Issue:

When using image files to distribute product installations, how can I reset the host UID for Policy Manager Proxy to prevent duplicate hosts appearing in Policy Manager?

Resolution:

If you use image files to distribute product installations, you need to make sure that there are no unique ID conflicts. For Policy Manager Proxy this can be prevented by following the steps below:

1. Stop F-Secure Policy Manager Server service: 
   • Linux: [/etc/init.d/fspms stop]
   • Windows: [net stop fsms]
2. Remove following two files:
   • Linux:
     • /var/opt/f-secure/fspms/data/h2db/fspms.h2.db
     • /var/opt/f-secure/fspms/data/fspms.jks
   • Windows:
     • <F-Secure Installation Folder>\Management Server 5\data\h2db\fspms.h2.db
     • <F-Secure Installation Folder>\Management Server 5\data\fspms.jks
3. Use fspmp-enroll-tls-certificate script to generate proxy node certificate. Run the script and authenticate yourself as root administrator of the Master Policy Manager:
   • Linux: /opt/f-secure/fspms/bin/fspmp-enroll-tls-certificate
   • Windows: <F-Secure Installation Folder>/Management Server 5/bin/fspmp-enroll-tls-certificate.bat
4. Start F-Secure Policy Manager Server service:
   • Linux: [/etc/init.d/fspms start]
   • Windows: [net start fsms]

Issue:

FSMAUTIL is no longer available for WithSecure Business Suite Server Security / Client Security 15.x or 16.x, how do I reset the host's unique ID (UID)?

Resolution:

In WithSecure Server Security/Client Security 15.x, there is a new tool introduced called resetuid.exe to reset the host identity. This tool will replace FSMAUTIL (F-Secure Management Agent Utility) for both the products. The tool can be found in C:\Program Files (x86)\F-Secure\Client Security\BusinessSuite\ (Client Security 15.x) or 
C:\Program Files (x86)\F-Secure\Server Security\BusinessSuite (Server Security 15.x).

Check the Help page for the procedure.

Usage:

RESETUID SHOWUID  Shows the host Unique Identity currently in use.

RESETUID RESETUID {SMBIOSGUID | RANDOMGUID | WINS | MAC} [APPLYNOW] Schedules regeneration of the host Unique Identity using one of the specified methods:

• SMBIOSGUID        – uses SMBIOS GUID
• RANDOMGUID      – uses randomly generated GUID
• WINS                      – uses WINS (NetBIOS) name
• MAC                       – uses MAC (ethernet card) address
• APPLYNOW           – If the product is running, requests to apply new Unique Identity immediately. Otherwise, it is applied to the next start of the product.

Issue:

Emails sent to a user never arrive because the user is not recognized as a verified recipient and are therefore blocked. How to add the user as a verified recipient on a Protection Service for Email (PSE) or Messaging Security Gateway (MSG) appliance? 

Resolution:

1. Log in to the PSE / MSG appliance
2. Select the System tab from the top
3. Go to the User Management section from the menu of the left 
4. Go to Users 
5. Click Add User 
6. Enter the user's details and click Add Entry

Now you can verify that the emails sent to the user are no longer blocked.

Issue:

How can I manually isolate Client Security hosts from the network with WithSecure Policy Manager?

Resolution:

You can isolate one or more hosts from the network in your WithSecure Policy Manager.

Note: Use network isolation with caution and only in case of a network attack.

1. Select the target host in the policy domain tree
2. Go to the Operations tab
3. Click Isolate under Network isolation. This isolates the selected host from the network
4. To reconnect an isolated host to the network, click Release on the Operations tab

Isolated hosts are shown on the Host issues section of the dashboard.

This feature is only available in Policy Manager 14.10 and later.

Issue:

How to create a custom firewall rule (service) for Client Security or Server Security in Policy Manager Console?

