Building Automation Knowledge Base

Issue How is time synchronized between the Controllers and Security Expert Server?  Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert Controllers (SP-C, SP-ACX, SP-AC1, SP-DCU) Cause Require details on different ways the Controllers can have their time set. Resolution There are two methods for synchronizing time on the Controllers. Periodically updated by the SNTP Time Server configured under the controllers Time Update tab. SNTP Time Server The controller polls its SNTP Time Server every 11 minutes.) A third-party NTP server such as Meinberg NTP, can be used. These servers synchronize with four or more internet time sources and are considered reliable. Ensure that UDP Port 123 is open on any firewalls, as this port is required for NTP communication. Without an SNTP Time Server configured, time is updated on the Controllers by the following methods. Time is updated manually by the Operator right-clicking the controller and selecting Set controller date/time. This will set the controllers time to the current time of the Workstation. Set Controller Time Time is updated to the server time whenever a “Force Download” is initiated for that controller. Force Download

Issue The “User Last Active” field does not update when users access controlled elevators using their access cards. As a result, users who primarily use elevators are incorrectly marked as inactive and automatically disabled after 90 days, despite regular use. Product Line EcoStruxure Security Expert Environment Security Expert Elevator integrations (e.g., OTIS, low-level relay) User inactivity policies (e.g., auto-disable after 90 days) Cause The “User Last Active” feature is designed to track access events at doors or keypads. When a reader expander is configured in elevator mode, the system does not associate elevator access with standard access events. Therefore, elevator usage does not update the “User Last Active” timestamp. Note: The current documentation does not clearly state that elevator access is excluded from this feature. It only references doors and keypads, which may lead to confusion. Resolution If tracking elevator access as part of user activity is required, we recommend submitting a feature request through your local Solution Category Management team. This ensures the request is formally reviewed and prioritized for future development.   Workaround: Create a Report of Disabled Users Open the User Report. Add a filter: Disable User equals Yes disabled user filter Save the report layout for future use. For detailed steps on applying filters in reports, refer to the Security Expert Community Post Security Expert User Reports.

Issue Clarification needed on whether AC-1A door modules are supported in Security Expert. Product Line EcoStruxure Security Expert Environment SP-AC1 Controller Andover Continuum door modules: AC-1 AC-1 Plus AC-1A Cause The AC-1A door module is not explicitly listed in the Continuum Transition documentation, leading to uncertainty about its compatibility. Resolution Although the AC-1A door module is not specifically mentioned in the documentation, it is supported by the Continuum Transition Tool. This means it can be used with Security Expert when transitioning from a Continuum system.   For detailed transition steps, refer to the Continuum Transition documentation available on the Schneider Electric Exchange portal.

