Issue:

How to upgrade WithSecure Policy Manager to a newer version on a Windows Server?

Resolution:

It's highly recommended that you first back up your existing WithSecure Policy Manager data before upgrading:

1. Create a full backup of the WithSecure Policy Manager data (H2 database, preferences and other files). The backups are stored in the <F-Secure installation folder>\Management Server 5\data\backup folder. For more information about how to do a full backup, consult the Policy Manager Administrator Guide.
2. Download the newest WithSecure Policy Manager installation file from the downloads page
3. If the Policy Manager Console is running, close the application before starting the upgrade.
4. Run the Policy Manager setup on a computer that has the Policy Manager components installed
5. The Policy Manager setup recommends that you upgrade the components that are installed on the computer. Continue with the default options to upgrade the installed components while keeping the existing configuration.

Issue:

How to exclude a domain or specific website from Web Content Control disallowed site categories? The site belongs to a blocked category but users need to be able to access it. 

Resolution:

If a website or domain has been assigned a category that the administrator wants to have as disallowed, the Trusted sites exception list can be used to allow users to access the site. 

The administrator can add the site as trusted by following these steps:

1. Log in to Policy Manager Console
2. Highlight a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to Web content control settings
5. Click Add from the right side of the Trusted sites list
6. Add the site or domain URL in the address field
7. Distribute the policy

Once the policy has been distributed, users will be able to access the site even though it belongs to a disallowed site category.

Issue:

Submitting a False positive or False negative for MSG

Resolution:

Issue:

How to configure the Business Suite Client Security or Server Security host ID in a machine creation service (MCS) environment. 
For instance, a Citrix Golden Image / Master Image

Resolution:

First you need to know which behavior you are aiming for.

Here are the most common one:

Clients are created recurring every day from the Golden Image / Master Image and should retain their WithSecure Unique ID known to the Policy Manager

1. Boot into your golden image
2. Open a command prompt as administrator
3. Change the working directory to C:\Program Files (x86)\F-Secure\<Client Security or Server Security>\
4. Run the following tool with these options to use either the SMBIOS GUID, WINS name, or MAC address when the product reports to the PM Server.

   resetuid.exe resetuid <SMBIOSGUID or WINS or MAC>

   NOTE: DO NOT run resetuid with the APPLYNOW parameter in this case.

5. Shut down and save the state of the golden image

   NOTE: No more reboot at this stage, otherwise the process until step 4 has to be repeated

When deploying a new virtual machine from the golden image, the deployed virtual machine will render the Unique ID based on either the SMBIOS GUID, WINS name or MAC address.

As long as the Unique ID will not change from the deployed virtual machine, it will remain known to the Policy Manager and will only have to be imported once.
 

Clients are created recurring and should always be considered as a new host to the Policy Manager

1. Boot into your golden image
2. Open a command prompt as administrator
3. Change the working directory to C:\Program Files (x86)\F-Secure\<Client Security or Server Security>\
4. Run the following tool with these options:

   resetuid.exe resetuid randomguid

   NOTE: DO NOT run resetuid with the APPLYNOW parameter in this case.

5. Shut down and save the state of the golden image

   NOTE: No more reboot at this stage, otherwise the process until step 4 has to be repeated

When deploying a new machine from this master image, the deployed machine will render the WithSecure Unique ID based on a random GUID string

This approach will create a "new" host for the Policy Manager Server with every new machine deployment. 

One functionality that might help here are the import rules, explained in this help guide.
 

Issue:

How can I replace the default self-signed Policy Manager certificate with a trusted certificate authority (CA) created certificate?

Resolution:

Assume that you have:

• The signed or maybe self-signed certificate (with full chain of intermediate CA) and private key for it inside PKCS12 Keystore.
• It is protected with password "srcpassword"
• Your certificate and the private key are referenced by name (alias) "server".
• The Keystore file is "server.p12" and it is located in the same directory as "fspms.jks".

