Issue:

Client Security or Server Security unable to fetch updates and AUA.log shows error=111 (connection refused) 

Resolution:

First make sure that the client device can connect to the server that is running the Policy Manager Server. Open a web browser on the client device and try to access the policy manager address and port with the browser. It should show you the following message:

• If you see this message, WithSecure™ Policy Manager Server is installed and is working fine.

If you do not see this message, then check the firewall settings on the client and on the server. Also check that the Policy Manager Server service (wspms) is running on the server.

If you see the message, then the most likely cause for the issue is that either the ports or the policy manager server address have been misconfigured in the client configuration when the installer was exported. 

You need to ensure the Client Security/Server Security is configured with the correct Policy Manager Server address configured, including the HTTP port and the HTTPS port through the Policy Manager Console.

In Policy Manager Console, navigate to: Settings > Windows > Centralized management > Policy Manager Server host communication settings 

Check the following values:

• Policy Manager Server address
• HTTP port
• HTTPS port

For the Policy Manager Server address, you can either use the fully qualified domain name (FQDN) or the server IP address. Also, you need to ensure that the configured ports are not in used by other third-party application.

If the ports or address have been misconfigured in the policy, fix the address in the policy and distribute the policy to save it. Then you can export a new client installer from the Installation tab and reinstall Client Security or Server Security on the device. 
 

If you instead would like to change the ports that the Policy Manager Server listens to, that can be done by following the steps below:

1. Stop the Policy Manager Server service by running "net stop wspms" command in an elevated Command Prompt
2. Open regedit
3. Navigate to HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\
4. Change the values of HttpPortNum and HttpsPortNum
5. Start the Policy Manager Server service by running "net start wspms" command in an elevated Command Prompt

Issue:

How to enable Advanced View in the Policy Manager? Why is the Advanced View button missing in the Policy Manager 16 and later?

Resolution:

The Policy Manager Console's Advanced View is no longer by default visible since the Standard View is the recommended way to use the Policy Manager Console. Here are the steps to re-enable the Advanced View in Policy Manager Console:

1. Log in to the Policy Manager Console

2. Go to Tools menu.

3. Select Preferences option.

4. In Appearance tab, you will find the option: Make advanced mode available for Settings and Status pages.

5. Check this option to enable the Advanced View.

Now the Advanced view should be visible in the top-right corner in Policy Manager Console. Please note that we do not recommend to use the Advanced view unless absolutely necessary. 

Issue:

Linux Security 64: What is the maximum level of nested archives to be scanned? 

Resolution:

By default, the maximum level of nested archives to be scanned is set to "5" for both real-time scanning and manual scanning. The value is configurable from Policy Manager console or lsctl command tool. 

How to change the max nesting level for archive scanning via Policy Manager Console:

Real-time scanning:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab 
4. Navigate to Linux > Real-time scanning
5. Scroll down to the Handling archive in real-time scanning section
6. Change the value in the field called "Scan archive up to nesting level:" 
7. Distribute the policy (Ctrl + D)

Manual scanning:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab 
4. Navigate to Linux > Manual scanning
5. Scroll down to the Handling archive in manual scanning section
6. Change the value in the field called "Scan archive up to nesting level:" 
7. Distribute the policy (Ctrl + D)

lsctl instructions can be found in the Linux Security 64 user guide: Configuring settings with the lsctl utility | Linux Security 64 | Latest | WithSecure User Guides 

Issue:

After an upgrade or reinstallation of a WithSecure Client Security or Server Security client, why are there duplicate hosts visible in the WithSecure Policy Manager Server's domain tree?

Resolution:

If you are using the method "Randomly generated global unique ID" to create a host identification string, it may happen that after a reinstallation or upgrade of a Client Security or Server Security client, this identification string is regenerated and the client is effectively seen as a new host in the WithSecure Policy Manager Server's domain tree. This is why the device can be seen twice in the domain tree.

This can also happen if you have selected a different host identification method for the upgrade than what was used during the installation of the client on the host. The host identification method is chosen when exporting the installation package, in the "Configure communication with Policy Manager Server" step.

To view which host identification method was used on a host, follow the steps below:

1. Open a command prompt as an administrator on the host
2. Navigate to : 
   C:\Program Files (x86)\F-Secure\Client Security or
   C:\Program Files (x86)\F-Secure\Server Security
3. Run command: RESETUID.EXE SHOWUID

Depending on the settings in your WithSecure Policy Manager Server, the older host will be seen as disconnected after the defined number of days. 
After another defined period of days, it will be removed from the domain tree of your WithSecure Policy Manager Server.

You can change these settings by following the steps below:

1. Log in to the Policy Manager Console
2. Click Tools > Server configuration

In the Hosts tab, you can change after how many days hosts should be considered disconnected. You can also enable to automatically remove disconnected hosts after a defined number of days. 

Issue:

I would like to register my Policy Manager Server which is not connected to a network (offline), how do I proceed?

Resolution:

1. Contact WithSecure support by opening a support request here.
2. Provide the following information for WithSecure technical support to create an offline registration file:

• Account Name
• Customer ID
• Installation ID 
• Business Suite license Expiry date

How to obtain Customer and Installation ID:

Policy Manager for Windows

• Open Policy Manager console, and go to Help menu > Registration dialog, or;
• Find the information from the Policy Manager Server installation folder: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\upstream-statistics.json
• Note: the folder C:\ProgramData\ by default is a hidden folder. To workaround this issue, copy/paste the name of the folder C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\to an File Explorer window to view the content of set folder.

