Issue:

After an upgrade or reinstallation of a WithSecure Client Security or Server Security client, why are there duplicate hosts visible in the WithSecure Policy Manager Server's domain tree?

Resolution:

If you are using the method "Randomly generated global unique ID" to create a host identification string, it may happen that after a reinstallation or upgrade of a Client Security or Server Security client, this identification string is regenerated and the client is effectively seen as a new host in the WithSecure Policy Manager Server's domain tree. This is why the device can be seen twice in the domain tree.

This can also happen if you have selected a different host identification method for the upgrade than what was used during the installation of the client on the host. The host identification method is chosen when exporting the installation package, in the "Configure communication with Policy Manager Server" step.

To view which host identification method was used on a host, follow the steps below:

1. Open a command prompt as an administrator on the host
2. Navigate to : 
   C:\Program Files (x86)\F-Secure\Client Security or
   C:\Program Files (x86)\F-Secure\Server Security
3. Run command: RESETUID.EXE SHOWUID

Depending on the settings in your WithSecure Policy Manager Server, the older host will be seen as disconnected after the defined number of days. 
After another defined period of days, it will be removed from the domain tree of your WithSecure Policy Manager Server.

You can change these settings by following the steps below:

1. Log in to the Policy Manager Console
2. Click Tools > Server configuration

In the Hosts tab, you can change after how many days hosts should be considered disconnected. You can also enable to automatically remove disconnected hosts after a defined number of days. 

Issue:

I would like to register my Policy Manager Server which is not connected to a network (offline), how do I proceed?

Resolution:

1. Contact WithSecure support by opening a support request here.
2. Provide the following information for WithSecure technical support to create an offline registration file:

• Account Name
• Customer ID
• Installation ID 
• Business Suite license Expiry date

How to obtain Customer and Installation ID:

Policy Manager for Windows

• Open Policy Manager console, and go to Help menu > Registration dialog, or;
• Find the information from the Policy Manager Server installation folder: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\upstream-statistics.json
• Note: the folder C:\ProgramData\ by default is a hidden folder. To workaround this issue, copy/paste the name of the folder C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\to an File Explorer window to view the content of set folder.

Policy Manager for Linux:
    Please refer 
     /var/opt/f-secure/fspms/data/upstream-statistics.json

Notes:
"upstream-statistics.json" file is created by Policy Manager when it attempts to connect to the registration backend (corp-reg.f-secure.com) and it keeps updating daily on each attempt to check the license. You should not create or edit the Customer ID and Installation ID in the upstream-statistics.json file directly because it is not intended to be edited manually.

Once support has provided you with an offline registration file, use the following steps to activate it on your Policy Manager Server. 
This file is actually created based on the ordered period or expiry date in the license certificate and there is no other license file used by Policy Manager Server for registration.

Windows:

Policy Manager for Windows:

1. Copy the offline registration file registration.json to the folder: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data
2. Restart the WithSecure Policy Manager Server service by typing the following commands in an elevated command prompt (CMD)
   • net stop wspms
   • net start wspms

Linux:

1. Copy the offline registration file to registration.json the folder /var/opt/f-secure/fspms/data 
2. Restart the fspms daemon:

• # /etc/init.d/fspms restart

If the registration.json file disappears from data folder, the activation was successful and Policy Manager is activated until the expiry of your current subscription. After renewing the subscription you need to request a new registration token from support. There is no need to change the permissions for the registration.json file as file inherits proper permissions from the parent folder data.
Make sure to do this some time in advance so that you don't end up with an expired Policy Manager Server.

Issue:

Policy Manager Web Reporting sends report multiple times at 10-15 minute intervals. Why are duplicate web reports sent by Policy Manager Server Web Reporting? 

Resolution:

The Policy Manager Web Reporting could be sending multiple reports to some users because there are some users for whom the reporting fails, so it tries to resend the whole report.

