Issue:

How to disable or enable automatic updates locally and via Policy Manager Console?

Resolution:

For Client Security clients, you can disable automatic updates by following these steps:

1. Log into Policy Manager Console
2. Highlight a host or policy domain from the domain tree
3. Go to the Settings tab 
4. Go to the Centralized management page
5. In the Automatic updates section, disable Enable automatic updates 

If set to 'Disabled', Automatic Update Agent will not automatically check for any kind of new updates. This does not prevent user initiated updates ('check now' button).

Note: This setting is only applicable for Client Security and does not apply for Server Security.

It is not possible to disable automatic updates from the Client Security local user interface.

If you need to manage the updates differently, you can also change the polling interval. Set it to a longer time period, for example one week or month. When you would like the clients get the updates, you can temporarily set it back to a shorter time period.

How to change the settings via Policy Manager Console:

1. Log into the Policy Manager Console
2. Highlight a host or policy domain from the domain tree
3. Go to the Settings tab 
4. Go to the Windows > Centralized management page
5. In the Automatic updates section, change the setting Interval for polling updates from Policy Manager Server 

Issue:

I have forgotten my login password to WithSecure Policy Manager Console, how do I reset the admin password?

Resolution:

If you have lost the password for the admin user, or if the account was accidentally deleted, you can reset the admin account for Policy Manager on Windows by following the steps below:

For 16.x and later the admin password can be reset with these steps:

1. Open command line prompt as administrator
2. Stop WithSecure Policy Manager Server service by running command:
   • net stop wspms
3. Navigate with the command prompt to the following location and run the reset-admin-account.exe tool:
   • C:\Program Files\WithSecure\Policy Manager\Policy Manager Server\bin\reset-admin-account.exe
4. Enter your new password
5. Start WithSecure Policy Manager Server service by running command:
   • net start wspms
6. Try to log in to Policy Manager Console

For Policy Manager on Linux, use the following script to reset the user account:
/opt/f-secure/fspms/bin/fspms-reset-admin-account

If you are still not able to login to Policy Manager Console, make sure the account used in the login windows is admin (and not administrator).

For legacy versions such as 15.x and older, the admin password can be reset with these steps:

1. Open command line prompt as administrator
2. Stop F-Secure Policy Manager Server service by running command:
   • net stop fsms
3. Navigate with the command prompt to the following location and run the reset-admin-account.bat tool
   • C:\Program Files (x86)\F-Secure\Management Server 5\bin\fspms-reset-admin-account.bat
4. Enter your new password
5. Start F-Secure Policy Manager Server service by running command:
   • net start fsms
6. Try to log in to Policy Manager Console

Issue:

How to change Policy Manager Server address of Client Security or Server Security to a new Policy Manager Server address.

Resolution:

After migrating the Policy Manager Server data to a new server, you can follow these instructions on the old Policy Manager Server to have the clients connect to the new address. If you have not migrated the Policy Manager Server to a new server yet, you can find the instructions here: How to migrate the Policy Manager Server to the new Windows Server? – WithSecure Community 

How to change the Policy Manager Server address of the hosts to refer to the new Policy Manager Server address:

1. In the old Policy Manager Server, navigate to:
   • – ​​​​Settings -> Centralized management -> Policy Manager Server host communications settings
2. Change the Policy Manager Server address to the new Policy Manager Server 
3. Distribute the policies to the hosts (Ctrl + D)

If the old Policy Manager Server is no longer available, the options are:

• Uninstall the current Client Security and / or Server Security installations and reinstall the clients using an installation package exported from the new Policy Manager server and pointing to the correct Policy Manager Server address.
• You need a keyreplacer package, which can be provided by WithSecure Support. This tool when executed, allows the Policy Manager address to be changed by executing a file locally on the client. 

Issue:

How to allow Business Suite Client Security or Server Security client to download malware definition updates from back-end update server when product is unable to connect to Policy Manager Server? 

Resolution:

By default, the client will failover to the Withsecure / F-Secure update server, guts2.sp.f-secure.com, when the Policy Manager Server is not reachable. If the client has been set to not to be allowed to download updates from the update server, here are the steps how to allow it.

