Label: "EcoStruxure Security Expert"

Issue How to use Wiegand 26-Bit format cards in Security Expert with the new Custom Credentials Product Line EcoStruxure Security Expert Environment Wiegand 26-Bit Format Access Cards Custom Credentials Cause From the release of Security Expert 4.3, Custom Credentials have been introduced as a 'new' way of handling cards with formats such as Wiegand-26 Bit. Resolution Select Sites > Credential Types and create a new Wiegand Credential Type called Wiegand 26-Bit with the following format: A,FACILITY,8,MSB,BIN_B,CARD,16,MSB,BIN_PAAAAAAAABBBBBBBBBBBBBBBBP_EXXXXXXXXXXXX............._.............XXXXXXXXXXXXO Select Programming > Door Types and create a new Door Type called Wiegand 26-Bit. Under Entry select a Reading Mode of Custom and then select 'Add'. Select the Wiegand 26-Bit Credential Type created earlier. If using Custom Credentials on both Entry and Exit this will need be done for both as shown below. Select Programming > Doors and ensure the Door Type of the Door being configured is set to the Wiegand 26-Bit Door Type created earlier. Select Expanders > Reader Expanders and ensure the Readers for the configured door are set to Custom Credential (Reader 1 Secondary format does not actually take effect and is set to Custom Credential here simply to avoid confusion). Select Users > Users and create a test User.  Do not use the regular Card Numbers section which is filled out for cards which do NOT use the Custom Credential, and instead scroll down to the Credentials section at the very bottom of the General Tab. Add the Wiegand 26-Bit Credential Type and Specify the users cards details in the format: Site Code : Card Number and then test.

Issue What are the recommendations/limitations around using RDM2 and mRDM2 Reader Expander Modules on SP-ACX and SP-AC1 controllers? Product Line Security Expert Environment SP-ACX SP-AC1 RDM Expander Modules Cause The number of RDM2 and mRDM2 modules which can/should be used on an SP-C/SP-C-Web is well documented, but it is not so clear what limitations exist when using these modules on other SP Controllers. Resolution RDM2 and mRDM2 modules are NOT supported on an SP-ACX. RDM2 and mRDM2 modules are NOT supported on an SP-AC1 controllers when AC1 modules are also connected on the same communication bus.   The SP-AC1 does actually have the potential to support RDMs, but mixing both Legacy(AC1) and current(RDM) modules runs the risk of overtasking the controller, especially when approaching maximum door limits.   SP-ACXs and SP-AC1s are primarily designed as transitional controllers to allow Continuum ACXs and Continuum NetControllers to be transitioned smoothly into a new Security Expert system.   As such the use of current Reader Expander modules such as RDM2s and mRDM2 should be avoided and left strictly to SP-C and SP-C-Web controllers.

Issue Troubleshoot Security Expert Controllers showing offline in the client. Product Line EcoStruxure Security Expert Environment Security Expert Cause Require some common troubleshooting steps to help determine why controllers may be offline to the client. Resolution The main items to check are: Refer to the Troubleshooting Security Expert Controller Connectivity - Application Note on Exchange Restart the client software. Power restart the controller. Remove power Wait for all LED's on the controller to go completely off Apply power to the controller. In the controller web interface, on the Settings page, check that Event Server 1 has the correct IP address. Check that the Firewall is disabled. Check any Anti-Virus Firewalls/settings as well. Restart the Security Expert services under the PC's Services option in Control Panel. These need to be restarted when any changes are made. Confirm that the module versions are all the same. Go to About  > Version and check there. If the database has not been upgraded to the same version as the client software, then this can cause communications issues. On the Security Expert Server check that MSMQ is installed as this is now a requirement   Security Expert MSMQ is required (Not showing live point status / shows "Unknown Status" error)   If MSMQ was installed after Security Expert, you'd need to reinstall Security Expert to allow it to run correctly. If MSMQ is installed and controllers are still not coming online (or the controllers are "bouncing" offline/online) then anecdotal evidence suggests enabling Windows 8 Compatibility Mode may help especially for Windows Server 2016 and Server 2019. Set the Windows 8 Compatibility Mode checkbox in the Properties page for C:\Program Files (x86)\Schneider Electric\Security Expert\SecurityExpertEvtSvr.exe   Also, note that if a database backup has been imported, then there is a need to check/change some other settings as well to ensure everything is set up for the specific server and controller.   Under Global > Download Server confirm that your computer name is the name of the PC where the download server service is running. Under Global > Event Servers ensure that the computer name is the name of the PC where the event server service is running. Under Sites > Controllers confirm the Serial number, IP Address, Download Port, Download Server and Control and Status Request Port match what is set in the controller's configuration web page (browse to the controllers IP Address to view). On that same General tab go to Diagnostic Windows and open the download and event server windows. Review the information contained and if there are any errors shown. Right click the controller and select Get Health Status. Review the status messages displayed.

