Issue What Fingerprint readers does Security Expert support? Product Line Security Expert Environment Security Expert Fingerprint Reader Cause Require information on what Fingerprint Biometrics are supported with Security Expert. Resolution We only officially support Suprema Biometric readers (HLI p/n SX-BIO-SP) however our reader expanders/controllers should be able to be connected/work with any reader that outputs a standard 26-bit Wiegand output. If there is a fingerprint reader that does this it should be able to be connected to Security Expert like a standard card reader supplying the controller with Wiegand data that is assigned to a user's fingerprint. The enrolling of fingerprints etc would need to be handled by the third party system, we would essentially be treating it as a normal card reader and card. The integration with Suprema Biometric readers allows you to enroll the users fingerprints to the biometric device from within the Security Expert UI. For a list of Suprema devices that Security Expert supports refer to the Suprema Biometric Integration in Security Expert Application Note.

Issue Security Expert client Status Window is not showing live point status for inputs, outputs, doors. Shows an error message “Status Unknown” instead. The client is still however able to receive access control events such as reader entry/exit. Product Line Security Expert Environment Security Expert Cause MSMQ (Microsoft Message Queueing) is not enabled. This is a requirement for MSMQ to be installed on the Security Expert Server, the Security Expert Client machines do not need this but the machine where the Security Expert Services are installed does need this feature installed to function properly. Resolution In Windows Features settings (Turn Windows features on or off) turn on the “Microsoft Message Queue (MSMQ) Server” and the “Microsoft Message Queue (MSMQ) Server Core” features.

Issue A Pelco IWP221-1ES IP camera is being used and configured as a direct camera in Security Expert but the image from the camera is not being displayed in the Security Expert. Product Line Security Expert Environment Security Expert Pelco IWP221-1ES IP camera Cause The wrong URL to the image feed was used. When we use the IP address of camera to display the camera image in a web browser, it requires the Pelco Media plug in or Quicktime but these cannot be used in Security Expert. Resolution Use a direct URL to the camera stream. For the Pelco IWP221-1ES IP camera, use "http://camera.ip.address/jpeg/pull".

Issue A previous version of the client software badged SecureStruxure is installed, and needs to be upgraded to Security Expert. Product Line Security Expert Environment Security Expert SecureStruxure Cause The offer had the name changed between versions, and it's not straight forward to update the software. Resolution SecureStruxure can be upgraded to Security Expert by following these steps: Contact Product Support to upgrade the site license to Security Expert.. Backup the SecureStruxureOperations and SecureStruxureOperationsEvents databases via SQL Server Management Studio. Uninstall SecureStruxure. Rename the SecureStruxureOperations and SecureStruxureOperationsEvents databases to SecurityExpert and SecurityExpertEvents When you run the Security Expert installer, use the new Security Expert SSN. You will need to point Security Expert at the MS SQL database instance you were previously using for SecureStruxure (this is likely "localhost\SECURESTRUXURE"). The installation wizard should pick up the databases and upgrade them, retaining all the SecureStruxure programming. Log into the UI and re-license the software. If you are unable to connect to the license server (no internet connection), you can use the manual method for registering a license.

Issue Can HID iCLASS format cards be used with Security Expert card readers? Product Line Security Expert Environment Security Expert HID iCLASS Cause iCLASS format is a proprietary card format. Resolution The iCLASS format is an exclusive card format for HID readers and will only work on HID readers and will not work with the current Security Expert readers.

Issue When attempting to login to Web Client the below error is seen. “The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state." Product Line Security Expert Environment Security Expert Web Client Cause The typical cause of this error is a mismatch in the security bindings between the SOAP Service and the Security Expert Data Service. For example if you enable the Windows Authentication checkbox in the Security Expert installer but not in the SOAP Service installer (or vice versa) then you have a mismatch. Resolution Either uninstall the SOAP service and update the checkbox selection to match whatever was selected in the Security Expert installer, or follow the instructions under Troubleshooting | Communication Fault/Failure in the SX-WEB Web Client Installation Manual.pdf for editing the config files of the SOAP service to match the Security Expert Data Service.

