Building Automation Knowledge Base

Issue When attempting to update the firmware on the SP-MRDM module, the update process fails, and the module appears offline with the fault LED activated. A "Module not responding" error message is displayed that indicates the module should be disconnected, and a utility used to restore the firmware.   Product Line EcoStruxure Security Expert Environment SP-MRDM SP-MRDM2 Cause The module has lost its firmware during a failed firmware update attempt, leading to the offline status and fault LED activation. Resolution To resolve this issue, follow these steps: Establish a connection to the SP-C controller using a web browser. Force a module update operation from the Application Software tab. Note that it may be necessary to check the "Skip Verification" checkbox during the update process.

Issue All Facility/Card Number fields are blank in Users that were transitioned into Security Expert from Continuum Product Line EcoStruxure Security Expert Environment Security Expert Server Continuum Database Transition Tool Cause Expected site code and card numbers from transitioned Continuum personnel objects to populate in the Facility/Card Number fields of the user objects in Security Expert but find all those fields are blank Resolution The site code and card number of personnel objects transitioned from Continuum using the Continuum Transition Tool will show up as credentials on the Security Expert side, this is by design. There is no need for any further changes, the credentials will work when presented to the reader.

Issue When transitioning users from Continuum to Security Expert, only about half of the user db is transferred. Product Line EcoStruxure Security Expert Environment Security Expert Controller Continuum Database Transition Tool Security Expert Data Sync Service Cause Continuum Database Transition Tool and Security Expert client must BOTH have the same configuration for "Allow Pin duplication". It could be either both unchecked or both checked Export history must be deleted when Continuum Transition Tool and Security Expert Data Sync services have stopped Resolution After a fresh transition and proper configuration ("Allow Pin duplication" in both CTT and SX client):   In the Continuum Database Transition Tool: Stop both Continuum Database Transition and Security Expert Data Sync services Delete export history Start both services again

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue In some recent versions of Security Expert there is unexpectedly high data usage on controllers connected by 4G modems.  Product Line Security Expert Environment Security Expert Server SP-C 4G Modem Cause This can be caused by the Security Expert regularly contacting all controllers to improve status reporting from the event service. Resolution If you are experiencing high data usage on metered (low data) connections, you can turn off these regular "check-ins". Be aware that this may increase the chance of controllers dropping offline.   Stop the Security Expert services.   In the File Explorer, navigate to the installation directory: ..\Program Files (x86)\Schneider Electric\Security Expert  Open SecurityExpertSV.exe.config. Files in this directory require administrator permissions to edit. You may need to open the file as an administrator using an application like Notepad++, or make a copy in a different directory to edit and replace the original.   Add the following code under the <configuration> node, between </configSections> and <microsoft.scripting>:  <appSettings>     <add key="gx:EnableUnknownStatusMitigation" value="false" /> </appSettings> Save the file.  Open SecurityExpertEvtSvr.exe.config.   Under the <appSettings> node, add the following code:  <add key="EnableControllerConnectionWatchdog" value="0" /> Save the file.  Restart the Security Expert services.  

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue SP-C has a valid gateway specified and it's not receiving communications Product Line EcoStruxure Security Expert Environment Security Expert Controller firmware .1248 (or higher) Security Expert 4.0.128 (or higher) Security Expert Controller w/ USB port 2.08.582 (or higher) SX-ELV-HLI-TK license to enable the integration USB to Ethernet adaptor dongle TKE Controller (American) v2r0 (only supported version) Cause It is a known issue. SP-C sends a heartbeat message to TKE but it is not being sent/received as a broadcast message. The controller still sends a heartbeat message to TKE but it is not sending it as a broadcast message with a destination of FF:FF:FF:FF:FF:FF. The gateway being valid causes it to send a Unicast message to the gateway itself (eg router) which does not pass it on to the rest of the network. (This is a known issue and has been logged with engineers). Resolution The workaround is to enable the USB Eth NIC on the SP-C and use: - The onboard NIC to connect to the Security Expert Server that requires a valid gateway to be set - The USB to ethernet adaptor (USB NIC) to connect to the TKE Network where we would set any gateway to avoid this bug Note: The USB NIC can only be configured when using OTIS elevator HLI type. The USB NIC hardcodes the required OTIS IP info to the Onboard NIC for connection to Security Expert. To enable Web UI: 1. In Security Expert, Go to Sites|Controllers|Configuration Tab. 2. Scroll down and expand the Elevator HLI section. Set Elevator HLI type to choose OTIS 3. Return to the General Tab, Scroll down and expand the Commands section and enter OTISUseUSBForMainComms = true 4. Save changes and wait for the programming to be downloaded. 5. Power cycle the SP-C. 6. Go to SP-C Web UI. The USB Eth adaptor will have the original IP. Configure both IP adresses 7. Once The NICs are configured, change the Elevator HLI type back to Thyssen Krupp, choose Cable Network type 8. Click Save and restart the SP-C.

