Building Automation Knowledge Base

Issue How can the firmware version of Security Expert Smart Card Readers be determined. Product Line EcoStruxure Security Expert Environment Security Expert Smart Card Readers Cause It is not possible to easily identify the firmware which a reader has been shipped with. Serial Numbers are not sequential and cannot be used as general guide. Resolution There are two supported methods to determine the firmware version of a Security Expert Smart Card Reader: 1. Via Product Support If you need to identify the original firmware version shipped with a reader: Raise a case with Schneider Electric Product Support. Include the reader’s serial number in your request. Product Support will contact Manufacturing to obtain confirmation of the firmware version originally installed on the reader. 2. Via Controller Web Interface (Requires Reader Expander Firmware 1.12.605 or later, Security Expert Controller Firmware 2.08.1498 or later, SP-C-WEB Firmware 4.00.2261 or later) From firmware version 1.12.605 and above, the Security Expert Controller’s web interface displays the serial numbers and firmware versions of connected card readers via RS-485 or OSDP. Steps to View Firmware Version: Log in to the Controller Web Interface. Navigate to Application Software. Open the Module dropdown to view connected readers. Important Notes: Wiegand-connected readers are not displayed in the web interface. If the Reader Expander address has changed, a power cycle is required for the readers to reappear in the interface.  

  Issue Understanding the size of individual tables within the Security Expert databases is essential for effective database management. This insight helps optimize system performance and supports archiving strategies. Product Line EcoStruxure Security Expert Environment EcoStruxure Security Expert Microsoft SQL Server Cause Managing SQL database size is critical to maintaining system performance. Identifying which tables consume the most space provides actionable data for optimization and archiving. Resolution To determine table sizes in the Security Expert and Security Expert Events databases, follow these steps using SQL Server Management Studio (SSMS): Open SSMS Right-click on the relevant database (e.g., Security Expert or Security Expert Events). Navigate to: Reports > Standard Reports > Disk Usage by Table Review the report to identify tables with the largest data footprint. Examples: Security Expert DB Security Expert Events DB Exporting the Report You can print or export the report for documentation or analysis: Print Export to Excel, PDF or Word Right-click on the data results and select Export Note: The “Disk Usage by Table” report is available in SQL Server 2008 and later.

Issue When attempting to use the Read Card button to read credentials from a card reader the following error is shown. Failed to read the card from the reader Failed to read cardFailed to read card Product Line Security Expert Environment Security Expert Client Proximity Card Encoder (PRX-ENC-DT) Cause A Proximity Card Encoder (PRX-ENC-DT) is not connected to the Workstation. Resolution 1. Using a USB connection, connect a PRX-ENC-DT to the Workstation. The USB connected card reader can be used to read new cards and add those card credentials to a User by placing the card on the reader and pressing the Read Card button in the User object. Read CardRead Card This will read 13.56MHz Schneider encoded Mifare and DESFire cards. The encoder is not able to read 125KHz cards.   2. Using alternative methods for adding credentials to Users Manually adding the Facility and Card Numbers to an available slot in the User object. Badging the card at a Card Reader and right-clicking the resulting access event in the Status Window and selecting to add to an existing or create a new User. Use the Data Sync Service to import Users, and changes to Users, from CSV files. See Mass importing User Photos into Security Expert using Data Sync Service for an indication of how the Data Sync Service is configured.

