LevelBlue Knowledge Base » Knowledgebase » WebMarshal

Supported Operating Systems and Prerequisite Versions

Charles — Thu, 16 Apr 2026 20:46:27 GMT

This article applies to:

MailMarshal (SEG) 10.0 and above
- MailMarshal Web Components (SQM)
WebMarshal 7.6
Marshal Reporting Console 2.6 (for SEG, ECM, and WebMarshal reports)

(For ECM/MailMarshal Exchange, see Q14131. For Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of SQL, IIS and ASP.NET are required and supported?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

OS and SQL versions earlier than those listed are not supported.

OS and SQL versions that are out of support from Microsoft are not supported.

The information reflects the latest versions of the named products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

VMWare deployments of the supported operating systems are also supported. See LevelBlue Knowledgebase article Q11828.

Key:

Symbol	Meaning
RTM	Release to Manufacturing, no service pack.
SPn KBnnn	Minimum required service pack or Microsoft Update. Later service packs are supported.
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. LevelBlue plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

The table below lists minimum compatible operating system versions and service packs. The products have been tested with the minimum compatible service pack (and in some cases with later service packs).

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, LevelBlue will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.

The listed products do not support RISC architectures. x64 or x86 is the supported architecture.

Server Operating Systems

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows Server 2025	RTM	RTM	Q21228 (Limited testing performed)	RTM
Windows Server 2022	RTM	RTM	RTM	RTM
Windows Server 2019	RTM (Also with any SEG 8.X)	RTM	RTM	RTM
Windows Server 2016	RTM	RTM	RTM	RTM
Windows Server 2012 R2 See also SQL Server service pack requirements			KB2919355
Windows Server 2012 See also SQL Server service pack requirements	(10.0.6 is the last release that allows installation on Windows 2012)		RTM
Windows Server Core edition (any release)

Workstation Operating Systems
(for server installation)

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows 10 or 11 (32 and 64 bit) See also SQL Server service pack requirements	RTM (64 bit required. Permitted but not recommended)	RTM (Permitted but not recommended)		RTM (Permitted but not recommended)

Prerequisites

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Web Browser	The Management Console works with Microsoft Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer is explicitly not supported.	SQM works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	MRC works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	Any browser can be used as client.
.NET Framework (minimum - later 4.X is also supported)	4.6.1 MailMarshal also automatically installs a version of the newer .NET technology (previously known as .NET Core) on Array Manager servers.	3.5 SP1 and 4.0	3.5 SP1 (Note that SQL 2016 requires .NET 4.6)	4.6.2

SQL Server Versions

	MailMarshal 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
SQL 2012 SQL Express 2012 (Microsoft ESU ends July 2025)	(10.0.6 is the last release that allows installation using SQL 2012)
SQL 2014 SQL Express 2014 (Microsoft ESU ends July 2027)	*(CAUTION: Upgrade from earlier versions fails under SQL 2014)*	SP3	SP3
SQL 2016 SQL Express 2016	*(CAUTION: Upgrade from earlier versions fails under SQL 2016)*	SP3	SP3
SQL 2017 SQL Express 2017	RTM		RTM
SQL 2019 SQL Express 2019	RTM		RTM
SQL 2022 SQL Express 2022	RTM	Can upgrade from SQL 2016 Q21228	RTM
Azure SQL Server	Supported where MailMarshal is deployed on Azure

Notes on MRC Installation

MRC 2.6 cannot be installed with SQL versions later than 2016 for the reporting database. However, after installation using the bundled SQL 2016 Express, the SQL Express instances can be upgraded. See Q21228.
MRC can report on data in MailMarshal or WebMarshal databases hosted on later SQL versions.

Supported Operating Systems and Prerequisite Versions

Charles — Thu, 16 Apr 2026 20:46:27 GMT

This article applies to:

MailMarshal (SEG) 10.0 and above
- MailMarshal Web Components (SQM)
WebMarshal 7.6
Marshal Reporting Console 2.6 (for SEG, ECM, and WebMarshal reports)

(For ECM/MailMarshal Exchange, see Q14131. For Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of SQL, IIS and ASP.NET are required and supported?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

OS and SQL versions earlier than those listed are not supported.

OS and SQL versions that are out of support from Microsoft are not supported.

The information reflects the latest versions of the named products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

VMWare deployments of the supported operating systems are also supported. See LevelBlue Knowledgebase article Q11828.

Key:

Symbol	Meaning
RTM	Release to Manufacturing, no service pack.
SPn KBnnn	Minimum required service pack or Microsoft Update. Later service packs are supported.
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. LevelBlue plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, LevelBlue will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.

The listed products do not support RISC architectures. x64 or x86 is the supported architecture.

Server Operating Systems

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows Server 2025	RTM	RTM	Q21228 (Limited testing performed)	RTM
Windows Server 2022	RTM	RTM	RTM	RTM
Windows Server 2019	RTM (Also with any SEG 8.X)	RTM	RTM	RTM
Windows Server 2016	RTM	RTM	RTM	RTM
Windows Server 2012 R2 See also SQL Server service pack requirements			KB2919355
Windows Server 2012 See also SQL Server service pack requirements	(10.0.6 is the last release that allows installation on Windows 2012)		RTM
Windows Server Core edition (any release)

Workstation Operating Systems
(for server installation)

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows 10 or 11 (32 and 64 bit) See also SQL Server service pack requirements	RTM (64 bit required. Permitted but not recommended)	RTM (Permitted but not recommended)		RTM (Permitted but not recommended)

Prerequisites

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Web Browser	The Management Console works with Microsoft Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer is explicitly not supported.	SQM works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	MRC works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	Any browser can be used as client.
.NET Framework (minimum - later 4.X is also supported)	4.6.1 MailMarshal also automatically installs a version of the newer .NET technology (previously known as .NET Core) on Array Manager servers.	3.5 SP1 and 4.0	3.5 SP1 (Note that SQL 2016 requires .NET 4.6)	4.6.2

SQL Server Versions

	MailMarshal 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
SQL 2012 SQL Express 2012 (Microsoft ESU ends July 2025)	(10.0.6 is the last release that allows installation using SQL 2012)
SQL 2014 SQL Express 2014 (Microsoft ESU ends July 2027)	*(CAUTION: Upgrade from earlier versions fails under SQL 2014)*	SP3	SP3
SQL 2016 SQL Express 2016	*(CAUTION: Upgrade from earlier versions fails under SQL 2016)*	SP3	SP3
SQL 2017 SQL Express 2017	RTM		RTM
SQL 2019 SQL Express 2019	RTM		RTM
SQL 2022 SQL Express 2022	RTM	Can upgrade from SQL 2016 Q21228	RTM
Azure SQL Server	Supported where MailMarshal is deployed on Azure

Notes on MRC Installation

MRC 2.6 cannot be installed with SQL versions later than 2016 for the reporting database. However, after installation using the bundled SQL 2016 Express, the SQL Express instances can be upgraded. See Q21228.
MRC can report on data in MailMarshal or WebMarshal databases hosted on later SQL versions.

Supported Operating Systems and Prerequisite Versions

Charles — Thu, 16 Apr 2026 20:46:27 GMT

This article applies to:

MailMarshal (SEG) 10.0 and above
- MailMarshal Web Components (SQM)
WebMarshal 7.6
Marshal Reporting Console 2.6 (for SEG, ECM, and WebMarshal reports)

(For ECM/MailMarshal Exchange, see Q14131. For Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of SQL, IIS and ASP.NET are required and supported?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

OS and SQL versions earlier than those listed are not supported.

OS and SQL versions that are out of support from Microsoft are not supported.

The information reflects the latest versions of the named products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

VMWare deployments of the supported operating systems are also supported. See LevelBlue Knowledgebase article Q11828.

Key:

Symbol	Meaning
RTM	Release to Manufacturing, no service pack.
SPn KBnnn	Minimum required service pack or Microsoft Update. Later service packs are supported.
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. LevelBlue plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, LevelBlue will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.