Issue Security Expert client Status Window is not showing live point status for inputs, outputs, doors. Shows an error message “Status Unknown” instead. The client is still however able to receive access control events such as reader entry/exit. Product Line EcoStruxure Security Expert Environment Security Expert Cause MSMQ (Microsoft Message Queueing) is not enabled. This is a requirement for MSMQ to be installed on the Security Expert Server, the Security Expert Client machines do not need this but the machine where the Security Expert Services are installed does need this feature installed to function properly. Resolution Windows 10 In Windows Features settings (Turn Windows features on or off) turn on the “Microsoft Message Queue (MSMQ) Server” and the “Microsoft Message Queue (MSMQ) Server Core” features. Windows Server 2016 or above  Start Server Manager. Select Manage / Add Roles and Features. Click Next. Select Role-based or Feature-based installation Click Next. Select the server where to install the feature. Go to Features, and navigate to Message Queuing / Message Queuing Services and select Message Queuing Server. Click Install to start the installation. The setup may require a system restart. Click OK to finish.  

Issue How can the reports list sort order be changed and saved so that reports are always displayed in a specific order.  Product Line EcoStruxure Security Expert Environment Security Expert Server Cause Reports are printed in order of Database ID by default. There is a need to have this changed to a custom sorting order.  Resolution 1. In Security Expert Client  menu , go to Reports --> Setup--> User Add and name the new report Choose a Report Type and give your Report a Title Skip sorting properties Save your report With your new report highlighted, go to "Columns" tab Click Add to add desired columns for your report Save your report   2. To print new report, return to Client menu Reports-->User Select new report from "User report:" drop-down menu Click execute to print Report will be printed in order of item's database ID Items printed in db ID (ascending) by default 3. Configure report: Edit order by left-clicking on column tabs   Click Save Report Filter to save your changes   Note: 1. 1. You can clear custom sorting of the report table by:: Right-click tab and hit clear sorting Click Save Report Filter 2. You can also filter multiple columns: Right-click the columns Sort primary column (Dept, Access Level, Region) Sort secondary columns Click Save Report Filter

Issue When launching Security Expert after restarting the PC, a License Expired message is shown. The license is not able to be found. Product Line Security Expert Environment Security Expert Client Security Expert Licensing Cause This is a timing issue. The Security Expert services are attempting to start simultaneously as Windows components that they rely on. Resolution Change the Startup Type of the Security Expert services to use Automatic (Delayed Start), so they start after the Windows OS components. Services - Automatic Delayed   It is also possible that the Security Expert Data Service may be the only service that requires being set to a delayed startup to resolve this problem.

Issue Security Expert Smart Connector integration is working but Alarms states are not updating, the following error is appearing in Smart Connector logs:   2021-01-07 15:19:22.2621,Info,Processor,<no principal>,Validation Prompt for Security Expert Alarm Update Processor: MayNotContinue : The EwsServer was not located or the credentials you supplied were incorrect. Please verify your credentials and try again. Product Line EcoStruxure Security Expert Environment Smart Connector Cause It appears that the SOAP credential within the Security Expert Discovery Processor does not match the credential within the Security Expert Client SOAP operator credential.   This is a known issue where the credential does not update when changed/edited within the Processor Configuration of the Security Expert Discovery Processor configuration.   Resolution A workaround is to log on to your local Smart Connector portal and edit the credential value within: Setup/Processor Values/SecurityExpertSettings      Change the username and password as required here.                Then save and the new credentials should be updated.  

Issue Is any version of Security Expert compatible to install in SQL Clustering? Product Line Security Expert Environment Security Expert Microsoft SQL Server Cause Installation and configuration of Security Expert databases (Security Expert and Security Expert Events) in SQL Clustering Resolution There is not currently a Tested Validated Documented Architecture (TVDA) for Security Expert compatibility with SQL Clustering so it is not officially supported. It is recommended to install and configure in standard SQL Server versions. Click here to refer compatibility matrix for supported environments.