Issue After successfully logging in, the controllers' web page is only partially displayed, showing broken image links and incorrectly formatted text. Resetting the controller does not resolve the problem. SP-C Configuration Web Page Product Line EcoStruxure Security Expert Environment Security Expert SP-C SP-AC1 SP-ACX Cause Incorrect controller web page files have been cached in the browser. This may occur if different controller firmware versions are viewed/commissioned on the same PC.  Resolution Clear the web browser's cache and try again.  Connect directly to the controllers' configuration page. For a controller with default settings, browse to 192.168.1.2.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue Security Expert Installation steps for separate SQL, SX application Server, and Client for use with Windows Authentication and Active Directory Product Line EcoStruxure Security Expert Environment Microsoft SQL Server Microsoft Windows10 Security Expert Server and Client  Cause Access Denied error appears when attempting to log into Security Expert with Windows Authentication with a multiple PC Security Expert Installation Resolution Important considerations when connecting Security Expert to an external SQL Server: Machines should be on the same network and Domain. When you install Security Expert, reference the SQL database in this form:  Machine Name\SQL Instance Name The Windows user account doing the installation must have admin rights on both machines. The windows login you're using to install on the Security Expert machine has to have admin privileges to alter the SQL Database on the remote machine. The easiest way to do this is to use the same account to set up all machines. Different accounts can be used, but the accounts have to have privileges added to the SQL Database manually. (Not covered in this document)   Assumptions: Active Directory server has a domain user that can be used to install the applications on all machines. Licenses cover all machines Security Expert users are set up to use Windows Authentication (snapshots at the end of the document) If the SQL server ever had Security Expert Installed on it, uninstall Security Expert and reboot. If the Security Expert application server had SQL on it, uninstall SQL, reboot and reinstall Security Expert without local SQL. If the Client PC had Server components installed, uninstall Security Expert, reboot and install the client only.   Perform the SQL Server Installation onto a separate Server per the Security Expert Installation Instructions Security Expert Application Server/Client installation (No SQL) If this box is selected, the install may fail because the service has not been installed yet. With this option selected, the install will finish and then the service can be configured later. 3. Change the database server to NOT be localhost\SecurityExpert Use machinenameofSQLServer\SecurityExpert (Ex. SECEXPERTVM\SecurityExpert) 4. Select Windows Authentication Complete the installation.   5. Open Windows Services on the Security Expert Application Server (Run> services.msc) Right-click on Security Expert Data Service> Properties Select the Log On tab Deselect Login As Local System Account Select This account and then click browse to search for the domain admin user   Start the service. Security Expert Data Service, Security Expert Event Service, and Security Expert Update should all start   Client only setup - Ensure the Server option is deselected In the following dialog select Custom   7. Select the drop-down next to Server> then select “This feature will not be available” Complete the installation   A successful login with the domain admin account using Windows Authentication from the Security Expert machine and also the client PC should work.   From the Client PC – Security Expert application server = 10.169.90.170 From the Security Expert Server/Client SecurityExpertSV.exe.config (Server) – This file did not have to be changed    SecurityExpert.exe.config (Client) - This file did not have to be changed   Note: There may be circumstances where these files do need to be configured. See LL https://community.se.com/t5/Knowledge-Base/Security-Expert-Error-Server-Has-Rejected-Client-Credentials/ta-p/698   Domain Tab example set up in Security Expert for Active Directory Windows Authentication   Operator Example setup in Security Expert for Windows Authentication   Global Support Lab Testing SX Application Server (Windows10 1803) SQL Server – Server 2012 R2 with SQL 2016 SP1 (VM) SX Client – Window 8.1 Pro

Issue An SP-RDM2 will be used to add doors to an I/NET-transitioned site. The readers connected to the SP-RDM2 will need to read Hex Card Number credentials. Product Line EcoStruxure Security Expert, TAC INET Environment Security Expert Controller (SP-C) Security Expert Reader Module (SP-RDM2). Cause After transitioning an INET site to Security Expert, you may find it necessary to add one or more new doors. In Security Expert, you add doors to your system by attaching one or more SP-RDM2 modules to the RS-485 bus of an SP-C (up to two doors per SP-RDM2). That is still true for the transitioned system; however, some configuration tasks must be performed to allow the SP-RDM2 to coexist with the SCUs and DCUs that are already communicating with the SP-C.  You will also configure the SP-RDM2 to use the custom Hex Card Number credential you created as part of the INET transition process. Resolution For an SP-RDM2 module to work in conjunction with I/NET modules it must be configured in a specific way. You will need: SP-C firmware 2.08 build 911 or later SP-RDM2 firmware 1.12 build 546 or later Configuring the SP-RDM2: To the existing transitioned I/NET site, add a new Reader Expander for the additional SP-RDM2 reader module. (Note that the last reader expander defined in your existing system may be assigned to a dual-address SCU. If this is the case, make sure the address you assign to the SP-RDM2 is at least two addresses higher than the SCU to avoid address conflict.)  Set the Reader 1 Format and the Reader 2 Format to "Custom Credential". (Note that if the Port 1 Network Type or Port 2 Network Type is set to "Schneider Electric RS485" then this will need to be changed to "Wiegand" to allow you to set the reader format; it is greyed out otherwise. The network type can be set back to "Schneider Electric RS485" afterward.) Set the Port 1 Network Type and Port 2 Network Type according to the type of readers that are connected. In order to correctly convert the card read to the hexadecimal credential format that is programmed for the users, the reader expander must know what card format is being presented. This is done using commands. For the reader on port 1, add the command "R1RawFmt = #" where # is one of the descriptions shown in the table below. Similarly for the reader on port 2, add the command "R2RawFmt = #" where # is one of the descriptions shown in the table below.  If the command is absent, then Wiegand 26 is used as a default. Command Card Type R1RawFmt = Wiegand 26 26-bit Wiegand R1RawFmt = Wiegand 32 32-bit Wiegand R1RawFmt = Wiegand 34 34-bit Wiegand R1RawFmt = Wiegand 66 66-bit Wiegand R1RawFmt = Custom Wiegand Any Wiegand card - parity check is skipped Additionally, the SP-C controller must know which reader expanders to expect on the I/NET network and which reader expanders to expect on the Security Expert module comms network. By default, if the controller command "INET = true" is present in the SP-C, then all modules are considered to be on the I/NET network. Adding an SP-RDM2 to the Security Expert module comms network with no additional commands will result in partial operation but there will be problems. To use a mixture of I/NET modules and Security Expert modules, a command must be added to the programming of all I/NET modules. This command is: "HardwareType = INET" If this command has never been added to any module, and the command "INET = true" is present in the SP-C, then all modules are treated as I/NET. This maintains backward compatibility with existing sites. As soon as the "HardwareType = INET" command has been added to even one module, then it must be added to the programming of all I/NET modules from then on for the site to function as expected. Configuring the SP-RDM Doors to Accept Hex Card Number Credentials Create a new Door Type for reading cards as a Hex Card Number credential and configure it as follows. In the Entry section on the General tab, set the Entry Reading Mode to "Custom". In the Entry Credential Types section, add the "Hex Card Number" credential type. Save the Door Type. Configure each door on the SP-RDM2 to use the new Door Type as follows: In the Setup section on the General tab of the door, set the Door Type to the name of the Door Type you just created in step 1. Save the door.