Make sure that if the web report has several recipients that all recipient addresses are written correctly without any typoes. Since the job can never fully "succeed" (the bad address always fails), it never leaves the retry queue — so the good recipients keep getting a fresh copy every 10–15 minutes for as long as the bad address stays in the list.

If the email addresses are valid, it could be that the report size is very large and generating the report times out. In that case you can try to increase the phantomJsReportGenTimeout value from the default of 60 to a higher value between 180 and 300. 

Steps: 

1. Run Regedit as administrator.
2. Create the following string registry key:
   1. HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\additional_java_args
3. Enter the following property and the value:
   1. -DphantomJsReportGenTimeout <180-300>
4. Restart the policy manager server by opening a command prompt and running commands:
   1. net stop wspms
   2. net start wspms

On Linux, the above works as well. However, instead of the registry, use the /etc/opt/f-secure/fspms/fspms.conf configuration file:

Create a new line with the parameter additional_java_args:

• -DpropertyName=value If you want to specify multiple properties, use space as the delimiter. Property names and values are case-sensitive. 

Restart the Policy Manager Server service to make the new configuration settings take effect.

Issue:

Will changing of Policy Manager customer number and registration affect communication between Policy Manager Server and Client Security and Server Security hosts ?

Resolution:

If you specify a new customer number in the Policy Manager Console's Help > Registration page, it will not affect the communication between the clients and the Policy Manager Server. 

The registration only affects your ability to log in to the Policy Manager Console to manage the policies. If the new customer number is valid, you will be able to log in normally during then login. 

Issue:

Client Security or Server Security shows "Central Management Status not available" error in the local user interface

Resolution:

Make sure that the device is able to connect to the Policy Manager Server. You can open a browser and enter http://<pm-server-address-here>:80 and it should show you a message if the device is able to connect to the Policy Manager Server. 

• If there connection is successful, then that means that the issue is in the Client Security or Server Security installation itself. Try to restart the device and if that doesn't fix the issue, reinstall the client since it could be that it is connecting to the wrong Policy Manager Server address. 
• If the connection check was unsuccessful:
  • Make sure that firewall on either the client or policy manager server side is not blocking the connection
  • Make sure that the Policy Manager Server service (wspms) is running on the server 

Issue:

How long do Client Security or Server Security keep the quarantined files stored on a computer or server until they are automatically deleted? After what time can the files no longer be released from quarantine? 

Resolution:

By default both Business Suite Client Security and Server Security delete quarantined files after 30 days.

You can change the default settings for quarantine management via the Policy Manager Console:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Open the Settings tab 
4. Navigate to the Windows > Quarantine Management settings page
5. Make sure that Remove Old items automatically is enabled 
6. Change the amount of time for:
   1. Remove items Older than
7. Distribute the policy (Ctrl + D)

Issue:

We need to filter out Client Security or Server Security Application Control alerts being forwarded to Policy Manager. How can i change this alert setting in Policy Manager console and distribute it as a policy to clients? I do not want to receive Application Control security alerts to the Alerts page in the Policy Manager nor do I want email alerts. 

Resolution:

If you do not want an Application Control rule to send an alert, this can be changed in the Application Control rule itself:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to the Windows > Application control settings page
5. Select a rule from the table and click Edit rule
6. Disable the "Send alert" setting
7. Click OK
8. Distribute the policy (Ctrl + D)

Now when this Application Control rule is triggered on a client, it will not send an alert to the Policy Manager Console. Since there is no security alert no email alert will be sent either. 

If you do not want to edit rules manually, you can filter out all Application Control alerts from the Alert sending settings:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to the Windows > Alert Sending settings page
5. Click Add on the right side of the table
6. Select as condition: Source = Application Control 
7. Click OK
8. Distribute the policy (Ctrl + D)

Issue:

Is there a Web User Interface or local graphical user interface access (GUI) to configure Linux Security 64 on a Linux device? 

Resolution:

Linux Security 64 does not include a separate web user interface or local user interface to configure the clients. 