Issue After transitioning an INET security system to Security Expert, SCU1200 and SCU1280 controllers do not come online Product Line Security Expert, TAC INET Environment Security Expert Controller (SP-C) I/NET SCU1200 I/NET SCU1280 Cause The INET-to-Security Expert transition brings each SCU1200/1280 into Security Expert as an Input Expander but there is a known issue that causes the devices to remain offline. R&D is working on a fix. Resolution The workaround for bringing a SCU1200/1280 controller online in Security Expert is to create a Reader Expander and then edit the inputs and outputs associated with the SCU1200/1280 to point to the Reader Expander you’ve just created.   Important:  Create a backup of your Security Expert database before proceeding with the instructions that follow.   For a transitioned SCU1200/1280, create a Reader Expander as follows: In Security Expert, navigate to Expanders > Reader Expanders. Choose a Controller from the drop-down list. Click the Add icon. Define a Name for the expander.  The transition tool would create a name like SCU1200 <703503> for the expander.  In this example, the SCU’s link address is 70, its station address is 35, and its point address is 3. When manually defining the name of the new expander, you may wish to use this naming convention to keep the system uniform. Set the Physical Address of the expander.  This address should be 1 higher than the point address of the SCU.  So, for SCU1200 <703503>, the point address is 3 (7035 03 ) and so the physical address of the expander should be set to 4. Set Port 1 Network Type to “Third Party Generic”. Set Port 2 Network Type to “Third Party Generic”. Expand the Commands section and enter the following commands:       PortOne=INET       HardwareType=INET Navigate to the Reader 1/2 tabs and perform the following steps: Set Reader 1/2 Keypad Type to “None”. Uncheck Allow Reading Opened/unlocked. Uncheck Display Card Detail when Invalid. Navigate to the Reader 1/2 Options tabs and perform the following steps: Uncheck Door Sense Enabled. Uncheck REX Enabled. Uncheck Invert REX Input R1/2. Uncheck Always Allow REX R1/2. Save the expander. When presented with the Configure Module wizard, perform the following steps: Set Inputs to 0. Set Outputs to 0. Uncheck Add Trouble Inputs. Uncheck Add Doors. Click Add Now.   Edit the inputs associated with a transitioned SCU1200/1280 as follows: In Security Expert, navigate to Programming > Inputs. For each input associated with the SCU1200/1280, change the Module Type to “Reader (RD)”. Save the input.   Edit the outputs associated with a transitioned SCU1200/1280 as follows: In Security Expert, navigate to Programming > Outputs. For each output associated with the SCU1200/1280, change the Module Type to “Reader (RD)”. Save the output.   When you have finished with all of the steps above, perform a Module Update on the Reader Expander.  Repeat these steps as necessary for other SCU1200/1280 devices.  Once you have verified all SCU1200s/1280s are working properly, you can delete the Input Expanders that were created by the transition tool since they are now unnecessary.

Issue When attempting to use the Door Entry Requires Verification option in a Door Type the verification window does not pop up when a User badges at the door. Product Line EcoStruxure Security Expert Environment Security Expert Cause This option requires a Camera record to be assigned to the Door record even if there is no physical camera at the door. Resolution Create a Door Type that has the Door Entry Requires Verification option enabled. Door Type Create a Camera under Monitoring | Setup | Cameras and set the Type to Direct Camera and URL to any value (this needs to be set even if it is not correct). Camera Configuration In your Door set, the Door Type to the new one created earlier and the Camera (Entry) to the camera just created. Door Configuration Operation: Badging a valid User at the Door will create an Entry Verification event (1) that pops the camera window that includes an Unlock Door button (2) allowing the Operator to manually open the Door (3) once visually identifying the User. Operator Verification

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Unable to view PINs in the User screen if “Allow PIN Duplication” is checked   Product Line EcoStruxure Security Expert Environment Security Expert Server Cause This is viewed as a Site Security Enhancement feature Resolution Disable both the "Require Dual Credential for Keypad Access" and "Allow PIN Duplication" options

Issue When attempting to log in the below network errors, or similar, are displayed. Connect: The server was unable to process the request due to an internal error. Could not log on to Server. Please check your remote connection setup Further checking the Windows Application Event logs on the Server you may also find error messages similar to the below being logged against the Security Expert services. CDTNames::GetTagName : Cannot open database "SecurityExpert" requested by the login. The login failed. Product Line EcoStruxure Security Expert Environment Security Expert MS SQL Cause The Security Expert services do not have the correct credentials to access the SecurityExpert database. Resolution Confirm the user account that the Security Expert services are using in Windows. Go to Start > Run > and type "Services.msc". Confirm the account that those services are being run under. By default, and in the example, this is the Local System account. Run Microsoft SQL Server Management Studio and under your server browse to Security > Logins. Find the user account that your services were used in step 1 In the Server Roles page of this user account. Enable the "sysadmin" server role Save changes and restart the Security Expert services.  

Issue Error 503 when testing for SOAP service availability using URL:   http://localhost:8030/SecurityExpertSOAPService/service.svc  Product Line Security Expert Environment Security Expert Server Cause Application pool in IIS not running.   Resolution In IIS Application Pools, start the pool associated with the Security Expert site.