Issue What third party Card Printers are supported for use with Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Client Third-party Card Printers Cause There is no list of supported printers as there are too many devices to test.  Some testing has been done as listed in the resolution below.  If an issue should come up with a card printer then raise a support case and they will assist where possible and offer suggestions regarding the update of printer drivers, windows and printer preferences, etc. If necessary and the customer cannot resolve an issue then they may wish to supply the particular printer for testing and validation. Resolution There is currently no list of supported Card Printers, the following two printers have been tested by Engineering  with Security Expert: Datacard SD260 Datacard CD800 Indications that the HID Fargo HDP8500 and Fargo DTC4500e also work with Security Expert. In general, if the card printer presents itself in Windows as an XPS printer, then the printer should work with the Security Expert Client. This may require a printer driver to be downloaded and installed from the printer manufacturer for the printer to show up in the "Printers and Scanners" list in Windows.   Note: R&D has indicated that currently (12/19/2024) there is no list of printers or documentation as to what specific features or configurations are supported by each printer above.   Some functionality in Security Expert and within printer drivers allows the selection of landscape or portrait orientation. However, hopper selections are not currently supported. Printer testing was done with standard iso card printing using landscape and portrait using a single hopper. Any other requirements outside the above will rest fully with the partner/branch/customer to test and confirm it works as needed.    In unsupported printers it has been observed that some printer functions, such as badge orientation and hopper choice, may not work for all printers using the pop-up printer configuration window within Security Expert client. In those cases a workaround may be to manually change the default printer options in Windows to the required setting before printing badges. If specific functions or badge printers are required then a feature request can be submitted to potentially implement that in a future version of Security Expert. This will need to be raised with your local solution category management.

Issue A method is require to provide an Executive Privilege function to a Door to allow tailored credential requirements for specific Users. Product Line Security Expert Environment Security Expert Cause Doors are currently set up for two credentials (Card + Biometric) but there is a need to allow certain Users access through those Doors without having to present the second credential. Resolution The Access Level Door Type feature allows for this functionality. The option overrides the Door's Door Type with the one set in the Access Level (e.g. to allow a VIP to override 'Card + Biometric' to just 'Card' at a door). Required Objects Door Type Access Level User Configuration In the Door Type set the Access Level Door Type to the door type you wish to use whenever Access Level Door Type is enabled - in this example it would be "Card". Fig.1 - Door TypeFig.1 - Door Type In the Access Level enable the Use Access Level Door Type option. Fig. 2 - Access LevelFig. 2 - Access Level Assign the Access Level in step 2 to your User. Fig. 3 - UserFig. 3 - UserFor a Video KB article showing a similar configuration process see:  Security Expert user specific access vs standard door access 

Issue When attempting to save any type of change in Security Expert, you receive an error message that says "Failed to save Controller. Please try again in a moment". Product Line Security Expert Environment Security Expert Client Security Expert Server Cause The Security Expert database server is out of disk space. Resolution See this Knowledge Base article for information on why the database is consuming so much disk space and how you can resolve the problem.

Issue Is it possible to setup more than one custom card format in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Custom Card Formats Cause Have a requirement for two or more custom card formats. Resolution Currently, only one Custom Format can be configured.   It is possible to add a Secondary Format to a Reader port in Reader Expanders, but only one port can be setup with a Custom Format.    However, Credential Types have now been introduced with the release of Security Expert 4.3, which largely supersedes Custom Formats going forward and allows multiple custom card formats and even QR codes where required.  Please see AN 276 Security Expert - Configuring Credential Types - Integration Guide for more information on setting up Credential Types and Maximum number of Credential Types for more info on how many can be used.

Issue Blank window while capturing a photo using "Logitech HD Pro Webcam C920". Product Line EcoStruxure Security Expert Environment Security Expert Cause While capturing a user photo using "Logitech HD Pro Webcam C920", it shows up as an image source (in the drop-down along with Topaz). When selected however, the screen is blank. Resolution With this webcam, you need LWS software by Logitech installed on your machine. G Hub has replaced LWS however it seems like G Hub is not currently functional with the integration. Find more information about the  "LWS280" driver HERE.  The driver can be downloaded from the attachment.

Issue Is it possible to integrate Schlage products with Security Expert? Product Line Security Expert Environment Security Expert Server (vv4.2.259.19 and above) SP-C controller Firmware (v2.08.923 and above) Cause Unable to migrate or convert a legacy access control system which has Schlage devices integrated to Security Expert Resolution With Security Expert Software (v4.2.259.19 and above) and SP-C firmware (v2.08.923 and above), the integration of Schlage devices (AD300 and AD400) with Security Expert software is supported.  It is always recommended to use the latest Security Expert Version and SP-C firmware version to avoid any known issues. For more information regarding the, Schlage Integration with Security Expert, download the attachment.  Refer to Security Expert Allegion Smart Reader Integration 

