Building Automation Knowledge Base

  Issue Information needed for using Mercury downstream controllers with Access Expert Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Cause List of Mercury downstream controller and configuration information Resolution Mercury Downstreams    Overview Mercury controllers are an open architecture controller made by Mercury Security. Access Expert supports the series 2 and series 3 SIO boards.   Controller Equivalent    Features FN-RIM1 MR50 Single-card reader interface panel and supports Wiegand, clock and data, magnetic stripe, F2F, Supervised F2F, OSDP, keypad, and biometrics reader technologies. FN-RIM2 MR52 The MR52 is a dual-card reader interface panel. Each unit can connect two card readers, eight general-purpose input monitor points and six control relays to any Mercury EP series intelligent controller. FN-16IN MR16IN The  MR16IN interface panel can support 16 general-purpose input circuits and two dedicated programmable relay outputs. FN-16OUT MR16OUT The MR16OUT interface panel provides 16 general-purpose outputs as Form C relay contacts. FN-MR51e MR51e The MR51e is a single-door, network-ready interface panel.     Adding Downstreams to Access Expert Disconnect the power supply from the downstream and the controller. Set the RS485 jumper to the 2 wire position. Wire the RS485 communication from the downstream to the controller. Downstream Controller TR+ CLK/Data1 TR- DAT/Data0 GND GND Apply power to the downstream and the controller. In Access Expert, from the top bar menu (located at the top left corner of the screen) click on the ‘View All Hardware’ button to open the 'Hardware tree'. In the 'Hardware Tree', double click on the controller or right-click and select ‘Open’ top open the controller page. Alternatively, click on the 'Hardware Provisioning' tab (located a the top of the screen) to open the menu. Click on the 'Controllers' icon(located to the left of the 'Hardware Provisioning' menu to open the 'Controllers' page). Double click or right-click and select 'Open' on the controller, to open that controllers 'Controller Configuration' page. Click on the ‘Add downstream’ button (located at the top of the controller page) to add a downstream. From the drop-down menu, select the appropriate downstream model. Enter a unique ‘Display Name’ for the downstream. Set the ‘Panel Address’ of the downstream. Example: To set devices address to 3, DIP switch 1 and 3 must be ON and 2,3 and 4 OFF and 'Panel Address' in Access Xpert must be set to 3. The DIP switches on the downstream must match the ‘Panel Address’ in the 'Downstream Configuration' page. Note: DIP switches 1 through 5 sets the device address of the downstream and is binary. DIP switch 1 = 1, DIP switch 2 = 2, DIP switch 3 = 4, DIP switch 4 = 8, DIP switch 5 = 16 Confirm that DIP switch 6 and 7 are in the ON position to enable for 38.400BPS communication. Leave DIP switch 8 in the OFF position. Click on the ‘Save’ button (located at the bottom of the page) to apply changes to the downstream.   Downstreams are added to Access Expert from the Controller page. When adding a downstream, you will need to select the downstream type from the drop-down list. If the downstream you are trying to add does not match one of the types listed, it is either not supported on that port or not supported by that controller.     Downstream Addressing Chart     Common Issues Issue                                             Solution The EP/LP1501 has no SIO port The EP/LP1501 uses the CLK and DATA on Reader 1 to communicate to downstreams. This means that if you are leveraging a downstream device, the EP/LP1501 only supports 1 onboard reader. My MR52 is toggling on and offline. The MR52 has a conflicting address with another downstream. Confirm your dipswitches are set to the correct address. Addressing is done on dipswitch 1-5 and baud rate is set on dipswitch 6 and 7 (suggested both on). Dipswitch 8 should always be off. J3 - The jumper for 2 wire and 4 wire RS-485 also needs to be set. By default is set to 2 and should not need changing but this does happen. J5 is the Termination jumper that needs to be set on the last unit in the series. My MR51e is programmed for Static IP but won't connect Check the dip switches on the board. Make sure the dip switches are set back to static IP mode after programming. Check to make sure the static IP address programmed in is valid. Make sure the Downstream can be seen by the controller. My downstream will not come online but my other downstream did. If you have a Mercury downstream on the same port as an Engage Gateway, the Mercury downstream will not be able to come online. Engage Gateway's and Mercury downstreams cannot share a port. Confirm the addressing on your downstream is correct.  My downstream device says "Timeout" This is due to incorrect addressing or incorrect baud rate set on the downstream. Dipswitches 1-5 set the address in a binary fashion and dipswitches 6 and 7 set the baud rate. We suggest leaving both 6 and 7 on. My downstream device says it is in "loader mode" and will not leave that mode Follow the steps below to correct the loader mode: Remove Power from the controller and downstreams Disconnect all downstreams from the controller Bulk Erase the controller. Once the controller is powered back on, reconnect the downstream that is in loader mode only. Reboot the controller.