Resolution:

To create a custom firewall rule over the Policy Manager Console:

For Client Security 14 and 15

1. Open the Policy Manager Console and go to the Settings-tab
2. Go to Firewall, using Standard view (changeable in the upper right corner)
3. Make sure the 14.X / 15.x clients-tab is selected
4. Select the profile you want to edit from the Profile being edited-dropdown menu (if the list only contains the default profiles, clone the one you want to use as a base as the defaults can't be modified)
5. Click Add rule on the right of the firewall rules list and create the rule as needed (see step 6 if the service required is missing)
6. If the service you want to add is missing, click on Configure network services below the firewall rule list. Click Add and follow the steps to add a new firewall service
7. Check the Enabled-checkbox to the left of the rule name to make sure that it is in use
8. Distribute the new policy by clicking the symbol in the upper left corner of the interface, or by pressing Ctrl+D

Note: The firewall profiles are shared between all policies. If you want to have a single host or policy domain use different firewall rules, you will have to create a new firewall profile and select that policy domain or host to use that profile. We recommend to do it like this:

1. Log in to the Policy Manager Console
2. Go to the Settings tab
3. Select your existing firewall profile from the "Profile being edited" drop-down menu and click Clone
4. Give the new profile a name and click OK
5. Edit the newly created firewall profile to your liking
6. Select the single host or policy domain from the Domain tree
7. Depending if the host is a Workstation or Server, select the newly created profile from the "Workstation host profile" or "Server host profile" drop-down menu
8. Distribute the policy (Ctrl + D)

To create a custom firewall rule locally on the workstation:

In versions 14.00 and later, rules are added through the Windows firewall settings. You can reach them through the Client Security or Server Security user interface:

1. Open Client Security or Server Security user interface
2. Go to Settings
3. Click on Firewall settings
4. Click on the Change Windows Firewall settings…-link to be brought to the Windows firewall settings

Issue:

How can I change Polling interval for virus definitions updates in Policy Manager Server?

Resolution:

By default the clients checks for updates every 10 minutes

How often the client checks for updates can be changed: 

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > Centralized management.
5. Change the Interval for polling updates from WithSecure Policy Manager Server value

In Automatic updates settings you can edit the time for which it is suppose to get poll: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_AD516BEDC4194E8F967E823074ECD143-16.00-en

Issue:

How to backup and restore Policy Manager Server database ?

Resolution:

Read the following instructions completely before you start working on the server.

If you want to keep the DNS name, just move h2db to the new host, stop the old host and start the new one.

If you change the DNS name of the server, you must follow the instructions below.

Create a backup of the Policy Manager Server:

1. Stop the Policy Manager Server service:
   • Policy Manager 15: net stop fsms
   • Policy Manager 16: net stop wspms
2. Back up the directory:
   • Policy Manager 15: <F-Secure Installation Folder> \ Management Server 5 \ data \ h2db>
   • Policy Manager 16: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data
3. Note: Please copy the database to a different location than the one Policy Manager is installed in
4. Restart the Policy Manager Server service:
   • Policy Manager 15: net start fsms
   • Policy Manager 16: net start wspms

Now perform the installation on the new server. The current installation file can be found here

Note: To avoid the communication issues, use exactly the same ports by the installation like for the old WithSecure Policy Manager Server.

To restore secured Policy Manager data:

1. Stop the Policy Manager Server service:
   • Policy Manager 15: net stop fsms
   • Policy Manager 16: net stop wspms
2. Copy the backup to the correct location:
   • Policy Manager 15: <F-Secure Installation Folder>\Management Server 5\data\h2db\
   • Policy Manager 16: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\
3. Restart the Policy Manager Server service:
   • Policy Manager 15: net start fsms
   • Policy Manager 16: net start wspms

After the installation is complete, the new Policy Manager Server has the complete domain structure, including the settings.

After logging into the old server using the Policy Manager Console, enter the address of the new Policy Manager Server in the Settings > Windows > Centralized management > Policy Manager Server host communication settings and distribute the policies for all your policy domain. Note that the policy setting needs to be locked down to ensure that it's not getting overwritten by locally defined settings.

Now all clients will connect the new server. Once all clients are connected without errors with the new Policy Manager Server, you can turn off the old one.

You may also find additional instructions in this community article. 
 

Issue:

How does the Protect the hosts file security feature work with WithSecure security product on a Windows host? 
What happens to an already modified hosts file when WithSecure security product is installed? 

