Issue:

A software in our environment sends out regular emails to internal and external recipients. A tag is added to the subject line to have these messages encrypted by MSG.
Only the messages intended for internal recipients are being encrypted, all messages from the software to external recipients arrive unencrypted.

Resolution:

Start by verifying that these messages are being routed through the MSG-appliance. It is possible that the software has different routing rules based on domains and that the external traffic isn't routed to the MSG-appliance at all.

In MSG, you can check the details of a message using Smart Search:

1. Log in to the MSG Web UI
2. Make sure the System-tab is selected at the top
3. On the left-hand menu, navigate down to Smart Search-> Search
4. Use the sender and/or recipient information to search for the message. Do note that the Time-field usually is set to Last 24 Hours, which might be too restrictive, so expanding it to for example Last 7 Days is recommended.
5. If you find messages, you can verify their encryption status by checking the envelope symbol at the left of the message row. If it has a small lock on it, the message is encrypted. 
6. Expand the message info by clicking the small + next to the envelope symbol to see more details. Here the Encryption-field should also be set to Proofpoint Encryption/Secure Reader Encrypted if the message is encrypted.

If you find messages that should be encrypted but aren't, open a support ticket so that it can be investigated. Provide the appliance-ID and information about the messages so that we can identify them (sender/recipient info, time when it was sent, subject field text). A sample message saved as .eml or .msg is also useful.

To ensure that we can help you efficiently, please make sure that the following IP-addresses can access the MSG-appliance on ports 22 and 10000:

203.112.232.170                 F-Secure Support / Kuala Lumpur
193.110.108.33                   F-Secure Support / HTC Helsinki
208.86.202.10                     Proofpoint
208.84.66.21                       Proofpoint
208.84.67.21                       Proofpoint

Issue:

Windows Management Instrumentation (WMI) Integration with Policy Manager for Windows

Resolution:

Policy Manager supports Windows Management Instrumentation (WMI) Integration. See this user guide for more information: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/concept_E55FFF0187A54B79B30637C7983BDCC8-16.00-en
 

Issue:

Does Policy Manager create and maintain an audit log for user and admin activity? For example for these events:

• User login / logoff
• Host deletion  / add / rename events
• Policy sub-domain deletion / add / rename events 
• Change of policy settings

Resolution:

The Policy Manager Server logs can be found in the following folder:

• C:\Program Files (x86)\F-Secure\Management Server 5\logs

The user login actions are recorded in the fspms-users.log. The log does not show the full user name, only the User ID. To get the full user name, a query must be performed using the H2Console. The H2Console is not enabled by default, so it will need to be enabled before you can run the query. 

Note: Please backup your registry before making any registry changes

1. Open Registry Editor (regedit)
   • Policy Manager 15: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Data Fellows\F-Secure\Management Server 5\
   • Policy Manager 16: HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server
2. Edit "additional_java_args"
3. Add parameter: -Dh2ConsoleEnabled=true
4. Close registry editor and restart  Policy Manager Server service by running command line commands net stop fsms and net start fsms (net stop wspms and net start wspms for Policy Manager 16)

How to open H2Console and run query:

1. Open a browser and go to https://localhost:8080
2. Click the H2Console link
3. Type in query: SELECT * FROM users;
4. Click Run (Ctrl+Enter) to run the query

You will receive a result showing which user names correspond to which User ID. 

Changes made to policy settings are saved in fspms-policy-audit.log.

Changes made to the Policy domain computers/servers or specifically changes made to the policy domain structure are saved in fspms-domain-tree-audit.log.

Another log to look into is fspms-active-directory-rules.log. For example, in case the AD synchronization rule was executed, and the host with unique ID, 4d896695-8de1-4f96-9c29-0ebd2bb60418 was moved into a domain, you will find the following is logged:

20.06.2022 17:59:01,276 INFO [activeDirectoryRules] – Starting to process manually triggered rule [ruleId=5, domainController='LDAP://<domain name>', containerDn='OU=<OU name>,DC=<partial domain name>,DC=<partial domain name>', containerGuid='XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', targetDomainId=<policy domain ID>, enabled=true]
20.06.2022 17:59:01,386 INFO [activeDirectoryRules] – 1 hosts found in Active Directory, 0 of them unmanaged
20.06.2022 17:59:01,388 INFO [activeDirectoryRules] – Domain <policy domain name> updated
20.06.2022 17:59:01,390 INFO [activeDirectoryRules] – Host having identity 4d896695-8de1-4f96-9c29-0ebd2bb60418 moved
20.06.2022 17:59:01,416 INFO [activeDirectoryRules] – Rule was successfully processed

Q: How to find out who deleted a policy sub-domain in Policy Manage Console?
A: This information is available in the fspms-domain-tree-audit.logs. Below is an example, where a sub-domain called test was added and immediately deleted.

05.12.2019 09:44:17,785 INFO [audit.domainTree] – User 'admin' added domain test (id=76) to domain Root (id=1)
05.12.2019 09:44:23,615 INFO [audit.domainTree] – User 'admin' deleted domain test (id=76)
 

Issue:

My devices are getting blocked. How can I grant access to specific devices on Policy Manager?

Resolution:

You can set rules to allow a specific device while all other devices under the same class are blocked.

You need to know the hardware ID of the device that you want to allow before you can create a rule that grants full access to the device.

To add an exception to a rule, follow these instructions.

1. Get the hardware ID for the device that you want to allow. The hardware ID has to be more specific than the ID which is used to block the device.
2. Go to the Settings tab and select Windows > Device control.
3. On the Device access rules table, click Add.
4. Enter the hardware ID for the device as the Hardware ID in the new rule.
5. Set Access Level to Full access to allow the use of the device.
6. Set Active to Yes for the new rule.
7. Distribute Policy

Issue:

Do DeepGuard exclusions accept Windows environment variables or wildcards when the exclusion is created through WithSecure Policy Manager?

