Issue:

• I have Client Security and Server Security Standard installed, and have enabled the web content control to block the adult category. Why am I able to reach the porn site still?
• I'm having a problem with Web Content Control, it doesn't block any of the categories set as "Disallowed". 

Resolution:

The Web Content Control feature is available only on the Premium subscriptions of Client Security  or Server Security. You can refer to the following release note for more information: https://community.withsecure.com/discussion/125299/business-suite-client-security-and-server-security-changelog#latest

If you have the Client Security Premium or Server Security Premium product license, we advise that you switch your Client Security or Server Security to the Premium version.

NOTE: In case you have Client Security Premium or Server Security Premium installed, ensure that the Security Cloud is not disabled in the Policy Manager Console:

1. Open the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > Real-time scanning page
5. Enable "Use Security Cloud"
6. Distribute the policy (Ctrl+D)

Also, the connectivity towards the Security Cloud(*.fsapi.com and *.f-secure.com) should be whitelisted on the proxy/firewall.

If none of the above-mentioned helps, you may clear the cache files by doing the following and try again:

1. Open a Command prompt as an administrator
2. Stop the service by running the following command:
   • net stop fsulnethoster
3. Open the Windows registry editor (regedit), backup and clear values under HKEY_USERS\S-1-5-20\SOFTWARE\F-Secure\Ultralight\Doorman
4. Remove all files from "C:\Windows\ServiceProfiles\NetworkService\AppData\Local\F-Secure\fsscor"
5. Start the service by running the following command: 
   • net start fsulnethoster

Issue:

When trying to deploy WithSecure Client Security or Server Security installation from the Policy Manager Console via Push Installation method , user receives error code 5.

Resolution:

Error code 5 means that the host was reachable, but the access from the instructing system / account was denied.

Verify these points, to ensure the push installation can be instructed and executed on the remote host:

• The installation account has appropriate permission on the host (has to be local or domain administrator)
• Enable the remote registry service on the host: Control Panel -> Administrative Tools -> Services -> Remote registry
• Administrator share is enabled on the target host (this share is utilized by the push installation procedure)
• Both Policy Manager Server and workstation are on the same network
• Certain inbound traffic needs to be allowed to the host, such as RPC (TCP 135 Port), NetBios (137-139)  and SMB (TCP 445 port)

In case the target host is running on Windows 8 or newer, the following registry should be set on the remote host to enable access to the admin share

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"LocalAccountTokenFilterPolicy"=dword:00000001

Issue:

Firewall rule creation fails for one or more WithSecure Client Security hosts. WithSecure Policy Manager Console host Alerts list shows either one of the following alerts:

Warning: F-Secure firewall rule creation or modification failed.
From: <hostname>, <date/time>
Details: F-Secure firewall rule creation or modification failed. Rule name: <FirewallRuleName> (F-Secure) Error: Remote address is invalid Additional data: <domainName>

Warning: F-Secure firewall rule creation or modification failed.
From: <hostname>, <date/time>
Details: F-Secure firewall rule creation or modification failed. Rule name: <FirewallRuleName> (F-Secure) Error: Remote address is invalid Additional data: <ip.address goes.here ip.address.goes.here ip.address.goes.here>

Resolution:

If you have ::1 included which is the loopback address, this is not allowed. You need to specify addresses or ranges.

When in doubt, you can always try to add the rule manually via Windows Firewall and see the result.

Resolution if the Additional Data field contains a domain name:
When the firewall rule is implemented via the policy, the WithSecure Firewall Plug-in on the local client will try to resolve the domain name. Successfully resolved IP addresses are then used for the firewall rule creation. 

The entry will have a TTL (time-to-live) of 240 minutes, after which the resolution of the domain name will be triggered again, in case the IP-addresses have changed. Currently the entries can hold up to 128 IP addresses per host/entry.

Note: If the address for the firewall rule is internal and the WithSecure client's host is currently remote without VPN connection to the internal network, the resolution will most likely fail.