Policy Manager for Linux:
    Please refer 
     /var/opt/f-secure/fspms/data/upstream-statistics.json

Notes:
"upstream-statistics.json" file is created by Policy Manager when it attempts to connect to the registration backend (corp-reg.f-secure.com) and it keeps updating daily on each attempt to check the license. You should not create or edit the Customer ID and Installation ID in the upstream-statistics.json file directly because it is not intended to be edited manually.

Once support has provided you with an offline registration file, use the following steps to activate it on your Policy Manager Server. 
This file is actually created based on the ordered period or expiry date in the license certificate and there is no other license file used by Policy Manager Server for registration.

Windows:

Policy Manager for Windows:

1. Copy the offline registration file registration.json to the folder: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data
2. Restart the WithSecure Policy Manager Server service by typing the following commands in an elevated command prompt (CMD)
   • net stop wspms
   • net start wspms

Linux:

1. Copy the offline registration file to registration.json the folder /var/opt/f-secure/fspms/data 
2. Restart the fspms daemon:

• # /etc/init.d/fspms restart

If the registration.json file disappears from data folder, the activation was successful and Policy Manager is activated until the expiry of your current subscription. After renewing the subscription you need to request a new registration token from support. There is no need to change the permissions for the registration.json file as file inherits proper permissions from the parent folder data.
Make sure to do this some time in advance so that you don't end up with an expired Policy Manager Server.

Issue:

Policy Manager Web Reporting sends report multiple times at 10-15 minute intervals. Why are duplicate web reports sent by Policy Manager Server Web Reporting? 

Resolution:

The Policy Manager Web Reporting could be sending multiple reports to some users because there are some users for whom the reporting fails, so it tries to resend the whole report.

Make sure that if the web report has several recipients that all recipient addresses are written correctly without any typoes. Since the job can never fully "succeed" (the bad address always fails), it never leaves the retry queue — so the good recipients keep getting a fresh copy every 10–15 minutes for as long as the bad address stays in the list.

If the email addresses are valid, it could be that the report size is very large and generating the report times out. In that case you can try to increase the phantomJsReportGenTimeout value from the default of 60 to a higher value between 180 and 300. 

Steps: 

1. Run Regedit as administrator.
2. Create the following string registry key:
   1. HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\additional_java_args
3. Enter the following property and the value:
   1. -DphantomJsReportGenTimeout <180-300>
4. Restart the policy manager server by opening a command prompt and running commands:
   1. net stop wspms
   2. net start wspms

On Linux, the above works as well. However, instead of the registry, use the /etc/opt/f-secure/fspms/fspms.conf configuration file:

Create a new line with the parameter additional_java_args:

• -DpropertyName=value If you want to specify multiple properties, use space as the delimiter. Property names and values are case-sensitive. 

Restart the Policy Manager Server service to make the new configuration settings take effect.

Issue:

Will changing of Policy Manager customer number and registration affect communication between Policy Manager Server and Client Security and Server Security hosts ?

Resolution:

If you specify a new customer number in the Policy Manager Console's Help > Registration page, it will not affect the communication between the clients and the Policy Manager Server. 

The registration only affects your ability to log in to the Policy Manager Console to manage the policies. If the new customer number is valid, you will be able to log in normally during then login. 

Issue:

Client Security or Server Security shows "Central Management Status not available" error in the local user interface

Resolution:

Make sure that the device is able to connect to the Policy Manager Server. You can open a browser and enter http://<pm-server-address-here>:80 and it should show you a message if the device is able to connect to the Policy Manager Server. 

• If there connection is successful, then that means that the issue is in the Client Security or Server Security installation itself. Try to restart the device and if that doesn't fix the issue, reinstall the client since it could be that it is connecting to the wrong Policy Manager Server address. 
• If the connection check was unsuccessful:
  • Make sure that firewall on either the client or policy manager server side is not blocking the connection
  • Make sure that the Policy Manager Server service (wspms) is running on the server 

Issue:

How long do Client Security or Server Security keep the quarantined files stored on a computer or server until they are automatically deleted? After what time can the files no longer be released from quarantine? 

Resolution:

By default both Business Suite Client Security and Server Security delete quarantined files after 30 days.

You can change the default settings for quarantine management via the Policy Manager Console:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Open the Settings tab 
4. Navigate to the Windows > Quarantine Management settings page
5. Make sure that Remove Old items automatically is enabled 
6. Change the amount of time for:
   1. Remove items Older than
7. Distribute the policy (Ctrl + D)

Issue:

We need to filter out Client Security or Server Security Application Control alerts being forwarded to Policy Manager. How can i change this alert setting in Policy Manager console and distribute it as a policy to clients? I do not want to receive Application Control security alerts to the Alerts page in the Policy Manager nor do I want email alerts. 

Resolution:

If you do not want an Application Control rule to send an alert, this can be changed in the Application Control rule itself:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to the Windows > Application control settings page
5. Select a rule from the table and click Edit rule
6. Disable the "Send alert" setting
7. Click OK
8. Distribute the policy (Ctrl + D)

Now when this Application Control rule is triggered on a client, it will not send an alert to the Policy Manager Console. Since there is no security alert no email alert will be sent either. 

If you do not want to edit rules manually, you can filter out all Application Control alerts from the Alert sending settings:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to the Windows > Alert Sending settings page
5. Click Add on the right side of the table
6. Select as condition: Source = Application Control 
7. Click OK
8. Distribute the policy (Ctrl + D)