Resolution:

DeepGuard exclusions for WithSecure Client Security, Server Security and Email and Server Security products support wildcards for DeepGuard exclusions. Follow these steps to create an exclusion using a wildcard:

1. Log into Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab and select Standard view
4. Go to Real-time scanning 
5. Scroll down and enable Do not scan the following files and applications 
6. Click Add and select Folder path
7. Enter the folder path, for example: *\examplefolder\subfolder\* and click OK
8. Distribute the policy (Ctrl + D)

More examples can be found in the following F-Secure Community article: https://community.f-secure.com/business-suite-en/kb/articles/5665-using-wildcards-in-exclusions-in-real-time-scanning

Issue:

DNS resolution for certain sites are blocked with the product installed. How to avoid this from happening?

Resolution:

Most likely the DNS resolution is blocked by the Botnet Blocker feature. The site is rated as unsafe and hence blocked by the feature.

1. Share the URL with the Labs team, for further investigation. The Labs team will whitelist the URL if the site is not malicious: https://www.withsecure.com/en/support/contact-support/submit-a-sample

2. Whitelist the blocked site or the IP address of the blocked site via the Advanced View in the PM Console at:

1. Log in to Policy Manager Console
2. Highlight a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to Web content control settings
5. Click Add from the right side of the Trusted sites list
6. Add the site or domain URL in the address field
7. Distribute the policy (Ctrl + D)

Issue:

The symptoms include

• Clients are unable to download updates from the Policy Manager Server
• Clients are unable to upload status information to the Policy Manager Server and will eventually show up in Policy Manager Console as disconnected hosts

However, clients might still be able to download updates because in the default configuration, fallback to WithSecure update servers is allowed.

A couple of logfiles on the endpoint help to establish, if the client is having a connection problem due to the firewall blocking access on the server.
Examples are for Client Security 14 but also apply for Server Security 14 and later. Policy Manager Server here is pms.acme.com listening on default ports 80 and 443.

C:\ProgramData\F-Secure\Log\AUA\Aua.log

2019-10-02 12:07:25.311 [15d4.1d50]  I: Connecting to pms.acme.com:80/guts22019-10-02 12:07:46.349 [15d4.1d50]  I: Update check failed, error=110 (connection timed out)

Same is also visible in this log file:

2019-10-02 12:17:37.502 [15d4.1d68]  I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from pms.acme.com:443 with HTTP proxy ''2019-10-02 12:17:58.535 [15d4.1d68] *E: UpdatablePmCertVerifier::RenewCertificates: Failed to download certificate bodies (FsHttpRequest::Error_Timeout, AsyncSendRequest failed: 12002)2019-10-02 12:18:07.536 [15d4.1d68]  I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from pms.acme.com:443 with HTTP proxy ''

Error 12002 translates to 

12002 ERROR_INTERNET_TIMEOUT The request has timed out.

Resolution:

WithSecure Server Security uses the Windows Firewall. It is likely that the ports that the HTTP and HTTPS services are using are blocked in the firewall on the server where Policy Manager Server is installed in. This would cause the clients to be unable to be in contact with the Policy Manager Server.  

To resolve the issue, create a firewall rule allowing inbound HTTP and HTTPS traffic to the server where Policy Manager Server is installed. 

You can find instructions how to create firewall rules in Policy Manager 14 in this guide.

Things to consider:

1. Make sure, the firewall rule is enabled. This is the first checkbox in the Firewall rules table
2. Make sure, the Server profile containing the rule is assigned as the "Server host profile". In the example below, the profile is called Server (cloned)
3. The other rules in the profiles in this screenshot are also activated but this is is not needed to meet client Policy Manager Server communication requirements
4. As this particular rule is only required for the server host running Policy Manager Server, we have selected the server before making the change (the server called here DC1-PETERF)

Issue:

Client Security and Server Security are not connecting to Policy Manager via reverse proxy or proxy.

Resolution:

Please use Policy Manager Proxy. Policy Manger is not internet application, but internal network application.  Client Security and Server Security cannot connect to Policy Manager via reverse proxy or proxy. CS/SS need to connect to Policy Manager directly or via Policy Manager Proxy. Some techniques, like Proxy/NAPT, may be working, however F-Secure won't assure those environment. 

Issue:

What is the correct way to combine certificate(s) and key into one file that can be imported into MSG?

Resolution:

The files provided by the Certificate Authority needs to be assembled in the following order: Appliance certificate, any intermediate certificate(s), Private key.
The data can be bundled together in your text editor of choice, and then saved as a .pem-file to be imported into the MSG appliance.
The end result might look something like this:

—-BEGIN CERTIFICATE—–

—–END CERTIFICATE—–
—-BEGIN CERTIFICATE—–

—–END CERTIFICATE—–
—-BEGIN PRIVATE KEY—–

—–END PRIVATE KEY—–

Issue:

• Universal CRT is not installed therefore Client Security or Server Security installation fails.
• In Policy Manger Console, push installations result in the status error message: "Installation failed. MSI error code is 1603".
• The following error can be seen in Windows Application Event Logs: "Product: F-Secure Client Security [Premium] 14.XX/F-Secure Server Security [Premium] 14.XX — Universal CRT is not installed".

Resolution:

The latest version of Client Security and Server Security require Windows Universal C Runtime to be installed on the system. Download and install Windows Universal C Runtime from the link here before installing Client Security or Server Security.

Here is also an alternate link from where to download Windows Universal C Runtime. Use this link, if a server operating system is used.