Building Automation Knowledge Base

Issue Information is not clear on what the available intercom parts are and what each looks like. Product Line EcoStruxure Security Expert Environment SX-IPI SX-IPI-C SX-IPI-C-ES SX-IPI-C-EF Cause Old product announcements contain misleading information. Details are missing from current documentation. Resolution There are only three possible intercom part numbers that can be ordered. SX-IPI: This is the part code for the regular intercom with no camera SX-IPI SX-IPI-C: This is the part code for the regular intercom with camera SX-IPI-C SX-IPI-C-EF: This is the part code for the Flush Mount Kit for the SX-IPI-C intercom SX-IPI-C-EF front SX-IPI-C-EF back Note: There is no surface-mount kit (SX-IPI-C-ES) for either intercom, and the non-camera intercom (SX-IPI) does not have the option of a flush mount kit.

Issue Is it possible to setup more than one custom card format in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Custom Card Formats Cause Have a requirement for two or more custom card formats. Resolution Currently, only one Custom Format can be configured.   It is possible to add a Secondary Format to a Reader port in Reader Expanders, but only one port can be setup with a Custom Format.    However, Credential Types have now been introduced with the release of Security Expert 4.3, which largely supersedes Custom Formats going forward and allows multiple custom card formats and even QR codes where required.  Please see AN 276 Security Expert - Configuring Credential Types - Integration Guide for more information on setting up Credential Types and Maximum number of Credential Types for more info on how many can be used.

Issue System changes made to a Security Expert server can cause the license to fail. Product Line EcoStruxure Security Expert Environment Security Expert licensing Cause When the SSN license is activated on the Security Expert server a hardware footprint of the server system is created and stored with the license activation. This ties the license to that specific machine, if the hardware footprint changes in the future this will break the license activation.   There may be additional system changes that trigger this but the ones we are aware of that will break the licensed hardware footprint are the following: A change of the Security Expert servers computer name. Normally when we see this the installer is attempting to activate/update the license from a Security Expert client machine instead of the Security Expert server machine. A change in the Network Interface Cards. Changing from a wired to wifi connection can potentially do this. If the server is installed on a virtual machine ensure that the Network Interface Card is assigned a static MAC address. Other hardware changes such as changing Hard Drives, CPU, Memory, Operating System or Motherboards. Resolution If the hardware footprint has changed, breaking the license activation, the SSN will need to be reset and an activation added. Contact your local support to add a registration to the license and clear the hardware profile. The installer will then do a License Update from the Security Expert server to re-activate the SSN.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue A large number of alarms have accumulated and need to be acknowledged at one time. Product Line EcoStruxure Security Expert Environment Security Expert Client Cause A large number of unacknowledged alarms have been allowed to build up until the number is too large to acknowledge them manually one at a time. Resolution To acknowledge the alarms all at once, please raise a Support Case with your local Customer Care Centre and Product Support can assist with a remote session to apply a 'one time' SQL Query direct to the Security Expert Database. See Browsing slow in Security Expert Client for some methods to minimize unacknowledged alarms accumulating so rapidly in the database.

Issue What SQL collation does Security Expert use? Product Line EcoStruxure Security Expert Environment Security Expert server Microsoft SQL Server Cause Need to know the SQL collation used in Security Expert databases. Resolution The default collation is SQL_Latin1_General_CP1_CI_AS. This is the only supported collation and is set by default during installation and creation of the Security Expert databases.   Changing the collation can have serious ramifications to the stability and operation of Security Expert and is not supported.

Issue After configuration, Suprema readers are showing as offline in the Security Expert client. There are Security Expert Download Service events logged in the windows application event log. Cannot load DLL - LoadLibrary() Failed. Cannot load DLL event mesage Product Line EcoStruxure Security Expert Environment Security Expert Suprema biometric readers Cause Required DLL SecurityExpertSV2.ThirdParty.dll is missing from the installation folder. Some versions of Security Expert installer will not install this required DLL and the file need to be manually added. Resolution Check the Security Expert install folder, typically C:\Program Files (x86)\Schneider Electric\Security Expert, to confirm if the file SecurityExpertSV2.ThirdParty.dll is present. SecurityExpertSV2.ThirdParty.dll   If the file is not in the installation folder then it can be sourced from the integration guide ZIP package. AN 264 Security Expert - Suprema Biometric - Integration Guide contains the three DLL's required for the integration. Install the file by copying it into the installation folder, then restart all of the Security Expert services or restart the Security Expert server.