Issue Attempt to download license and see the below error. Failed to request license Error: Failed to store licence file Exception HRESULT:0x8007051B) (0x0000051B)   Failed to request license Error: Failed to store licence file Exception HRESULT:0x8007051B) (0x0000051B) Environment Security Expert Cause This error could be caused by a folder permissions issue. Usually occurring when Security Expert was installed without proper permissions to edit the folder or parent folder of where the license is stored. Alternatively it can be caused by a domain user account and local user account having identical names since Security Expert doesn’t know which user to check the permissions of when trying to save the license file. Resolution The possible solutions are shown in the order that they should be attempted: Right click the Security Expert license folder, (usually "C:\ProgramData\SchneiderElectric\SecurityExpert\License")and ensure that the Windows user has permissions to modify and view the contents of the folder. Ensure that the there is no local windows user with the exact same name as a domain windows user (e.g. LOCALHOST\admin, as well as ACME\admin). If this is the case change the name of one of the windows users so it doesn’t exactly match the other.

Issue Windows authentication is not working with Security Expert once configured. Environment Security Expert Windows Authentication Cause Windows authentication was not installed or configured properly during initial install/setup of Security Expert. Resolution 1. Install the Security Expert Server, and any Security Expert Clients, with the "Use Windows Authentication" option enabled during the installation process. If this was not initially done at install then you will need to backup your SecurityExpert and SecurityExpertEvents databases, uninstall Security Expert (installing overtop or repairing install may not work) and then re-install Security Expert with the "Use Windows Authentication" option enabled.   2. Go to Global | Operators and create a new operator. The Name can be anything you want. The User Name must be the domain name and domain username you want to have access to Security Expert. This is in the form of "domain\username" as shown in the example image. Set a Role for this operator. And then enable the "Use Windows Authentication" checkbox and save the changes.   3. Go to Global | Home and logout of Security Expert. 4. On the login page select the "Use Windows Authentication" checkbox, set the Server to your Security Expert Server machine name (or blank if it is the local machine) and press Logon.   5. You should now be logged into Security Expert with your Windows username being used.   If you receive an "Access Denied" or other error then confirm the following before contacting Product Support for further help. Security Expert Client and Server were installed with "Use Windows Authentication" option enabled. There is an operator object created in Security Expert with the same domain and user name as the domain user you are trying to login with. The "Use Windows Authentication" option is enabled on this operator object. At the login screen you have enabled "Use Windows Authentication" and set the Server correctly.

Issue Reader Expander loses communications to the SP-C, how are Users authenticated when they attempt to access Doors controlled from this Reader Module? Which Users will still have access through Doors when the Reader Expander is offline to the (SP-C) Controller. Product Line Security Expert Environment Security Expert SP-C SP-RDM2 Cause The SP-RDM2 Security Expert - Door Expansion Module - Installation Guide lists three options for how the SP-RDM2 should behave when it is offline from its SP-C controller.  The resolution below describes what each of these modes means. Resolution There are three options with how to handle access when the Reader Expander is in offline mode (not communicating with the Controller).  1. No Users Under Reader Expander | General tab > Offline Operation, the “No Users” option removes access for any cards badged at these Readers. no one will have access while the Reader Expander is offline to the Controller. 2. Any Card Under Reader Expander | General tab > Offline Operation, the “Any Card” option allows for any card at all to be granted access when the Reader Expander is offline to the Controller. This is the least secure option as anyone with a valid technology card, which is correctly formatted to either the Primary or Secondary formats defined for the Reader Expander, will be granted access. There is no validation of the cards Facility Code or Card Number. At present there is no option available for providing valid access on reading a cards Facility Code only. 3. First 10 Users plus Cache Under Reader Expander | General tab > Offline Operation, the “First 10 Users plus Cache” option allows for the below Users to be granted access when the Reader Expander is offline to the Controller. The first 35 Users in that Controllers Database. The last 150 Users that have badged with valid access. Note: This options text description is an old reference and will be updated in a new software version to reflect that this supports the first 35 Users.

Issue Floor Plans and Camera Views that show up in the Security Expert thin client do not work in the Web Client. Instead of floor and camera images, “Floor plan not supported” and “Camera view not supported” are displayed. Product Line Security Expert Environment Security Expert Web Client Cause Floor Plans and Camera Views are not displayed through the Web Client interface and will only work with the Security Expert Client. The Security Expert Web Client is not intended to support the full suite of options available through the thin client. Resolution Use the Security Expert Client as this will support Floor Plans and Camera Views.

Issue Downloading a license update, such as after adding features to a site license or extending the evaluation period on an evaluation license, and this fails with the below error being shown. Hardware details do not match Environment Security Expert Cause The hardware details on record do not match the hardware details of the machine that is trying to be licensed. Resolution Contact support to have the hardware profile reset.

