Issue:

How can I migrate from Client Security to Elements Endpoint Protection for Computers using Policy Manager?

Resolution:

You can follow the steps explained here on migrating from Client Security to EPP for Computers using Policy Manager Console.

Issue:

How do I install a hotfix for Windows Business Suite products?

Resolution:

You can do the following via the Policy Manager Console to install a hotfix for Windows Business Suite products:

1. Import the downloaded jar file into the Policy Manager Console, and export as MSI installer(which you can then execute the hotfix on the target host locally, or roll out via GPO/SCCM, etc.) for the standalone host:

a. Login to the Policy Manager Console
b. Select Installation
c. Click on Installation package
d. Click on the Import button
e. Select the downloaded jar file
f. Click on the Export button
g. Select the path to create the MSI installer

2. Import the downloaded jar file into the Policy Manager Console, and roll out the hotfix via policy-based installation for the centrally managed host:

a. Login to the Policy Manager Console
b. Select Installation
c. Click on Installation package
d. Click on the Import button
e. Select the downloaded jar file
f. Select target host or policy domain
g. Click on the Install button at the bottom of Installation
h. Select the hotfix
i. Click on OK button
j. Distribute the policy

Issue:

How to change the default installation path of WithSecure Client Security or Server Security using an MSI -package

Resolution:

WithSecure Client Security 14.10 and Server Security 14.00 and later versions include the support for changing the default installation path for the product. 

This can be accomplished using the MSI-startup parameter FORCED_TARGETDIR
To set it, use the parameters when launching the MSI or using a transform file

i.e. msiexec /i fsss-15.11.3-exported.msi FORCED_TARGETDIR="D:\test folder"

Issue:

I need to enable or disable the Browsing Protection feature on some client, how can I do it centrally using Policy Manager Console?

Resolution:

1. Open Policy Manager Console
2. Select a host or policy domain 
3. Go to the Settings tab
4. Go to the Browsing Protection settings page
5. Uncheck the box to Disable or Enable Browsing Protection
6. Distribute the policies (Ctrl + D)

Note: After you have chosen your setting, make sure that the padlock is closed, after that you can distribute the policies (Ctrl+D)
 

Issue:

How to disable Web Traffic Scanning (Advanced Network Protection) for WithSecure Client Security using Policy Manager policy settings?

Resolution:

To centrally disable Web Traffic Scanning (Advanced Network Protection) from target hosts in Policy Manager, follow these steps:

1. Log in to the WithSecure Policy Manager Console
2. Select a host or policy domain from the Domain Tree
3. Go to the Settings tab and use Standard View
4. Go to Web traffic scanning section
5. Choose from HTTP Scanning HTTP scanning enabled and set the value as disabled
6. Distribute the new policy with the Distribute policies (Ctrl + D) button

Once the hosts have received the new policy, the Web Traffic Scanning will be disabled on the target hosts.

Issue:

FSMAUTIL is no longer available for WithSecure Business Suite Server Security / Client Security 15.x or 16.x, how do I reset the host's unique ID (UID)?

Resolution:

In WithSecure Server Security/Client Security 15.x, there is a new tool introduced called resetuid.exe to reset the host identity. This tool will replace FSMAUTIL (F-Secure Management Agent Utility) for both the products. The tool can be found in C:\Program Files (x86)\F-Secure\Client Security\BusinessSuite\ (Client Security 15.x) or 
C:\Program Files (x86)\F-Secure\Server Security\BusinessSuite (Server Security 15.x).

Check the Help page for the procedure.

Usage:

RESETUID SHOWUID  Shows the host Unique Identity currently in use.

RESETUID RESETUID {SMBIOSGUID | RANDOMGUID | WINS | MAC} [APPLYNOW] Schedules regeneration of the host Unique Identity using one of the specified methods:

• SMBIOSGUID        – uses SMBIOS GUID
• RANDOMGUID      – uses randomly generated GUID
• WINS                      – uses WINS (NetBIOS) name
• MAC                       – uses MAC (ethernet card) address
• APPLYNOW           – If the product is running, requests to apply new Unique Identity immediately. Otherwise, it is applied to the next start of the product.

Issue:

When using image files to distribute product installations, how can I reset the host UID for Policy Manager Proxy to prevent duplicate hosts appearing in Policy Manager?