Issue When following the Enabling Transparent Data Encryption configuration steps in the SX-SRVR Security Expert - Client Server - Installation Guide, an error is seen running the supplied script to backup the certificate and encryption key.   Cannot find the certificate ‘TDECertificate’, because it does not exist or you do not have permission. Product Line EcoStruxure Security Expert Environment Security Expert Server Microsoft SQL Server Cause When copying the text from the SX-SRVR Security Expert - Client Server - Installation Guide the formatting contains a carriage return that stops the script from being able to be run in SQL. Resolution 1. Ensure the correct database is being run against by selecting it from the drop down in the SQL Server Management Studio menu bar or by adding "use master" as the first line in the script. 2. Create folders "c:\storedcerts" and "c:\storedkeys". 3. Fix the script by removing the carriage return breaking up the "TDE Certificate" file name.   The following script was successfully used to backup one file in each directory. use master; go BACKUP CERTIFICATE TDECertificate TO FILE = 'c:\storedcerts\TDE Certificate' WITH PRIVATE KEY ( FILE = 'c:\storedkeys\TDE Key' , ENCRYPTION BY PASSWORD = 'Hard_drive' ); GO  

Issue Schedules are not unlocking or locking doors according to the dates and times specified by the scheduled events Product Line EcoStruxure Security Expert Environment EcoStruxure Security Expert Cause The Security Expert system has a number of variables that schedules take into consideration when determining control of doors and if one of these isn't configured correctly, it will affect proper schedule function and control. Resolution 1. Verify that the schedule has the appropriate dates and times set 2. Check Holiday Groups and ensure that any calendar actions created to repeat each year have the same start and end date. Having different start and end dates with a repeat can cause the action to span long periods which can affect scheduled operations. 3.   

Issue When attempting to update the firmware on the SP-MRDM module, the update process fails, and the module appears offline with the fault LED activated. A "Module not responding" error message is displayed that indicates the module should be disconnected, and a utility used to restore the firmware.   Product Line EcoStruxure Security Expert Environment SP-MRDM SP-MRDM2 Cause The module has lost its firmware during a failed firmware update attempt, leading to the offline status and fault LED activation. Resolution To resolve this issue, follow these steps: Establish a connection to the SP-C controller using a web browser. Force a module update operation from the Application Software tab. Note that it may be necessary to check the "Skip Verification" checkbox during the update process.

Issue All Facility/Card Number fields are blank in Users that were transitioned into Security Expert from Continuum Product Line EcoStruxure Security Expert Environment Security Expert Server Continuum Database Transition Tool Cause Expected site code and card numbers from transitioned Continuum personnel objects to populate in the Facility/Card Number fields of the user objects in Security Expert but find all those fields are blank Resolution The site code and card number of personnel objects transitioned from Continuum using the Continuum Transition Tool will show up as credentials on the Security Expert side, this is by design. There is no need for any further changes, the credentials will work when presented to the reader.

Issue When transitioning users from Continuum to Security Expert, only about half of the user db is transferred. Product Line EcoStruxure Security Expert Environment Security Expert Controller Continuum Database Transition Tool Security Expert Data Sync Service Cause Continuum Database Transition Tool and Security Expert client must BOTH have the same configuration for "Allow Pin duplication". It could be either both unchecked or both checked Export history must be deleted when Continuum Transition Tool and Security Expert Data Sync services have stopped Resolution After a fresh transition and proper configuration ("Allow Pin duplication" in both CTT and SX client):   In the Continuum Database Transition Tool: Stop both Continuum Database Transition and Security Expert Data Sync services Delete export history Start both services again

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue In some recent versions of Security Expert there is unexpectedly high data usage on controllers connected by 4G modems.  Product Line Security Expert Environment Security Expert Server SP-C 4G Modem Cause This can be caused by the Security Expert regularly contacting all controllers to improve status reporting from the event service. Resolution If you are experiencing high data usage on metered (low data) connections, you can turn off these regular "check-ins". Be aware that this may increase the chance of controllers dropping offline.   Stop the Security Expert services.   In the File Explorer, navigate to the installation directory: ..\Program Files (x86)\Schneider Electric\Security Expert  Open SecurityExpertSV.exe.config. Files in this directory require administrator permissions to edit. You may need to open the file as an administrator using an application like Notepad++, or make a copy in a different directory to edit and replace the original.   Add the following code under the <configuration> node, between </configSections> and <microsoft.scripting>:  <appSettings>     <add key="gx:EnableUnknownStatusMitigation" value="false" /> </appSettings> Save the file.  Open SecurityExpertEvtSvr.exe.config.   Under the <appSettings> node, add the following code:  <add key="EnableControllerConnectionWatchdog" value="0" /> Save the file.  Restart the Security Expert services.  