Also, if DNS-queries are not forwarded, it can happen that the resolution of the domain name will fail. 
Both scenarios might show the following error: WithSecure firewall rule creation or modification failed. Rule name: <FirewallRuleName> (F-Secure) Error: Remote address is invalid Additional data: <domainName>

Resolution if the Additional Data field contains a list of IP-addresses:
Double-check the formatting of the remote hosts-field for the firewall rule. For example, if multiple IP-addresses are specified, they need to be comma-separated. If the error message lists the addresses without commas, it could be an indicator that they are missing from the field.
The firewall rule creation wizard has tooltips on how to format entries in the remote hosts-field.

If you wish to filter out these alerts, follow these steps:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to the Alert sending page
5. Look to the right of the Alert sending exclusions list and click Add
6. Select Firewall as the Source 
7. Add a condition and select rule creation or modification failed as the Alert
8. Click OK
9. Distribute the policy (Ctrl + D)

Note: This will only make it so that new alerts will not appear on the alerts list. If you want to remove old alerts from the list, you can search all similar alerts with the search functionality, select all the similar alerts and then click delete. 

Issue:

Windows Defender was uninstalled after installing WithSecure Server Security 15.10 on Windows Server 2016.
On ESS manual (SS should be the same as well) describes below.
===
After installing the product on Windows Server 2016 or newer, you need to explicitly disable or uninstall Windows Defender.
===
https://help.f-secure.com/product.html#business/email-server-security/15.00/en/task_423BA82B96694FA2A64F7EDE3787C225-15.00-en

Does this mean that Windows Defender is not automatically uninstalled even though "Switch off Windows Defender during installation" is enabled?
Is this expected behavior?
There are other servers which Windows Defender was not uninstalled but it was just disabled. What is the difference?

Resolution:

Actually Server Security uninstalls Windows Defender from the server.
But it will be enabled back upon our product uninstallation.

In case, it's necessary for Windows Defender to get back without uninstalling our product, they can run this command in powershell with admin rights.

powershell Install-WindowsFeature -Name Windows-Defender

We don't actually log the output of Windows Defender disabling attempts – there could be different reasons why Windows Defender can't be uninstalled in some cases, e.g., GPO settings on the server.

Customer can, for example, try the command

powershell Uninstall-WindowsFeature -Name Windows-Defender

by themselves on the affected server, and see if it works.
 

Issue:

Will the WithSecure Policy Manager auto discovery feature work if hosts located in different subnets or domains?

Resolution:

There should be no issue for WithSecure Policy Manager to auto discover NT Domains to detect the hosts as long as;

• The hosts can communicate to the Policy Manager Server
• There is no block between host and Policy Manager Server (eg: firewall, proxy etc.)
• There is trust relationship between the different domains

If there is an issue where the NT Domains are not showing the hosts, it is recommended to run the net view command to troubleshoot the issue.

Issue:

I executed fspmp-enroll-tls-certificate.bat for Policy Manager Proxy and it gives me the error "Error: CA certificate verification failed" or "RA not issued by CA".

Resolution:

This error can occur if the server's Simple Certificate Enrollment Protocol (SCEP) is not up to date. You can follow the steps below on the Policy Manager Server to resolve this:

1. Launch Command Prompt as administrator
2. Type net stop fsms and hit Enter to stop Policy Manager Server services
3. Delete the fspms.jks file from the Policy Manager Server installation folder (…\F-Secure\Management Server 5\data)

4. In Command Prompt, navigate to the folder mentioned in Step 3. 

5. Type the following command below one after another: 

• C:\Program Files (x86)\F-Secure\Management Server 5\jre\bin\keytool.exe" -delete -alias fspm-ra-encryption -keystore fspms-ca.jks
• C:\Program Files (x86)\F-Secure\Management Server 5\jre\bin\keytool.exe" -delete -alias fspm-ra-signing -keystore fspms-ca.jks 

6. Type net start fsms and hit Enter to stop Policy Manager Server services

Last, you need to run the fspmp-enroll-tls-certificate.bat script located in the Policy Manager Proxy Server installation folder. (…\F-Secure\Management Server 5\bin\fspmp-enroll-tls-certificate.bat), and restart PMP service.