Issue How to get answers for project specification responses or how to get a product enhancement implemented. Product Line Security Expert, EcoStruxure Building Operation Environment Security Expert EcoStruxure Building Operation Cause Unsure who to go to for help with specification replies or how to get a potential product enhancement added to the offer. Resolution Create an idea on The Exchange Community for your specific Offer. The more Likes an idea floated on the Community receives, the more attention it is given by offer management for that associated product line. Even if you do not yourself have an Enhancement Request, help raise the profile of others by Liking theirs Contact your local solution category manager for the Offer as they will be able to point you in the right direction for answers to specification questions and can help escalate enhancement requests to Product Management. Americas: Americas.EcoStruxureBuilding@schneider-electric.com EMEA: EMEA.EcoStruxureBuilding@schneider-electric.com Asia Pacific & India: AsiaPac.EcoStruxureBuilding@schneider-electric.com When providing your feature request make sure to include as much detail as possible about the feature as well as any specifics that might help justify the need for the new feature.

Issue Troubleshoot Security Expert Controllers showing offline in the client. Product Line EcoStruxure Security Expert Environment Security Expert Cause Require some common troubleshooting steps to help determine why controllers may be offline to the client. Resolution The main items to check are: Refer to the Troubleshooting Security Expert Controller Connectivity - Application Note on Exchange. If a controller has failed and the Replacement controller unable to be brought online then check if controller encryption had been enabled on the replaced controller. Restart the client software. Power restart the controller. Remove power Wait for all LED's on the controller to go completely off Apply power to the controller. In the controller web interface, on the Settings page, check that Event Server 1 has the correct IP address. Check that the Firewall is disabled. Check any Anti-Virus Firewalls/settings as well. If the Firewall cannot be disabled, ensure that all required ports are open between devices. See SX-SRVR Security Expert - Network Administrators - Installation Guide for details. Restart the Security Expert services under the PC's Services option in Control Panel. These need to be restarted when any changes are made. Confirm that the User Interface, Data Server, Event Server and Download Server module versions are all the same. Go to About  > Version and check there. If the database has not been upgraded to the same version as the client software, then this can cause communications issues. On the Security Expert Server check that MSMQ is installed as this is now a requirement   Security Expert MSMQ is required (Not showing live point status / shows "Unknown Status" error)   If MSMQ was installed after Security Expert, you'd need to reinstall Security Expert to allow it to run correctly. If MSMQ is installed and controllers are still not coming online (or the controllers are "bouncing" offline/online) then anecdotal evidence suggests enabling Windows 8 Compatibility Mode may help especially for Windows Server 2016 and Server 2019. Set the Windows 8 Compatibility Mode checkbox in the Properties page for C:\Program Files (x86)\Schneider Electric\Security Expert\SecurityExpertEvtSvr.exe   Also, note that if a database backup has been imported, then there is a need to check/change some other settings as well to ensure everything is set up for the specific server and controller.   Under Global > Download Server confirm that your computer name is the name of the PC where the download server service is running. Under Global > Event Servers ensure that the computer name is the name of the PC where the event server service is running. Under Sites > Controllers confirm the Serial number, IP Address, Download Port, Download Server and Control and Status Request Port match what is set in the controller's configuration web page (browse to the controllers IP Address to view). On that same General tab go to Diagnostic Windows and open the download and event server windows. Review the information contained and if there are any errors shown. Right click the controller and select Get Health Status. Review the status messages displayed.

Issue Configuring Security Expert Readers Product Line EcoStruxure Security Expert Environment Security Expert Smart Card Readers Cause Security Expert Smart Card Readers have options such as Mifare Reading Mode, LED colors, etc. that can be configured. How the readers are configured will depend on the reader's firmware. Resolution The method used to configure a Security Expert Smart Card Reader depends on the firmware version it is using. There is no way to visually determine the firmware version. To identify what firmware the reader was shipped with from the factory refer to Knowledge Base article Identifying Security Expert Smart Card Readers Firmware. 1. Smart Card Readers with firmware below build 200 - (I.e. 1.04.64) These are older readers which were configured with a serial terminal program by connecting to the reader using a USB-RS485 converter. Please refer to the 'Installer Programming' section of the attached Smart Card Reader Installation Manual - Feb 2017. This has been replaced by a newer version of the manual on Exchange which no longer includes this information. 2. Smart Card Readers with firmware build 200 or above (I.e. 1.04.229) These newer readers do not have a serial interface and will require a configuration card to change reader options. The configuration card (SX-ISO-CONFIG) is ordered from Schneider Electric, see the Security Expert Credentials Order Form for details.

