Issue:

Best Practice Upgrading Policy Manager from Version 15.x to 16.x – Step-by-Step Guide

Resolution:

This following guide provides step-by-step instructions on upgrading your F-Secure Policy Manager from version 15.x to version 16.x. Please ensure that you have backed up your system before proceeding with this upgrade.

1. Backup Your System:
   – Create a system backup. If you're running a virtual machine, create a snapshot.
   – At a minimum, ensure that you have a backup of the Policy Manager Server folder.

2. Stop the Policy Manager Server Services:
   – Open the command prompt.
   – Execute the command: net stop fsms

3. Copy the Following Content:
   – Copy the specified content from your existing installation:
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\events\`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\guts2\`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\h2db\`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.jks`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.db.config`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.proxy.config`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\fspms-ca.jks`
     – `?:\Program Files (x86)\F-Secure\Management Server 5\data\sdata`

4. Uninstall the Older Version:
   – Uninstall the previous version of Policy Manager (15.x).

5. Download and Install the Latest Version:
   – Download the latest version of Policy Manager (16.x) and install it on your machine.

6. Stop Policy Manager Server 16 Services:
   – Open the command prompt.
   – Execute the command: net stop wspms

7. Move/Paste Copied Content:
   – Paste the content you copied in step 3 to the following path:
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\events\`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\guts2\`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\h2db\`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms.jks`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms.db.config`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms.proxy.config`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\fspms-ca.jks`
     – `C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\sdata`

8. Execute the Maintenance Tool:
   – Run the maintenance tool located at: `C:\Program Files\WithSecure\Policy Manager\Policy Manager Server\bin\fspms-db-maintenance-tool`

9. Check and Ensure Port Settings:
   – Verify that the HTTPS and HTTP ports are correctly defined in the registry and match the settings from the previous F-Secure installation.
   – For version 15.00 (and older), check the settings in the `?:\Program Files (x86)\F-Secure\Management Server 5\config.txt` file.
   – For version 16.00 (and newer), check the registry location: `HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\`

10. Restart Policy Manager Services:
    – Open the command prompt.
    – Execute the command: net start wspms

Note:
– Replace "?" with the source drive for your previous Policy Manager installation. If you're unsure where the old version is installed, check the following registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Data Fellows\F-Secure\Management Server 5\InstallationDirectory`.
– For example: `E:\Program Files (x86)\F-Secure\Management Server 5` indicates the target source drive as E:.

Issue:

After upgrading to Policy Manager 15.x, Client Security or Server Security hosts show disconnected status or are missing in the Policy Manager Console.

AsyncSendRequest SSL fail: 12175  is logged in the pmpselectorplugin.log or nrb.log:

I: UpdatablePmCertVerifier::RenewCertificates: Renewing certificates from 192.168.98.247:9443 with HTTP proxy ''
*E: UpdatablePmCertVerifier::RenewCertificates: Failed to download certificate bodies (FsHttpRequest::Error_Certificate, AsyncSendRequest SSL fail: 12175 [0x80000000])
.W: PmpSelectorPlugin::Run: Policy Manager unavailable

Visible symptoms:

• The host is not able to receive policy updates from the Policy Manager Server
• Policy Manager Console Centralized management status page shows Policy counter on the host and on the server do not match (policy in use is not the latest)
• The host is shown in disconnected status in the Policy Manager Console domain tree
• AUA.log on the host shows it is able to connect to the Policy Manager Server using HTTP to download updates

Resolution:

Policy Manager 15.x dropped the support for weak cipher suites (TLSv1 and TLSv1.1) for TLS protocol. This may result in connectivity issues with outdated Windows hosts that are missing e.g. KB3042058 updates from May 2015. Hosts with Windows 7, 8, 8.1, Server 2008 R2, Server 2012 or Server 2012 R2 are affected by this issue.

The download links and more information, including prerequisites for KB3042058 are available here. The update adds additional cipher suites to the default list on affected systems and improves cipher suite priority order.

The easiest way to verify if the host is able to use the Policy Manager Server SSL connector or not, is to load the Policy Manager Server page via HTTPS (port 443 in default config) with Microsoft Internet Explorer from the managed host. 