The listed products do not support RISC architectures. x64 or x86 is the supported architecture.

Server Operating Systems

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows Server 2025	RTM	RTM	Q21228 (Limited testing performed)	RTM
Windows Server 2022	RTM	RTM	RTM	RTM
Windows Server 2019	RTM (Also with any SEG 8.X)	RTM	RTM	RTM
Windows Server 2016	RTM	RTM	RTM	RTM
Windows Server 2012 R2 See also SQL Server service pack requirements			KB2919355
Windows Server 2012 See also SQL Server service pack requirements	(10.0.6 is the last release that allows installation on Windows 2012)		RTM
Windows Server Core edition (any release)

Workstation Operating Systems
(for server installation)

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows 10 or 11 (32 and 64 bit) See also SQL Server service pack requirements	RTM (64 bit required. Permitted but not recommended)	RTM (Permitted but not recommended)		RTM (Permitted but not recommended)

Prerequisites

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Web Browser	The Management Console works with Microsoft Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer is explicitly not supported.	SQM works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	MRC works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	Any browser can be used as client.
.NET Framework (minimum - later 4.X is also supported)	4.6.1 MailMarshal also automatically installs a version of the newer .NET technology (previously known as .NET Core) on Array Manager servers.	3.5 SP1 and 4.0	3.5 SP1 (Note that SQL 2016 requires .NET 4.6)	4.6.2

SQL Server Versions

	MailMarshal 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
SQL 2012 SQL Express 2012 (Microsoft ESU ends July 2025)	(10.0.6 is the last release that allows installation using SQL 2012)
SQL 2014 SQL Express 2014 (Microsoft ESU ends July 2027)	*(CAUTION: Upgrade from earlier versions fails under SQL 2014)*	SP3	SP3
SQL 2016 SQL Express 2016	*(CAUTION: Upgrade from earlier versions fails under SQL 2016)*	SP3	SP3
SQL 2017 SQL Express 2017	RTM		RTM
SQL 2019 SQL Express 2019	RTM		RTM
SQL 2022 SQL Express 2022	RTM	Can upgrade from SQL 2016 Q21228	RTM
Azure SQL Server	Supported where MailMarshal is deployed on Azure

Notes on MRC Installation

MRC 2.6 cannot be installed with SQL versions later than 2016 for the reporting database. However, after installation using the bundled SQL 2016 Express, the SQL Express instances can be upgraded. See Q21228.
MRC can report on data in MailMarshal or WebMarshal databases hosted on later SQL versions.

Can I use PAC (Proxy auto-configuration) files with WebMarshal?

Charles — Sun, 15 Mar 2026 21:28:11 GMT

This article applies to:

WebMarshal

Question:

Do PAC files work with WebMarshal?
How do I use or deploy PAC files with WebMarshal?

Reply:

Yes, you can use PAC files with the WebMarshal proxy. PAC files are applied at the web browser level, and do not depend on the proxy software.

Usage and configuration of PAC files will depend on your environment. LevelBlue Technical Support is not responsible for authoring, reviewing or deploying PAC files.

The remainder of this article provides some general suggestions about usage and deployment of PAC files, and links to additional information.

PAC Usage:

Proxy Auto-configuration (PAC) files direct a browser to use specific proxy servers. Because PAC files are scripted, they can contain complex configuration such as:

A list of URLs that should be excluded from proxying
A list of one or more proxy server names (or IP addresses) and ports that can be used
Different proxy server usage depending on the client IP address (useful for laptops that may be browsing from different networks)

PAC files can be hosted on each workstation, or on an intranet server. PAC files and browser configuration can be updated using Windows Group Policy or other administration tools.

Sample PAC Configuration

The procedure given below is for a PAC file in its simplest form and should work for any web proxy software. It redirects all website requests from a client computer's browser to the WebMarshal proxy server (just as would happen by entering proxy information directly in the browser).

In the example, the name of the proxy server is webmarshal.local and the proxy port is the default 8080.
Substitute the correct name or IP address and port for your WebMarshal proxy.

Create a text file using Notepad.
Copy the script below into the file (replacing the name and port of the proxy server with the actual name or IP address and port of your WebMarshal server).
- If you use a name, ensure that it can be resolved to an IPv4 address.
function FindProxyForURL(url, host)
{
return "PROXY webmarshal.local:8080";
}
Save the file as C:\proxy.txt
- For testing you can save this file in any convenient location that your account has read and write access to.
To use this file:
- For browsers that honor Windows internet settings (such as Edge and Chrome):
  - Open the system Internet Options > Connections > LAN Settings
  - Select "Use automatic configuration script"
  - Enter the path as file://c:/proxy.txt (or the path where you saved the file). Note: the format is URL format with the "file" prefix.
  - Click OK as required to accept the changes.
- For Firefox (recent versions)
  - On the Firefox menu open Options > Options > Network, and click Settings
  - Select "Automatic proxy configuration URL"
  - Enter the path as file://c:/proxy.txt (or the path where you saved the file). Note: the format is URL format with the "file" prefix.
  - Click OK as required to accept the changes.
- For other browsers, please refer to their support documentation.
Browse to http://webmarshal.home and you should see the WebMarshal home page.
Browse to Internet sites. You should be able to see the activity from the specific computer in "Active sessions" within your WebMarshal Console.

Notes:

For information about using the Web Proxy Auto-Discovery Protocol (WPAD) with WebMarshal, please visit LevelBlue Knowledgebase article Q12228.

References:

http://en.wikipedia.org/wiki/Proxy_auto-config

Using WebMarshal with kiosk computers, smartphones and tablets with IP Authentication

Charles — Sun, 15 Mar 2026 21:24:52 GMT

This article applies to:

WebMarshal 6.X and 7.X

Question:

How can I set up Kiosk Computers, iPads and other mobile devices to use WebMarshal as the proxy?

Reply:

WebMarshal IP Authentication can be used to log and control web activity where the user does not have a network credential, or the device does not understand proxy authentication.

IP Address authentication is transparent to the end user. WebMarshal will use the IP Address of the connecting device/computer and will apply policy based on the address. You can apply any WebMarshal rule based on IP address.

Procedure:

To configure and enable IP Address based authentication:

The browser or other application on the Kiosk computer or mobile device must understand the concept of using a "web proxy" (it must have the relevant settings to configure which proxy and port to use). The application must be able to connect to WebMarshal using the configured web proxy settings, at the network connection level.
WebMarshal must accept IP based authentication. By default WebMarshal accepts IP based authentication on port 8081. To customize this setting, in the WebMarshal Console navigate to Tools > Global Settings > Proxy Settings > Ports and Authentication.
- Before changing the port, check that no other software is listening on the new port. See article Q12072.
WebMarshal must be configured with IP Address user groups that include the IP addresses you want to allow. To add an IP address group:
- In the WebMarshal Console, click User Groups.
- From the Action menu or the right pane menu bar, choose “New IP Address Group”.
- Enter a name and optionally a description.
- Enter a starting and ending IP address for the range.
  
  Note: WebMarshal adds the name or IP address of each computer in this range to the All Users list the first time that computer connects to WebMarshal. Once the computer names are included in the list, you can use them individually within Rules in the same way as any other User.
Configure the web browser or application software to use your WebMarshal proxy server and the port specified in step 2.
- To specify these settings on a client computer, open the control panel Internet options > Connections > LAN Settings.

For other browsers and applications, please refer to the application's support documentation for configuring proxy settings. Many applications allow you to set a custom proxy that is different from the configuration of IE or other browsers.
- As an example, in MailMarshal SEG you can configure this setting in the Configurator, Tools > MailMarshal Properties > Internet Access (and optionally in the Server Properties for each processing node).