Issue How is time synchronized between the Controllers and Security Expert Server?  Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert Controllers (SP-C, SP-ACX, SP-AC1, SP-DCU) Cause Require details on different ways the Controllers can have their time set. Resolution There are two methods for synchronizing time on the Controllers. Periodically updated by the SNTP Time Server configured under the controllers Time Update tab. SNTP Time Server The controller polls its SNTP Time Server every 11 minutes.) A third-party NTP server such as Meinberg NTP, can be used. These servers synchronize with four or more internet time sources and are considered reliable. Ensure that UDP Port 123 is open on any firewalls, as this port is required for NTP communication. Without an SNTP Time Server configured, time is updated on the Controllers by the following methods. Time is updated manually by the Operator right-clicking the controller and selecting Set controller date/time. This will set the controllers time to the current time of the Workstation. Set Controller Time Time is updated to the server time whenever a “Force Download” is initiated for that controller. Force Download

Issue The “User Last Active” field does not update when users access controlled elevators using their access cards. As a result, users who primarily use elevators are incorrectly marked as inactive and automatically disabled after 90 days, despite regular use. Product Line EcoStruxure Security Expert Environment Security Expert Elevator integrations (e.g., OTIS, low-level relay) User inactivity policies (e.g., auto-disable after 90 days) Cause The “User Last Active” feature is designed to track access events at doors or keypads. When a reader expander is configured in elevator mode, the system does not associate elevator access with standard access events. Therefore, elevator usage does not update the “User Last Active” timestamp. Note: The current documentation does not clearly state that elevator access is excluded from this feature. It only references doors and keypads, which may lead to confusion. Resolution If tracking elevator access as part of user activity is required, we recommend submitting a feature request through your local Solution Category Management team. This ensures the request is formally reviewed and prioritized for future development.   Workaround: Create a Report of Disabled Users Open the User Report. Add a filter: Disable User equals Yes disabled user filter Save the report layout for future use. For detailed steps on applying filters in reports, refer to the Security Expert Community Post Security Expert User Reports.

Issue Clarification needed on whether AC-1A door modules are supported in Security Expert. Product Line EcoStruxure Security Expert Environment SP-AC1 Controller Andover Continuum door modules: AC-1 AC-1 Plus AC-1A Cause The AC-1A door module is not explicitly listed in the Continuum Transition documentation, leading to uncertainty about its compatibility. Resolution Although the AC-1A door module is not specifically mentioned in the documentation, it is supported by the Continuum Transition Tool. This means it can be used with Security Expert when transitioning from a Continuum system.   For detailed transition steps, refer to the Continuum Transition documentation available on the Schneider Electric Exchange portal.

