Issue:
Using Policy Manager Console, after activation of a new Elements EDR for Business Suite Computers license key on the devices when switching from an evaluation to production subscription, the devices are not visible in the Endpoint Detection and Response (EDR) Portal.
submission.log shows the following error:
2020-11-24 10:05:24.374 [5020.0c14] *E: SenderQueue::SenderThread: [1] Send failed
2020-11-24 10:05:27.833 [5020.2508] .W: TraceUpstream::CompleteSubmission: Unsuccessful submission [1] [2020-11-24T09:05:27.821Z] [xxxxxxxxx-xxxx-xxx-xxxx-xxxxxx] [0000-1xxxxxxx2] [3] [18686 B] [126/0] (state 1)
2020-11-24 10:05:28.130 [5020.2508] I: *** LOGGING ENDED ***
Resolution:
When an EDR client registers to the F-Secure subscription management platform (Backend), it receives CCR credentials. With the credentials, it fetches tokens from doorman.sc.fsapi.com:443 to do submissions. Those tokens are valid for limited time and it should refresh the tokens time-to-time. If the client fails to fetch token, it won't be able tp send any submissions.
The client in this case has received 401 from proxy or from Doorman, which has resulted the client credentials to been revoked, and thus client can't get tokens from Doorman to do any submissions.
Basically, client has registered with evaluation key once, and now after switching to Production, is not able to activate with the new license key.
We have hotfix FSCS1511-HF01, which provides the possibility to re-register a RDR client to the RDR portal with a new keycode.
Contact F-Secure Customer Care to provide you the Hotfix.
How to apply the hotfix:
- Open your F-Secure Policy Manager Console
- Select Installation tab, import the downloaded jar file
- Select appropriate domain or host and press "Install" button.
- Select this hotfix and distribute policies.
Hotfix support:
Business suite 14.xx and 15.xx series
The only limitation is that for ESS Exchange/SHP statistics will be reset
Standalone computers: Not supported
After the Hotfix is distributed, you enter the new subscription key for your Rapid Detection & Response using the F-Secure Policy Manager Console and activate it.
If you don't have a new subscription key, please contact F-Secure Order Services to provide you with the new key.
If the client is still not registering/not connecting after applying the hotfix, you could restart the sensor by using command line and run:
- net stop fsatps
- net start fsatps
If you notice any connection issue, please refer to this F-Secure Community article for more help.
Article no: 000029546