Issue The following error can occur when logging into Security Expert using a Remote Client:   Could not log on to Server. Please check your remote connection setup. The server has rejected the client credentials.   Environment Security Expert Cause The security policy settings are different between the Server and Client.   When installing the Security Expert Server and Clients, the default security policy is used. This requires that the Windows username and password that the operator has used to log in on a client machine is also a valid user on the computer that is running the Security Expert Server. These security requirements are very favourable for corporate networks and setups where the users and policies are easy to manipulate. For that purpose alone, the Security Expert Server and Client are installed with these settings by default.   All installations are not created equal however and sometimes the Security Expert Server is not located within a domain. In another scenario, the server may be in a domain but the operators need to connect to it from a machine that is not in the domain. In these cases, it has been requested that the security policy in place on a domain or the physical machine is disabled and although this is not recommended practice the security of the system can be maintained using a suitable VPN structure.   This solution should be used with full knowledge that the security of the system will rely on the operator user login name and password as well as the security measures put in place for a client to be able to hit the server with a login request. Protection of the infrastructure to the connection is beyond the scope of this document. Resolution The easiest solution would be to put the Client machine(s) in the same Domain as the Server.  However if this is not possible or if no Domain is used then you can still manually update the security policy instead.   The following process is a manual edit of the XML configuration files SecurityExpert.exe.config and SecurityExpertSV.exe.config  which are located in the .\Program Files\Schneider Electric\Security Expert directory on the Client and Server. It is recommended then to backup these two files prior to performing this task.   1. Close all Security Expert clients and stop the Security Expert Data Service. 2. We are first going to update the Security Expert Client configuration file SecurityExpert.exe.config on the client machine.  If using more than one Client, the change must be done for ALL clients 3. Open Notepad as the administrator, browse to the specified location making sure the 'all files option' is selected.  Then open SecurityExpert.exe.config     (Be aware that it may not have the file extension showing and will be called an XML Configuration file by default) 4. Locate the netTcpBinding tag . Nested within this tag is the binding tag.     Ensure that you insert the below text after the opening binding tag and before the closing \binding tag . If you insert the text outside this tag, the application will fail to run.        "<security mode ="None"></security>"   5. IMPORTANT You must ensure you enter "None" with a capital "N" (not lower case). Ensure you copy input text exactly as shown. Now save the file. If you get a write error then you need to open notepad as the administrator.     6. We are now going to repeat the process for the Security Expert Server configuration file SecurityExpertSV.exe.config which is located in the same directory on the server machine.       Again, make sure the line is inserted after the opening tag and before the closing tag or the application will fail to run when you save the changes.       7. Restart the Security Expert Data Service and test the connection settings.    

Issue Security Expert database size increasing rapidly and getting large Security Expert database size: From the screen capture below, it can be seen that the Security Expert transaction log file SecurityExpert.ldf has increased to a large size. Product Line Security Expert Environment Security Expert Microsoft SQL Server Cause The Recovery model of the Security Expert database is set to FULL and the database has not been maintained. When using the Full recovery model, regular backups of the transaction log should be performed to prevent the transaction log file size from growing out of proportion to the database size. New user databases are created with the same recovery model as the model database. The default recovery model for the model database depends on the edition of SQL Server you have installed. Editions targeted at test and development environments (SQL Server Express) set the recovery model of the model database to SIMPLE. Other editions set the recovery model of the model database to FULL. Resolution For Security Expert, it is recommended that the Recovery model be set to the default of SIMPLE. You can reduce the size of the logs and also prevent them from getting too large again by changing the recovery model of the database from FULL to SIMPLE. The databases can be shrunk to free up drive space. Refer to the following steps: Take a backup of both the SecurityExpert and SecurityExpertEvents databases and store them in a safe location Change the Recovery Model of the SecurityExpert database from FULL to SIMPLE in SQL Server Management Studio. To do this, right click on the SecruityExpert database and go to its properties. Select 'Options'. You should be able to see Recovery model setting. Right click on the SecurityExpert database and select Tasks > Shrink > Files In the Shrink File - Security Expert window, change the File type to Log. Click OK Repeat steps 2-5 for the SecurityExpertEvents database It is recommended that regular scheduled backups be configured when using the SIMPLE recovery model. In SIMPLE recovery mode, changes since the most recent backup are unprotected.

Issue Requirement for a number of users to be able to access Security Expert using Web Client at the same time. Product Line Security Expert Environment Security Expert Web Client Cause Unsure how many Web Client users are licensed with the standard license or how to add additional user licenses. Resolution Included with the base SX-SRVR license is an allowance for having three (3) concurrent Web Client operators.  Additional operator licenses (SX-WEB-OPR) must be purchased to allow Web Client logins beyond the licensed amount of three, purchase as many of these as is required.