Issue After successfully logging in, the controllers' web page is only partially displayed, showing broken image links and incorrectly formatted text. Resetting the controller does not resolve the problem. SP-C Configuration Web Page Product Line EcoStruxure Security Expert Environment Security Expert SP-C SP-AC1 SP-ACX Cause Incorrect controller web page files have been cached in the browser. This may occur if different controller firmware versions are viewed/commissioned on the same PC.  Resolution Clear the web browser's cache and try again.  Connect directly to the controllers' configuration page. For a controller with default settings, browse to 192.168.1.2.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Security Expert Installation steps for separate SQL, SX application Server, and Client for use with Windows Authentication and Active Directory Product Line EcoStruxure Security Expert Environment Microsoft SQL Server Microsoft Windows10 Security Expert Server and Client  Cause Access Denied error appears when attempting to log into Security Expert with Windows Authentication with a multiple PC Security Expert Installation Resolution Important considerations when connecting Security Expert to an external SQL Server: Machines should be on the same network and Domain. When you install Security Expert, reference the SQL database in this form:  Machine Name\SQL Instance Name The Windows user account doing the installation must have admin rights on both machines. The windows login you're using to install on the Security Expert machine has to have admin privileges to alter the SQL Database on the remote machine. The easiest way to do this is to use the same account to set up all machines. Different accounts can be used, but the accounts have to have privileges added to the SQL Database manually. (Not covered in this document)   Assumptions: Active Directory server has a domain user that can be used to install the applications on all machines. Licenses cover all machines Security Expert users are set up to use Windows Authentication (snapshots at the end of the document) If the SQL server ever had Security Expert Installed on it, uninstall Security Expert and reboot. If the Security Expert application server had SQL on it, uninstall SQL, reboot and reinstall Security Expert without local SQL. If the Client PC had Server components installed, uninstall Security Expert, reboot and install the client only.   Perform the SQL Server Installation onto a separate Server per the Security Expert Installation Instructions Security Expert Application Server/Client installation (No SQL) If this box is selected, the install may fail because the service has not been installed yet. With this option selected, the install will finish and then the service can be configured later. 3. Change the database server to NOT be localhost\SecurityExpert Use machinenameofSQLServer\SecurityExpert (Ex. SECEXPERTVM\SecurityExpert) 4. Select Windows Authentication Complete the installation.   5. Open Windows Services on the Security Expert Application Server (Run> services.msc) Right-click on Security Expert Data Service> Properties Select the Log On tab Deselect Login As Local System Account Select This account and then click browse to search for the domain admin user   Start the service. Security Expert Data Service, Security Expert Event Service, and Security Expert Update should all start   Client only setup - Ensure the Server option is deselected In the following dialog select Custom   7. Select the drop-down next to Server> then select “This feature will not be available” Complete the installation   A successful login with the domain admin account using Windows Authentication from the Security Expert machine and also the client PC should work.   From the Client PC – Security Expert application server = 10.169.90.170 From the Security Expert Server/Client SecurityExpertSV.exe.config (Server) – This file did not have to be changed    SecurityExpert.exe.config (Client) - This file did not have to be changed   Note: There may be circumstances where these files do need to be configured. See LL https://community.se.com/t5/Knowledge-Base/Security-Expert-Error-Server-Has-Rejected-Client-Credentials/ta-p/698   Domain Tab example set up in Security Expert for Active Directory Windows Authentication   Operator Example setup in Security Expert for Windows Authentication   Global Support Lab Testing SX Application Server (Windows10 1803) SQL Server – Server 2012 R2 with SQL 2016 SP1 (VM) SX Client – Window 8.1 Pro

