Issue:

After migrating the Policy Manager Server to a new server, the managed Client Security or Server Security hosts stop receiving the policy updates. How to make the managed hosts connect to the new Policy Manager Server to receive the policy update again?

Resolution:

In case the old Policy Manager Server is available, do the following:

Export the admin key pairs (admin.pub & admin.prv) from the old Policy Manager Console

1. Log in to the Policy Manager console at old server
2. Choose Tools
3. Choose Server configuration
4. Choose Keys and Export

After this import the admin key pairs (admin.pub & admin.prv) to the new Policy Manager Console

1. Log in to the new Policy Manager Console
2. Choose Tools
3. Choose Server configuration
4. Choose Keys and Import

Change the management server address in the old Policy Manager Console to use the hostname/IP of the new Policy Manager Server, and distribute the policy:

1. Go to the old Policy Manager Console
2. Select a policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > Centralized management
5. Enter in the Policy Manager Server address field the new policy manager's server address.
6. Distribute the policy (Ctrl + D)

The hosts will start connecting using the new management server address once the hosts picked up the new policy from the old Policy Manager Server.

Also make sure on the new Policy Manager server that you have allowed inbound HTTP and HTTPS traffic from the firewall.  

In the event that a small number of hosts are affected and not all hosts, try to reinstall the Client Security or Server Security client on the affected hosts. You can export a new installation file from the Policy Manager Console.  

Issue:

Is it possible to revert previous (temporary) policy changes back in Policy Manager Console after policies have already been distributed, or find out the previous values for those changes?

Resolution:

It is not possible to revert back to a previous policy. However, from the Policy Manager's policy audit log (fspms-policy-audit.log) you can find what are the previous changes, and who has done those changes:

In Windows the audit log can be found from:
C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\log\

In Linux the audit log can be found from:
/var/opt/f-secure/fspms/logs
 

Issue:

Can the Business Suite (Client Security or Server Security) Device control feature allow executables to be run on a specific device but block other removable storage devices?

Resolution:

Yes, the allow executables to run and allow write access rules for removable storage devices can be set on a per device level., so that on specific mass storage devices they are always allowed. 

Follow these steps:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to the Windows > Device Control settings page
5. In the Removable storage devices section, disable both:
   1. Allow write access 
   2. Allow executables to run
6. Click on the "Configure removable storage devices where execute and write permissions are allowed" button
7. Enter the HardwareID of the storage devices which you want to allow 
8. Click Close 
9. Distribute the policy (Ctrl + D)

Issue:

When the Client Security or Server Security Web traffic scanning (Advanced Network Protection)  feature is enabled, some applications are slow to start, unable to connect to an internal server and some URLs are inaccessible or some applications have connectivity or performance issues

Java-based applications are slow to start or unable to connect to an internal server or there are connectivity issues.

Resolution:

If the Web Traffic Scanning is causing issues for an application that connects to an internal server or slowness in some Java based applications, you can add the server address as trusted.

This will exclude the network traffic from Web Traffic Scanning.      

How to add the server address as trusted:

1. Log in to Policy Manager Console
2. Select the host or domain from the Domain Tree
3. Go to the Settings tab 
4. Go to the Web content control page
5. Click Add on the right side of the Trusted sites list
6. Enter the server address in the Address column
7. Distribute the policy (Ctrl+D)

No wildcard is needed in the address, for example:

• http://193.110.109.55
• http://sql-server-2008:8080
• SAMPLESERVER:8080

     
If the steps above did not solve your problem, disable Botnet Blocker to see if it is the cause for the issue.