1. Open Microsoft Internet Explorer
2. Go to address https://<YourPolicyManagerServerAddress>:443 

If the connection works, you should see a message that tells you the Policy Manager Server is installed and is working fine. 

Microsoft Internet Explorer browser is used because it is the only browser using the same secure channel library as the clients under Windows to establish a secure connection with the Policy Manager Server. Other browsers might establish that secure connection with an integrated library to the Policy Manager even without KB3042058.

If the issue is spotted on a newer Windows operating system, you will need to verify whether the cipher suites supported on the Policy Manager Server, are supported on the host. You can do the following to find out:

To fetch list of cipher suites supported for Policy Manager Server, install Nmap and run the following on a host where Policy Manager Server is reachable:

• nmap –script ssl-enum-ciphers -p <HTTPS port for Host Module> <Policy Manager Server hostname or IP address>

To fetch a list of cipher suites supported on the host, run the following in Windows PowerShell on Server 2016 and newer:

• Get-TlsCipherSuite

Sometimes 'schannel' library is attempting to use TLS 1.0 even with the KB3042058 update installed. It was discovered that this can happen if the Windows Server is running in an Active Directory role. Making any changes to SSL Cipher Suite Order Group Policy setting as described in More Information at https://support.microsoft.com/en-us/help/3042058/microsoft-security-advisory-update-to-default-cipher-suite-priority-or#section-2 and rebooting the server fixes this, even if SSL Cipher Suite Order Group Policy setting value is later reset to default.

If you are unable to install the cipher suites Windows update on the host or fix the SSL Cipher Suite Order Group Policy setting, a workaround would be to allow TLSv1 and TLSv1.1 for the Policy Manager Server by using these steps:

1. Stop the Policy Manager Server service using command prompt command:
   • For Policy Manager 15: net stop fsms
   • For Policy Manager 16: net stop wspms
2. Open Regedit and navigate to:
   • Policy Manager 15: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Data Fellows\F-Secure\Management Server 5\
   • Policy Manager 16: HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\
3. Open the additional_java_args string and add: -DenableVistaInteroperability=true
4. Start the Policy Manager Server service using command prompt command:
   • For Policy Manager 15: net start fsms
   • For Policy Manager 16: net start wspms

Now hosts using TLSv1 and TLSv1.1 will be again able to connect to the Policy Manager Server and download policies.

Issue:

A website (URL) is blocked by Client Security Web Content Control feature. Where in the Policy Manager Console can I see a detailed explanation on why the site is blocked?

Resolution:

If a website (URL) is blocked by Web Content Control, no alert will be sent to the Policy Manager alerts page. To send this information to Policy Manager would be a violation of the user's privacy. The reason why a website has been blocked is shown for the local user in the browser. In the notification the user can see the content category which has been blocked. 
 
If the website should not belong to the category, the user can click on the Report this website button to send a sample URL to F-Secure Labs to have the category corrected.

If the end-user didn't see the reason why the website was blocked, verify that the Browsing Protection extension is installed and enabled. 

Issue:

After installation, user is unable to launch Policy Manager Console and they receive error: "The item referred by this shortcut cannot be accessed. You may not have the appropriate permissions".

Resolution:

The setup wizard creates the user group FSPM users. The user who was logged in and ran the installer is automatically added to this group. To allow another user to run Policy Manager Console you must manually add this user to the FSPM users user group.

To add users to a group, use the following instructions:

1. Click on the Server Manager icon on the bottom left of the Windows desktop 

Issue:

User get the following error message when trying to log in to Policy Manager Console:

Cannot connect to server: authorization failed because the specified user credentials are invalid.

Resolution:

Firstly, users must not be members of the Active Directory group "Protected Users". This prevents them from logging on to Policy Manager.
Alternatively, verify the Active Directory group used to has not been renamed in Active Directory.

This error message appears because you are using either a wrong username or password when logging in or the Active Directory group has been renamed. 

The default username when logging in to Policy Manager Console is Admin.