Issue General use of the Wireshark program. Product Line Access Expert, Andover Continuum, EcoStruxure Building Expert, EcoStruxure Building Operation, Pelco, Satchwell MicroNet, Satchwell Sigma, TAC IA Series, TAC INET, TAC Vista Environment Ethernet Networks Cause General Information on using WireShark. Resolution Wireshark is an Ethernet packet analysis programme, Which can be downloaded from: Latest version available from Wireshark Locally stored version 1.0.9 Installing Wireshark If necessary, unzip the WireShark executable file to a suitable location on the PC/Laptop you wish the programme to be installed on. Run the executable file and follow the on-screen instructions. Rules for capturing LAN traffic using Wireshark: Do not use a switch or router to connect the LAN capture PC to the network as these will filter important network activity that you will need to see. You will want to capture everything that is passing over the network at the point of concern. Usually, this means tapping into the ethernet at the Controller or controllers, that is having an issue. midBit-Technologies-LLC-10-100 is an example of a device that can be used to easily tap into the network to take the capture. The monitoring PC must see all traffic from the controller's point of view. The monitoring PC can be connected in either two ways: Connected to the network at the controller The customers IT department can mirror all the network traffic from the controllers port to another port the PC can be connected to. If connected to the network at the controllers, the connection must be made through a true ethernet hub. A hub will not selectively filter important network traffic as a switch or a router will do. More information on what a "true ethernet hub" can be found at http://wiki.wireshark.org/HubReference There are however some switches that feature port mirroring, please see How to Configure a NETGEAR Prosafe Plus Switch for Mirroring. If connected to a mirrored port, the port must mirror 100% of the network traffic to and from the controller. No filtering should be done. Once a complete capture file has been obtained it can be filtered after the fact using WireShark or EtherReal. Using Wireshark Run WireShark Start a trace by choosing the "Capture" menu and then select "Interfaces" Choose the appropriate interface. Generally, this can be identified by its IP Address, but if not, then the packets increasing are an indication. Press the "Start" button. The trace will start and will be similar to the following screenshot. After an appropriate time, the trace can be stopped by selecting "Capture" menu and "Stop" To save the capture file, choose "File" menu and "Save As".

Issue Need to mirror a switch port in order to capture controller data with Wireshark.   Product Line Access Expert, Andover Continuum, EcoStruxure Building Expert, EcoStruxure Building Operation, TAC IA Series, TAC INET, TAC Vista Environment NETGEAR Prosafe Plus Switch Cause Need a step-by-step guide to set up a mirrored port and an understanding of how it works.  Resolution View the attached video.   Use the link to the original post in Area360 to get written instructions.

Issue The Otis Destination Dispatch integration with Access Expert is not enforcing badge requirements for access to restricted floors. Users can select any elevator key without presenting a badge. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Mercury EP/LP4502 controller Otis Destination Dispatch elevator Compass System Cause The issue stems from missing routing table entries in the Mercury EP/LP4502 controller. These entries are essential for enabling communication between the Otis system and the Access Expert controller, which is required to enforce badge-based access restrictions. Resolution To resolve the badge enforcement issue: Verify Routing Table Entries on the LP/EP4502 controller’s web interface. Ensure the following entries are present: 192.168.50.0 – Enables communication with the Otis Compass Server. 192.168.1.0 – Enables communication with the Otis Destination Entry Computer. Important: If either entry is missing, the systems will not communicate properly, and badge enforcement will fail. Refer to the Hardware Setup section in the integration guide for detailed instructions: Access Expert Otis Elevator Integration Guide   Detailed instructions for installing the Otis Destination Dispatch Access Expert Integration can be found in the Access Expert Otis Elevator Integration with Destination Dispatch Knowledge Base article.