Issue Scheduled event reports exported to PDF are using the US date time format not the local systems date time format. Report settings   In the below example the Windows system, and Security Expert, were both setup for Australia regional settings with a date format of dd/mm/yyyy. The automatic scheduled reports exported to PDF were showing the US date format mm/dd/yyyy. Report export before   Product Line EcoStruxure Security Expert Environment Security Expert event reports Cause The local Windows system date settings for Welcome screen and New user accounts are incorrect. Resolution In Windows navigate to Control Panel\Region Click on Change date, time, or number formats. A new window (Region) will pop up. Click the Administrative tab Click Copy settings... Enable the following options if not enabled already. Under Copy your current settings to tick Welcome screen and system accounts and New user accounts as shown in the image below. This will copy the Current users format over to the Welcome screen and New user accounts sections. Date format settings After making the above changes the PDF reports generated now show the correct date format of dd/mm/yyyy. Report export after

Issue Need to disable HTTP access for both SOAP web service and Web Client to allow HTTPS access only. Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert SOAP Web Service Security Expert Web Client Cause Need to disable HTTP access for enhanced cybersecurity Resolution Disable HTTP access for SOAP: Navigate to the SOAP IIS Directory, by default this is "C:\inetpub\wwwroot\SecurityExpertSOAPService" and open the "Web.config" file using a text editor such as Notepad or Notepad++. Scroll down to the <services> section and comment out the following two lines: <endpoint address="" binding="basicHttpBinding" bindingConfiguration="basicHttpEndpointBinding" contract="GXWCF2.IService1" /> <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />   To confirm that the HTTPS version of the service is accessible, paste the following link into the URL bar and replace the placeholders with the relevant values: https://<pcname>.<domainname>:<portnumber>/SecurityExpertSOAPService/service.svc. A web page will open with a message saying that the service has been created, this confirms SOAP is working correctly. Disable HTTP access for Web Client: Open Internet Information Server (IIS) manager.  Right click on the SecurityExpertWeb site and select "Edit Bindings".   Remove the HTTP site binding. Configure Web Client to connect to SOAP via HTTPs: Navigate to the IIS directory for the Web Client, by default this is "C:\inetpub\wwwroot\SecurityExpertWebClient". Go to the 'include' directory and open the file 'soap.connect.php" Modify the address on the $wsdl = to the HTTPS SOAP address, and change the port number as well. Additionally, 'localhost' does not work, and it must be changed to hostname with qualified domain name. See below image for reference: Once this change is made it should now be possible to browse to the web client over HTTPS.

Issue After configuration, Suprema readers are showing as offline in the Security Expert client. There are Security Expert Download Service events logged in the windows application event log. Cannot load DLL - LoadLibrary() Failed. Cannot load DLL event mesage Product Line EcoStruxure Security Expert Environment Security Expert Suprema biometric readers Cause Required DLL SecurityExpertSV2.ThirdParty.dll is missing from the installation folder. Some versions of Security Expert installer will not install this required DLL and the file need to be manually added. Resolution Check the Security Expert install folder, typically C:\Program Files (x86)\Schneider Electric\Security Expert, to confirm if the file SecurityExpertSV2.ThirdParty.dll is present. SecurityExpertSV2.ThirdParty.dll   If the file is not in the installation folder then it can be sourced by contacting Product Support. Once provided, install the file by copying it into the installation folder, then restart all of the Security Expert services or restart the Security Expert server.