Issue When a card is presented at the Smart Reader it beeps but no card data is sent through to the Security Expert Controller. The Reader LED is flashing red then green every second continuously. Environment Security Expert SX-DRD-?? SX-DRK-?? SX-RD-?? SX-RK-?? Cause The Smart Card Reader is not able to communicate with the Controller as it is in RS-485 mode but the connection being used is Weigand. Once connecting to the the Smart Reader in RS-485 mode the reader will not communicate if it is then connected up to a Wiegand port. Resolution The Smart Card Reader needs to be connected to a terminal connection in RS-485 so it can be changed back to using Weigand mode. See theEntering RS-485 Programming Modesection in the Smart Card Reader Installation Guide for further details.

Issue With Microsoft's new licensing model there is uncertainty around which parts of a Security Expert system need to allow for addition device CAL's for SQL Server. Product Line Security Expert Environment Security Expert Microsoft SQL Server Cause Unclear documentation. Resolution Security Expert Controllers do not talk to the SQL Server, are not a client on SQL and do not require a CAL.The Controllers talk to the Security Expert Software, not SQL or the OS. A card holding user who is NOT a Security Expert Operator will not require a CAL. The Controller and any attached equipment are NOT a user in SQL, they do not inject or operate queries against it, so a CAL is not required. A CAL would be required for a Windows user to log into their Windows user account, and the Security Expert client would connect to the Server using the CAL associated with the Windows user account.

Issue Maximum number of expansion modules and doors per controller Environment SP-C Security Expert Security Expert Controller SP-RDM2 Security Expert Security Expert Door Expansion Module Cause Documentation states that one SP-C supports up to 128 doors but this is dependent on the communications.  Resolution The current recommendation from Product Management is a maximum of 24 to 34 doors per SP-C. This equates to about 10 to 17 reader expansion modules.  

Issue When the EWS is installed on the same machine using the service then all packets will be going to the localhost and will not hit the NIC so will not be captured in a Wireshark packet capture. Product Line EcoStruxure Building Operation, Security Expert Environment Security Expert EBO Cause Packets sent between services on the same machine (like SOAP and EWS) do not hit the NIC and therefore cannot be captured with the default configuration of Wireshark using the WinPcap packet sniffing library.  Resolution Replace WinPcap with Npcap to emulate a loopback NIC for packet capture. Go to https://nmap.org/npcap/ for details on the library. Download the library installer from https://nmap.org/npcap/#download Uninstall WinPcap. Install Npcap. Npcap will create an adapter named Npcap Loopback Adapter for you. In Wireshark choose this adapter to capture, you will see all loopback traffic the same way as other non-loopback adapters. You can test this out by typing in commands like "ping 127.0.0.1" (IPv4)  or "ping ::1" (IPv6).

Issue After changing a controller's IP settings, it does not come online and cannot be accessed via its web interface. The controller can be accessed via its web interface by temporarily defaulting the IP address. Still, changes to its IP settings cannot be saved and are instead met with the following "Invalid Port" errors. Invalid Port – Module UDP Port Invalid Port – Touch Screen UDP Port Product Line Security Expert Environment Security Expert Controllers (SP-C, SP-ACX, SP-AC1, SP-C-WEB) Cause The controller's HTTP Port has been set to 0. If this field is set to no value, this is converted to an invalid 0 value, the controller will no longer be accessible via the web interface and will require defaulting the IP address to connect. Resolution Change the HTTP Port to a valid value. The default HTTP Port is 80, but it should be changed to another available port for increased security.

Issue SP-RDM2 Reader Expanders running firmware 1.12.544 appear to fail whenever an attempt is made to update their firmware revision. Product Line Security Expert Environment SP-RDM2 SP-RDM2m Cause There is a known defect in 1.12.544 (Build .544) which prevents the SP-RDM from being upgraded or even downgraded. However, a number of SP-RDM units have been shipped from the factory with this build pre-installed. Any attempt to select an SP-RDM running this firmware and upgrade or downgrade it to a different revision will consistently fail with an error: 'Module not responding'. There is also a possibility that the SP-RDM can be permanently disabled in the process Resolution Since the .544 Build defect cannot be resolved the only recourse at this time is to swap out the unit via the Returns Material Advice (RMA) process for a new unit.      List of SP-RDM2 Serial #s affected thus far: Note: All other SP-RDMs running firmware both above and below .544 Build are unaffected