After configuring proxy settings, browse to http://webmarshal.home
- The result should be a pages showing the name or IP address of your computer and other details regarding your WebMarshal proxy server.
- Any user or process on a computer with an IP address in the specified range (as in step 3) can browse through WebMarshal, subject to any rules you choose to apply on this IP Address group.
The recommended way to apply policy to an IP Address group is to add it to one of the standard groups created by default with WebMarshal (Power Users, Standard Users, Restricted Users). This approach is versatile and flexible as the application of the rules will remain the same regardless of any new users, computers or groups added or removed from a WebMarshal user group.
- It is best practice to NOT use any imported groups directly in policy.

Notes:

For more information on creating and managing WebMarshal groups and modifying your policy accordingly, please refer to the WebMarshal User Guide and help.
If you use IP authentication in an environment that assigns IP addresses dynamically (using DHCP), please note the following limitations:
- The IP address of a device could change.
- To ensure that IP based rules apply as expected in a DHCP environment, you should not set up special rules for individual device names or addresses.
- Where devices have resolvable names (for instance in a Windows domain environment), WebMarshal attempts to resolve the name and applies rules to devices by name if possible. This feature is designed to assist with policy and reporting if the IP address changes. However tracking by name is generally not possible for mobile devices, or if name resolution is not available.
- When WebMarshal cannot resolve a device name, it applies policy using the current IP address of the device.

Configuring authentication bypass with WMProxyLogon

Charles — Sun, 15 Mar 2026 21:23:40 GMT

This article applies to:

WebMarshal 6.9 and above
Windows operating system clients

Question:

Authentication problems when using Skype or iTunes through WebMarshal
Authentication problems with browser helper applications

Background:

In certain circumstances, browsers and browser plug-ins on Windows operating systems fail to authenticate with the Proxy. This may be due to an incompatibility, or simply software that does have proxy settings but does not provide for authentication.

The WMProxyLogon mechanism described here is a simple workaround designed to overcome this limitation in the client software. It is not limited to the named clients and could be used anywhere that a similar problem occurs.

Procedure:

WebMarshal includes a small utility called WMProxyLogon.exe. In earlier versions, this utility is used to allow NDS users to authenticate. In WebMarshal version 6.9 and above, this program also works with all Windows logins.

This utility runs on the user workstation.
By default the utility uses the Windows Internet Options settings so if these are not properly configured the logon procedure will not work. To override these settings see Options below.
If this program is added to the logon script it will run as a system tray icon and periodically inform the proxy server of the active Windows (or NDS) logon. While this program is running the user will not be prompted for authentication for any applications.
You do not need to make any change on the WebMarshal server.

Usage

WMProxyLogon.exe runs on the client workstation. Typically this software would be included as part of the user logon script for some or all users. The program is small enough that it can be run from its location on the WebMarshal server. Double-click the system tray icon to see the current user information and/or exit from the program.

Options

WMProxyLogon.exe has the following command line options:

/?: Shows help information.
/Proxy:<server>:<port>: Overrides the system settings and forces WMProxyLogon.exe to communicate with the stated proxy server. Note that the browser must still be configured correctly to use the proxy server.
/NoIcon: Disables display of the system tray icon.

Notes:

This solution allows access for ANY software running on the workstations that can use a proxy server (subject to WebMarshal Rules that control access).
- Potentially unwanted applications could also be allowed by this solution.
For another solution that can provide more granular control, see Q12734: Configuring the Authentication Bypass Cache

Considerations when investigating slow Web Browsing

Charles — Sun, 15 Mar 2026 21:15:32 GMT

This article applies to:

WebMarshal 6.X and 7.X

Question:

What should I consider when my WebMarshal installation is running slower than normal?
What factors can affect browsing and operational performance?

Items To Consider:

Is browsing really slower, or does it just seem slower?
- Time a page from click to complete.
- The images may seem to 'pop in' rather than displaying partially as they load, which can make the page loading seem slower. However, the total time taken to load the page is roughly the same.

Hardware and Server Specification

Does the WebMarshal server meet (or exceed) the recommended hardware requirements?
- If you are using a virtual machine, does the host have adequate resources to support all VMs?
Does the WebMarshal server have two NICs? If so are they listed in the correct order?
- On the WebMarshal server, navigate to Network Connections --> Advanced --> Advanced Settings --> Adapters and Bindings. Ensure the Local/Inside network is first in the list.

Client Configuration

Toggle use of HTTP 1.1 in the end-user's browser settings (normally 1.1 will give better performance)
- Edge, Chrome: Windows Internet Options --> Advanced
  - Setting: Use HTTP 1.1
  - Setting: Use HTTP 1.1 through proxy connections
- Firefox: In the Address Bar enter about:config
  - Filter for network.http
  - Setting: network.http.version
  - Setting: network.http.proxy.version
Is the speed impacted in only one browser or workstation?
- Is the speed acceptable in another browser?
- Are plugins enabled on the slow browser?
- Are "performance enhancers" loaded for the browser?
Do the end-users have web filtering applications installed locally such as an antivirus application?

Firewalls

Is there a firewall in place?
- Is the firewall inspecting Content/Packets?
- Are firewall resources running high?
- Is the firewall setting "Enforce Host Tag search for CFS" enabled? If so this should be disabled.

Server Configuration

What version of WebMarshal are you running?
- LevelBlue always recommends you use the latest version. Almost every release includes changes that can improve the browsing experience.
- If using a version below 6.5.6, check the trickle transfer rate setting (Server & Array Settings > Download Options). This setting can safely be increased to 90%.
- Sometimes page completion can be slower for large pages with a lot of text. WebMarshal returns the entire page to the browser after scanning, which means that the browser doesn’t get the opportunity to begin loading satellite resources while continuing to receive the page. From WebMarshal version 6.5, you can configure the holdback for text and binary files separately (Server & Array Settings > Download Options).
Is WebMarshal configured to use caching?
- Caching can help to reduce delays in fetching pages. Ensure that the cache folder is on a high quality disk with adequate free space.
- Note that WebMarshal does not cache the result of rule evaluation. Rules are re-run for every request.
Is WebMarshal configured to use an upstream proxy?
- If users access the web via the upstream proxy (bypassing WebMarshal), is there a change in performance?
- Does setting WebMarshal to access the web directly instead of via an upstream proxy increase the performance?
Consider disabling Reverse DNS lookups for client workstations:
- See Q11895
Does the timeout threshold need to be increased? (The current default setting is 300 seconds.)
- See Q12914
Has Advanced Logging been left on at some stage causing reduced performance due to the extra load?
Ensure that NetBIOS over TCP is enabled on the WebMarshal servers.

Rules and Processing Settings

Does disabling rule processing (the Access Policy) inside WebMarshal improve the performance?
Are complex or multiple text censor scripts being applied for many result pages?
Is URLCensor installed and enabled with WebMarshal?
- This feature depends on DNS lookups and can be slow to respond in a real-time environment. You should consider disabling it.
Are there large URL Categories? If so, these will slow down each request as the list is scanned.
Is HTTPS Content inspection enabled? This will increase the engine load and reduce performance.
If WebMarshal is configured to use virus scanners, is performance increased after disabling them?
- Are the "Extensive Virus Scanning" rules enabled?
- Is the Virus Scanner slow to respond?
- Is more than one scanner installed and enabled via the rule set? If so this will cause duplicate scanning to occur on every web request.

Resolving SSL certificate issues

Charles — Sun, 15 Mar 2026 21:11:15 GMT

This article applies to:

WebMarshal 6.X or 7.X
HTTPS Content Inspection

Question:

WebMarshal blocks HTTPS sites
Message: Certificate Chain is not Trusted

Information:

When WebMarshal HTTPS Content Inspection is enabled, WebMarshal attempts to check the validity of the SSL certificates used by each website.

Validation may be unsuccessful if the required Root Certificate and in some cases Intermediate Certificates are not present in the correct certificate stores on each WebMarshal processing server.