Issue When attempting a login from a Security Expert client PC, it generates a "Network SSPI error" when using Windows Authentication and the machine name. Product Line EcoStruxure Security Expert Environment Security Expert 4.3.285.21 Multiple PC Security Expert Installation using Windows Authentication Cause The Network SSPI error is generated at the Client PC Login because of how Security Expert implements RFC1034 which stipulates how machine names are used for DNS. Resolution 1. Place a period at the end of the Security Expert Server machine while logging into the client only Security Expert PC Example: Using "WIN-B0DOGEHESMN" as the server name will not work Using "WIN-B0DOGEHESMN." will work Notice this works because of the "." at the end Here is a graphical example of logging in with the correct server name by adding the "." 2. The other workaround would be to use the IP address of the server instead of the fully qualified domain name (FQDN). *Note* IT departments typically prefer the use of the FQDN name

Issue The network card is not working on the PC.  Product Line Andover Continuum, EcoStruxure Access Expert, EcoStruxure Building Expert, EcoStruxure Building Operation, EcoStruxure Security Expert, Satchwell BAS & Sigma, Satchwell MicroNet, TAC IA Series TAC I/NET, TAC Vista Environment PC Network Interface Card Cause Require a method to test the network card. Resolution Assuming you have the correct protocols loaded:- Open up a command prompt and type ‘ipconfig’(1) then press enter to get a list of the available network cards. Find the specific network card by name (2) Record the IP Address (3) assigned to the card, e.g. 192.168.5.90 If the card is unplugged (4) connect a network cable and start back at step 1 If the network card does not appear in Device Manager check the drivers are correctly installed for the card and when installed correctly start back at step 1. If the network card still does not appear it could be disabled.  In Network Connections right click the adaptor and select Enable (5) and start back at step 1. After these steps if the network card still does not appear when running ipconfig it is most likely damaged. If/when an IP Address is successfully obtained open a Command Prompt and type ping followed by the IP Address of the card, for example ping 192.168.5.90 (1). A functioning card will respond with 4 successfully replies (2) and the associated statistics (3) As additional information a good first step would be to "ping 127.0.0.1". This will not test a network card but indicates that the TCP/IP protocol is installed and functioning on the host PC.

   

Issue The error "Failed to Invoke the Security Expert Suprema Component" is seen when attempting to register/enroll a user's biometric credential at a Security Expert Client Only machine.   Figure 1 - Suprema scan error   When doing a registration/enrollment from the Security Expert Server this error is not seen and the registration is successful. Product Line EcoStruxure Security Expert Environment Security Expert Suprema Biometric Reader Cause The Suprema.dll has not been properly registered on the local machine. Resolution First check in C:\Program Files (x86)\Schneider Electric\Security Expert folder and confirm that the three files Suprema.dll, BS_SDK.dll, and BS_SDK_V2.dll are all present. If they are not you will need to copy them over from a working installation of Security Expert Server Installation.   Now run the below commands via an Administrator authenticated command prompt session: For 64-bit machines cd C:\Windows\SysWOW64 regsvr32.exe “C:\Program Files (x86)\Schneider Electric\Security Expert\Suprema.dll” For 32-bit machines regsvr32.exe “C:\Program Files\Schneider Electric\Security Expert\Suprema.dll” You should get a pop-up saying the .dll was registered successfully. Close and re-open the Security Expert client and re-test enrolling a user's fingerprint.

Issue Valid Users are randomly unable to gain access when presenting at a Suprema biometric reader. Sometimes they are able to gain access but others they are not and see user denied events in the events window. User denied entry by entry mode error door mode is not correctly programmed using invalid reading device User Denied Event Product Line EcoStruxure Security Expert Environment Security Expert Suprema BioEntry W2 fingerprint reader Cause The sensitivity settings in the Suprema software are too sensitive resulting in missed fingerprint reads. Resolution Reducing the fingerprint sensitivity from the default setting of 7 to a setting of 5 may allow fingerprints to be read more reliably.   The sequence used to authenticate the User can also result in more frequent read failures. Presenting a valid card then an invalid (or bad read) fingerprint and then presenting the card again,  the sequence starts all over again and will result in a user denied event. If the user presents the correct finger (after presenting the wrong finger) or tries the same finger again within the configured timeframe they will be granted access.