Resolution:

The Protect the Hosts file security feature monitors if there have been any changes made to the hosts file in a Windows system. If the feature detects a non-default hosts file, it will alert of a redirected hosts file and replace it with a hosts file with the following content:

#
# Copyright (c) 2007 F-Secure Corporation 
# 
# This is a HOSTS file created during malware removal. 
#
# Your original HOSTS file was infected and it was replaced 
# by this file containing only clean default entries. 
# The original HOSTS file may be restored from the product's
# quarantine feature.
#
127.0.0.1    localhost
::1            localhost

If a hosts file has been modified before the installation of Client Security, the modified hosts file will be detected during the first system scan.

If the hosts file is modified during a time when the Protect the hosts file feature has been disabled, the modified hosts file will be detected when the feature is turned back on. 

Follow these steps to turn off the Protect the hosts file feature.

For Policy Manager:

1. Log in to Policy Manager Console
2. Select the policy domain or host from the Domain Tree
3. Go to the Settings tab and select Advanced view ​​​​​​​
   • Note: Advanced view needs to be enabled from the settings
4. Navigate to: F-Secure Anti-Spyware > Settings > Anti-Spyware Scanner > Real-Time Scanning > Real-Time Scanning Options > Protect the "hosts" File 
5. Disable the setting 
6. Distribute the policy (Ctrl + D)

For Elements Endpoint Protection:

1. Log on to the WithSecure Elements Security Center portal (https://elements.withsecure.com)
2. Expand the Security Configurations tab and go to Profiles
3. Click on your profile to edit the settings
4. Go to the Real-time scanning > Protect Hosts File
5. Disable the setting
6. Click Save and publish

Issue:

• Is there a way to block users from accessing or running a specific file with Business Suite products such as Client Security and Server Security?
• Can you for example block C:\Temp\temp.do or even the WithSecure  Uninstallation Tool?

Resolution:

With the help of Application Control file access rules, the admin can block the distribution and execution of a certain file in their environment.

When creating the rule, providing only a file hash as a rule condition is enough but may result in performance degradation, because of the need to calculate new digests, especially for big files. To optimize rule performance it is recommended to supply a file size as an extra condition for file access rules.

1. Log in to Policy Manager Console
2. Select the host or domain from the Domain Tree
3. Go to the Settings tab
4. Go to the Application control page
5. Click Clone to create a custom profile which can be edited
6. Set the newly created profile as the Host profile 
7. Click Add rule
8. Set Event as File access 
9. Set Action as Block 
10. Add condition: Target SHA1 – Equals – <file SHA1>
11. Add condition: Target size – Equals – <file size>
12. Click OK to save the rule
13. Distribute the policy (Ctrl + D)

Note: To be able to add the target size condition, you need to have F-Secure Policy Manager 14.30

This screenshot shows an example how to configure this in Policy Manager Console. This blocks users from launching a "bad" PDF file containing an exploit.

Issue:

How do I automate and schedule reports in Policy Manager?

Resolution:

You can configure Web Reporting to send regular reports by email to one or more recipients.

To send the reports by email, you need to enter the mail server details in Policy Manager Console. To do this:

1. Select Tools > Server configuration and click the Mail tab.
2. Enter the mail server address and authentication information.
3. Enter the address that you want to display as the sender in the report emails. This does not have to be a valid email address.
4. Click OK.

To configure the report scheduling:

Note: You cannot schedule reports for individual hosts, only for domains. You can use the root domain if you want the reports to cover all configured domains.

Use semi-colons to separate multiple addresses.

If you choose to send the reports on a monthly basis, the reports for each month are automatically sent on the first day of the following month.

1. On the Web Reporting main page, select Scheduled reporting.
2. On the policy domain tree, select the domain that you want to use for the reports.
   Note: You cannot schedule reports for individual hosts, only for domains. You can use the root domain if you want the reports to cover all configured domains.
3. In the Recipient emails field, enter the email addresses that should receive the reports.
4. Choose whether to send the reports daily, weekly or monthly.
   • If you want to send the reports on a weekly basis, select the weekday.
   • If you choose to send the reports on a monthly basis, the reports for each month are automatically sent on the first day of the following month.
5. Select which reports you want to send.

The listed recipients will receive the selected reports in HTML format according to your settings.
If you want to check that the report emails are delivered correctly, click Send reports now.
 

For more information: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_4644F99989CB41A4BD5BBC5FE87919A2-16.00-en