Issue How is the Otis elevator destination dispatch system configured in Access Expert? Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Otis elevator system Mercury controller LP4502/EP4502 Cause Configuration steps needed for Otis Destination Dispatch in Access Expert Resolution An Otis Elevator Compass Destination Dispatching System model allows the LP/EP4502 to inform Access Expert if a cardholder is allowed and authorized for specific floors.   Elevator Control Types in Access Expert There are 2 main types of Elevator control in Access Expert: Basic - does not track the destination of the elevator and cardholder Destination Dispatch - tracks the destination of the elevator and the cardholder Licensing & Hardware Requirements License required: FN-DEST-OTISRS Controllers: LP4502 or EP4502 Mercury Recommended Adapters: LP4502: Micro-B USB adapter (Pluggable USB2-OTGE100) EP4502: USB 2.0 adapter (Pluggable USB2-E100 Hardware Setup: Connect the USB adapter to the controller and connect the Ethernet cable for the NIC2 to the Otis network. Log in to the controller page and navigate to the Network page Under Interface 2 (NIC2), select Static IP Type 192.168.50.250 in the IP address field. Type 255.255.255.0 in the subnet mask field. Click on Accept at the bottom of the page. Navigate to Apply Settings. The controller should reboot to apply the changes. Mercury Controller Configuration Ensure the following routes are configured in the Mercury Controller web interface. Feenics Setup From the Controller Page in Feenics: On the LP/EP4502 controller page, navigate to the "Destination Dispatch" Tab, located on the bottom of the page. Select Otis. Update the floor offset to reflect your Otis setup. The offset must be greater than or equal to 0. Make sure to take into consideration this offset when assigning elevator floor access. Enable "Has front and rear floors" if your Otis setup has front and rear floors.  Make sure to take into consideration this flag when assigning elevator floors access. Enable the "Primary Otis controller" option. Press Save. Issue a "Push Controller Database" command.   Note: The Otis Destination Dispatch Systems can only support one EP/LP4502. In order to support multiple EP/LP4502’s, a Primary and Secondary needs to be configured. The Primary EP4502 will manage communications to the Otis DDS. Communications between the Otis DDS and the Secondary EP4502’s will have to go through the Primary EP4502.   Reader Page: On the reader page, navigate to the "Elevator" tab and select "OTIS Destination Dispatching" as the Elevator Type. In the Dispatch IP enter the DEC (Destination Entry Computer "Touch screen or Keypad") IP address. For the Elevator Dispatch Mode, select the desired mode. You can hover over the tool-tip to read a description of the mode. If desired, select an Override Elevator Access Level. This will allow a set of floors to be public during defined schedules. Press Save. Look for an "Otis DEC {Reader} is Online" event in Live Monitoring that reports the controller communication with the DEC. The controller will report "Otis DEC {Reader} is Offline" if the communication between it and the DEC drops. Person Page: On the person page, navigate to the "Destination Dispatch Settings" tab. On the "Otis Settings" tab, click on "Add Otis Setting". Select the Otis controller and press OK. Select a Default Floor and Floor side. This floor will be served when a DEC is set to Mode 1. Select User flags. Note that Standard and ADA are mutually exclusive. Cardholder Flag selection descriptions: Standard - Standard access, speed and features. Disability - When checked, this indicates the cardholder has a disability. The Otis system recognizes this indicator and cab be set up to provide special accommodations (such as dispatch an adjacent car, extended time to board an elevator car, provide audible announcements at each floor). VIP - When checked, this indicates the cardholder is a VIP. The Otis system can be set up to dispatch an empty elevator car that runs non-stop to the destination floor. Vertigo - When checked, this indicates the cardholder experiences vertigo. The Otis system can be set up to accommodate this passenger by not dispatching them to a glass elevator. SplitGroup - When checked this indicates the cardholder belong to a split group. The Otis system is set up to recognize this person as belonging to a separate group of passengers who use a separate elevator car(s) that is not used by the general population (such as service elevators where technical or service staff do not mix with regular guests). Vertigo2 - no description  CartSvc - no description CIMOverride - Compass Inter-floor Matrix override. This overrides the segmentation used to place certain tenants into certain elevators. Technical Notes DECs must be represented by readers which can be connected to "fake" downstreams such as the MR52. The Cab used will be sent by the Otis system to Feenics upon access granted and displayed in event data.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Access Expert uses Docker containers and images for the Bosch and Schindler integrations and at times the virtual machine image(s) need to be updated. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause Feenics updates virtual machine images which requires an update Resolution Feenics may update a Docker image for one of their integrations.  Note: A Docker software update may be indicated in the bottom right of the Docker Window This is only a software update for Docker and will not update the container image. An image update requires a command to Pull the image down from Feenics. The Docker software update is not required to update the Docker Image.  (see yellow highlight in the snapshot below)   Here are the instructions to update the Docker Container Image to the (latest) Open Docker Desktop for Windows 1. Under Containers, make note of the current bosch service name Ex. AX-bosch-service1 2. Stop the container/service using the stop button 3. Click the Red Delete button above the container Click Delete Forever No container after the delete Image still shows 4. Delete the Image by clicking on the Red Delete button under Images Select Delete Forever (Image) Image deleted (See below) 5. Click on the Blue button 'Search images to run' Type in the following to search for Images feenics/keep-bosch:latest   6. Select the 'feenics/keep-bosch:latest' Image and Click PULL You will see the progress of the image downloading 7. Click on Containers on the top left - the container will not be there 8. Click on Images and then Click the Play button on the Feenics/bosch entry 9. On the next screen, after selecting Play, select the down arrow next to Optional settings Enter the original container name that was noted above i.e. AX-bosch-service1, Click Run You will see messages from the bosch service startup Although the image is updated and running, you will likely see an 81 exception error in the startup log (see highlight above). Here are some additional steps to finalize this process.   10. Check in Windows Services> Docker Desktop Service One of the updates along the way may have changed the startup type to Manual Double-click on the service and select Automatic for Startup type Click Start (to start the service) Click Ok.   11. Open Windows PowerShell in ADMIN mode (standard mode will not work) Run the following command   docker run -d --restart unless-stopped --name feenics-bosch-service --env-file C:\ENV\env-us.txt feenics/keep-bosch   If you try to run the command with the same name as the original service, you will receive the following message in PowerShell  Successful running of the Power Shell command This command ensures Docker runs with the parameters that are stored in c:\env-us.txt 12. Click on Containers, and there will be 2 Containers Select the one that is NOT running and click the Red Delete button The Delete Forever prompt comes up, select the Delete forever button One container should remain and should be running The panel should be online and communicating 13. Test and verify everything is working with the Bosch integration