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue SP-C has a valid gateway specified and it's not receiving communications Product Line EcoStruxure Security Expert Environment Security Expert Controller firmware .1248 (or higher) Security Expert 4.0.128 (or higher) Security Expert Controller w/ USB port 2.08.582 (or higher) SX-ELV-HLI-TK license to enable the integration USB to Ethernet adaptor dongle TKE Controller (American) v2r0 (only supported version) Cause It is a known issue. SP-C sends a heartbeat message to TKE but it is not being sent/received as a broadcast message. The controller still sends a heartbeat message to TKE but it is not sending it as a broadcast message with a destination of FF:FF:FF:FF:FF:FF. The gateway being valid causes it to send a Unicast message to the gateway itself (eg router) which does not pass it on to the rest of the network. (This is a known issue and has been logged with engineers). Resolution The workaround is to enable the USB Eth NIC on the SP-C and use: - The onboard NIC to connect to the Security Expert Server that requires a valid gateway to be set - The USB to ethernet adaptor (USB NIC) to connect to the TKE Network where we would set any gateway to avoid this bug Note: The USB NIC can only be configured when using OTIS elevator HLI type. The USB NIC hardcodes the required OTIS IP info to the Onboard NIC for connection to Security Expert. To enable Web UI: 1. In Security Expert, Go to Sites|Controllers|Configuration Tab. 2. Scroll down and expand the Elevator HLI section. Set Elevator HLI type to choose OTIS 3. Return to the General Tab, Scroll down and expand the Commands section and enter OTISUseUSBForMainComms = true 4. Save changes and wait for the programming to be downloaded. 5. Power cycle the SP-C. 6. Go to SP-C Web UI. The USB Eth adaptor will have the original IP. Configure both IP adresses 7. Once The NICs are configured, change the Elevator HLI type back to Thyssen Krupp, choose Cable Network type 8. Click Save and restart the SP-C.

Issue Scheduled event reports exported to PDF are using the US date time format not the local systems date time format. Report settings   In the below example the Windows system, and Security Expert, were both setup for Australia regional settings with a date format of dd/mm/yyyy. The automatic scheduled reports exported to PDF were showing the US date format mm/dd/yyyy. Report export before   Product Line EcoStruxure Security Expert Environment Security Expert event reports Cause The local Windows system date settings for Welcome screen and New user accounts are incorrect. Resolution In Windows navigate to Control Panel\Region Click on Change date, time, or number formats. A new window (Region) will pop up. Click the Administrative tab Click Copy settings... Enable the following options if not enabled already. Under Copy your current settings to tick Welcome screen and system accounts and New user accounts as shown in the image below. This will copy the Current users format over to the Welcome screen and New user accounts sections. Date format settings After making the above changes the PDF reports generated now show the correct date format of dd/mm/yyyy. Report export after

Issue Need to disable HTTP access for both SOAP web service and Web Client to allow HTTPS access only. Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert SOAP Web Service Security Expert Web Client Cause Need to disable HTTP access for enhanced cybersecurity Resolution Disable HTTP access for SOAP: Navigate to the SOAP IIS Directory, by default this is "C:\inetpub\wwwroot\SecurityExpertSOAPService" and open the "Web.config" file using a text editor such as Notepad or Notepad++. Scroll down to the <services> section and comment out the following two lines: <endpoint address="" binding="basicHttpBinding" bindingConfiguration="basicHttpEndpointBinding" contract="GXWCF2.IService1" /> <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />   To confirm that the HTTPS version of the service is accessible, paste the following link into the URL bar and replace the placeholders with the relevant values: https://<pcname>.<domainname>:<portnumber>/SecurityExpertSOAPService/service.svc. A web page will open with a message saying that the service has been created, this confirms SOAP is working correctly. Disable HTTP access for Web Client: Open Internet Information Server (IIS) manager.  Right click on the SecurityExpertWeb site and select "Edit Bindings".   Remove the HTTP site binding. Configure Web Client to connect to SOAP via HTTPs: Navigate to the IIS directory for the Web Client, by default this is "C:\inetpub\wwwroot\SecurityExpertWebClient". Go to the 'include' directory and open the file 'soap.connect.php" Modify the address on the $wsdl = to the HTTPS SOAP address, and change the port number as well. Additionally, 'localhost' does not work, and it must be changed to hostname with qualified domain name. See below image for reference: Once this change is made it should now be possible to browse to the web client over HTTPS.