Causes:

Newer Windows releases install a very limited set of SSL CA certificates by default.
- To resolve this issue, you can install updated CA certificates from Windows Update. See LevelBlue Knowledge Base article 21016.
- Note that WebMarshal does not automatically retrieve root certificates in most cases.
In rare cases a required certificate for a site may not be included in the Microsoft certificate package.
- To resolve this issue, log on to the WebMarshal processing server as an administrator. Using Edge or Chrome, browse to the site in question WITHOUT passing through WebMarshal content inspection.
- When prompted, install (trust) required certificates. Normally, when you browse as an administrator, these certificates will be correctly installed in the computer certificate store and will be available to WebMarshal services.

You can also add certificates or verify the location of certificates using the MMC Certificates snap-in.

Run Microsoft Management Console (MMC.exe)
Choose to add a snapin and select the Certificates snap-in. Choose to manage certificates for the Computer account.
Add the Certificates snap-in again and choose to manage certificates for the current user account.
- You can check for the presence of certificates in the Computer section (for instance in Trusted Root Certification Authorities > Certificates.)
- If required, you can copy certificates from the User section to the Computer section.

After adding certificates, restart the WebMarshal Proxy service. Remember to repeat these steps on each WebMarshal processing server.

Notes:

WebMarshal 6.8 and above addresses some additional issues with determination of certificate validity.
From time to time Microsoft includes additional Root Certificates in Windows Update. LevelBlue recommends that you schedule update of Root Certificates.
WebMarshal currently checks certificate status only for the leaf certificate and not for root certificates.

Prerequisites and tips for WebMarshal Remote Console

Charles — Sun, 15 Mar 2026 21:09:47 GMT

This article applies to:

WebMarshal 6.8 and above
Remote Console functionality

Question:

What are the prerequisites for WebMarshal Remote Console?
What are common problems using the Remote Console?
What authentication methods are supported by Remote Console?
Why does the Remote Console link not appear on the WebMarshal Home page?

Information:

The WebMarshal Remote Console is implemented as a Microsoft ClickOnce application.

Note: Most administrators who require access to WebMarshal administration from their workstation should install the main WebMarshal Console application. Remote Console is provided for administrators who may want to connect without a software installation (for instance, from a user workstation)

This article details the prerequisites and other tips for use of the WebMarshal Remote Console. Prerequisites generally follow the prerequisites for the WebMarshal Console standard installation.

For some common error messages see the Common Problems section below.

Note: Issues using the Remote Console with UAC are resolved at WebMarshal 7.4.5

Prerequisites:

WebMarshal Remote Console requires the following items on the client workstation:

For version 7.X:
- .NET Framework 4.6.2
- Microsoft Visual C++ 2015 redistributable
For versions 6.10 through 6.12, .NET Framework 4.0
For 6.8 and 6.9, .NET 3.5 SP1
A web browser that supports the Microsoft ClickOnce functionality
- Edge Chromium, with ClickOnce support enabled (see edge://flags)
- Mozilla Firefox current versions may be usable with the ClickOnce extension from Breez (this extension is not supported or warranted functional by LevelBlue)
- Google Chrome may be usable with the ClickOnce extension from Menarva (this extension is not supported or warranted functional by LevelBlue)
Browser configured to use WebMarshal as proxy.
For any browser:
- You must have the Windows Internet Options proxy settings configured to use WebMarshal. The ClickOnce functionality uses these proxy settings.
- You may need to add http://webmarshal.home to the Trusted Sites zone.

Authentication:

To allow use of Remote Console you must grant access in two places:
1. Enable users to run the Remote Console, in WebMarshal Global Settings > Remote Console
2. Grant users access to Console features, using the WebMarshal Security Tool. The settings you make here affect access from both the Remote Console and the installed Console. By default, members of the Administrators group on the WebMarshal Array Manager server have full access.

Remote Console link:

Users access the Remote Console using a link on the WebMarshal Home page.

This link is generated as part of the {Options} tag found in the default template for the WebMarshal Home page. If you customized your WebMarshal Home page and removed this tag, the Remote Console link will not display.

To display the link, ensure the {Options} tag is included in the body of the WebMarshal Home page.

Common Problems:

Error message: "Cannot Start Application.": Cause 1: Using an unsupported browser (such as Google Chrome with no plugin).
Cause 2: Using another browser, but the system proxy setting is not configured to use the WebMarshal server. Both the system and browser proxy settings must be configured to use the WebMarshal Server.
Error message: "Failed to load snapin module" or "Could not load file or assembly": Cause: .NET Framework is not installed or not up to date.
Error message: "Cannot download the application" "Manifest.exe not found": Detailed error: Could not find file 'C:\Users\Administrator\Downloads\MarshalConsole.exe.manifest'; Cause: using Edge Chromium without enabling ClickOnce Support, or Google Chrome without third party extension.
Error message: "Deployment and application do not have matching security zones.": Cause: http://webmarshal.home is not added to the Internet Options Trusted Sites zone.
Error message: "The Execution level requested by this application is not supported.": Cause: UAC is enabled. This issue affects 7.X versions below 7.4.5. To resolve the error, upgrade to 7.4.5 or above.

What browsers can I use with WebMarshal?

Charles — Sun, 15 Mar 2026 21:06:11 GMT

This article applies to:

WebMarshal

Question:

What browsers can I use with WebMarshal?
Does WebMarshal work with handset browsers?
Does WebMarshal work with Apple browsers?

Reply:

WebMarshal supports client connections from current versions of major browser software running on any operating system, as well as non-browser applications that can use proxy servers.

WebMarshal also works with client software on handset devices that meet the technical requirements described below (subject to the limitations of the devices).

The relevant open standards are Internet RFC 2616 (HTTP 1.1) and Internet RFC 2617 (HTTP Authentication).

The following information applies to WebMarshal as a standalone proxy.

WebMarshal user authentication supports client connections from software that implements RFC 2616 and RFC 2617, and can be configured to use an explicit proxy server.
WebMarshal NTLM (Windows integrated) authentication requires client software that implements NTLM.
- WebMarshal NTLM authentication is known to work with most current web browsers on the Windows platform. Browsers on other platforms can usually work with some additional setup.
WebMarshal IP authentication supports connections from software that implements RFC 2616 and can be configured to use an explicit proxy server.

LevelBlue does not test third party browsers for conformance to the RFCs. However the following browsers are known to work with WebMarshal :

Microsoft Edge
Firefox current versions (Windows, Linux, Mac)
Google Chrome current versions (Windows, Mac, Android)
Safari 3.2.2 and above (Windows)
Safari (Mac) - latest versions
Opera 8 and 9 (Windows)
Google Chrome (Windows, Mac, Android)
Mobile-safari (iPod Touch, iPhone)
Opera Mobile (Symbian S60 v3)
Nokia browser (Symbian S60 v3)
Internet Explorer (although this browser is obsolete and deprecated)

Configuring advanced settings for FTP proxy

Charles — Sun, 15 Mar 2026 21:03:21 GMT

This article applies to:

WebMarshal 6.1 and above

Question:

What is the behavior of WebMarshal with proxied FTP connections?
Using non-browser FTP clients (such as FileZilla or WinSCP) through WebMarshal when HTTPS inspection is enabled

Information:

Non-browser FTP clients use a HTTP proxy such as WebMarshal by issuing a HTTP 1.1 CONNECT request to the proxy (requesting a connection to the remote FTP control port, usually port 21). The server replies with a passive FTP connection on a high port.

In WebMarshal 6.1 through 6.5.3, when HTTPS inspection is enabled, these connections fail. The initial CONNECT request is treated as a request to create a SSL tunnel. The FTP data connection is not allowed.
In WebMarshal 6.5.5 and above, WebMarshal examines the content of the CONNECT request to determine if it is a FTP connection. FTP connections that are established in this way are allowed and the content is inspected as with any other FTP connection.

Configuration:

You can choose to disable the checking of the CONNECT requests, or the inspection of the FTP content sent through these connections (in WebMarshal 6.5.5 and above).