Issue You need to forward specific events from Security Expert to a third-party Syslog server for monitoring or logging purposes. Product Line EcoStruxure Security Expert Environment Security Expert software Syslog server (e.g., SolarWinds) Cause There is a requirement to send filtered Security Expert events (e.g., operator activity, user access, door unlocks, output activations) to an external system for analysis or integration. Resolution Security Expert allows you to forward events using the Send Event action. Follow these steps to configure it: Step 1: Create an Event Filter In Security Expert, go to the Events menu. Create a new Event Filter that captures the specific events you want to forward. Example: Filter for events like  Output <PGM_NAME> On By <DOOR_NAME> Function <DOOR_FUNCTION> . Tip: You can trigger these events by manually unlocking a door from the client to test the filter. event filter Step 2: Create a Send Event Action Still under the Events menu, create a new Action. Set the following parameters: Type:  Send Event Event Filter: Select the filter you created in Step 1. IP Address: Enter the IP address of the Syslog server. Port: Enter the port number used by the Syslog server (e.g., 514 for standard Syslog, or a custom port used by Packet Sender). action Step 3: Test with Packet Sender Use Packet Sender to simulate a Syslog server. In Packet Sender: Note the TCP port number shown in the bottom right corner. Ensure this matches the port configured in your Security Expert Action. The IP address should be the one assigned to your Security Expert server (e.g., your laptop’s IP if testing locally). Manually trigger the event (e.g., unlock a door or activate a relay). status page Confirm that the event is received in Packet Sender’s log window. packet sender

Issue Maximum number of expansion modules and doors per controller Product Line EcoStruxure Security Expert Environment SP-C Security Expert Security Expert Controller SP-RDM2 Security Expert Security Expert Door Expansion Module Cause Documentation states that one SP-C supports up to 128 doors but this is dependent on the communications.  Resolution The current recommendation from Product Management is a maximum of 24 to 34 doors per SP-C. This equates to about 10 to 17 reader expansion modules.  

Issue Downloading a license update, such as after adding features to a site license or extending the evaluation period on an evaluation license, and this fails with the below error being shown. License not found Product Line EcoStruxure Security Expert Environment Security Expert Server Cause This error generally occurs when trying to license Security Expert from a Client machine and not the  Server machine where the Security Expert services are installed. Resolution Go to the Security Expert Server and license/update the license from that machine using the Security Expert client.

