Issue:

I enabled "Ignore all firewall rules that are not listed in this profile" for version Client Security and Server Security from the Policy Manager Console's Windows > Firewall settings page, but still there are firewall rules enabled on the clients that aren't created by the WithSecure firewall profile.

Why can there still be firewall rules created by other source than WithSecure firewall profile if it should ignore all firewall rules that are not listed in the WithSecure profile? 

Resolution:

If you have Windows firewall rules enabled and configured via GPO, GPO has higher precedence than firewall rules created by the WithSecure firewall profile. The rules created via GPO can not be overridden by the firewall profile created in Policy Manager.

Issue:

Can Policy Manager Server or Console be upgraded to the latest version automatically? 

Resolution:

Neither Policy Manager Server or Console can be upgraded automatically to the latest version. To upgrade Policy Manager Server and Console, you need to manually run the Policy Manager installer locally on the server. 

The same applies for the endpoint products Client Security and Server Security. The clients will remain in the same version until you manually upgrade them. 

You can find the latest Policy Manager, Client Security and Server Security installers in the WithSecure Download Center: Download – WithSecure™ 

Issue:

In Linux Security 64, if –malware=ACTION or Action on malware has been configured as RENAME, how is the file name or extension modified by Linux Security 64 if a scanned file is detected as malicious or harmful? 

Resolution:

If –malware=ACTION is configured as rename (–malware=rename) or the Action for malware setting has been set as Rename in the policy, and the file (e.g. eicar.txt) is detected as malware, it will be renamed as "eicar.txt.malware".

Also, for example, if –pua=rename is configured, and some file detected as PUA, then it will be renamed as "eicar.txt.pua". 

So, basically, how the file is renamed depends on the detection type of the file. The detection type will be added as an extension to the detected file.  

Issue:

Where does Policy Manager Server store the downloaded Software Updater patches? How long are the updates stored in the cache? What is the maximum size for the cache and can it be increased or decreased?

Resolution:

The downloaded Software Updater updates / patches on the Policy Manager Server are stored in this folder: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\swup

Policy Manager Server keeps the Software Updater updates stored for 21 days and it deletes them starting by the oldest file if the size of the downloaded updates reach the maximum cache size defined on the Tools > Server Configuration > Updates cache page in the Policy Manager Console. The default Maximum cache size for downloaded Software Updater updates is 5000MB. 

The Updates cache page shows the current size of the folder. 

Policy Manager Server checks for new Software Updater database updates every 4 hours.

Issue:

Can the Policy Manager Server address that a Linux Security 64 connects to be changed after it has been installed? 

Resolution:

There is no setting to change Policy Manager server address in Linux Security 64, so it is not possible to change the address after it has been installed. You need to uninstall the current Linux Security 64 installation and then export a new installer from the Policy Manager Console that includes the updated server address. 

Issue:

After changing the port number for the modules in the registry and restarting the Policy Manager Server, I can see that logging in to the Policy Manager Console using the new port number works.

Also, the managed hosts can reach the Policy Manager Server using the new port number too.

Why the status monitor still shows the old port numbers in use, and the status is not functioning?

Resolution:

Changing the port number for the modules in the registry does not update the port numbers in the Status Monitor automatically.

You need to update the port number for the modules by doing the following:

1. Open the Status Monitor
2. Click on "Configure" button
3. Enter the new port number(s) for the module(s)

Issue:

Software Updater shows error status "Could not download update" in the Policy Manager Console's Software updates tab. 

Resolution:

By default Policy Manager Server downloads the Software Updater updates directly from the vendor's sites. Make sure that the connectivity it not blocked by the servers firewall where you are running Policy Manager Server. 

The Client Security and Server Security host devices can be set to download the Software Updater updates directly from the vendor's sites, bypassing the Policy Manager Server, by following these steps:

1. Log in to the Policy Manager Console 
2. Select a host or policy domain from the domain tree
3. Open the Settings tab
4. Navigate to Windows > Software updater
5. Ifrom the Download software updates from Policy Manager drop-down menu, select If possible
6. Distribute the policy (Ctrl + D)

Now the clients will try to first download the update from the Policy Manager and if that would fail, they will fall back to trying to download the update directly from the vendor's site. 

If clients require a proxy to access the internet, you can set up the proxy settings:

• Centralized management > Internet connections > Use HTTP proxy
• Centralized management > Internet connections > HTTP proxy address

If issues persist, we recommend to look into fspms-software-updater.log on the Policy Manager Server in C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\log to see if there are any obvious download issues. 

You can also collect an wsdiag diagnostic file from the affected devices and view the fssua.log to view Software Updater related issues.

Issue:

Will configuring settings locally on a Linux server with Atlant's atlantctl utility overwrite the settings created in the the Policy Manager's policy?

Resolution:

If a setting for the distributed policy is locked in the Policy Manager, then that setting is enforced and you cannot edit it locally with the atlantctl command-line utility. But, if the setting has not been locked in the policy, then the setting configured previously in the Policy Manager's policy will be overwritten by the local changed setting. 

Issue:

Is it possible to install and run Linux Security 64 or Elements Linux Protection on a Linux machine that is also running Policy Manager Server ?

Resolution:

Yes, any WithSecure Linux client (Linux Security 64 or Elements Linux Protection) can be installed on the same server that is running Policy Manager Server for Linux. There are no conflicts. 

Issue:

How to disable email alerts only for one or few Client Security or Server Security host devices in Policy Manager Console? 

Resolution:

If you do not want to receive email alerts from specific Client Security or Server Security host devices, you can create a new sub policy domain and move the hosts to it. Once done, you can disable the alert forwarding in that sub policy domain. 

How to create a new policy domain in the Policy Manager Console's domain tree:

1. Log in to the Policy Manager Console
2. Right-click an existing policy domain in the domain tree
3. Select New policy domain
4. Enter a name and comment
5. Click OK

Now you can move the hosts for which you don't want to receive email alerts to that policy domain:

1. Right-click the host in the domain tree
2. Select Cut (Ctrl + X)
3. Right-click the policy domain you want to move it to
4. Select Paste (Ctrl + V)

Now you can right-click the new policy domain and select Alert forwarding for domain and then disable the Forward alerts via email setting.