Configure these settings by adding an entry in the WebMarshal Proxy Configuration file (WMProxy.config.xml) as follows:

<WebMarshal>   <Proxy>     <Config>        <FTP detectFtpTunnels="{value}" processTunnelFiles="{value}" />     </Config>  </Proxy></WebMarshal>

Where each value can be true or false.

Enter the values in lower case, not including the {} braces, but including the quote marks.

detectFtpTunnels indicates whether the Proxy will sniff CONNECT tunnels to see if they are for an FTP control channel. This is needed to pick out the IP address and port that the client will attempt to connect to. Default (if not present): true. If set to false, and HTTPS inspection is enabled, these connections will fail.

processTunnelFiles indicates whether the Proxy should intercept the data connections and treat them as file requests instead of SSL tunnels. This is what allows the WebMarshal Engine to process the files as standard FTP requests. If set to false, the data connections will simply be treated as non-inspected SSL connections and the content will NOT be scanned in any way. Default (if not present): true.

Notes:

This article does not apply to web browsers accessing FTP. They do not use the method described here. Connections from browsers should succeed regardless of HTTPS inspection.
The issue with connections from non-browser clients only applies when HTTPS content inspection is enabled.
WebMarshal cannot proxy connections that use FTPS (FTP over TLS/SSL).
For general information about editing XML settings files, see article Q12705.

WebMarshal HTTPS inspection and SSL/TLS versions

Charles — Sun, 15 Mar 2026 21:02:05 GMT

This article applies to:

WebMarshal 6.1 and above
- Note changes at version 7.3, 6.12, and 6.11
HTTPS Content Inspection
SSL/TLS version settings

Question:

How does WebMarshal HTTPS content inspection affect SSL/TLS settings?

Information:

SSL (secure sockets layer) and TLS (Transport Layer Security) are the protocols that allow web browsers and web sites to communicate securely using HTTPS.

The following versions of SSL/TLS algorithms are currently supported by WebMarshal:

SSLv2 (the original protocol, less secure and now deprecated)
SSLv3 (also considered less secure)
TLSv1.0
TLSv1.1 (WebMarshal 6.11 and above)
TLSv1.2 (WebMarshal 6.11 and above)
TLSv1.3 (WebMarshal 7.3 and above)

When a web browser connects to a site using HTTPS, the browser and the site negotiate an encryption algorithm, based on the algorithms that they share (usually the most secure available). This algorithm is used to create the encrypted connection.

Some recent security standards (such as the US Government FIPS) require use of TLSv1.0 (or above).
All recent web browsers support the latest TLS versions.
Some recent web browsers have completely disabled support for legacy options by default.

How WebMarshal affects SSL

When WebMarshal HTTPS Content Inspection is enabled, two secure connections are required: one between the browser and WebMarshal, and another between WebMarshal and the web site. These connections are negotiated separately. WebMarshal supports all three algorithms.

If a remote site does not support the strongest algorithms, by default WebMarshal will use any available algorithm. The algorithm used is not reported to the browser. Therefore, even if a user sets their browser to refuse SSLv2, the Internet connection through WebMarshal could still be using SSLv2.

WebMarshal SSL Options

You can configure WebMarshal HTTPS rules to accept or refuse a SSL protocol (using the rule condition "Where the security protocol is". WebMarshal can warn a user, or block a connection, if a lower security algorithm is in use.

If SSL security is important to your organization, and you are using WebMarshal HTTPS inspection, you should configure WebMarshal rules in support of your SSL security policy.

Change in version 7.3 and above

TLSv1.3 is supported in 7.3 and above.

Change in version 6.12 and above

SSLv2 is no longer supported through WebMarshal.
All configuration options related to SSLv2 are removed from WebMarshal as of version 6.12.
When HTTPS inspection is enabled, LevelBlue recommends you use the rule condition "Where SSL/TLS could not be negotiated" to block any attempt to connect with SSLv2.
A rule to block connections "Where SSL/TLS could not be negotiated" is created and enabled on new installation and on upgrade.
SSLv3 is blocked by default as for version 6.11 (see below).

Change in version 6.11

When HTTPS Content Inspection is enabled, connections that use SSLv2 or SSLv3 are blocked by default regardless of rule conditions. To configure the list of SSL and TLS protocols that will be negotiated and allowed, see LevelBlue Knowledge Base article Q20067.

Notes:

When WebMarshal HTTPS Content Inspection is not enabled, or if HTTPS Content Inspection is not enabled for a particular site, the secure connection is made directly between the browser and the site. The settings in the browser control the protocols that are accepted.
You can select TLS/SSL options for Internet Explorer from the Windows Internet Options > Advanced tab, Security section.

How do I configure my web browser to use the WebMarshal HTTPS Root Certificate?

Charles — Sun, 15 Mar 2026 20:58:34 GMT

This article applies to:

WebMarshal 6.X and 7.X
Edge browser
Firefox
Chrome
Opera
Safari
Windows services

Question:

How do I configure my web browser to use the WebMarshal security certificate?
How do I configure an application that runs as a Windows service to use HTTPS Root Certificate?

Information:

The WebMarshal HTTPS Root Certificate can be used by any web browser. For help on its installation, see your web browser's help. This article provides guidance for some common browsers.

If you use Edge or other compliant browsers in a Windows domain, the easiest way of setting up the HTTPS Root Certificate is with Group Policy. For details, see the following article:

Q12014 : How do I push the WebMarshal HTTPS Root Certificate to all users in an organization using Microsoft windows group policy?

If you use other browsers and applications, there are a number of other ways to set up use of the WebMarshal HTTPS Root Certificate.

The recommended way is by accessing the http://webmarshal.home/ website from your web browser. See below.
The alternative way is to export the WebMarshal HTTPS Root Certificate which is detailed further below.
For applications that run as Windows services and update over the web, you can import the WebMarshal HTTPS Root Certificate to the Local Computer Certificate Store.
For the Sun Java Runtime Environment (JRE), you may need to import the WebMarshal HTTPS Root Certificate to the Java Certificate Store.

Edge
Google Chrome

Click Install Root content inspection certificate. Then click Open file.
Click Install Certificate and click Next.
Select Place all certificates in the following store.
Browse to the Trusted Root Certification Authorities store and click OK.
Click Next then Finish. Click Yes to the Security Warning.

Note: In some versions of Windows the option 'automatically select the certificate store' does not select the Root store. The above instructions work for all versions as of the date of this article.

Opera

Click Install Root content inspection certificate.
Click Install and click OK.

Firefox

Click Install Root content inspection certificate. Check the Trust this CA to identify web sites box.
Click OK.

Safari

Click Install Root content inspection certificate.
Press CTRL and click the Mouse Button. Click Open.
Click OK to add the Certificate to the KeyChain for the login.
Click Always Trust. Enter the Administrators Username and Password.
Click Lock the Login Key Chain.

Note: Some versions of Safari may not display the http://webmarshal.home/ website correctly.

Other Applications

To allow Windows services to access HTTPS sites through WebMarshal, import the Root Certificate into the Local Computer certificate store.

Note: MailMarshal SMTP does not require this action. For help with MailMarshal SMTP SpamCensor updating, see article : Q11718.

Click Install Root content inspection certificate. Then click Open file.
Click Install Certificate and click Next.
Select Place all certificates in the following store. Click Browse.
On the Select Certificate Store window, check the box Show Physical Stores.
From the list, expand Trusted Root Certification Authorities, and select the Local Computer entry.
Click OK.
Click Next then Finish.

Installing an exported WebMarshal HTTPS Root Certificate

Follow the instructions below if you want to install a HTTPS security certificate that was exported from WebMarshal.

Edge or Chrome

Generally use the system install method mentioned above. For advanced customization of certificates:

In Edge or Chrome settings, select Privacy, Search, and Services.
Select Security > Manage Certificates.
You can choose to manage the system store, or install custom certificates. If you install custom certificates, you may need to install both trusted and intermediate certificates.