For Linux

The main issue is the CA certificate was updated, but SCEP certificates were not on the Policy Manager.

So to fix the issue we should delete Simple Certificate Enrollment Protocol (SCEP) certificates from fspms-ca.jks.
 

On Policy Manager Server machine:

   1) stop FSPMS service;
   2) delete fspms.jks ;
   3) run under data folder (/var/opt/f-secure/fspms/data/ ) next:
      – /opt/f-secure/fspms/jre/bin/keytool -delete -alias fspm-ra-encryption -keystore fspms-ca.jks
      –  /opt/f-secure/fspms/jre/bin/keytool -delete -alias fspm-ra-signing -keystore fspms-ca.jks ;
   4) start FSPMS service

On Policy Manager Proxy machine :run fspmp-enrol- tls-certificate script (/opt/f-secure/fspms/bin/), and restart PMP service.

Issue:

What ports are used for communication between Policy Manager Server and Linux Security 64 ?

Resolution:

Check connectivity from host to Policy Manager Server using HTTP Browser. If your Linux host does not have GUI, check connectivity using these commands:

curl -o https-host -k  https://:PMS_address:port_number
curl -o http-host http://:PMS_address:port_number

Linux Security 64 uses HTTP and HTTPS connections, therefore port numbers that are set for these protocols needed to be allowed.
By default, these are the port numbers:
HTTP : 80
HTTPS : 443

The same port is used for:

• downloading updates,
• downloading base-policies from the Policy Manager Server (settings),
• uploading status information to the Policy Manager Server.

Issue:

When trying to uninstall WithSecure Policy Manager from a Windows Server, uninstallation fails due to "Unable to load the uninstallation plugin DLL" error-message.

Resolution:

This error message occurs, when the server hosts an old, unsupported version of WithSecure Policy Manager or the installation has been partially corrupted.

There are two options to solve this issue:

1. Install the latest version of Policy Manager. After the upgrade, uninstallation should work correctly.
2. Remove the old Policy Manager using the Uninstallation tool.

NOTE: The Uninstallation Tool should be only used as a last resort and at your own risk.

Issue:

Why is the Software Updater button missing from the WithSecure Client Security main user interface? 

Resolution:

Do note that Software Updater feature is only available on Premium version of Client Security and Server Security. You may refer to our release notes here:

https://help.f-secure.com/product.html?business/releasenotes-business/latest/en/fsss-latest-en

https://help.f-secure.com/product.html?business/releasenotes-business/latest/en/fscs-latest-en

If the Software Updater button is not shown for local users in the user interface, it has been most likely disabled from the policy. 

Follow these steps to enable the Software Updater user interface for the local users:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab (standard view)
4. Go to the Software Updater settings 
5. Enable the setting Show Software Updater options to users
6. Distribute (Ctrl+D) the policy

Once the policy has been received by the clients, users will be able to see the Software Updater button in the main user interface. Using the Software Updater local feature, the users can see which updates are available and select to install them on their computers. 

Issue:

When exporting Client Security for Windows / Mac or Server Security 16 installer for local installation, push installation or upgrade, the HTTP,/ HTTPS ports and the Policy Manager server addresses are grayed out. 

Resolution:

This is by design. The Policy Manager Server address and the HTTP / HTTPS ports need to be pre-configured from the policy before continuing with the installation wizard. We recommend to not leave the ports and addresses blank or empty on the root level. 

Follow these steps:

1. Log in to the Policy Manager Console 
2. Select either Root, Policy domain or single host from the Domain tree 
3. Go to the Settings tab
4. Go to the Centralized management settings
5. Enter the Policy Manager Server address, HTTP and HTTPS ports
6. Distribute the policy (Ctrl + D)

Then you can select the policy with the correct Policy Manager Server address and ports in the Initial policy step of the installation wizard:

• Select Default policy if you have set the address and ports for the whole Root 
• Select Policy for and select the policy domain or host if the settings have been created for a specific policy domain or host

Once it is done, you may proceed with the exporting of our product installer, where the Policy Manager Server address and HTTPS port are displayed according to your configurations in the policy.