Issue Unable to configure alarms to remain active after being acknowledged if they are still in the alarm condition. Product Line EcoStruxure Security Expert Environment Security Expert Cause Security Expert handles alarms a little differently to the rest of our product lines. The main difference being that everything is event based with each transition being an event which can itself trigger an alarm if it has been configured to do so. Those alarms are then seen as "active alarms" in the system (showing up in the Active Alarms Status Page View) until they are acknowledged by an Operator. Each alarm transition is separate with there being no direct tie to the current status of the object/condition that triggered the original alarm. Resolution What you can do is have both an Active Alarms list and an Acknowledged Alarms list in the same status page view. That way you will be able to see the last events that have triggered an alarm and if it has been acknowledged by an operator yet or not. This coupled with a status list of the objects you are monitoring can provide the operator with enough information to identify and manage each event transition of the alarm condition.

Issue Partners and branches need to understand the terminology used with Security Expert and what those terms mean from a Continuum perspective Product Line EcoStruxure Security Expert Environment Security Expert Continuum Cause A table key to map object terminology between Security Expert and Continuum Resolution   Continuum Security Expert Objects Records User Operator Personnel User Area Door Group (Area) = Intrusion/Antipassback/Counting Area Rights Access Levels AC1/IOUs Reader Expanders/RDM2 Numerics Virtual Inputs/Outputs Plain Enlgish Programmable Functions/Function Code/services Event Viewer Status Pages Alarm Viewer Status Pages Listview Status Pages Power Supply Analog Expander Network Sites NC/ACX Controller SPC Doors Doors Security levels Security levels Schedule Schedule Scedule Exception Calendar Action Holiday Holiday Reset Manual - Factory default – short Reader, L2D0, download Array Data Values Permisssions/Security Levels Record Groups +V V+ Ground V- Data 1 1 1 Clock 0 0 0 LED L1    

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue After making changes to object names in the system, outdated or incorrect names may still appear under the Hardware folder in EcoStruxure Web Services (EWS).     Product Line EcoStruxure Building Operation, EcoStruxure Security Expert. Environment EcoStruxure Building Operation Enterprise Server (ES) EcoStruxure Security Expert Smart Connector Integration EcoStruxure Web Service (EWS). Cause When significant changes are made to object names in the system, the Smart Connector may retain outdated data. If a standard Discovery does not update these names, the most effective solution is to clear the Smart Connector database and re-establish the connection.   Resolution To clear the outdated data from the Smart Connector:   Step 1: Access the Smart Connector Portal Open a browser and navigate to http://localhost:8082 (assuming Smart Connector is installed locally). Log in to the Smart Connector Portal. Step 2: Delete the Existing Processor Configuration Go to Configurations → Processor. Locate the Security Expert Discovery Processor. Click the Delete (bin icon) next to it. ⚠️ Do not delete other processors (e.g., Alarm Processor). Step 3: Delete the Existing EWS Server Navigate to the EWS Servers section. Locate the SecurityExpertServer. Click the Delete (bin icon) to remove it.   Step 4: Reconfigure the Processor and EWS Server Follow the instructions in Section 4.4 of the referenced document [1] to: Add a new Security Expert Discovery Processor Configure a new EWS Server Allow 10–15 minutes for the initial discovery process to complete. This will create a fresh snapshot of the current Security Expert database. Once the discovery is complete: Refresh the Hardware folder in EcoStruxure Building Operation. Rehost the new EWS objects as needed. Step 5: Verify Alarm Processor Configuration After re-adding the EWS Server, ensure the Alarm Processor is correctly configured to reference the new server. Refer to Section 4.5 of the same document [1] for detailed steps.   Reference [1] Refer to the official integration guide documentation for more information. Security Expert SmartConnector Version 1.1.0.8 - Installation & User Manual  

Issue Can licenses be transferred in Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Cause Unsure if a single SSN can be authenticated on multiple PC's or if licenses can be transferred or moved. Resolution Each PC requires a separate SSN. These licenses can be transferred between PC's. As part of the licensing process, the hardware details of the computer are recorded against each SSN, so any hardware changes require re-licensing, this also means SSN's cannot be shared across computers, and if used on a virtual machine – it must be assigned a static MAC address. Licenses can be transferred between machines without issue, Product Support will add a registration onto the license and clear the hardware profile after receiving a request. The installer will then do a License Update from the Security Expert server.