Firefox

In Firefox settings, search for Certificates and click View Certificates.
Select the Authorities tab.
Click Import and browse to the certificate exported from WebMarshal.
Click OK.

Opera

Open Opera click on Tools and select Preferences.
Select the Advanced tab and then the Security option in the left pane.
Click the Manage Certificates button.
Click Import. Select All Files from the Files of type field. Browse to the certificate exported from WebMarshal.
Click OK and OK again.

Safari

Safari uses Apple's KeyChain technology for managing Security certificates.

How do I push the WebMarshal HTTPS Root Certificate to all users in an organization using Microsoft windows group policy?

Charles — Sun, 15 Mar 2026 20:21:08 GMT

This article applies to:

WebMarshal 6.X and 7.X

Question:

How do I push the WebMarshal HTTPS Root Certificate to all users in an organization using Microsoft windows group policy?

Procedure:

Follow the steps below to push the WebMarshal HTTPS Root Certificate to all users on the network:

Log onto the Domain Controller machine and open Administrative Tools.
Double click on Active Directory Users and Computers.
Right click on the domain and select Properties. Select the Group Policy tab.
Click New to create a new Group Policy Object.
Select a relevant name for the new object. Click Edit on the new object.
In Group Policy Object Editor expand Computer Configuration and then expand Windows Settings.
Expand Security Settings then Public Key Policies and right click on Trusted Root Certification Authorities in the left pane and select Import.
Follow the prompts and select the Security Certificate you have exported from the HTTPS Content Inspection window on the Server and Array Properties dialogue window in WebMarshal - Tools > Server and Array Properties. See User Guide and Help for more information.
Close all the windows.

Notes:

To configure the Security Certificate for use with browsers that do not use the Windows certificate store, see the following article.

Q12015 How to configure your web browser to use the WebMarshal HTTPS Root Certificate

The server returned an error - 407 - Proxy Authentication Required.

Charles — Sun, 15 Mar 2026 20:13:47 GMT

This article applies to:

WebMarshal

Question:

Why do I receive an error when requesting a new license key for WebMarshal through a proxy?

Information:

In order to successfully request a license through WebMarshal, you must be able to access the Marshal website (www.marshal.com) from the computer where the Console is running, using the credentials of the logged on user.

The WebMarshal Console uses the system proxy settings configured in the profile of the logged on user.

To verify access, and to set the proxy configuration if required, in current Windows versions see Settings > Network & Internet > Proxy.

Windows Media Player prompts for basic authentication when downloading external content with the WebMarshal proxy server enabled.

Charles — Sun, 15 Mar 2026 20:12:45 GMT

This article applies to:

WebMarshal
Windows Media Player

Question:

Windows Media Player prompts for basic authentication when downloading external content with the WebMarshal proxy server enabled.

Symptoms:

I can download and view a file in Windows Media Player only after providing credentials via basic authentication.
I am receiving an authentication prompt in Windows Media Player when WebMarshal is enabled.
Windows Media Player is not passing NTLM credentials properly.

Causes:

Windows Media Player does not automatically pass NTLM credentials to a proxy server located in the local Intranet zone.
In some cases WMP might not recognize that the WebMarshal server is in the Intranet zone.

Information:

Problem 1 is due to the method by which Windows Media Player attempts (sometimes unsuccessfully) to automatically pass NTLM credentials to the WebMarshal proxy.
Problem 2 can be caused by the way you enter proxy server details in WMP or system proxy settings. An IP address or fully qualified name might be interpreted as a serer outside the Intranet zone.

You should always enter the proxy server location as a local hostname (for instance, Proxy1).

Notes:

Users may still encounter authentication prompts in some cases.

Users should still be able to download the file in question by providing valid credentials via basic authentication.

WMP is obsolete and users should consider using other software to play media.

This article was previously published as:: NETIQKB44352

Windows Update does not connect through WebMarshal proxy

Charles — Sun, 15 Mar 2026 20:10:52 GMT

This article applies to:

WebMarshal
Microsoft Windows Update
Windows Store

Symptoms:

Some clients are unable to run Windows Update or Windows Store through WebMarshal proxy.
Windows Update does not run automatically through WebMarshal proxy.

Causes:

WebMarshal policy might not allow access to all sites required by Windows Store or Windows Update.
Windows automatic processes do not use a proxy by default, and cannot use account authentication.
Windows automatic processes use a system proxy setting that you can set manually.

Information:

Sites required for Windows Updates

You can allow access to all sites required by Microsoft Windows Updates by setting up some policies in the WebMarshal configuration.

Create a new URL category called 'Software updates' and populate it with the list of URLs below:
- http://download.windowsupdate.com
- http://*.download.windowsupdate.com
- http://download.microsoft.com
- https://*.update.microsoft.com
- http://*.update.microsoft.com
- https://update.microsoft.com
- http://update.microsoft.com
- http://*.windowsupdate.com
- http://*.windowsupdate.microsoft.com
- http://windowsupdate.microsoft.com
- https://*.windowsupdate.microsoft.com
- http://ntservicepack.microsoft.com
- http://wustat.windows.com
Note: The list of sites used by Windows Updates is subject to change. The list above was taken from Microsoft KB 885819. If you continue to encounter problems after completing the steps in this article, use the Active Sessions feature in WebMarshal Console to identify any blocked sites and add them to the list.
Create a new Standard Rule similar to the following. Place it above any blocking rules:
Site Rule: Permit Software Updates
When a web request is received
For any User
And where the URL is a member of 'Software Updates'

Permit Access to this site
And do not process any further site blocking rules
Create a new Content Analysis Rule similar to the following. Place it above any File Type blocking rules:

FileType Rule: Permit Software Update files
When a web request is received
For any User
And where the URL is a member of 'Software Updates'

Permit Access to this file
And do not process any further file type rules
Be sure to reload the configuration after making these changes.

Proxy authentication options

Windows Update cannot use a proxy that requires account authentication; there is no method to save a credential.

Several possibilities are available to enable automatic updating through a proxy.

Use WSUS. You can configure the WSUS server to use proxy credentials. This is the recommended option for enterprise scenarios and provides greatest flexibility. For WSUS setup, refer to WSUS documentation. Search Microsoft Technet for the latest version of documentation. Here is a recent version.
- Note: If WSUS is connecting through WebMarshal, set WSUS to perform downloads in foreground mode, or add the sites to the Proxy Bypass list. WSUS in background mode uses byte ranges and these are not supported by the WebMarshal Engine. For details, see LevelBlue Knowledgebase article Q11582.
Use IP Authentication in WebMarshal. To use this option:
- Add a 'Software Updates' URL category as described above.
- Enable IP authentication in WebMarshal. (If you want to require account authentication for interactive users, enforce browser proxy settings with GPO or other tools.)
- On each workstation, configure the default proxy setting for WinHTTP as described below, using the IP authentication port of WebMarshal.
Use the WebMarshal Proxy Bypass List. To use this option:
- Add the URLs mentioned above to the WebMarshal Proxy Bypass list.
- On each workstation, configure the default proxy setting for WinHTTP as described below.

Proxy settings for WinHTTP

To configure default proxy settings, use proxycfg or netsh winhttp (depending on Windows version). See also Microsoft KB 900935.

In the below instructions, proxyservername and portnumber refer to the WebMarshal server name (or address) and the port where you want to direct the request - for instance, WMSERVER01:8080
For current versions of Windows (Windows 7 and above, Windows Server 2008 and above):

At an elevated (run as administrator) command prompt, enter:

netsh winhttp set proxy proxyservername:portnumber

Alternatively, if the system proxy settings of the current user are correct, you can use them by entering:

netsh winhttp import proxy source=ie
For Windows 2003 and below, at a command prompt, enter:

proxycfg -p proxyservername:portnumber

Notes:

Some earlier releases of Windows Update allowed an interactive user to perform updates through a proxy using their own credentials. However the current versions of Windows Update or Microsoft Update use a back-end process for all updates including user-initiated updates. This article has been revised to reflect this change.