Issue The Access Expert Bosch integration User sync stopped working whereas previously the Users and their passcodes from the Bosch Panel could be brought into Access Expert using Import Configuration. Example: In the case below, there should be 4 Users, not 2 compared to Bosch RPS.   Note: User 0 is not counted Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted Bosch Panel Integration Bosch Remote Programming Software (RPS) Docker Cause There was a September 2024 update from Feenics to fix a User synchronization defect and there are pre-requisites for the User synchronization to operate normally Resolution 1. Check the version number of Access Expert that is displayed when logging in. The version should be 24.9.1.0 or greater 2. Pre-requisites for the User synchronization     a. Area Authority Assigned     b. Person assigned to the User - the person cannot be blank. This can happen if LDAP is used     c. At least 1 Area Assigned To verify: In Access Expert> Access Configuration Select Area Assighnment 1, or 2, etc. Blank Person for a User Open Bosch RPS and connect to the panel, Expand User Configuration> User Assignments 3. Check Access Expert Live Monitoring and the Docker Logs  If the Import is still not working after ensuring Access Expert client software is up to date and the pre-requisites are set, check to see if there are any entries related to the Import or Users that may help troubleshoot by using Live Monitoring in Access Expert and/or the Docker Logs. An Example of the Docker Logs: Launch Docker> Under the Bosch Service> Logs (User 2 and 4 were not coming in prior to the Sep. Update) If the above steps do not resolve the issue, please open a case with Product Support for assistance.

Issue After installing the Feenics Keep Bosch Service to integrate Bosch panels with Access Expert the service will not start Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Bosch Service and panels Cause A configuration issue is preventing the service from starting successfully Resolution The Feenics Bosch Service will fail to start for a number of reasons: 1. Check that the Feenics Keep Bosch Service exists and hasn't been deleted. "C:\BoschService" 2. The service is unable to authenticate to the Access Expert Instance.  Double-check the username and password being used for the service. Ensure they haven't been recently changed or the username and/or password is correct. Typically the username is Bosch with a configured password. 3. While attempting to start the Bosch service open Live monitoring and see if there is a failed login attempt or other related errors. 4. Open the Windows application log on the PC that has Access Expert and the Bosch service installed and check if there is an exception or a similar error like the following: 5. Install and use the SEQ Log to troubleshoot For Install Instructions for SEQ, see the following article:  https://community.se.com/t5/Building-Automation-Knowledge/Access-Expert-Installing-SEQ-Logs/ta- p/436521  Once installed, run the SEQ Log http://localhost:5341 while attempting to start the Bosch Service and see if errors are being posted. Example:   6. Check the last ping from the Bosch service to the Feenics host API : This date/time will give an idea of the last successful ping which can help target what may have been changed on the system or network that has affected the service. 7. Run the telnet command to access the Feenics host server If the DOS page is blank/black after hitting enter on the telnet command, that is a good sign. If there are any errors these can be a clue as to what is happening. If a firewall is blocking this connection you won't be able to reach the Feenics server.   Note: If the telnet command isn't recognized, telnet may not be enabled on the PC If none of these steps help to identify the issue, please open a Support case.