Issue An SP-RDM2 will be used to add doors to an I/NET-transitioned site. The readers connected to the SP-RDM2 will need to read Hex Card Number credentials. Product Line EcoStruxure Security Expert, TAC INET Environment Security Expert Controller (SP-C) Security Expert Reader Module (SP-RDM2). Cause After transitioning an INET site to Security Expert, you may find it necessary to add one or more new doors. In Security Expert, you add doors to your system by attaching one or more SP-RDM2 modules to the RS-485 bus of an SP-C (up to two doors per SP-RDM2). That is still true for the transitioned system; however, some configuration tasks must be performed to allow the SP-RDM2 to coexist with the SCUs and DCUs that are already communicating with the SP-C.  You will also configure the SP-RDM2 to use the custom Hex Card Number credential you created as part of the INET transition process. Resolution For an SP-RDM2 module to work in conjunction with I/NET modules it must be configured in a specific way. You will need: SP-C firmware 2.08 build 911 or later SP-RDM2 firmware 1.12 build 546 or later Configuring the SP-RDM2: To the existing transitioned I/NET site, add a new Reader Expander for the additional SP-RDM2 reader module. (Note that the last reader expander defined in your existing system may be assigned to a dual-address SCU. If this is the case, make sure the address you assign to the SP-RDM2 is at least two addresses higher than the SCU to avoid address conflict.)  Set the Reader 1 Format and the Reader 2 Format to "Custom Credential". (Note that if the Port 1 Network Type or Port 2 Network Type is set to "Schneider Electric RS485" then this will need to be changed to "Wiegand" to allow you to set the reader format; it is greyed out otherwise. The network type can be set back to "Schneider Electric RS485" afterward.) Set the Port 1 Network Type and Port 2 Network Type according to the type of readers that are connected. In order to correctly convert the card read to the hexadecimal credential format that is programmed for the users, the reader expander must know what card format is being presented. This is done using commands. For the reader on port 1, add the command "R1RawFmt = #" where # is one of the descriptions shown in the table below. Similarly for the reader on port 2, add the command "R2RawFmt = #" where # is one of the descriptions shown in the table below.  If the command is absent, then Wiegand 26 is used as a default. Command Card Type R1RawFmt = Wiegand 26 26-bit Wiegand R1RawFmt = Wiegand 32 32-bit Wiegand R1RawFmt = Wiegand 34 34-bit Wiegand R1RawFmt = Wiegand 66 66-bit Wiegand R1RawFmt = Custom Wiegand Any Wiegand card - parity check is skipped Additionally, the SP-C controller must know which reader expanders to expect on the I/NET network and which reader expanders to expect on the Security Expert module comms network. By default, if the controller command "INET = true" is present in the SP-C, then all modules are considered to be on the I/NET network. Adding an SP-RDM2 to the Security Expert module comms network with no additional commands will result in partial operation but there will be problems. To use a mixture of I/NET modules and Security Expert modules, a command must be added to the programming of all I/NET modules. This command is: "HardwareType = INET" If this command has never been added to any module, and the command "INET = true" is present in the SP-C, then all modules are treated as I/NET. This maintains backward compatibility with existing sites. As soon as the "HardwareType = INET" command has been added to even one module, then it must be added to the programming of all I/NET modules from then on for the site to function as expected. Configuring the SP-RDM Doors to Accept Hex Card Number Credentials Create a new Door Type for reading cards as a Hex Card Number credential and configure it as follows. In the Entry section on the General tab, set the Entry Reading Mode to "Custom". In the Entry Credential Types section, add the "Hex Card Number" credential type. Save the Door Type. Configure each door on the SP-RDM2 to use the new Door Type as follows: In the Setup section on the General tab of the door, set the Door Type to the name of the Door Type you just created in step 1. Save the door.

Issue You need to forward specific events from Security Expert to a third-party Syslog server for monitoring or logging purposes. Product Line EcoStruxure Security Expert Environment Security Expert software Syslog server (e.g., SolarWinds) Cause There is a requirement to send filtered Security Expert events (e.g., operator activity, user access, door unlocks, output activations) to an external system for analysis or integration. Resolution Security Expert allows you to forward events using the Send Event action. Follow these steps to configure it: Step 1: Create an Event Filter In Security Expert, go to the Events menu. Create a new Event Filter that captures the specific events you want to forward. Example: Filter for events like  Output <PGM_NAME> On By <DOOR_NAME> Function <DOOR_FUNCTION> . Tip: You can trigger these events by manually unlocking a door from the client to test the filter. event filter Step 2: Create a Send Event Action Still under the Events menu, create a new Action. Set the following parameters: Type:  Send Event Event Filter: Select the filter you created in Step 1. IP Address: Enter the IP address of the Syslog server. Port: Enter the port number used by the Syslog server (e.g., 514 for standard Syslog, or a custom port used by Packet Sender). action Step 3: Test with Packet Sender Use Packet Sender to simulate a Syslog server. In Packet Sender: Note the TCP port number shown in the bottom right corner. Ensure this matches the port configured in your Security Expert Action. The IP address should be the one assigned to your Security Expert server (e.g., your laptop’s IP if testing locally). Manually trigger the event (e.g., unlock a door or activate a relay). status page Confirm that the event is received in Packet Sender’s log window. packet sender

Issue Maximum number of expansion modules and doors per controller Product Line EcoStruxure Security Expert Environment SP-C Security Expert Security Expert Controller SP-RDM2 Security Expert Security Expert Door Expansion Module Cause Documentation states that one SP-C supports up to 128 doors but this is dependent on the communications.  Resolution The current recommendation from Product Management is a maximum of 24 to 34 doors per SP-C. This equates to about 10 to 17 reader expansion modules.