Issue Downloading a license update, such as after adding features to a site license or extending the evaluation period on an evaluation license, and this fails with the below error being shown. The SSN is invalid for this installation. Product Line EcoStruxure Security Expert Environment Security Expert Cause Wrong SSN being used. The SSN being used is different to what was used when Security Expert was initially installed. Resolution Uninstall Security Expert and re-install using the correct SSN. Backup the SecurityExpert and SecurityExpertEvents databases and copy the resulting backup files somewhere safe. Manual backups can be initiated from the Global > Global Settings menu. Select the directory location and press backup now. Uninstall Security Expert from Windows Add or Remove Programs. Search for "Security Expert" to filter the results. Install Security Expert from available installation files. When asked for the license make sure to use the correct SSN.

Issue Can licenses be transferred in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Cause Unsure if a single SSN can be authenticated on multiple PC's or if licenses can be transferred or moved. Resolution Each PC requires a separate SSN. These licenses can be transferred between PC's. As part of the licensing process, the hardware details of the computer are recorded against each SSN, so any hardware changes require re-licensing, this also means SSNs cannot be shared across computers, and if used on a virtual machine – it must be assigned a static MAC address. Licenses can be transferred between machines without issue, Product Support will add a registration onto the license and clear the hardware profile after receiving a request. The installer will then do a License Update from Security Expert.

Issue Performing a firmware upgrade on a reader expander module via the SP-C's web page will fail with the message: "Error - The module failed to restart in boot mode" Firmware update failure Product Line EcoStruxure Security Expert Environment SP-C, SP-RDM2, SP-MRDM2. Cause Cause 1 There was an intermittent communications fault hindering the update process. Cause 2 There are Smart Card Readers connected to the reader expander module, which are set to RS485 communication. This appears to be causing RS485 communication issues between the SP-C and the reader expander which is hindering the firmware upgrade process. Resolution For Cause 1 Run the module upgrade process again. For Cause 2 Physically remove all connected RS485 Smart Card Readers from the reader expander module being upgraded. Run the module upgrade process again. Once the reader expander firmware has been successfully upgraded, reconnect all Readers.

Issue When trying to connect to a Controller via FTP or Telnet the connection is failing even with known working usernames and passwords. Product Line EcoStruxure Security Expert Environment SP-C-Web SP-C SP-ACX SP-AC1 Cause When connecting with FTP via an application such as Filezilla the error 'Bad username/password' is returned. Via Telnet the error is simply 'Logon Incorrect' and the connection once again fails to complete    Resolution FTP and Telnet have been intentionally disabled on the Controllers for Cyber Security purposes and will not be possible to use going forward. As mentioned in the Controller firmware release notes, Ping is disabled by default and can be re-enabled via Controller Commands: EnablePing = true

Issue Security Expert does not run correctly after installation Product Line EcoStruxure Security Expert Environment Security Expert Cause While Security Expert will install and run correctly on a supported platform, there are occasions when an installed security policy will prevent the correct operation of Security Expert.  In the example below, the installation went smoothly, but when the user tried to log in to Security Expert the error "Error - Exception has been thrown by the target of an invocation" is seen. Thus the install could not be licensed. This example had SQL, Security Expert Server and Security Expert Client all installed on the same PC. Exception has been thrown by the target of an invocation Resolution If the new install does not run correctly, then install the software on a clean Windows platform, this will allow the site to be set up and commissioned. In the above example, the customers extra security policies were applied one at a time until the policy that caused the problem could be isolated.  

Issue When attempting to login to Web Client the below error is seen. “The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state." Product Line EcoStruxure Security Expert Environment Security Expert Web Client Cause The typical cause of this error is a mismatch in the security bindings between the SOAP Service and the Security Expert Data Service. For example if you enable the Windows Authentication checkbox in the Security Expert installer but not in the SOAP Service installer (or vice versa) then you have a mismatch. Resolution Either uninstall the SOAP service and update the checkbox selection to match whatever was selected in the Security Expert installer, or follow the instructions under Troubleshooting | Communication Fault/Failure in the SX-WEB Web Client Installation Manual.pdf for editing the config files of the SOAP service to match the Security Expert Data Service.

Issue How is time synchronized between the Controllers and Security Expert Server?  Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert Controllers (SP-C, SP-ACX, SP-AC1, SP-DCU) Cause Require details on different ways the Controllers can have their time set. Resolution There are two methods for synchronizing time on the Controllers. Periodically updated by the SNTP Time Server configured under the controllers Time Update tab. (Note: the controller polls its SNTP Time Server every 11 minutes.) SNTP Time Server Without an SNTP Time Server configured, time is updated on the Controllers by the following methods. Time is updated manually by the Operator right-clicking the controller and selecting Set controller date/time. This will set the controllers time to the current time of the Workstation. Set Controller Time Time is updated to the server time whenever a “Force Download” is initiated for that controller. Force Download