Warning Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue When hosting objects from EWS/Smart Connector, such as Security Expert, into EcoStruxure Building Operation (EBO), additional or mismatched object names can result in unresolved bindings and duplicate EWS IDs. Common symptoms include:  - Duplicate EWS IDs with different names - Unresolved or broken bindings - Binding loss after deleting containers   Duplicate EWS IDs with different names Unresolved or broken bindings     Product Line EcoStruxure Building Operation, EcoStruxure Security Expert. Environment EcoStruxure Building Operation Enterprise Server (ES) Security Expert Smart Connector Integration EcoStruxure Web Service (EWS) Cause Typical reasons for this to occur: Hosted object names do not match those in Security Expert. Deleting containers without proper renaming can cause binding loss. Resolution   Best Practices for Future Hosting Always rename the hosted object in EBO before rehosting from the hardware folder. This ensures that existing bindings are preserved. Avoid hosting the entire `SecurityExpertServer` container—only host changed or new objects. For Unbound or Irrelevant Objects: - If objects have no bindings, naming is not critical from an EBO perspective - Delete the container and rehost the object from the **Hardware folder**.   To Retain Existing Bindings  Identify the correct object name in the Hosted Containers folder  Copy the name to avoid typos. Delete the duplicate object with the correct name. Rename the existing EWS ID to match the copied name. Save the rename Verify bindings: Right-click the renamed object Select Delete Click Show References Confirm bindings are still valid. Click No to cancel deletion. Repeat this process for each object (inputs, outputs, doors, etc.) that has existing bindings.  

Issue When a Reader Expander is offline from the controller, users with Credential Type-based access are unable to be authenticated. Product Line EcoStruxure Security Expert Environment Security Expert SP-C, SP-AC1, SP-ACX SP-RDM2, SP-MRDM2 Cause Reader Expanders store a limited number of user card records locally, depending on the Offline Operation setting. However, user credentials (such as credential types, biometric or PIN-based data) are stored only in the controller, not in the Reader Expander. It’s important to note that the term "card" in the Offline Operation feature (as described in the online help and the SX-SRVR Security Expert - Operator Reference Guide) refers specifically to the Card Numbers section [1] of a user record, not the Credentials section [2]. User record Resolution The Offline Operation functionality of Reader Expanders supports authentication using Card Numbers only. It does not support authentication using Credential Types when the expander is offline.  

Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Issue For hardware failure or persistent issues, it is necessary to replace Security Expert hardware components Product Line EcoStruxure Security Expert Environment Security Expert SP-C or SP-C-Web controller Expanders (i.e. RDM2 or SP08) Card Readers Cause A hardware failure occurs or a persistent issue happens that requires steps to replace Security Expert hardware Resolution At times it's necessary to replace Security Expert hardware   Steps to replace Security Expert SP-C Controllers: 1. Determine if the original controller has encryption turned on If the failed controller was setup for encrypted communications with the Security Expert server, the newly installed replacement controller will not have the encryption keys to be able to decode the packets from the server. Attempting to bring it online will be unsuccessful. On the controller's Configuration tab press the Disable controller encryption, then Yes to confirm. A replacement controller will typically be unencrypted. As soon as it shows online you can decide if you want to encrypt it. If it was already encrypted in Security Expert before replacing it, you might need to hit the encryption button again to get it in sync. Note: It can be helpful to use the event server diagnostic. If you see messages including “unencrypted” set encryption on the controller and see if it comes online. 2. Disconnect the old controller from its networks unplug ethernet and RS-485 module network and other hardware 3. Replace the Serial Number in Security Expert In Security Expert, navigate to Sites | Controllers. Replace the Serial number of the old controller with that of the new one. 4. Disable encryption In the Configuration tab, click Disable controller encryption. 5. Default the Controller If the controller has been used on a different server, default the new controller. See the SP-C Installation manual for detailed steps on performing a controller default https://ecoxpert.se.com/search?documentUUID=b4fb1237-fd07-2ee5-d9ad-4324178c364c&title=SP-C%20Security%20Expert%20-%20Security%20Purpose%20Controller%20-%20Configuration%20Guide  6. Enter the event server settings on the controller Log in to the new controller's web interface. In Settings, enter the same IP settings, event server and ports as those of the old controller, then restart the controller. Note: Remember to remove the jumper used to default the controller 7. Connect the new controller to the networks and hardware The controller should come online in Security Expert if all the network settings, serial number and encryption settings are in sync. 8. Download the controller In Security Expert, right click on the controller record and select Force download. The controller should receive the download. 9. Enable encryption Once the controller is online, in the Configuration tab click Enable controller encryption in Security Expert if desired. Steps to replace Security Expert SP-C-Web Controllers: 1. Take a backup of the old SP-C Web controller Login to SP-C Web, In System | Backup controller This creates a .bak file prompting to save in a folder or in the downloads folder 2. Disconnect the old controller Unplug the controller from the ethernet network, the RS-485 module network and other hardware. 3. Register the new controller Log in to the new controller and register it in System | Licensing 4. Restore the previous backup taken Navigate to System | Backup and Choose File and browse to the previously created .bak file 5. Configure the IP settings In System | Settings, enter the same IP settings as those of the old controller, then restart the controller 6. Connect the new controller to the networks and hardware and Test Steps to replace Security Expert Expanders: 1. Disconnect the old expander from the RS-485 module network and any inputs, outputs or card readers. 2. Connect the new expander to the module network and hardware. 3. Set the new expander's address to the same as that of the old expander.  In Security Expert, navigate to Sites | Controllers, right-click the controller and select Module addressing.  In SP-C-WEB, use the Expanders Wizard. To address a keypad, power cycle it and then press [X], [Enter]. Enter the new address and press [Enter] to save. Note: Sometimes the old expander can remain in the module addressing window even after being physically disconnected. To free up the address, module update the expander record. This will fail, but the address should become available. 4. Module update the new expander. The expander should start operating normally using the programming from the original expander. Steps to replace Security Expert Card Readers: 1. Disconnect the old card reader from the reader port. 2. Connect the new card reader 3. Apply any Custom Configurations If the reader needs any custom configuration, apply it within two minutes of the reader starting up using the config card. 4. Wiegand and RS-485 readers should connect automatically For OSDP readers, put the card reader into installation mode, then send an OSDP install mode command to the reader expander.   Additional configuration after controllers have been replaced If used at the site, areas that are configured for duress alarms default to un-armed after a SP-C has been replaced and need to be re-armed via forced arming. If used at the site, the alarm dialer (Contact ID) "Service Mode" defaults to "0 - Manual Mode" after a SP-C has been replaced (see the arrow below) and needs to be changed to "1 - Start with controller OS". Service mode Test the replaced hardware to ensure the issue is resolved

Issue What is the password policy for Security Expert operators, and how can it be configured to meet specific cybersecurity requirements? Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert Client Cause Some sites require customized password policies to comply with cybersecurity standards. These may include requirements such as: Enforcing regular password changes Preventing the reuse of previous passwords Setting minimum password length Requiring strong password complexity Resolution   Default Password Policy in Security Expert By default, Security Expert enforces the following password policy for operator accounts: Minimum password length: 8 characters Password change required: On first login For more information on Security Expert’s cybersecurity practices, refer to the SX-SRVR Security Expert System Hardening Reference Guide. Custom Password Policies via Active Directory Integration Security Expert does not support advanced password policy configuration directly within the client interface. However, enhanced password policies can be enforced by integrating Security Expert with Windows Active Directory. To implement this: Integrate Security Expert with Active Directory Follow the steps outlined in Option 1 of the How to Integrate Active Directory with Security Expert article or Option 2 for full Active Directory integration. See AN 288 Security Expert - Using Active Directory - Integration Guide for additional details. Configure Password Policies in Windows Domain Once integration is complete, operator accounts managed through Active Directory will adhere to the domain’s password policy. This allows you to enforce: Password expiration intervals Password history restrictions Minimum and maximum password lengths Complexity requirements (uppercase, lowercase, numbers, symbols)