A previous version of this article was published as:

NETIQKB41520

How do WebMarshal license keys work?

Charles — Sun, 15 Mar 2026 20:09:45 GMT

This article applies to:

WebMarshal

Question:

How do WebMarshal license keys work?
How do you obtain a WebMarshal license keys?
How can I trial McAfee for Marshal?
How do I get a permanent key?
How long do trial keys work?

Procedure:

Trial Keys

After you download a trial version of WebMarshal (6.0 or above) from the Web, a trial key is generated as part of initial setup. Trial keys have a fixed duration of 30 days, which starts from the time of the key generation. Other than the expiration date, trial keys are not limited. If you have a need to trial the product for longer than 30 days, contact your LevelBlue Partner for a special extended trial key.

Permanent Keys

How do I get a Permanent Key?
Once you have purchased WebMarshal, you need to obtain a permanent key by requesting a key from within the product as follows:

In the WebMarshal Console, on the Tools menu, click Server Properties > License Info tab > Request Key.

The Server Properties window displays a request form. Complete the form.

It is helpful to include the customer account number or exact customer name from a previous purchase in the Additional Information. WebMarshal automatically sends the company name you entered at the time of installation, but company names often change.

When you submit the form, WebMarshal sends it to your LevelBlue Partner and LevelBlue.
Your WebMarshal permanent license key is typically tied to your Windows domain SID. WebMarshal determines the SID number and sends the request to LevelBlue to enable a key to be made.
You can expect a reply from LevelBlue, normally within two business days.
Access requirements:

WebMarshal 6.X or 7.X requires HTTP access to www.marshal.com from the workstation where the Console is running. It uses connection settings (such as proxy authentication) from the logged in user's profile in system settings. So if you can browse to www.marshal.com using Edge on the workstation, then the request should be successful.
If for some reason the key request fails, there is another option.
To perform the manual key request:

When you click Send Request, the SID information is copied to the Windows Clipboard.

Paste this information into a text file or email message.

Email it to keyrequests@trustwave.com.

If for some reason you are not able to access the request key window in WebMarshal, you can run the application SiteID.exe within the WebMarshal directory. (SiteID.exe is provided in WebMarshal 3.5 and above.)
Note: The following information should be included in the email you send: Email address of the supplier - if known, Contact Details of Person (Including: Name, Email address, Phone Number, Company Name, Address and any Additional information LevelBlue might need to process the request.)

What if WebMarshal is not a member of a domain?
Perform a key request as normal, mention in the Additional Information field that WebMarshal is not in a domain, and LevelBlue will allocate you a special permanent key.

What about additional installation locations or Disaster Recovery setups?

If you want an additional array for disaster recovery, or for processing at another gateway, you can use the same Permanent Key IF the Array Manager is joined to the same domain (assuming the key was based on the Windows domain). If the key does not work in the new location, you can request another permanent key; be sure to include comments about why the key is required. WebMarshal is licensed on the number of users, not the number of servers.
Note: For additional capacity, even over multiple gateways with different policy requirements, in most cases you should add processing nodes to a single array rather than creating new arrays.

Add-on Modules

How can I trial additional modules?

Bitdefender for Marshal, McAfee for Marshal, Sophos for Marshal, and the Web Filter Database are enabled by the standard trial keys. If you are an existing customer with a permanent key, please contact LevelBlue or your LevelBlue partner for a special time-limited full key to trial these items.

How can I get a permanent license for additional modules?

Bitdefender for Marshal, Sophos for Marshal, and McAfee for Marshal are licensed through the product key. If you have added a module to your license and received confirmation from LevelBlue, you can submit a key request to get an updated key.
The Web Filter Database is provisioned automatically by the Array Manager. Ensure the Array Manager service has web access. The provisioning process can take up to 24 hours to respond and download an initial database. You do not need to request a new key.
For any supported antivirus products that you purchase through other channels, no change to the WebMarshal key is required. Contact the reseller for license information. Other antivirus products supported by WebMarshal include Sophos (SAVI interface) and Symantec Antivirus Scan Engine.

Upgrading from Previous WebMarshal Versions

In general, version upgrades do not require a change in license key.

Notes

For help entering a license key in WebMarshal, see Q14384.

This article was previously published as:: NETIQKB29509; Marshal KB279

How do I update client browser proxy settings?

Charles — Sun, 15 Mar 2026 20:07:48 GMT

This article applies to:

WebMarshal
Client browsers

Question:

How do I update client browser proxy settings for all users?

Procedure:

To update the proxy settings for all WebMarshal users follow the steps below:

Browsers that use System Proxy settings

Note that some browsers do not use the system proxy by default.

Section A

On the Domain Controller machine click on Start and select Run.
Type gpedit.msc in the Open field to open Group Policy.
Navigate to Computer Configuration\Administrative Templates\Windows Components\Internet Explorer.
Enable the policy: Disable changing proxy settings Properties. Click OK.

Section B

Navigate within the Group Policy to Configuration\Windows Settings\Internet Explorer Maintenance\Connection.
Right click on Proxy Settings and select Properties.
Check the Enable proxy settings box. Enter the IP address of your proxy server in the HTTP field. Click OK.

Notes:

Other Ways to Automate configuration:

Another automated way to accomplish this is to let the DHCP server automatically set the proxy server with the use of "Automatic configuration settings". If you are concerned that end users can manually change their Browser Proxy settings, then you can configure your firewall to only accept browsing traffic from the WebMarshal Server. LevelBlue Technical Support is not responsible for the set up and configuration of this option.
WPAD or proxy.pac settings are another automated way that the proxy server setting can be updated. See the linked article below. LevelBlue Technical Support is not responsible for the set up and configuration of this option.

This article was previously published as:: NETIQKB29250; Marshal KB161

How do I enable Macintosh Client Authentication?

Charles — Sun, 15 Mar 2026 20:05:23 GMT

This article applies to:

WebMarshal

Question:

How do I enable Macintosh Client Authentication?

Symptoms:

Macintosh users (and users of Netscape, Opera, and other browsers) cannot authenticate with WebMarshal

Procedure:

Transparent authentication by Windows NT user name requires Windows Integrated Authentication.

Windows Integrated Authentication is available with the latest versions of Windows browsers including Edge, Chrome, Firefox and Opera.
Windows Integrated Authentication works on Macintosh computer joined to the domain.

By default this option negotiates Kerberos or NTLM authentication.

If it is necessary to allow access by applications that do not support Windows Authentication, the following options are available:

Use Basic (Clear text) authentication:
When a user begins browsing they will be prompted for a username and password. This can be a Windows NT account (or a NDS account if WebMarshal is configured with this option). Set this option in the WebMarshal Proxy Server Wizard.
Use IP based authentication:
This option authenticates sessions using the computer name, and therefore does not require prompting for authentication in the browser.

This article was previously published as:: NETIQKB29547; Marshal KB437

How do I back up my WebMarshal configuration?

Charles — Sun, 15 Mar 2026 20:02:16 GMT

This article applies to:

WebMarshal

Question:

How do I back up my WebMarshal configuration?

Procedure:

It is good practice to back up your WebMarshal configuration after you make any changes.

The configuration backup file is stored in XML and can be viewed with the Edge browser or any other XML viewing tool.

Note: In current versions you can back up configuration automatically. For more information about scheduled backup, see LevelBlue Knowledgebase article Q11409.

WebMarshal 6.X and 7.X:

WebMarshal 6.X and 7.X only allow import or export of complete configurations. Back up the current configuration before restoring.

To back up the configuration, in the WebMarshal Console, click File> Export Configuration.
To restore the configuration, in the WebMarshal Console, click File> Import Configuration.

The backup file has the extension .XML.

