. Include the IP that is blocked and information about how long the situation has been ongoing.

Issue:

Smart Search reports that search fails and there are repeated eid.general-errors in the MSG alert viewer

The errors have the following rawlog-data:

[] err src=admin mod=CloudSearch sub=getResults err="Service unavailable"
[] err src=admin MISUtil::getIndexList failed. Response code: 503. url: https://:10000/mis/_stats/store

Resolution:

These messages could be a result of the Smart Search service being stopped. This might be the result of a system update or patch causing the service to hang.

To check if the Smart Search service is running:

1. Log in to the MSG Web UI
2. Select the System-tab
3. Navigate to System -> Servers using the left-side menu
4. Click the plus-sign next to the server names to expand information about their running services (Smart Search by default runs on the configuration master)
5. Check the status of the service pss
6. If it is stopped, use the Start-button to the right in the action-column to attempt a restart. Trying this a few times might be needed

If the service doesn't start, open a support ticket. Also make sure that the following support IP-addresses can access the MSG-appliance on ports 22 and 10000:

203.112.232.170                 F-Secure Support / Kuala Lumpur
193.110.108.33                   F-Secure Support / HTC Helsinki
208.86.202.10                     Proofpoint
208.84.66.21                       Proofpoint
208.84.67.21                       Proofpoint

Issue:

The user repository in the Messaging Security Gateway (MSG) appliance contains a large amount of users that have been imported from Active Directory, but are no longer part of it. Can the appliance automatically remove users from its user repository as they are removed from Active Directory?

Resolution:

You can configure the import profile to remove user profiles that are not present in the imported data:

1. Log in to the MSG web user interface
2. Select the System-tab at the top of the page
3. Navigate to User Management->Import/Auth Profiles using the left-hand menu
4. Click on the LDAP import profile you want to modify
5. From the window that appears, click on Advanced in the top right corner
6. Under Import Settings, set Remove User Profiles Not Imported to On
7. If you have multiple import profiles, set Add to Group/Sub-org With Profile Name () to On and set Type to the preferred option, between Group and Sub-Org. This is to prevent an import profile to remove users belonging to another profile
8. Click Save Changes

Next time the import profile is run, any user that isn't present in the AD will be removed from the MSG user repository. This will be either when the next LDAP import is scheduled, or when the task is run manually (by marking the import profile on the User Management->Import/Auth Profiles-page using the left-hand side checkbox and clicking Import)

Note: the setting Remove User Profiles Not Imported has a value for the maximum amount of users that it will remove at the same time. This is to prevent for example a failed import from deleting the whole user repository. If the actual number of users to be deleted exceeds this limit (default set to 50), the import process might not complete successfully and remove the users. To circumvent this, temporarily change the value for Restrict Number Of Profiles To Be Deleted To Less Than to be greater than the total amount of users in the group that the profile imports to, and run a manual import. You find the setting by following steps 1-5 from above.

Issue:

Recipients of encrypted mails are receiving warnings about untrusted pages and/or certificates when attempting to view messages.
Looking up the MSG address using an SSL checker gives the following type of reply:
"The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate."

Resolution:

The result from the SSL checker points to a missing intermediate certificate. This can be acquired from the Certificate Authority (CA) and added to the MSG server certificate using the instructions below:

1. Download the required intermediate certificate in PEM-format from your Certificate Authority
2. Download the MSG server-certificate in PEM-format from the appliance web UI: System -> Certificates -> Certificates, use the Download…-button to the right of the certificate
3. Open the PEM-file downloaded from the MSG-appliance in your text editor of choice
4. To the end of this file, add the content of the intermediate certificate PEM-file and save it as a new PEM-file
5. Import the new certificate file into the MSG-appliance: System -> Certificates -> Certificates, use the Import-button above the certificate list
6. Take the new combined certificate in use by distributing it to the master and agent(s): System -> Certificates -> Services

Issue:

• The MSG appliance has stopped sending emails out to external domain addresses
• Sending emails to internal domain addresses works without issue
• Receiving emails from any sender works normally
• Outgoing connector is showing errors about invalid certificates

Resolution:

The problem might be caused by an invalid or expired certificate on the MSG-appliance

To verify the active certificate:

1. Log in to the MSG web UI
2. Select the System-tab on the top of the page
3. Navigate to System->Certificates->Services using the menu on the left-hand side
4. Note which certificate is in use for the different services
5. Navigate to System->Certificates->Certificates
6. Verify the validity of the certificate(s) that is in use

If the wrong certificate is in use, it can be changed on the Services-page from step 3. Use the dropdown menus to change the certificate for all services and click Save changes.

If the certificate in use has expired, use the Generate Certificate Request-button on the Certificates-page from step 5 to start the process of adding a new certificate to the MSG-appliance. Use the created certificate request with an acquired certificate from a certificate vendor to make a new certificate for the MSG, then import the new certificate into the appliance using the Import-button, also on the Certificates-page from step 5. After this, use the instructions mentioned above to change the active certificate for all services, and save the changes.

Issue:

Does MSG message encryption work normally when sending emails from a distribution list?

Resolution:

Yes, sending from a distribution list has no effect on the MSG message encryption functionality.

Issue:

After upgrading the managed hosts and the Policy Manager Server to version 16, the managed hosts unable to retrieve policy or upstream host statistics to the Policy Manager Server.

The managed hosts have no issue to download the definitions update from the Policy Manager Server. Also, running the connectivity tool shows no issue in connecting to the Policy Manager Server.

The hosts might also after some delay, show up as disconnected or unmanaged in Policy Manager Console.

Resolution:

You need to ensure that the management server address has been configured on the root domain level in the Policy Manager Console:

* Settings (standard view) > Centralized management > Policy Manager Server address
* Settings (standard view) > Centralized management > HTTP port
* Settings (standard view) > Centralized management > HTTPS port

Also, you need to ensure that latest Client Security/Server Security 16.x installer is taken into use. If you are unsure, you may re-download the product installer from the download center at:

Client Security
https://www.withsecure.com/en/support/product-support/business-suite/client-security#download

Server Security
https://www.withsecure.com/en/support/product-support/business-suite/server-security#download

NOTE: This is no longer required with Policy Manager Server 16.02 in use. For more information, refer to the following change log:

https://community.withsecure.com/discussion/comment/130931/#Comment_130931