       How to disable Botnet blocker:

1. Log in to Policy Manager Console
2. Select the host or domain from the Domain Tree
3. Go to the Settings tab and select Standard view
4. Navigate to Web traffic scanning and select Botnet Blocker
5. Set the DNS query filtering to Allow all queries
6. Distribute the policy (Ctrl+D)

If disabling disabling the Botnet blocker did not solve the issue, disable DeepGuard temporarily and then try to reproduce the issue. How to disable DeepGuard:

1. Open the Client Security local user interface
2. Go to the Malware Protection tab
3. Click Edit settings from the left side of the user interface to enable administrator rights
4. Disable DeepGuard using the on / off switch

If the issue is resolved by disabling DeepGuard, you can create a global scanning exclusion for the affected application in the policy:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to the Real-time scanning settings page
5. Scroll down to the Files and applications excluded from scanning table and enable Do not scan the following files and applications 
6. Click Add on the right side of the table 
7. Add the application path and click OK
8. Distribute the policy (Ctrl + D)

It is also good to make sure ORSP Service (Security Cloud) is enabled. You may find more information about the Security Cloud here       

How to enable ORSP via Policy Manager console:

1. Log in to Policy Manager Console
2. Select the host or domain from the Domain Tree
3. Go to the Settings tab 
4. Navigate to Windows > Real-time scanning 
5. Enable Use Security Cloud
6. Distribute the policy (Ctrl+D)

You can run the WithSecure Connection Checker Tool found in the Client Security or Server Security installation folder to make sure that the connectivity to all the back-end services is OK.

Issue:

How can I install Policy Manager Console 16.00 as stand-alone, so that it installs only the Console and not also Policy Manager Server?

Resolution:

You can install Policy Manager Console separately by using msiexec.exe with NOSERVER=true parameter.

Example command:  msiexec.exe /i C:\temp\wspm-windows-msi-16.00.98215.msi NOSERVER=true

Note that the location where the .msi installation file resides depends on where you saved it when you downloaded it. 

Issue:

Via proxy or direct connection, Client Security is not receiving updates from Policy Manager. The following errors are visible in AUA.log:

Connecting to http://<Policy Manager IP address>/guts2/ via http proxy <Proxy IP address>
Update check failed. There was an error connecting http://<Policy Manager IP address>/guts2/ via http proxy Proxy IP address (Server error)
Connecting to http://Policy Manager IP address/guts2/ (no http proxy)
Update check failed. There was an error connecting http://<Policy Manager IP address>/guts2. (Unspecified error)
Connecting to http://Policy Manager IP address/ via http proxy Proxy IP address
Update check failed. There was an error connecting http://Policy Manager IP address/guts2/ via http proxy Proxy IP address (Server error)

Resolution:

Connectivity

Test the connectivity from the host to Policy Manager Server by using the HTTP and HTTPS protocol:

1. Open any web browser on the host that has Client Security installed.
2. Enter the IP address of the Policy Manager and press Enter.
3. Repeat the test, only this time by using the HTTPS protocol (for example https://192.168.0.10:443/).

If the HTTP (automatic updates) and HTTPS (management agent) connections are working, a webpage from the Policy Manager Server should be displayed. 

If the connection fails, troubleshoot the network connectivity between the host and Policy Manager at your end. Verify whether the host and the server can reach each other (for example through corporate firewall, switches or a proxy).

Policy Manager Proxy

If the intermediate proxy is a Policy Manager Proxy instance and the clients are unable to download updates through it, ensure that Policy Manager Proxy can connect to the internet directly as the default configuration for the Policy Manager Proxy is forward mode.
In forward mode, the Policy Manager Proxy fetches the required definition updates from the internet and not from Policy Manager Server. This configuration is controlled by changing the proxy mode to either reverse or forward via the registry. 

Reverse vs. forward modes define whether the virus definitions and software updates are retrieved directly from the internet or from the configured upstream Policy Manager Server or other proxy. Forward proxy is used to minimize traffic between networks, for example between a branch office and HQ. Reverse proxy is used for example in environments where the proxy has no direct connection to the internet, or to minimize the load on the master server (or other forward proxy). By default the proxy is installed in forward mode. Set "-DreverseProxy=true" additional Java argument to switch it to the 'reverse' mode.