Issue Cardholders and door schedules are no longer working and they were yesterday Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause There is likely a holiday or holiday group that is affecting the entire system Resolution A holiday in Access Expert will make every schedule in that instance NOT run that day. Holidays are exceptions to a normally scheduled interval. The holidays within the system apply globally to all schedules. Schedules normally activate at the beginning of an interval and deactivate at the end, however, on a holiday, the schedules do not activate. This creates Holidays as global exceptions to schedules.   Example: A site recently lost all card access and schedules did not work on Veteran's Day. Not all cardholders were out of the office that day.  Reviewing the Instance's Holidays showed that Veteran's Day was configured, so schedules and cards were not working.   ** To resolve this issue: 1. The Veteran's Day holiday was deleted from the above list 2. Next, the controller(s) needed a right click and then "Push controller database" After doing this, the schedules and cardholder access worked normally.

  Issue Cardholders are getting automatically changed from Active to Inactive (deactivated). When the LDAP/AD integration is configured to map the Active Directory attribute UserAccountControl to Card Status in Access Expert; records that have useraccountcontrol = 512 (normal active account) are getting their cards deactivated. These records should NOT be deactivated.   An LDAP query mapped to UserAccountControl Card(s) showing Inactive in Access Expert   Event History record showing the date and time the cardholder record was set to Inactive by LDAP Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Active Directory Cause A version of the LDAP service less than 24.2.1 Resolution Manually set the cardholder to Active as a workaround Ensure the LDAP service installed is greater than version 24.2.1. See the following link to a KB article showing how to "Identify which LDAP service is currently installed" : https://community.se.com/t5/Building-Automation-Knowledge/Identifying-which-Access-Expert-LDAP-integration-version-is/ta-p/480424    If the version installed is older than 24.2.1, perform the following steps: Uninstall LDAP from Windows Programs and Features Navigate to C:\ProgramData\Feenics_LDAP and delete the .dat file Restart the PC Install an updated version of LDAP from Feenic's web site: https://s3.amazonaws.com/download.feenics.com/ldap/Feenics.Keep.Installer.ActiveDirectory.msi  Test to ensure the issue has been resolved with the updated LDAP service

Issue An error may pop up when using Bosch RPS configuration software indicating there is an issue with the hardware key. The Bosch Panel is offline in Access Expert Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Bosch Panel using RPS (Remote Programming Software) SafeNet USB Driver Cause The USB hardware key may not be installed or the driver needs to be updated or repaired Resolution Note: This solution assumes that the Bosch panel has been online in Access Expert before.   While working with a Bosch panel to integrate with Access Expert, the RPS software is used to configure the Bosch panel. An error may pop up indicating there is an issue with the USB security dongle that is inserted into the PC to connect to the Bosch Panel using RPS. This error typically pops up when trying to login with RPS and making the connection to the panel in RPS. "Invalid or missing Hardware Key" Steps: 1. Check to make sure that the USB dongle is inserted into the PC RPS is installed on 2. Install, repair or update the Sentinel Driver in Windows Programs and Features  Navigate to Windows Programs and Features Right Click on the Sentinel Driver Select Repair       Clicked through Next and Install Prompted to restart the PC       Note: Before restarting the PC, Exit RPS, Stop and Exit Docker, Exit Access Expert and then Restart the PC. Once the restart is completed, restart RPS and connect the Bosch panel, there should not be an error with the hardware key. Restart Docker and Access Expert. The panel should show online in Access Expert.                Additional external reference from Bosch: https://community.boschsecurity.com/t5/Security-Intrusion/How-to-correct-the-Invalid-or-Missing-Hardware-Key-message-from/ta-p/2858

