Issue:

F-Secure Baseguard services f-secure-baseguard-orspgw and f-secure-baseguard-update services are gone for Linux Security 64 and Atlant after FSBG 1.0.907 update.

Resolution:

This is an intended change for Linux Security 64 and Atlant from FSBG version 1.0.907 onwards. These services were removed since they are no longer required. 

Details of these changes can be checked from change logs listed below:

New Linux Security 64 update has been released (2024-09-02)
https://community.withsecure.com/discussion/117646/linux-agent-ls64-changelog-elements-business-suite-standalone/p3
※LNX-299: Removed obsolete BaseGuard update service.

New Atlant update has been released (2024-09-02)
https://community.withsecure.com/discussion/120778/atlant-changelog/p3
※LNX-299: Removed obsolete BaseGuard update service.

Issue:

When trying to create or export an installation package for Client Security or Server Security from the Policy Manager Console, the user receives the following error message when entering the license key: "The keycode that you entered is not valid"

Resolution:

As with earlier major versions of Client Security and Server Security, each major version of the installer uses a new license key. So for example, version 16 has a different license key compared to version 15, but version 16.00 and 16.01 use the same license key. Start by making sure that the license keys you are using do not belong to version an older version of the product. This can easily be verified by checking your license certificate.

If your license certificate lacks the keys for the latest versions of Client Security and Server Security, you can request an updated license certificate from your WithSecure reseller partner or WithSecure sales contact.

Issue:

We are getting error "The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2755." during the Business Suite Client Security or Server Security installation.

For example:

Resolution:

The error 2755 means that Windows cannot open the files or lacks the proper permissions. Most likely it could be related to privileges on the system. Verify the user installation permission in Group Policy for the system.

This is an expected error when the WithSecure .msi installer is executed with User Account Control (UAC) enabled.

With the UAC enabled by default, even the administrator user is restricted until you click the elevation prompt during installation, but using an MSI installer does not have the possibility to elevation prompt. You are required to run the MSI installation with a built-in administrator rights account or with UAC disabled.

If you come across this error using a domain administrator account, proceed to install using your local administrator account instead.

Sometimes, you may right-click on the installer and select "Run as administrator". This would also help to workaround the issue. Alternatively, you can start the command line window in elevated mode, and run the MSI installer from there.

We also recommend ensuring the system has all Windows updates in place before installing our product.

Issue:

When installing WithSecure Policy Manager Server or  Policy Manager Proxy  the  user receives the following error after clicking Next on the Configure ports page:

Error: "The Host Module HTTPS port number specified is already in use."

Resolution:

If the port you have chosen for WithSecure Policy Manager Server or Policy Manager Proxy communication is in use by other services (e.g Microsoft webserver), thus causing a conflict, you can solve the issue by changing the port Policy Manager Server will use or by deactivating the service causing the conflict or changing the port that service is using. 

Policy Manager Proxy Upgrade
The error could be caused if clients are currently accessing the Policy Manager Proxy. If you are performing an upgrade of Policy Manager Proxy, you can stop all Policy Manager Proxy services and try the upgrade again, then it should work and the upgrade will be completed.

Issue:

A software in our environment sends out regular emails to internal and external recipients. A tag is added to the subject line to have these messages encrypted by MSG.
Only the messages intended for internal recipients are being encrypted, all messages from the software to external recipients arrive unencrypted.

Resolution:

Start by verifying that these messages are being routed through the MSG-appliance. It is possible that the software has different routing rules based on domains and that the external traffic isn't routed to the MSG-appliance at all.

In MSG, you can check the details of a message using Smart Search:

1. Log in to the MSG Web UI
2. Make sure the System-tab is selected at the top
3. On the left-hand menu, navigate down to Smart Search-> Search
4. Use the sender and/or recipient information to search for the message. Do note that the Time-field usually is set to Last 24 Hours, which might be too restrictive, so expanding it to for example Last 7 Days is recommended.
5. If you find messages, you can verify their encryption status by checking the envelope symbol at the left of the message row. If it has a small lock on it, the message is encrypted. 
6. Expand the message info by clicking the small + next to the envelope symbol to see more details. Here the Encryption-field should also be set to Proofpoint Encryption/Secure Reader Encrypted if the message is encrypted.

If you find messages that should be encrypted but aren't, open a support ticket so that it can be investigated. Provide the appliance-ID and information about the messages so that we can identify them (sender/recipient info, time when it was sent, subject field text). A sample message saved as .eml or .msg is also useful.

To ensure that we can help you efficiently, please make sure that the following IP-addresses can access the MSG-appliance on ports 22 and 10000:

203.112.232.170                 F-Secure Support / Kuala Lumpur
193.110.108.33                   F-Secure Support / HTC Helsinki
208.86.202.10                     Proofpoint
208.84.66.21                       Proofpoint
208.84.67.21                       Proofpoint

Issue:

Windows Management Instrumentation (WMI) Integration with Policy Manager for Windows

Resolution:

Policy Manager supports Windows Management Instrumentation (WMI) Integration. See this user guide for more information: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/concept_E55FFF0187A54B79B30637C7983BDCC8-16.00-en
 

Issue:

Does Policy Manager create and maintain an audit log for user and admin activity? For example for these events:

• User login / logoff
• Host deletion  / add / rename events
• Policy sub-domain deletion / add / rename events 
• Change of policy settings

Resolution:

The Policy Manager Server logs can be found in the following folder:

• C:\Program Files (x86)\F-Secure\Management Server 5\logs

The user login actions are recorded in the fspms-users.log. The log does not show the full user name, only the User ID. To get the full user name, a query must be performed using the H2Console. The H2Console is not enabled by default, so it will need to be enabled before you can run the query. 