You can verify whether Policy Manager Proxy can download updates by analyzing this log file:

C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\log\fspms-download-updates.log

The following message is an example of downloading updates failing:

26.03.2019 14:47:44,034 ERROR [c.f.f.s.g.d.DownloadUpdatesService] - Error while checking latest updates
org.apache.http.conn.ConnectTimeoutException: Connect to guts2.sp.f-secure.com:80 [guts2.sp.f-secure.com/2.21.76.146, guts2.sp.f-secure.com/2.21.76.152] failed: connect timed out.

Note: It is not supported to use the same host for the value of the Policy Manager Server and have it in the list of available Policy Manager Proxy servers. This might have the clients end up in a state were they will not use the local Policy Manager Server or Proxy at all, especially if the setting to allow fallback to the Policy Manager Server is disabled.

HTTP Proxy

If the host where the client is installed requires an HTTP proxy to communicate into the network of the designated Policy Manager or internet, follow these steps to enable this setting:

1. Log on to your Policy Manager Console.
2. Select the Policy domain or Host from the policy domain where you want to edit the policy on.
3. Go to Settings > Windows > Centralized management > Internet connections 
4. Choose how to obtain the HTTP proxy settings, if applicable
5. If you choose User-defined, type in the address in the text field below
6. Distribute the policy (Ctrl + D) 

Note: If you type in a user defined HTTP proxy address, always use the required protocol. 

Examples:

http[s]://[user[:password]@]host:port, for example:
http://myproxy.com
http://myproxy.com:8080
http://johndoe@myproxy.com
https://johndoe:secretpassword@myproxy.com

Issue:

When the Policy Manager Server forwards event logs to the syslog server, the log comes in UTC time format. Can it be changed to the Policy Manager Server's operating system time format? 

Resolution:

Regarding the syslog timestamp from Policy Manager Server — this is by design. Policy Manager Server always forwards event logs to the syslog server using UTC+0 timestamps, and there is currently no configuration option to change the timezone to local time (UTC+8 or any other).

As a workaround, we recommend configuring your syslog receiver or SIEM platform to apply a timezone offset when ingesting the logs. Most syslog solutions support converting UTC timestamps to a local timezone on the receiving side.

Issue:

I need to update Client Security 15 or older in an offline or isolated environment, where internet is not available.  I used to use f-secure-updates.zip to do that, but it is no longer created when the fspm-definitions-update-tool.bat is ran. 

Resolution:

Client Security 15 or older versions are no longer supported.  Client Security 15 and older versions connect to old f-secure.com update servers which are no longer online. You will need to upgrade to Client Security 16 or later so that you can use the withsecure-updates.zip. 

Issue:

Why do Client Security and Server Security host devices send the following alert to the Policy Manager Consoler Alerts tab?

Access to file was blocked.
Application path: C:Example\Example.exe
Path: C:\ProgramData\Example\Example\

Resolution:

This type of block is the function of the Tamper Protection functionality. The alerts you are seeing are expected behaviour and not a cause for alarm.

Tamper protection functionality sees that some process tries to open a protected file with write access rights. Tamper protection blocks this operation, so the application gets ACCESS_DENIED error. Importantly, this block does not affect the normal operation of either third party application or Client Security itself, it is a cosmetic alert.

To stop the flood of alerts without reducing your protection level, you can create an alert sending exclusion in Policy Manager Console for that specific alert type:

1. Log in to Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to the Alert sending page
5. Scroll down to the Alert sending exclusions list and click Add
6. Select Source as Tamper protection
7. Select the Type, Action and Alert shown in the security event
8. Click OK to finish adding rule
9. Distribute policy (Ctrl + D)

Issue:

I need the download link to an older version of Policy Manager / Server Security / Client Security. Can you send me the download link?

Resolution:

Previous versions of WithSecure products can be found in Partner Portal. If the version required is not there, please contact WithSecure and provide which product and version is needed, along with the reasons.

Gentle reminder to always use the latest version, as older versions may contain bugs and vulnerabilities that has been fixed in the latest version. End of Life versions may eventually no longer receive virus definition updates, and ineligible to receive support if there are any issues.