Issue Access Expert SEQ Log Installation Information Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause The SEQ Log is a valuable troubleshooting tool to be installed separately from Access Expert Resolution Overview Access Expert utilizes a system logging application called SEQ which is used for troubleshooting and diagnostic purposes. While this service is not technically required to run any of the Feenics services, it provides valuable information when troubleshooting. Downloading SEQ The latest version can be downloaded at https://getseq.net/Download Installing SEQ Once the MSI is launched the wizard will prompt for installation as shown in the following Figures. SEQ service installation dialog Once the SEQ logs are installed, click 'Browse Seq' button to open the log in the default browser. Bookmark or Favorite It may be beneficial to set the SEQ logs as a bookmark for easy access. The example below is from Chrome. SEQ Settings Click on the 'Settings' option at the top of the page to access and change the defaults. Initially after clicking on Settings, the API keys page opens. Add an API key if required. API Keys Retention Policy From the settings page, select 'Retention' from the left-hand side menu. Once at the Retention page, click add and set the retention policy. The Access Expert/Feenics default is 21 days. This is adjustable to your needs, however, it is recommended to never go below 7 days. Note: Seq will periodically delete events covered by the policy based on their timestamp. Disk space will be reclaimed by a background compaction process and may not be available immediately. Default is ‘all events’ Example Seq Log Note: Left Click once to expand an event and click it again to shrink it Tips and Troubleshooting Ensure SEQ is installed on the PC where the Access Expert client is installed or it cannot ingest the Access Expert events. If a reinstall of SEQ is needed, manually deleting C:\ProgramData\Seq and subfolders is required after uninstalling SEQ from Windows Control Panel> Programs and Features. The SEQ uninstall does not remove the folder, subfolders and files. If the folder and files are not removed, the installation will fail. Before reinstalling SEQ, Grant the User that is running the installation full permissions to C:\ProgramData\Seq and subfolders if they do not have them. Installing SEQ using Windows Power Shell can be useful since it gives some feedback if something isn't working. Running the MSI installer within Windows doesn't give any feedback.   Command syntax:  seq service install --listen=http://localhost:5341/ -u "YourPCName\admin" -p "YourAccountPassword" Note: The username must be specified as DOMAIN\user or MACHINE\user PowerShell Install Example: SEQ Log documentation: https://docs.datalust.co/docs/getting-started https://docs.datalust.co/docs/ingestion-troubleshooting

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue An explanation of Hosted backup options is needed to understand which objects are backed up and which are not. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause It's important to understand the backup options available for an instance. Resolution By default, each instance includes a one-year transactional history retention, giving one year of Event History backup. Additional event history retention time can be purchased if required, and such purchases will be visible under "Manage License." Example: Note: There are currently no configuration specific backups that are retained or that can be restored to reinstate deleted hardware or objects into an instance.    Recommendations: Exercise caution when deleting objects, especially controllers, from Access Expert. A prompt requests confirmation before deletion. Generate snapshots of controller configurations and other detailed objects. These snapshots serve as references in case of accidental object deletion, assisting the reconstruction of controllers or other objects with their original configurations. Summary reports can also be useful when trying to rebuild objects. For example: Inputs, Outputs, Readers, etc.

Issue Identify which Access Expert LDAP Active Directory Keep version is installed Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Access Expert LDAP Active Directory Keep Integration Active Directory Cause Windows Control Panel Programs and Features doesn't indicate which version of the LDAP Active Directory Keep Integration is installed Resolution Login to Access Expert and the Instance that has LDAP Active Directory Installed Navigate to the General Configuration Tab> LDAP Agents LDAP Right Click on the LDAP agent and select View Event History Note: You may need to change the Priority from 50 to 0 and the Date Range to see an event Expand (Click the plus sign) of one of the LDAP Events (i.e LDAP Agent - Started) The version of the LDAP Active Directory Keep installation will show