Follow these steps to allow the client to fallback to the WithSecure or F-Secure Update Server:

1. Log in to the Policy Manager Console
2. Select a policy domain from the domain tree
3. Go to the Settings tab 
4. Go to the Centralized Management settings page
5. Scroll down to the Automatic updates section and enable Allow falling back to WithSecure update server if Policy Manager Proxies are inaccessible
6. Distribute the policy (Ctrl + D)

Important: The device where Client Security or Server Security is installed, must be able to reach the F-Secure update server. The address is guts2.sp.f-secure.com. The HTTP port 80 is is used by default when connecting to the update server, but if Use HTTPS to download updates is enabled, then port 443 is used.  

The following setting determines how soon the client will failover to the WithSecure / F-Secure update server, when the Policy Manager Server is not reachable:

Settings (Advanced view / 13.x and older hosts) > F-Secure Automatic Update Agent > Settings > Communications > PM Proxies > Intermediate Server failover time

Note: You need to enable Advanced view from the Tools > Preferences.

NOTE: failover range can be set between 1 hour and 256 days.
 

Issue:

How to allow a local user to unload / disable / turn off all security features of WithSecure Client Security and Server Security through Policy Manager?

Resolution:

Follow these steps to allow local users to unload / disable WithSecure Client Security and Server Security security features on their computer:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab 
4. Go to the Windows > Centralized management settings page
5. In the Bypassing product security section, for Allow users to unload products, select Allowed always from the drop-down menu
6. Distribute the policies (Ctrl + D)

Now the users can unload / disable / turn off Client Security security features locally on their computers.

How to disable locally on Client Security or Server Security clients:

1. Open the Client Security or Server Security local user interface
2. Click on the More options icon (three dots)
3. Click Turn off all security features

Issue:

How can I migrate from Client Security to Elements Endpoint Protection for Computers using Policy Manager?

Resolution:

You can follow the steps explained here on migrating from Client Security to EPP for Computers using Policy Manager Console.

Issue:

How do I install a hotfix for Windows Business Suite products?

Resolution:

You can do the following via the Policy Manager Console to install a hotfix for Windows Business Suite products:

1. Import the downloaded jar file into the Policy Manager Console, and export as MSI installer(which you can then execute the hotfix on the target host locally, or roll out via GPO/SCCM, etc.) for the standalone host:

a. Login to the Policy Manager Console
b. Select Installation
c. Click on Installation package
d. Click on the Import button
e. Select the downloaded jar file
f. Click on the Export button
g. Select the path to create the MSI installer

2. Import the downloaded jar file into the Policy Manager Console, and roll out the hotfix via policy-based installation for the centrally managed host:

a. Login to the Policy Manager Console
b. Select Installation
c. Click on Installation package
d. Click on the Import button
e. Select the downloaded jar file
f. Select target host or policy domain
g. Click on the Install button at the bottom of Installation
h. Select the hotfix
i. Click on OK button
j. Distribute the policy

Issue:

How to change the default installation path of WithSecure Client Security or Server Security using an MSI -package

Resolution:

WithSecure Client Security 14.10 and Server Security 14.00 and later versions include the support for changing the default installation path for the product. 

This can be accomplished using the MSI-startup parameter FORCED_TARGETDIR
To set it, use the parameters when launching the MSI or using a transform file

i.e. msiexec /i fsss-15.11.3-exported.msi FORCED_TARGETDIR="D:\test folder"

Issue:

I need to enable or disable the Browsing Protection feature on some client, how can I do it centrally using Policy Manager Console?

Resolution:

1. Open Policy Manager Console
2. Select a host or policy domain 
3. Go to the Settings tab
4. Go to the Browsing Protection settings page
5. Uncheck the box to Disable or Enable Browsing Protection
6. Distribute the policies (Ctrl + D)

Note: After you have chosen your setting, make sure that the padlock is closed, after that you can distribute the policies (Ctrl+D)
 

Issue:

How to disable Web Traffic Scanning (Advanced Network Protection) for WithSecure Client Security using Policy Manager policy settings?

Resolution:

To centrally disable Web Traffic Scanning (Advanced Network Protection) from target hosts in Policy Manager, follow these steps:

1. Log in to the WithSecure Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab and use Standard View
4. Go to Web traffic scanning section
5. Choose from HTTP Scanning HTTP scanning enabled and set the value as disabled
6. Distribute the new policy with the Distribute policies (Ctrl + D) button

Once the hosts have received the new policy, the Web Traffic Scanning will be disabled on the target hosts.