The client configurations need to be handled from the Policy Manager, or by a command line using the "lsctl" utility. 

To use the lsctl utility:

1. 1. Log in to the Linux host as root.
2. 2. Use the following commands:
   • To see the current value of a setting, run /opt/f-secure/linuxsecurity/bin/lsctl get [OPTIONS] [SETTING]
   • To assign a new value to a setting, run /opt/f-secure/linuxsecurity/bin/lsctl set [OPTIONS] [SETTING] [VALUE]
   • To add an entry to a setting that holds several values, run /opt/f-secure/linuxsecurity/bin/lsctl add [OPTIONS] [SETTING] [VALUE]
   • To remove an entry from a setting that holds several values, run /opt/f-secure/linuxsecurity/bin/lsctl del [OPTIONS] [SETTING] [KEY]
   • To clear the value of a setting, run /opt/f-secure/linuxsecurity/bin/lsctl reset [OPTION] [SETTING]
   • To see a list of the operations available for a setting, run /opt/f-secure/linuxsecurity/bin/lsctl help [OPTIONS] [SETTING]
   • To load product settings from a backup, run /opt/f-secure/linuxsecurity/bin/lsctl load [OPTIONS] [SETTING] [VALUE]
   • To get a list of all available settings, run /opt/f-secure/linuxsecurity/bin/lsctl -h

The get, set, add, del, and load commands support the following options:

–json, -j

Treat input as JSON and produce output in JSON format.

–raw, -r

This is currently the default. Raw is an alternative input/output format that is similar to JSON with the following changes:

• String values are accepted and returned without surrounding quotes.
• Boolean values accept additional expressions such as yes and no in addition to true and false.

The set, add, and load commands accept the following options:

–prompt, -p

Prompt for input using a text editor.

–file, -f [PATH]

Read the input value from a file. If the path is set to -, the input value is read from the standard input.

If you use the –prompt or –file options, do not enter a [VALUE] for the command.

More details about "lsctl" utility usage can be found in the Linux Security 64 user guide:
https://support.withsecure.com/userguides/product.html#business/linux-security-64/latest/en/configuring_settings-latest-en

There are also a list of commands that can be run from the Command line:
https://support.withsecure.com/userguides/product.html#business/linux-security-64/latest/en/command_line_usage-latest-en

Issue:

When Client Security or Server Security Browsing Protection or Web Content Control feature blocks a website (URL), the address is not included in the security alert. How to include the URL blocked by Client Security or Server Security in the Policy Manager alert?
 

Resolution:

By default the URL addresses blocked by the Client Security or Server Security Browsing Protection or Web Content Control features aren't listed in the alert that is sent to the Policy Manager Console. 

You can from the policy settings have this changed so that they are included, but please notice that the regional legislation regarding monitoring the web activity of users might limit your right to enable this feature. It is your responsibility to ensure you understand how your local laws relate to this feature, and that you are in compliance with them.

How to have the URL addresses of websites blocked by Browsing Protection and Web Content Control visible in the security alert:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab 
4. Navigate to Windows > Browsing Protection
5. In the General section, enable Include the blocked URLs in all alerts 
6. Distribute the policy (Ctrl + D)

Issue:

If in Policy Manager Console I cut or copy a policy domain and move or paste it under a different policy domain, will all the policy settings for the host devices stay the same? 

Resolution:

When you copy or move a policy domain in the Policy Manager Console's domain tree, all the policy settings of that policy domain are transferred also. If the policy domain that you copied or moved is not under a new parent policy, it will also inherit the policy settings from the parent policy. 

Example: 

If the policy that you copied had real-time scanning exclusion rules, those will carry over when you copy the policy domain to be under a new parent policy domain. If the parent policy domain has its own real-time scanning exclusion rules, the subdomain will inherit the parent domains real-time scanning exclusions so that you will have both the parent domain's and subdomain's exclusions in the "Files and applications excluded from scanning" list.