Issue Suprema Fingerprint Reader Integration Product Line EcoStruxure Security Expert Environment Security Expert Suprema Fingerprint Reader Cause Security Expert integrates with Suprema BioEntry, BioEntry Plus, and FaceStation devices. Enrolment is both quick and easy with users scanning their fingerprint or face at an enrolment reader. The Suprema reader uses the scanned data to create a credential template, including a card number, which it sends to the Security Expert Server. Security Expert then sends this template to any other Suprema readers that are attached to the system so that only one enrolment is required. Resolution The following information is available on integrating Suprema Fingerprint Readers with Security Expert A list of qualified Suprema devices and configuration details can be found in the Suprema Biometric Integration in Security Expert Application Note. There are some available help topics in the online help. In the Security Expert  Client go to ABOUT | HELP and search for "Biometric Readers" and "Suprema". Each Suprema reader requires a wiegand port on a controller / expander, a license (SX-BIO-SP) and an IP address. The amount of Suprema readers allowed is only limited by these numbers. 

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue WebClient's PHP version causes alerts in scanning tools like Microsoft 365 Defender   Product Line EcoStruxure Security Expert   Environment Security Expert Controller   Cause PHP version is outdated   Resolution This video demonstrates how to manually upgrade PHP in a Windows environment   Navigate to https://windows.php.net/downloads/releases/archives and download the required "non-thread safe" PHP7.4 x64 or x86 Stop the IIS Web Server (WinKey + R, type inetmgr, press Enter) Rename the PHP folder in C:\Program Files (x86)\Schneider Electric\Security Expert Web Client\ from "PHP" to "PHP_7.3" Create a new folder in "C:\Program Files (x86)\Schneider Electric\Security Expert Web Client" and name it "PHP" Extract the downloaded zip PHP 7.4.29 to the new "C:\Program Files (x86)\Schneider Electric\Security Expert Web Client\PHP" folder Copy the file "PHP.ini" from PHP_7.3 to C:\Program Files (x86)\Schneider Electric\Security Expert Web Client\PHP Start IIS Web Server Browse to the WebClient and confirm you can log in and view/add records etc   Note: SX 4.3.344.20 requires SOAP 1.6.0.11 and WebClient 1.47.1.3. This version of Web Client uses PHP 8.1.13.  While it is possible to manually upgrade this PHP version as explained above, 8.1.13 is the latest version to be tested/supported at this time.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Creating a report that shows which visitor is being visited Product Line EcoStruxure Security Expert Environment Security Expert Controller Cause The standard visitor report does not record who at the site is being visited Resolution This video demonstrates how to create a visitor report that includes which users have been visited in the Security Expert System.   The advanced Visitor Report is created in 4 main steps: 1. Create an Access level for each user who receives visitors 2. Assign this Access level to the user's visitor tab 3. Create (or use existing) User report with the new "access level" column selected 4. Configure and run the user report   Creating Access levels 1. In Security Expert client, go to Users|Users a-Select a user who receives visitors (ex: John Doe) b-Go to the Visitor tab c-Check the "User supports visitors" box d-Click the ellipsis (3 dots) to open the Access Level window e-Click Add button f-Name it '[User]'s Visitors' (ex: John Doe's Visitors) g-In the configuration section, configure the access level required for the user's visitors h-Save and repeat for each user who normally receives visitors. Close the window and go back to the User table.   Assign Access level 2. Select "John Doe's Visitors" for Visitor access level -Save changes   Create User Report 3. Go to Report|Setup|User -Create (or use existing) report for visitors -Go to the Columns tab -Click Add and choose "Access Level" User Field -Save report setup   Configure User Report 4. Return to the general tab and expand the "Default user report filter" section. Press "edit in report view" and edit your desired layout -Save report view   The next time you run the visitor report it will print who's being visited in the "Access level 1" column