Issue When attempting a login from a Security Expert client PC, it generates a "Network SSPI error" when using Windows Authentication and the machine name. Product Line EcoStruxure Security Expert Environment Security Expert 4.3.285.21 Multiple PC Security Expert Installation using Windows Authentication Cause The Network SSPI error is generated at the Client PC Login because of how Security Expert implements RFC1034 which stipulates how machine names are used for DNS. Resolution 1. Place a period at the end of the Security Expert Server machine while logging into the client only Security Expert PC Example: Using "WIN-B0DOGEHESMN" as the server name will not work Using "WIN-B0DOGEHESMN." will work Notice this works because of the "." at the end Here is a graphical example of logging in with the correct server name by adding the "." 2. The other workaround would be to use the IP address of the server instead of the fully qualified domain name (FQDN). *Note* IT departments typically prefer the use of the FQDN name

Issue The network card is not working on the PC.  Product Line Andover Continuum, EcoStruxure Access Expert, EcoStruxure Building Expert, EcoStruxure Building Operation, EcoStruxure Security Expert, Satchwell BAS & Sigma, Satchwell MicroNet, TAC IA Series TAC I/NET, TAC Vista Environment PC Network Interface Card Cause Require a method to test the network card. Resolution Assuming you have the correct protocols loaded:- Open up a command prompt and type ‘ipconfig’(1) then press enter to get a list of the available network cards. Find the specific network card by name (2) Record the IP Address (3) assigned to the card, e.g. 192.168.5.90 If the card is unplugged (4) connect a network cable and start back at step 1 If the network card does not appear in Device Manager check the drivers are correctly installed for the card and when installed correctly start back at step 1. If the network card still does not appear it could be disabled.  In Network Connections right click the adaptor and select Enable (5) and start back at step 1. After these steps if the network card still does not appear when running ipconfig it is most likely damaged. If/when an IP Address is successfully obtained open a Command Prompt and type ping followed by the IP Address of the card, for example ping 192.168.5.90 (1). A functioning card will respond with 4 successfully replies (2) and the associated statistics (3) As additional information a good first step would be to "ping 127.0.0.1". This will not test a network card but indicates that the TCP/IP protocol is installed and functioning on the host PC.

   

Issue The error "Failed to Invoke the Security Expert Suprema Component" is seen when attempting to register/enroll a user's biometric credential at a Security Expert Client Only machine.   Figure 1 - Suprema scan error   When doing a registration/enrollment from the Security Expert Server this error is not seen and the registration is successful. Product Line EcoStruxure Security Expert Environment Security Expert Suprema Biometric Reader Cause The Suprema.dll has not been properly registered on the local machine. Resolution First check in C:\Program Files (x86)\Schneider Electric\Security Expert folder and confirm that the three files Suprema.dll, BS_SDK.dll, and BS_SDK_V2.dll are all present. If they are not you will need to copy them over from a working installation of Security Expert Server Installation.   Now run the below commands via an Administrator authenticated command prompt session: For 64-bit machines cd C:\Windows\SysWOW64 regsvr32.exe “C:\Program Files (x86)\Schneider Electric\Security Expert\Suprema.dll” For 32-bit machines regsvr32.exe “C:\Program Files\Schneider Electric\Security Expert\Suprema.dll” You should get a pop-up saying the .dll was registered successfully. Close and re-open the Security Expert client and re-test enrolling a user's fingerprint.

Issue Valid Users are randomly unable to gain access when presenting at a Suprema biometric reader. Sometimes they are able to gain access but others they are not and see user denied events in the events window. User denied entry by entry mode error door mode is not correctly programmed using invalid reading device User Denied Event Product Line EcoStruxure Security Expert Environment Security Expert Suprema BioEntry W2 fingerprint reader Cause The sensitivity settings in the Suprema software are too sensitive resulting in missed fingerprint reads. Resolution Reducing the fingerprint sensitivity from the default setting of 7 to a setting of 5 may allow fingerprints to be read more reliably.   The sequence used to authenticate the User can also result in more frequent read failures. Presenting a valid card then an invalid (or bad read) fingerprint and then presenting the card again,  the sequence starts all over again and will result in a user denied event. If the user presents the correct finger (after presenting the wrong finger) or tries the same finger again within the configured timeframe they will be granted access.