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Access Expert LDAP agent unable to connect to Instance Product Line EcoStruxure Access Expert Environment Access Expert V3 Hosted LDAP agent installed OnPrem on-site server (Not the appliance installed by Feenics) Cause LDAP agent cannot connect because the Username/PW may be stored in a registry that is no longer valid Resolution Double-check the site setup documentation records that the Username/PW combination is correct Run the SEQ Log and see if there's an entry that indicates that the 'Ldap agent is not able to connect to the instance' Note: Earlier versions of the LDAP on-site installer did not remove all registry entries including username/pw, so an older username/pw combination may be used instead of an updated combination.  If the username or password was changed at some point or if alternate combinations were used for troubleshooting then an incorrect combination could be used by the LDAP agent to connect to the instance and it cannot. Check the login to Access Expert with one of the LDAP username/password combinations and if there are 2 (Users) listed in Access Expert, delete the username/pw combination that does not work in Access Expert. Regedit Backup and old Username/PW deletion To obtain a registry backup just in case before deleting an entry: https://support.microsoft.com/en-au/topic/how-to-back-up-and-restore-the-registry-in-windows-855140ad-e318-2a13-2829-d428a2ab0692  It is suggested to back up the entire Feenics.Keep.ActiveDirectory.Service subkey Open regedit and delete the imagepath subkey Windows Start/Run> regedit Locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Feenics.Keep.ActiveDirectory.Service Right-click on the ImagePath subkey and select 'Delete' Only delete this subkey, not the other Reinstall the LDAP integration using the media received directly from Feenics or SE Product Support. i.e. Feenics.Keep.Installer.ActiveDirectory.msi The most recent version of the install can be found on Feenics site: Feenics Keep Active Directory LDAP Installation Media  During the installation ensure the tested username/pw combination is used Verify that the 'Feenics Keep Active Directory Service' starts successfully Go to Start>Run>Services.msc and click Ok Locate the 'Feenics Keep Active Directory Service' Right-click and select Start Open SEQ Log and verify that the Ldap agent is able to connect to the Instance. The SEQ entry at the top of this article 'Ldap agent is not able to connect to the instance.' should no longer appear in the SEQ log. The following entry should be there instead. Verify that the Access Expert Windows User(s) can now be used login to Access Expert

Issue The network card is not working on the PC.  Product Line Andover Continuum, EcoStruxure Access Expert, EcoStruxure Building Expert, EcoStruxure Building Operation, EcoStruxure Security Expert, Satchwell BAS & Sigma, Satchwell MicroNet, TAC IA Series TAC I/NET, TAC Vista Environment PC Network Interface Card Cause Require a method to test the network card. Resolution Assuming you have the correct protocols loaded:- Open up a command prompt and type ‘ipconfig’(1) then press enter to get a list of the available network cards. Find the specific network card by name (2) Record the IP Address (3) assigned to the card, e.g. 192.168.5.90 If the card is unplugged (4) connect a network cable and start back at step 1 If the network card does not appear in Device Manager check the drivers are correctly installed for the card and when installed correctly start back at step 1. If the network card still does not appear it could be disabled.  In Network Connections right click the adaptor and select Enable (5) and start back at step 1. After these steps if the network card still does not appear when running ipconfig it is most likely damaged. If/when an IP Address is successfully obtained open a Command Prompt and type ping followed by the IP Address of the card, for example ping 192.168.5.90 (1). A functioning card will respond with 4 successfully replies (2) and the associated statistics (3) As additional information a good first step would be to "ping 127.0.0.1". This will not test a network card but indicates that the TCP/IP protocol is installed and functioning on the host PC.

  Issue Schedule a meeting on a day when the site will be closed early. Steps are needed to ensure a door can be configured for 'card only' mode for the meeting. Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause At times it's necessary to schedule a meeting on a day when the site will be closed early. Steps are needed to ensure a door can be configured for 'card only' mode for the meeting and then revert back to the normal schedule or extend the meeting until the end of the standard schedule. Resolution Steps to configure a door(s) with a schedule using holidays and 2 T&Ps to temporarily place the door in Card Only mode and then revert back to the standard schedule. In this example, the standard schedule Unlocks the door from 8a-5p.   Create a Holiday (Early Meeting) for the meeting date and ensure a Holiday Group Membership is selected Configure a schedule(Leave Early) for the meeting date(s) and length of the meeting. Select the Holiday Group in this example named 'Early Meeting Test' in the far right drop-down. The Holiday Group is needed for this to work. Note: The short-duration example was used while testing this multiple times a day. Configure a T&P (Early Meeting TP) to temporarily change the reader mode to 'Card Only' using the schedule (Leave Early). Select the Leave Early schedule and the 'Schedule-Became-Active' Event, the reader mode and the reader(s). The "Indefinite" duration drop-down selection worked. The other drop-down options did not work for this schedule implementation. Configure a T&P (Early Meeting Cancel) to cancel the Temporary Reader mode and revert control back to the standard schedule and to Unlock the door. Select the Leave Early schedule and the 'Schedule-Became-Inactive' Event, the reader mode and the reader(s). Extend the meeting to the end of the standard schedule if needed to keep it in card-only mode. Testing Results: At 3:55p the Leave Early meeting schedule became active and the TP changed the reader mode to card only. * Please disregard the Door held open highlights in the following snapshots At 4:00p the Leave Early meeting schedule became inactive and the TP canceled the temporary reader mode. The door Unlocked in this example after control was handed back to the standard schedule.

