Issue:

An applications internet connection is interrupted or blocked when Connection Control in Client Security is activated when user enter a website that has been marked as a banking site. 

How do we add the application as trusted so that it can stay connected to the internet when Connection Control protection is active? 

Resolution:

The Connection Control blocks unsigned applications from connecting to the internet when the protection gets activated when a user visits a banking website. 

You can first try to disable the Disconnect untrusted apps setting for Connection Control:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Open the Settings tab
4. Navigate to Windows > Browsing protection settings page
5. In the Connection Control section, disable the Disconnect untrusted apps setting
6. Distribute the policy (Ctrl + D)

If the application would still get blocked from accessing the internet when Connection Control is activated, you can exclude the application from all scans. This will make it so that the applications connections aren't scanned at all and will not be blocked. 

To exclude an untrusted application, you can exclude the application executable or folder by following these steps:

1. Log on to the Policy Manager console
2. Select a host or policy domain from the domain tree 
3. Open the Settings tab
4. Go to Windows > Real-time scanning >
5. In the Files and applications excluded from scanning section, enable Do not scan the following files and application
6. Click the Add button
7. Use 'All scans' for the exclusion scope
8. Choose 'Folder path' and define the application folder path
9. Click OK
10. Distribute the policy (Ctrl + D)

Issue:

The "Policy in use" column for one or more hosts is shown as "not latest" in the Policy Manager Console's Status > Centralized Management tab when an operation is started from the Operations tab.

After that, the status reverted back to "latest". Why did the policy status change to "not latest" when one of these operations is started:

• Virus and spyware scan 
• Virus definition updates
• Product updates
• Network isolation
• WithSecure Support Tool

   

Resolution:

So for example when a Policy Manager admin user sends a "Virus and spyware scan" operation, the operation is sent to all the selected hosts within a policy domain in the form of a new policy. When they click on "Scan" from Policy Manager Console's Operations tab, a policy will be sent to the selected hosts. This is the reason why the Status tab can briefly show "Not latest" status, because the host can be offline (turned off) or simply hasn't yet reported back that is has received the policy.

On the Status > Centralized management tab you can add the Policy counter on host and Policy counter on server columns to the table if you want to see that the policy counter on server increases immediately after starting an operation. 

Issue:

When Server Security is installed on a Domain Controller and a DNS query to a harmful / malicious URL is blocked, an alert is sent to the Policy Manager Console's Alerts tab which shows the URL that was blocked but not any details which device sent the DNS query. 

How to find out which host is making a DNS query to a malicious URL when Server Security is installed on a Domain Controller

Example alert:

Warning: A DNS query was blocked for a domain.
From: Root/XXXX.XXX:XX/Domain Controllers/XXXXX, 2020-03-10 10:14:06 +00:00
Details: A DNS query was blocked for a domain. DNS: example.exampledomain.com.

Resolution:

Since the DNS query is blocked by the Server Security that is installed on the Domain Controller, only the server is shown as the source for the alert. Server Security cannot know which device is making the query, so you will need to check the DNS logs on the server. 

That warning doesn't tell the host, which is making the query. It needs to be checked from the DNS server logs.

Instructions how to enable DNS server debug logging:

https://superuser.com/questions/1229515/windows-dns-server-how-to-find-out-who-made-a-query

Issue:

Policy Manager Server for Linux is running low on space, what can be deleted from its logs to save on disk space?

Resolution:

If there's no client hosts version 15 and lower managed by the Policy Manager, old version directories can be deleted as following steps.

1. Stop Policy Manager Server service.
    For Policy Manager 16.03 and lower:

   # /etc/init.d/fspms stop

    For Policy Manager 16.10 and above:

   # systemctl stop fspms

2. Execute following commands to delete old directories and files.

   # rm -rf /var/opt/f-secure/fspms/data/guts2/*
   # rm -rf /var/opt/f-secure/fsaus/data/db
   # rm -rf /var/opt/f-secure/fsaus/data/misc
   # rm -f /var/opt/f-secure/fspms/logs/fspms-fsauasc.state

3. Start Policy Manager Server service
    For Policy Manager 16.03 and lower:

   # /etc/init.d/fspms start

    For Policy Manager 16.10 and above:

   # systemctl start fspms

In addition, after Policy Manager Server service is stopped, logs under /var/opt/f-secure/fspms/logs can be moved to other place for backup. Once it is backed up, these logs can be deleted. After deleting the logs, start the Policy Manager Server service again and it will automatically create the new empty current logs needed for Policy Manager functioning correctly.

Issue:

When Server Security is installed on a terminal server, it is not displaying a Windows toast notification pop-up in the local user interface when an infection is found. 