The password for the Admin account was set at installation, and if you do not know the correct password for the Admin account, you can reset it by following these steps:

1. Stop F-Secure Policy Manager Server service 
2. Open command line prompt as administrator
3. Run the reset-admin-account.bat from this location: C:\Program Files (x86)\F-Secure\Management Server 5\bin\
4. Enter your new password
5. Start F-Secure Policy Manager Server service
6. Try to log in to Policy Manager Console

To change the password for any other Policy Manager Console user account, use the following instructions:

1. Log in to Policy Manager Console by using the Admin account
2. (If needed, reset the password for the set Admin account by using the above instructions)
3. To use the setting, in Policy Manager Console select Tools > Users
4. To change the password, delete the existing user account
5. Recreate the account. This option allows you to configure a new password for the set account

Issue:

After Linux Security 64 update version 12.0.482 and Atlant update version 1.0.319 are installed in Linux Security 64 and Atlant products respectively, a directory named "capricorn-linux64" are added. The full path are as follow:

Linux Security 64:

/var/opt/f-secure/baseguard/databases/capricorn-linux64.xxxxxxxxxx

Atlant:

/var/opt/f-secure/atlant/baseguard/databases/capricorn-linux64.xxxxxxxxxx

Is this an intended change?

Resolution:

Yes, it is an intended change due to migration of WithSecure's backend server.

Issue:

"Customer number is invalid" error when registering or logging in to the Policy Manager Console. How to fix or troubleshoot the issue?
 

Resolution:

If you receive an error that the customer number you entered is no longer valid, check the following items:

• Make sure that the customer number entered during registration is a correct one (the number is visible in the license certificate).
• Make sure that the license is still valid (the information is visible in the license certificate).
• Make sure you have valid Client Security and Policy Manager versions:  Older versions such as 11, 12,13, 14 and 15 are  no longer supported and cannot connect to the correct registration server. 

Issue:

In order to update database in an offline server, an offline tool called fspm-definitions-update-tool is needed to be created by Policy Manager (PM).
Detailed steps can be found here.

For example, if this fspm-definitions-update-tool is created from a Linux Policy Manager, then this tool can only be executed on an online Linux machine.

If I do not have an online Linux machine, and do not have a Windows server to temporarily install Windows Policy Manager, how can I execute this tool to create an offline definition update file?

Resolution:

WithSecure's fspm-definitions-update-tool is using java files, therefore changing the java file will enable you to use the tool in a different platform.
Below are detailed steps on how to download and change the java file.

Scenario 1 : fspm-definitions-update-tool is created from Linux PM, and this tool is to be executed on a Windows machine.

1. Download Windows JRE from this link (specified links are valid for PM 15.x, older PM versions require JRE 8)
2. Unpack the content downloaded above to fspm-definitions-update-tool\jre\ and replace all existing files
3. Move to "fspm-definitions-update-tool" as current directory
4. Run the tool with the following command

jre\bin\java.exe -server -cp "lib\*" -XX:ErrorFile="logs\hs_err_pid%%p.log" com.fsecure.fspms.definitionsupdate.DefinitionsUpdateTool -configPath "conf\configuration.properties"

Scenario 2 : fspm-definitions-update-tool is created from Windows PM, and this tool is to be executed on a Linux machine.

1. Download Linux JRE from this link (specified links are valid for PM 15.x, older PM versions require JRE 8)
2. Unpack the content downloaded above to fspm-definitions-update-tool/jre/ and replace all existing files
3. Move to "fspm-definitions-update-tool" as current directory
4. Run the tool with the following command

jre/bin/java -server -XX:ErrorFile=logs/hs_err_pid%p.log -Djava.security.egd=file:/dev/./urandom -cp lib/\* com.fsecure.fspms.definitionsupdate.DefinitionsUpdateTool -configPath "conf/configuration.properties"

Issue:

Error: "The package you are installing is outdated. Please download the newer version of the product and import the downloaded package." when exporting Client Security or Server Security installer in the Policy Manager Console.

Resolution:

If you see the error "The package you are installing is outdated.", you need to delete the previously imported installation package from the Policy Manager Console's "installation packages" list and make sure that you download and import the latest installation package. 

Latest installation packages for Policy Manager, Client Security and Server Security can be found from our Downloads page: Download Center | WithSecure™ 

Issue:

 After upgrading to WithSecure Policy Manager 16.11, cannot view more than 10,000 items in Web Reporting views such as Host properties, and scheduled PDF reports for Host properties include only about 500 computers.

Resolution:

You can try splitting the machines in two groups and copy/paste Host Properties in excel and check it out.