Resolution:

If you use image files to distribute product installations, you need to make sure that there are no unique ID conflicts. For Policy Manager Proxy this can be prevented by following the steps below:

1. Stop F-Secure Policy Manager Server service: 
   • Linux: [/etc/init.d/fspms stop]
   • Windows: [net stop fsms]
2. Remove following two files:
   • Linux:
     • /var/opt/f-secure/fspms/data/h2db/fspms.h2.db
     • /var/opt/f-secure/fspms/data/fspms.jks
   • Windows:
     • <F-Secure Installation Folder>\Management Server 5\data\h2db\fspms.h2.db
     • <F-Secure Installation Folder>\Management Server 5\data\fspms.jks
3. Use fspmp-enroll-tls-certificate script to generate proxy node certificate. Run the script and authenticate yourself as root administrator of the Master Policy Manager:
   • Linux: /opt/f-secure/fspms/bin/fspmp-enroll-tls-certificate
   • Windows: <F-Secure Installation Folder>/Management Server 5/bin/fspmp-enroll-tls-certificate.bat
4. Start F-Secure Policy Manager Server service:
   • Linux: [/etc/init.d/fspms start]
   • Windows: [net start fsms]

Issue:

Emails sent to a user never arrive because the user is not recognized as a verified recipient and are therefore blocked. How to add the user as a verified recipient on a Protection Service for Email (PSE) or Messaging Security Gateway (MSG) appliance? 

Resolution:

1. Log in to the PSE / MSG appliance
2. Select the System tab from the top
3. Go to the User Management section from the menu of the left 
4. Go to Users 
5. Click Add User 
6. Enter the user's details and click Add Entry

Now you can verify that the emails sent to the user are no longer blocked.

Issue:

How can I manually isolate Client Security hosts from the network with WithSecure Policy Manager?

Resolution:

You can isolate one or more hosts from the network in your WithSecure Policy Manager.

Note: Use network isolation with caution and only in case of a network attack.

1. Select the target host in the policy domain tree
2. Go to the Operations tab
3. Click Isolate under Network isolation. This isolates the selected host from the network
4. To reconnect an isolated host to the network, click Release on the Operations tab

Isolated hosts are shown on the Host issues section of the dashboard.

This feature is only available in Policy Manager 14.10 and later.

Issue:

How to create a custom firewall rule (service) for Client Security or Server Security in Policy Manager Console?

Resolution:

To create a custom firewall rule over the Policy Manager Console:

For Client Security 14 and 15

1. Open the Policy Manager Console and go to the Settings-tab
2. Go to Firewall, using Standard view (changeable in the upper right corner)
3. Make sure the 14.X / 15.x clients-tab is selected
4. Select the profile you want to edit from the Profile being edited-dropdown menu (if the list only contains the default profiles, clone the one you want to use as a base as the defaults can't be modified)
5. Click Add rule on the right of the firewall rules list and create the rule as needed (see step 6 if the service required is missing)
6. If the service you want to add is missing, click on Configure network services below the firewall rule list. Click Add and follow the steps to add a new firewall service
7. Check the Enabled-checkbox to the left of the rule name to make sure that it is in use
8. Distribute the new policy by clicking the symbol in the upper left corner of the interface, or by pressing Ctrl+D

Note: The firewall profiles are shared between all policies. If you want to have a single host or policy domain use different firewall rules, you will have to create a new firewall profile and select that policy domain or host to use that profile. We recommend to do it like this:

1. Log in to the Policy Manager Console
2. Go to the Settings tab
3. Select your existing firewall profile from the "Profile being edited" drop-down menu and click Clone
4. Give the new profile a name and click OK
5. Edit the newly created firewall profile to your liking
6. Select the single host or policy domain from the Domain tree
7. Depending if the host is a Workstation or Server, select the newly created profile from the "Workstation host profile" or "Server host profile" drop-down menu
8. Distribute the policy (Ctrl + D)

To create a custom firewall rule locally on the workstation:

In versions 14.00 and later, rules are added through the Windows firewall settings. You can reach them through the Client Security or Server Security user interface:

1. Open Client Security or Server Security user interface
2. Go to Settings
3. Click on Firewall settings
4. Click on the Change Windows Firewall settings…-link to be brought to the Windows firewall settings