Resolution:

If local users are not seeing a Windows toast notification when a malicious file is blocked, quarantined or deleted, make sure that the setting Show server notification to is set as All users, since by default it will only be shown for administrators:

1. Log in to Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Go to the Windows > Centralized management settings page
5. Scroll down to the Local user interface section
6. Select from Show server notifications to drop-down menu the All users setting
7. Distribute the policy (Ctrl + D)

If you have enabled the Show server notification to all users setting, the cause for notifications not being shown can be due to some setting in the the Windows system which prevent WithSecure Server Security toast notification flyers from being shown. It will be best to start checking from Start > Settings > System > Notifications 

Issue:

Where can I download the newest and latest versions of Business Suite products (Client Security, Server Security, Linux Security 64, Policy Manager)?

Resolution:

You can find all the latest versions of Business Suite product installation packages (Client Security, Server Security, Linux Security 64, Policy Manager) from the WithSecure Download Center in the On-Premise products section: Download – WithSecure™ 

Issue:

The Allow button to Restore files from quarantine is grayed out in the Client Security or Server Security local user interface in the App and file Control > Quarantined tab. How to allow a local administrator user to allow a file to release it from quarantine? 
 

Resolution:

You can allow a local admin user to restore files sent to quarantine by following these steps:

1. Log in to Policy Manager console
2. Select a host or domain from the Domain Tree
3. Go to the Settings tab
4. Go to the Real-time scanning page
5. Disable Prevent users from adding scanning exclusion

Issue:

How to install Linux Security 64 in an offline or isolated environment?  Is it possible for Linux Security 64 to operate in an environment without any internet connection?

Resolution:

Issue:

How do I locally disable real-time scanning for Linux Security 64?

Resolution:

Use this command to locally disable / enable the real-time scanning in LS64

To enable: /opt/f-secure/linuxsecurity/bin/lsctl set oas disabled false
To disable: /opt/f-secure/linuxsecurity/bin/lsctl set oas disabled true

Configuring settings with the lsctl utility | Linux Security 64 | Latest | WithSecure User Guides

Issue:

Unable to connect to Policy Manager Server via the Policy Manager console. 
​

Resolution:

If logging in to Policy Manager Console fails, make sure that the WithSecure Policy Manager (wspms) service is running. If it is not running, check the fspms-service.log if you see the following is logged repeatedly in:

[ERROR]    Server process crashed, exit code was 1

This suggest that the Policy Manager Java process crashes at startup, which could stop the Policy Manager admin to logon to the Policy Manager Console since the Policy Manager Server service is not running. 

You would need to make sure that the listening ports used by Policy Manager Server service are not in use by any other process. This is the most common reason why the Policy Manager Server service (wspms) fails to start. 

1. Open a Command Prompt and run the command "netstat -anb" to check and ensure that there is no port conflict present by checking that no other process that is currently using the default 80 and 443 ports that Policy Manager Server service will try to use as listening ports. Alternatively, look into netstat-anb.log in the wsdiag. 

If the issue happens due to port conflicts, you should as first choice either stop the conflicting service or reconfigure it to use another port. As a second choice, you may consider changing the host module's port numbers from 80 and 443 to other available ports, such as 85 and 455 by using these steps:

1. Stop the Policy Manager Server service (net stop wspms)
2. Open the Registry Editor
3. Navigate to HKLM\Software\WithSecure\Policy Manager\Policy Manager Server
4. Modify the values of HttpPortNum and HttpsPortNum to the new ports (e.g., 85 and 455).
5. Start the Policy Manager Server service (net start wspms)

Remember to configure the clients to connect to the new port. 

If no port conflict is present, move to the next step. 

2. Stop the Policy Manager Server service, and backup the H2DB folder in the directory: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\Data\

3. Run the H2DB recovery tool (fspms-db-recover.bat), and the database maintenance tool (fspms-db-maintenance-tool.exe) to fix the potential corruption in the H2DB. You can find the tools in the directory,C:\Program Files\WithSecure\Policy Manager\Policy Manager Server\bin\ where Policy Manager Server is installed.

NOTE: Refer to README-recover-db.txt in the same directory on how to use the H2DB recovery tool.

If none of the above-mentioned help, proceed to re-install the Policy Manager Server on top of the existing installation.

If the h2database.log has a number of errors similar to the following:

ERROR [h2database] – fspms:jdbc[10] exception
org.h2.jdbc.JdbcSQLException: General error: "java.lang.ArrayIndexOutOfBoundsException"; SQL statement:
SELECT oid_id, value FROM status WHERE domain_id=? [50000-164]

Caused by: org.apache.http.conn.HttpHostConnectException: Connect to localhost:8000 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused: connect

To resolve the issue, we can do the following:

1. Stop the WithSecure Policy Manager service (net stop wspms)
2. Back up the H2DB located at: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data
3. Run the database maintenance tool, fspms-db-maintenance-tool.exe located at: C:\Program Files\WithSecure\Policy Manager\Policy Manager Server\bin
4. Start the WithSecure Policy Manager service (net start wspms)
5. Try logging in to the Policy Manager Console again