Steps to replace the default Policy Manager certificate:

1. Launch an elevated command prompt
2. Change the default folder to the directory where "fspms.jks" and import the new trusted certificate using the following commands:
   • Policy Manager 15.x:
   • cd "C:\Program Files (x86)\F-Secure\Management Server 5\data"
   • "C:\Program Files (x86)\F-Secure\Management Server 5\jre\bin\keytool" -importkeystore -destkeystore fspms.jks -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias server
   • Policy Manager 16.x: 
   • cd "C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data"
   • "C:\Program Files\WithSecure\Policy Manager\jre\bin\keytool" -importkeystore -destkeystore fspms.jks -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias server
3. You are replacing the certificate in "fspms.jks" so the following message will appear:
   • Existing entry alias server exists, overwrite? [no]:
4. Type "yes" and hit enter.
5. Restart the Policy Manager server to start using the new certificate. Use a Command Prompt to run the commands:
   • Policy Manager 15: net stop fsms and net start fsms
   • Policy Manager 16: net stop wspms and net start wspms

NOTE: When you execute the importkeystore command pay attention to "-destkeypass", it should be the same as "-deststorepass". If you forget to insert proper "-destkeypass", the command can complete successfully but problems on Policy Manager server startup may occur.

Issue:

How can I replace the default self-signed Policy Manager Linux certificate with trusted CA created certificate?

Resolution:

The Policy Manager for Linux keystore is located inside "/var/opt/f-secure/fspms/data/fspms.jks" (version 12.30 and higher) or "/opt/f-secure/fspms/config/fspms.jks" for previous Policy Manager versions.

You can use the following command to query details about certificates stored in fspms.jks:

• /opt/f-secure/fspms/jre/bin/keytool -list -v -keystore fspms.jks -storepass superPASSWORD
• You should see the following output:

You can follow the steps below to replace the default self-signed Policy Manager Linux certificate:

Assume that you have:

• The signed or maybe self-signed certificate (with full chain of intermediate CA) and private key for it inside PKCS12 keystore.
• It is protected with password " srcpassword "
• Your certificate and the private key are referenced by name (alias) " server ".
• The keystore file is " server.p12 " and it is located in the same directory as " fspms.jks ".

NOTE: When you execute importkeystore command pay attention to "-destkeypass", it should be same as "-deststorepass". If you forget to insert proper "-destkeypass" command can complete successfully but problems on Policy Manager server startup may occur.

1. Type the following command:

• /opt/f-secure/fspms/jre/bin/keytool -importkeystore -destkeystore fspms.jks -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias server

2. You are replacing certificate in "fspms.jks" so following message will appear:

• Existing entry alias server exists, overwrite? [no]:

3. Type "yes" and hit enter
4. Type the following command to restart the Policy Manager server to start using the new certificate:

• /etc/init.d/fspms restart

Issue:

How to check what versions of virus definitions are currently installed on WithSecure Client Security 16.00 (and above) or Server Security 16.00 (and above) with the Windows command line?

Resolution:

• General product information
• License status: License validity and expiration date
• Update status: Update server info, last update date and list of latest installed or failed to install updates
• Setting status: Management settings and profiles
• Feature status: Which features are enabled 

Issue:

How to release a license to free up the subscription usage for a Endpoint Detection and Response for Business Suites subscription key? 

Resolution:

For Client Security/Server Security 16.x, you can do the following through the Policy Manager Console:

1. Select the target domain.
2. Go to the Settings tab, and in Standard view, select Windows > Endpoint Detection and Response.
3. Uncheck Activate Endpoint Detection and Response module.
4. Distribute the policy

For Client Security 15.20 and Server Security 15.10 and later, we recommend having Client Security / Server Security 15.30 together with hotfix03 installed, to have the full support of activation/reactivation.

The hotfix03 can be downloaded at https://download.withsecure.com/corpro/cs/cs15.30/fscs1530-hf03-signed.jar

Also, to free up the subscription usage for the client older than Client Security 15.20 and Server Security 15.10, you need to uninstall the product from the device using the normal uninstallation method. 