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Create a report of all expired cards Product Line EcoStruxure Security Expert Environment Security Expert Controller Cause A custom report and its configuration are needed to find all expired cards at the site Resolution This video demonstrates how to create and configure a report to find all expired cards in a system   Create a User Report: 1. In Security Expert Client, go to Reports|Setup|User and Add a new (or use an existing) report. 2. Configure the desired Report Type and Sorting 3. Go to the Columns tab, click the Add button and select Columns.  Make sure to have: -Expiration date of badge AND/OR Expiry date 4. Save your report   Please note: The "Expiration date of badge" column pulls the date from Users|Users|Extended Tab|Expiration date of badge. The "Expiry date" column pulls the date from Users|Users|General Tab|User expiry date/time section's End date.   Customize the User Report's layout: 1. Go to Reports|Setup|User| General Tab| Default user report filter and click the "Edit in report view" button 2. Right-click "Expiration date of badge" (or "Expiry date") column and select the Filter Editor 3. Change the "And" condition (in red) to "Or" 4. Change Equals to DateTime Operators: Is Yesterday 5. Click "+" sign in green circle to a line and repeat changes 5 more times for the following: - Is Earlier This Week - Is Last Week - Is Earlier this Month - Is Earlier This Year - Is Prior This Year 6. Click Save Report Layout

Issue Reader Expander loses communications to the SP-C, how are Users authenticated when they attempt to access Doors controlled from this Reader Module? Which Users will still have access through Doors when the Reader Expander is offline to the (SP-C) Controller? Product Line EcoStruxure Security Expert Environment Security Expert SP-C SP-RDM2 Cause The SP-RDM2 Security Expert - Door Expansion Module - Installation Guide lists three options for how the SP-RDM2 should behave when it is offline from its SP-C controller.  The resolution below describes what each of these modes means. Resolution There are three options for how to handle access when the Reader Expander is in offline mode (not communicating with the Controller).  1. No Users Under Expanders | Reader Expander | General tab > Configuration section > Offline Operation, the “No Users” option removes access for any cards badged at these Readers. no one will have access while the Reader Expander is offline to the Controller. 2. Any Card Under Expanders | Reader Expander | General tab > Configuration section > Offline Operation, the “Any Card” option allows for any card at all to be granted access when the Reader Expander is offline to the Controller. This is the least secure option as anyone with a valid technology card, which is correctly formatted to either the Primary or Secondary formats defined for the Reader Expander, will be granted access. There is no validation of the card's Facility Code or Card Number. At present there is no option available for providing valid access on reading a card's Facility Code only. 3. First 10 Users plus Cache Under Expanders | Reader Expander | General tab > Configuration section > Offline Operation, the “First 10 Users plus Cache” option allows for the below Users to be granted access when the Reader Expander is offline to the Controller. The first 35 Users in that Controllers Database. The last 150 Users that have badged with valid access. Note: This options text description is an old reference and will be updated in a new software version to reflect that this supports the first 35 Users.

Issue The default LED Output names for Reader Expanders (eg. RD Red R1) do not always match the colour of the LEDs on the card reader Product Line EcoStruxure Security Expert Environment Security Expert Controller Security Expert Reader (New version only) Cause The default LED output names/labels don't accurately describe their function. Resolution The "RD Green R1/R2" Outputs represent the reader's LED colour in its "active" state. By default: These outputs are not inverted; (in Programming|Outputs|Options General section, "Invert output" checkbox) When the output is activated, the reader's LED is green; When the output is deactivated, the reader's LED returns to blue; The "RD Red R1/R2" Outputs represent the reader's LED colour in its "resting" state. By default: These outputs are inverted When the output is activated, the reader's LED colour is also green When the output is deactivated, the reader's LED returns to blue To have the Red LED in the active state, you must add the following to the output's command console (found in Programming|Outputs|General Commands section): LEDColour = 1, where 1 is Red.   Here is a list of available colours: 1= Red 2= Amber 3= Orange 4= Yellow 5= Lime 6= Green 7= Mint 8= Turquoise Note: Please refer to AN 270 to identify new from old versions of the reader hardware  

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue The list of visitors has become very large on the VMS front page Product Line EcoStruxure Security Expert Environment Security Expert Controller Cause By default, visitor users are not deleted automatically from the system Resolution 1. In The Security Expert client, go to Visitor | Template | General Tab. Select the template you want to edit. 2. Scroll down and expand the Configuration section. In the Checkout mode, select 'delete user'. 3. Click Save.