Issue An alarm is configured to be triggered by an event and when the event occurs, the Sound Effect (.wav) file configured for the alarm does NOT sound. Playing the .wav file on the PC outside of Access Expert works and it also works within the Access Expert Sound Effects Window.  Product Line EcoStruxure Access Expert Environment Access Expert Hosted v3 Cause The site IT may have blocked one or more ports Resolution Ensure that the Sound effect can be played from the Sound Effects window in Access Expert. If not, test the .wav file(s) in a different program i.e. Windows Media Player to make sure the PC can play sound files. Windows contains quite a few standard .wav files that can be used to test and they are located in the  C:\Windows\Media folder.   If all the above steps work then ensure that these ports below are not blocked as they are needed for Access Expert to function. download.feenicshosting.com tcp/443 keepevents.feenicshosting.com tcp/443 ocsps.ssl.com tcp/80 crls.ssl.com tcp/80 keepapi.feenicshosting.com tcp/443 connect.feenics.com tcp/443

Issue "Access Denied - Invalid Card Format" in live monitoring when the Door Relocks There is no error when the card is presented and the door unlocks normally Product Line EcoStruxure Access Expert Environment Access Expert Hosted V3 Cause There is some type of electromagnetic interference affecting the reader Resolution There are at least 2 different situations where this has been observed: 1. When using entry and exit readers that are very close together 2. A strong LED light that was close to an entry reader. In this case, there was no exit reader   The resolutions are to move/remove the device causing the interference or in the case of the LED light to ground the shield wire of the reader to the panel. This stopped the error from happening.

Issue Access Expert On-Premise setup needs procedures and tools to backup and restore the database Product Line Access Expert Environment Access Expert Premise Software V3 MongoDB Cause The procedures for backing up and restoring the MongoDB is documented online at the link below. https://docs.mongodb.com/manual/tutorial/backup-and-restore-tools/ However, these instructions do not outline how to use the commands (mongodump and mongorestore) within the Windows OS environment using specific examples. Resolution The following procedures are designed to fill in the gap for Access Expert administrators who need to do manual MongoDB Backup and Restore. These procedures assume that Access Expert V3 has been installed and is functioning normally. You will need 2 separate Command Prompts, run as Administrator, open for these procedures. Mongo DOS Shell to attach to and run commands within MongoDB environment Standard DOS Shell to run the Mongo backup and restore commands MongoDB Backup Ensure MongoDB service is running (Start> Run> services.msc) Open a Command Prompt as Administrator (referred to as the Mongo DOS Shell) Type mongo(command) Type show dbs (command) - shown above, to give a list of the dbs available) If the MongoDB service is "Running," but the client cannot connect when typing mongo, it's probably because the path to the mongo bin folder hasn't been added to the PC's environment. To Add a local path locations variable to a PC environment https://docs.microsoft.com/en-us/previous-versions/office/developer/sharepoint-2010/ee537574(v%3Doffice.14) Ex. C:\Program Files\MongoDB\Server\3.6\bin (This will vary based on the version of Mongo) Open another Command Prompt as Administrator (Standard DOS Shell) Use the CD command to navigate to where you would like the backup files to be created Ex. C:\Data mongodump (command) The mongodump command creates the dump folder with admin, Keep, Signalr subfolders MongoDB Restore In the (Mongo DOS Shell) Prompt show dbs (command) use Keep (command) (Case sensitive) db.dropDatabase() (command) Use the Command Prompt as Administrator (Standard DOS Shell) mongorestore (command) The window should indicate "Finished Restoring Keep.Events," "done" and RESTORE COMPLETE If there are “E11000 duplicate key error collection” Keep.Events errors, it’s because the collection events are already in the folder and need to be deleted first.   Steps to correct the E11000 duplicate issue: (Stop the service, delete and recreate the DB folder, restart service) Right-click on the MongoDB service and Stop (you can’t delete files while the service is running) Delete C:\Data\db folder (not the Data, only DB) MANUALLY CREATE THE DB FOLDER - Right Click > New Folder and name it DB Restart the MongoDB service - this creates the necessary files in the DB folder Once these steps have been done, rerun the mongorestore command mongorestore (command) Verify that users can log into Access Expert with this database