Next, you need to remove the Endpoint Detection and Response subscription key you have entered into the Policy Manager Console at Settings (Standard view) > Endpoint Detection and Response > Sensor activation. After removing the subscription key, distribute the policy (Ctrl + D). 

Last, you need to remove the inactive device from the Elements Security Center. To remove a device from the portal, you need to do the following:

1. Select Environment
2. Select Devices
3. Select the devices (a menu will appear from the bottom of the page)
4. Click Remove device and confirm that you want to remove the device

NOTE: If you have both Elements Endpoint Protection devices and Business Suite EDR devices on the devices list, you can use the filter "Subscription type" or "Subscription key" to show only the corresponding devices.

Issue:

How to schedule Business Suite Software Updater to check missing updates and install updates automatically to computers with Client Security and servers with Server Security? 

Resolution:

By default Business Suite Client Security and Server Security scan for missing Software Updater updates at Windows startup and then once per day. You can change the rescanning time by following these steps:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Navigate to the Windows > Software updater settings page
5. In the General section, modify the Maximum rescanning period
6. Distribute the policy (Ctrl +D)

By default, installation of software updates is manually triggered by the Policy Manager administrator or by the local user if they have been given the "Show Software updater options to users" rights. To automatically install updates: 

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Navigate to the Windows > Software updater settings page
5. Scroll down to the Automatic installation section and change the Install updates automatically to one of the following
   • All security
   • Critical and important
   • Critical
   • All missing
6. Then from the "Install every" and "installation time" drop-down menus you can select the appropriate installation date and time
7. Distribute the policy (Ctrl + D)

You can exclude specific updates from being automatically installed with the "Exclude software from automatic installation" feature. Note that this does not hide the update itself, so the installation of the update can still be manually triggered by the Policy Manager administrator or by the local user. 

You may also refer to our User Guide regarding Business Suite Software Updater feature.

Issue:

How to move the WithSecure Policy Manager Server to the new Windows Server?

Resolution:

Follow these steps to transfer the WithSecure Policy Manager Server to a new server.

1. Backup the current Policy Manager database from the old server: 
   1. Stop the Policy Manager Server service 
      • Policy Manager 15: net stop fsms
      • Policy Manager 16: net stop wspms
   2. Create a backup of the following directory:
      • Policy Manager 15: C:\Program Files (x86)\F-Secure\Management Server 5\data\
      • Policy Manager 16: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\Data\
2. Start the Policy Manager Server service on the old server:
   • Policy Manager 15: net start fsms
   • Policy Manager 16: net start wspms
3. Install the Policy Manager Server on to the new server
4. Apply the back-up copy of the Policy Manager database folder to the new Policy Manager server:
   1. Stop Policy Manager Server service 
      • Policy Manager 15: net stop fsms
      • Policy Manager 16: net stop wspms
   2. Replace the directories with the back-up versions from step:
      • Policy Manager 15: C:\Program Files (x86)\F-Secure\Management Server 5\data\
      • Policy Manager 16: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\Data\
   3. Restart Policy Manager Server service:
      • Policy Manager 15: net start fsms
      • Policy Manager 16: net start wspms
5. Configure both, new and old, Policy Manager Server address value in the policy to point to the new Policy Manager Server:
   1. Open Policy Manager Console
   2. Select a host or policy domain from the domain tree
   3. Go to Settings > Windows > Centralized management 
   4. In the Policy Manager Server address text field, type in the new Policy Manager Server address and in the respective HTTP/HTTPS text fields the designated values for these ports
   5. Set the padlock icons tailing these text fields to the locked position, which will ensure to enforce the new value
   6. Distribute (Ctrl+D) the new policy

Once the managed hosts have fetched the new communication settings from the old Policy Manager, they will start to communicate with the new Policy Manager Server.

 
Note #1: If the WithSecure clients continue communicating with the old Policy Manager Server, be sure to verify connectivity from the clients to the new Policy Manager Server's designated ports (HTTP/HTTPS).

Note #2: If the new host will preserve the DNS name of the old Policy Manager Server host and you are using that address the as main management server address, you can simply paste the H2-Database file from step 1 to the new Policy Server Manager host.