Note: Please backup your registry before making any registry changes

1. Open Registry Editor (regedit)
   • Policy Manager 15: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Data Fellows\F-Secure\Management Server 5\
   • Policy Manager 16: HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server
2. Edit "additional_java_args"
3. Add parameter: -Dh2ConsoleEnabled=true
4. Close registry editor and restart  Policy Manager Server service by running command line commands net stop fsms and net start fsms (net stop wspms and net start wspms for Policy Manager 16)

How to open H2Console and run query:

1. Open a browser and go to https://localhost:8080
2. Click the H2Console link
3. Type in query: SELECT * FROM users;
4. Click Run (Ctrl+Enter) to run the query

You will receive a result showing which user names correspond to which User ID. 

Changes made to policy settings are saved in fspms-policy-audit.log.

Changes made to the Policy domain computers/servers or specifically changes made to the policy domain structure are saved in fspms-domain-tree-audit.log.

Another log to look into is fspms-active-directory-rules.log. For example, in case the AD synchronization rule was executed, and the host with unique ID, 4d896695-8de1-4f96-9c29-0ebd2bb60418 was moved into a domain, you will find the following is logged:

20.06.2022 17:59:01,276 INFO [activeDirectoryRules] – Starting to process manually triggered rule [ruleId=5, domainController='LDAP://<domain name>', containerDn='OU=<OU name>,DC=<partial domain name>,DC=<partial domain name>', containerGuid='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', targetDomainId=<policy domain ID>, enabled=true]
20.06.2022 17:59:01,386 INFO [activeDirectoryRules] – 1 hosts found in Active Directory, 0 of them unmanaged
20.06.2022 17:59:01,388 INFO [activeDirectoryRules] – Domain <policy domain name> updated
20.06.2022 17:59:01,390 INFO [activeDirectoryRules] – Host having identity 4d896695-8de1-4f96-9c29-0ebd2bb60418 moved
20.06.2022 17:59:01,416 INFO [activeDirectoryRules] – Rule was successfully processed

Q: How to find out who deleted a policy sub-domain in Policy Manage Console?
A: This information is available in the fspms-domain-tree-audit.logs. Below is an example, where a sub-domain called test was added and immediately deleted.

05.12.2019 09:44:17,785 INFO [audit.domainTree] – User 'admin' added domain test (id=76) to domain Root (id=1)
05.12.2019 09:44:23,615 INFO [audit.domainTree] – User 'admin' deleted domain test (id=76)
 

Issue:

My devices are getting blocked. How can I grant access to specific devices on Policy Manager?

Resolution:

You can set rules to allow a specific device while all other devices under the same class are blocked.

You need to know the hardware ID of the device that you want to allow before you can create a rule that grants full access to the device.

To add an exception to a rule, follow these instructions.

1. Get the hardware ID for the device that you want to allow. The hardware ID has to be more specific than the ID which is used to block the device.
2. Go to the Settings tab and select Windows > Device control.
3. On the Device access rules table, click Add.
4. Enter the hardware ID for the device as the Hardware ID in the new rule.
5. Set Access Level to Full access to allow the use of the device.
6. Set Active to Yes for the new rule.
7. Distribute Policy

Issue:

Do DeepGuard exclusions accept Windows environment variables or wildcards when the exclusion is created through WithSecure Policy Manager?

Resolution:

DeepGuard exclusions for WithSecure Client Security, Server Security and Email and Server Security products support wildcards for DeepGuard exclusions. Follow these steps to create an exclusion using a wildcard:

1. Log into Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab and select Standard view
4. Go to Real-time scanning 
5. Scroll down and enable Do not scan the following files and applications 
6. Click Add and select Folder path
7. Enter the folder path, for example: *\examplefolder\subfolder\* and click OK
8. Distribute the policy (Ctrl + D)

More examples can be found in the following F-Secure Community article: https://community.f-secure.com/business-suite-en/kb/articles/5665-using-wildcards-in-exclusions-in-real-time-scanning

Issue:

DNS resolution for certain sites are blocked with the product installed. How to avoid this from happening?

Resolution:

Most likely the DNS resolution is blocked by the Botnet Blocker feature. The site is rated as unsafe and hence blocked by the feature.

1. Share the URL with the Labs team, for further investigation. The Labs team will whitelist the URL if the site is not malicious: https://www.withsecure.com/en/support/contact-support/submit-a-sample

2. Whitelist the blocked site or the IP address of the blocked site via the Advanced View in the PM Console at:

1. Log in to Policy Manager Console
2. Highlight a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to Web content control settings
5. Click Add from the right side of the Trusted sites list
6. Add the site or domain URL in the address field
7. Distribute the policy (Ctrl + D)