Issue Confusion about the current release version of Security Expert and the limited release Security Expert for the Enterprise Download Service. Product Line EcoStruxure Security Expert Environment Security Expert Enterprise Download Service Cause Two parallel development branches now exist for Security Expert: Maintenance Builds –  version 4.3.370.15 (Released 2025-May-01 - latest stable release) Limited Release Builds –  version 4.3.386.2, intended for use with the new Enterprise Download Service. This has led to confusion because: The limited release version (4.3.386.2) has a higher version number than the current maintenance release (4.3.370.15).  The Supported Software 2025 landing page does not host the actual installation files for the limited release. Instead, it now provides a ZIP file containing instructions and a request form. Initially, version 4.3.386.2 was directly downloadable, but it has since been replaced with the ZIP package. Resolution To Access the Current Maintenance Release Visit the EcoStruxure™ Security Expert – Software and Firmware page on the Extranet. Sort the list by date to find the most recent maintenance version (currently 4.3.370.15 Released 2025-May-01).   To Access the Limited Release (Enterprise Download Service) Go to the Supported Software 2025 landing page. Select either: “2025 Enterprise Download Service (VM Bundles)”, or “Client/Server Security Expert - v.4.3.386.2”. Both links download the same ZIP file, which includes: Instructions for requesting the limited release. A site evaluation form that must be submitted  to TeamVipers@se.com who will review and provide the installation files.   If You Need to Roll Back from 4.3.386.2 to 4.3.370.15 Due to database version incompatibility, rolling back requires the following steps: Backup the current SecurityExpert and SecurityExpertEvents databases. Record the site’s license SSN. Uninstall the current Security Expert version. Important: Any configuration or event data added after the backup will be lost and must be manually re-applied. Restore the database backups from version 4.3.370.15 or earlier. Install the maintenance version (4.3.370.15).

Issue After an upgrade the SP-C-WEB is showing "NOT REGISTERED" with the option to register the controller. Attempts to register the controller fail as it is already registered. SP-C-WEB not registered When attempting to create new records their is a "License Limit Reached" message displayed and the new records are unable to be created. SP-C-WEB license limit reached Product Line EcoStruxure Security Expert Environment SP-C-WEB Cause Browser has cached settings for this controller that are interfering.  Resolution Use browser incognito mode and/or clear the browser cookies and cache.

Issue What third party Card Printers are supported for use with Security Expert? Product Line EcoStruxure Security Expert Environment Security Expert Client Third-party Card Printers Cause There is no list of supported printers as there are too many devices to test.  Some testing has been done as listed in the resolution below.  If an issue should come up with a card printer then raise a support case and they will assist where possible and offer suggestions regarding the update of printer drivers, windows and printer preferences, etc. If necessary and the customer cannot resolve an issue then they may wish to supply the particular printer for testing and validation. Resolution There is currently no list of supported Card Printers, the following two printers have been tested by Engineering  with Security Expert: Datacard SD260 Datacard CD800 Indications that the HID Fargo HDP8500 and Fargo DTC4500e also work with Security Expert. In general, if the card printer presents itself in Windows as an XPS printer, then the printer should work with the Security Expert Client. This may require a printer driver to be downloaded and installed from the printer manufacturer for the printer to show up in the "Printers and Scanners" list in Windows.   Note: R&D has indicated that currently (12/19/2024) there is no list of printers or documentation as to what specific features or configurations are supported by each printer above.   Some functionality in Security Expert and within printer drivers allows the selection of landscape or portrait orientation. However, hopper selections are not currently supported. Printer testing was done with standard iso card printing using landscape and portrait using a single hopper. Any other requirements outside the above will rest fully with the partner/branch/customer to test and confirm it works as needed.    In unsupported printers it has been observed that some printer functions, such as badge orientation and hopper choice, may not work for all printers using the pop-up printer configuration window within Security Expert client. In those cases a workaround may be to manually change the default printer options in Windows to the required setting before printing badges. If specific functions or badge printers are required then a feature request can be submitted to potentially implement that in a future version of Security Expert. This will need to be raised with your local solution category management.