{"id":4416,"date":"2026-06-08T17:52:53","date_gmt":"2026-06-08T14:52:53","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4416"},"modified":"2026-06-08T17:52:53","modified_gmt":"2026-06-08T14:52:53","slug":"does-policy-manager-console-have-activity-logging-audit-trail-auditing","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fi\/support-articles\/does-policy-manager-console-have-activity-logging-audit-trail-auditing\/","title":{"rendered":"Does Policy Manager Console have activity logging (audit trail \/ auditing)?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>Does Policy Manager create and maintain an audit log for user and admin activity? For example for these events:<\/p>\n<ul>\n<li>User\u00a0login \/ logoff<\/li>\n<li>Host deletion\u00a0 \/ add \/ rename events<\/li>\n<li>Policy sub-domain deletion \/ add \/ rename events\u00a0<\/li>\n<li>Change of policy settings<\/li>\n<\/ul>\n<h3>Resolution:<\/h3>\n<p>The Policy Manager Server logs can be found in the following folder:<\/p>\n<ul>\n<li><b><font face=\"arial\">C:\\Program Files (x86)\\F-Secure\\Management Server 5\\logs<\/font><\/b><\/li>\n<\/ul>\n<p><font face=\"arial\">The user login actions are recorded in the <b>fspms-users.log<\/b>. The log does not show the full user name, only the User ID. To get the full user name, a query must be performed using the H2Console. The H2Console is not enabled by default, so it will need to be enabled before you can run the query.\u00a0<\/p>\n<p>How to enable H2Console:<\/p>\n<p><b>Note:<\/b>\u00a0Please backup your registry before making any registry changes<\/font><\/p>\n<ol>\n<li><font face=\"arial\">Open Registry Editor (regedit)<\/font>\n<ul>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">Policy Manager 15:\u00a0HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Data Fellows\\F-Secure\\Management Server 5\\<\/span><\/li>\n<li><span style=\"font-family: Courier New,Courier,monospace;\">Policy Manager 16:\u00a0HKLM\\SOFTWARE\\WithSecure\\Policy Manager\\Policy Manager Server<\/span><\/li>\n<\/ul>\n<\/li>\n<li><font face=\"arial\">Edit &quot;additional_java_args&quot;<\/font><\/li>\n<li><font face=\"arial\">Add parameter:\u00a0<b>-Dh2ConsoleEnabled=true<\/b><\/font><\/li>\n<li><font face=\"arial\">Close registry editor and restart \u00a0Policy Manager Server service by running command line commands\u00a0<span style=\"font-family: Courier New,Courier,monospace;\"><strong>net stop fsms<\/strong><\/span> and <span style=\"font-family: Courier New,Courier,monospace;\"><strong>net start fsms<\/strong><\/span> (<span style=\"font-family: Courier New,Courier,monospace;\"><strong>net stop wspms<\/strong><\/span> and <span style=\"font-family: Courier New,Courier,monospace;\"><strong>net start wspms<\/strong><\/span> for <span style=\"font-family: Courier New,Courier,monospace;\">Policy Manager 16<\/span>)<\/font><\/li>\n<\/ol>\n<p>How to open H2Console and run query:<\/p>\n<ol>\n<li>Open a browser and go to https:\/\/localhost:8080<\/li>\n<li>Click the H2Console link<\/li>\n<li>Type in query:\u00a0<span style=\"font-family: Courier New,Courier,monospace;\"><b>SELECT * FROM users;<\/b><\/span><\/li>\n<li>Click\u00a0<b>Run (Ctrl+Enter)\u00a0<\/b>to run the query<\/li>\n<\/ol>\n<p>You will receive a result showing which user names correspond to which User ID.\u00a0<\/p>\n<p><font face=\"arial\">Changes made to policy\u00a0settings are saved in\u00a0<\/font><font face=\"arial\"><b>fspms-policy-audit.log<\/b>.<\/font><\/p>\n<p><font face=\"arial\">Changes made to the Policy domain computers\/servers or specifically changes made to the policy domain structure are saved in<b>\u00a0<\/b><\/font><b><font face=\"arial\">fspms-domain-tree-audit.log<\/font><\/b><font face=\"arial\">.<\/font><\/p>\n<p>Another log to look into is fspms-active-directory-rules.log. For example, in case the AD synchronization rule was executed, and the host with unique ID,\u00a04d896695-8de1-4f96-9c29-0ebd2bb60418 was moved into a domain, you will find the following is logged:<\/p>\n<p>20.06.2022 17:59:01,276 INFO [activeDirectoryRules] &#8211; Starting to process manually triggered rule [ruleId=5, domainController=&#39;LDAP:\/\/&lt;domain name&gt;&#39;, containerDn=&#39;OU=&lt;OU name&gt;,DC=&lt;partial domain name&gt;,DC=&lt;partial domain name&gt;&#39;, containerGuid=&#39;XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&#39;, targetDomainId=&lt;policy domain ID&gt;, enabled=true]<br \/>20.06.2022 17:59:01,386 INFO [activeDirectoryRules] &#8211; 1 hosts found in Active Directory, 0 of them unmanaged<br \/>20.06.2022 17:59:01,388 INFO [activeDirectoryRules] &#8211; Domain &lt;policy domain name&gt; updated<br \/>20.06.2022 17:59:01,390 INFO [activeDirectoryRules] &#8211; Host having identity 4d896695-8de1-4f96-9c29-0ebd2bb60418 moved<br \/>20.06.2022 17:59:01,416 INFO [activeDirectoryRules] &#8211; Rule was successfully processed<\/p>\n<p><font face=\"arial\">Q:<\/font><b><font face=\"arial\">\u00a0<\/font><\/b>How to find out who deleted a policy sub-domain in Policy Manage Console?<br \/>A: This information is available in the <b>fspms-domain-tree-audit.log<\/b>s. Below is an example, where a sub-domain called test was added and immediately deleted.<\/p>\n<p>05.12.2019 09:44:17,785 INFO [audit.domainTree] &#8211; User &#39;admin&#39; added domain test (id=76) to domain Root (id=1)<br \/>05.12.2019 09:44:23,615 INFO [audit.domainTree] &#8211; User &#39;admin&#39; deleted domain test (id=76)<br \/>\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The customer asks for information about Policy manager logging \/ auditing \/ audit. The customer needs to know if PM does create an audit log for user and admin activity logging in and logging off, for example.<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-4416","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000012255","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:52:53","import_hash":"f6e36348bf3c54705de3013963b90cdacd6785b0","vanilla_article_id":32499,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32499-does-policy-manager-console-have-activity-logging-audit-trail-auditing","vanilla_kb_id":30,"vanilla_category_id":103,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article\/4416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/media?parent=4416"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article_product?post=4416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}