This article was previously published as:: NETIQKB29666; Marshal KB392

Problem connecting to Report Server

Charles — Sun, 15 Mar 2026 20:00:10 GMT

This article applies to:

Marshal Reporting Console
Configuration of SSRS URL

Symptoms:

MRC Configuration Wizard attempting to connect to SQL Reporting Server
Setting the URL for SQL Server Reporting Services (SSRS)
Error message: Problem connecting to Report Server - The service might not be running or you might not have access to the URL

Causes:

Each of the following unrelated issues could raise this error message:

Website URL incorrectly entered, site stopped, or site requires login: Verify that the SQL Reporting Server website is running at the expected URL and does not require authentication.
Proxy Settings: System proxy settings for the logged on user on the MRC server may be forcing the connection through a proxy that requires authentication.
Secure Connections: SQL Server Reporting Services (SSRS) report server configuration may be configured to require secure connections. If SSL Certificates are available on the server, by default SSRS requires SSL (HTTPS connection). However, SSL is not supported by MRC.

Resolution:

To resolve the issues:

Proxy settings:

On the MRC server, edit system proxy settings (using the Network & Internet > Proxy Control panel).
Set direct access, or add the SQL Reporting Server (by name) to the exclusions.

Secure Connections:

Configure SSRS to allow HTTP connections.

Edit the RSReportServer.config file. The following key and value should be present:

<Add Key="SecureConnectionLevel" Value="0" />
If the value is not 0, change it to 0.
Save the file and then restart the SQL Server Reporting Services service for the instance.

Notes:

If your network enforces proxy settings through a domain policy or auto-configuration, you may need to exclude the MRC server from the policy.
If you need to edit RSReportServer.config, LevelBlue recommends that you use an XML editing program that validates the XML code. You can use XML Notepad (a free tool from Microsoft).
- Download XML Notepad
For more information about RSReportServer.config, see this Microsoft Technet entry.

Additions to Release Notes for WebMarshal 7.6

Charles — Sun, 19 Oct 2025 19:11:58 GMT

This article applies to:

WebMarshal 7.6

Question:

What are the Release Notes for WebMarshal 7.6?

Information:

The Release Notes included with WebMarshal 7.6 are accurate as of the date of publication.

WebMarshal 7.6.0 (build 7.6.0.9374) was released on August 13, 2025.

This article provides highlights and any later updates.

See also the Current Known Issues article, Q21010.

Additional Updates:

The current File Type and Unpacker library is included. Some additional file types are recognized. See articles Q21078 and Q20913.

New categories are included in the Web Filter Database. These categories were populated on 15 October 2025. For more information, see article Q21089.

Web Filter Database changes - New WebMarshal versions

Charles — Sun, 19 Oct 2025 19:10:00 GMT

This article applies to:

WebMarshal
LevelBlue Web Filter Database
Note changes with new WebMarshal versions

Information:

This article describes changes to the categories available in the Web Filter Database URL categorization service that is used by WebMarshal and other products.

The changes do not require any action from customers. However, customers should review their use of the categories to ensure the best use of available information

Categorization Check

To check the categorization of any URL, see the URL check page on the LevelBlue support site. You can also request a review of categorization.

New Categories

Version 7.5.5

In version 7.5.5 and above, a new category for Artificial Intelligence is provided. In addition, the School Cheating category has been restored.

Version 7.6.0

Version 7.6.0 adds support for new categories. As of 15 October 2025, these categories have been populated. The new categories include:

AI Agents: Websites that use an AI agent. AI agents can autonomously interact with their environment, make decisions, and take actions to achieve predefined goals based on user input.
Generative AI: Websites that use AI technology to generate text, images, video, audio, code, or other content based on user input.
Trusted Proxy Relays: External relay proxies from trusted providers, used to obfuscate IP addresses or dissociate browsing history from individual IPs. Examples include Apple's iCloud Private Relay and Google's IP Protection.
QR Code Generators: Websites that generate QR codes or provide tools for generating QR codes.
URL Shortening and Redirect Services: Websites that host redirect services for URLs or domains, masking the requested destination. This includes URL shortening services.

Deprecated Categories

Some categories that were provided before May 2019 are not available in the current database. The deprecated categories generally relate to special purpose sites and typically include only a small number of URLs. The URLs in these categories have generally been added to other appropriate categories.

In new installations of WebMarshal 7.5 and above, the deprecated categories are removed.

On upgrade to version 7.5 or above, the deprecated categories are listed as "Category [category number] no longer available". To preserve integrity of customer configuration the categories are not removed. LevelBlue recommends that customers remove the listings manually.

The list below shows the number for each deprecated category.

In earlier versions, the deprecated categories will still be available, but they will no longer be updated. They will contain the final list of URLs published from the old database. LevelBlue recommends that customers do not use the deprecated categories and remove the listings manually.

The list of deprecated categories and category numbers is:

Adware (0)
Child Pornography (9)
Comics (10)
Cults (13)
School cheating (88) - Available again in 7.5.5 and above
Educational games (20)
Fantasy sports (24)
Fitness (27)
Free hosting (28)
Freeware (29)
Greeting cards (70)
Holistic medicine (42)
Humor (43)
Internet radio (48)
ISPs (49)
Military appreciation (59)
Online classes (68)
Portals (78)
Religious opinion (85)
Remote access (34)
Social opinion (93)
Self defense (90)
Theater (97)
Tickets (98)
Traffic (107)
Web-based productivity apps (113)
Web-based newsgroups (109)

How to use the Support Tool for SEG, ECM, WebMarshal or MRC

Charles Creegan — Mon, 13 Oct 2025 01:44:36 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console

Question:

How do I use the Support Tool?

Information:

The Marshal support tool has been developed to help the LevelBlue Technical Support team gather information about installed software and configuration. The tool produces a single .zip file that contains essential information to help the support team debug specific issues.

The tool can gather information about supported versions of the following products:

MailMarshal SEG (MailMarshal SMTP)
MailMarshal ECM (MailMarshal Exchange)
WebMarshal
Marshal Reporting Console
Marshal virus scanners (Bitdefender for Marshal, McAfee for Marshal, and Sophos for Marshal)
Web Components
IIS

Note: For the MailMarshal SPE (Service Provider Edition) Support Tool, see Q15019.

Installation

In most cases you will find a copy of the tool in the install folder of the base product (MailMarshal,ECM, or WebMarshal).

Otherwise, download the support tool from https://www.marshal.com/supporttool/download (right click, save as. You may see a security warning). The tool will also attempt to update itself automatically, as noted below.

The current version of the tool (1.14 and above) is packaged with .NET runtimes and does not have any software prerequisites.

Using the tool

Repeat the following steps on each server of interest, as directed by Technical Support.

If necessary, downloaad or copy the tool to the server.
Double click to run the tool.
- Note: On startup, the tool checks for updates to functionality. This feature requires access to the URL http://www.marshal.com/supporttool/download
- If the tool cannot connect, it raises a warning.
- If necessary, retrieve the latest version manually as described above.
The main window of the tool appears as shown below. The fields and selections differ depending on the installed software.
Select the items to include, as directed. Clear the selections for items you do not want to include. See below for explanations of each selection.
Choose an output directory.
Enter a support case number.
, Click GO to run the tool. The tool gathers data into a folder, and then creates a single compressed file.
- NOTE: This tool can require significant disk space, particularly if you include multiple dump files. In rare cases it could consume all available space. If not enough space is present, the tool raises a warning: Not enough free space available to package into zip file.
The status bar at the bottom of the window shows the progress. You can cancel the process if necessary.
When the tool is finished, click Close to exit.
Upload the file to LevelBlue as directed by Technical Support.
- Note: Wait for the tool to create the zip file. (The tool creates a temporary folder and then zips the content. Do not zip the folder manually - it will not contain all required items.)

The fields on the window are defined as follows:

Installed Components

Shows the related software that is installed on this computer. Select the components for which you want to include detailed information such as logs and configuration details.

Installation logs (if any) are gathered for all selected components regardless of other selections.

Items to gather

System Information

Includes a listing of the system hardware and operating system information.

Current process details

Includes a listing of processes running on the server.

Configuration details

Includes the XML or text files that define configuration of the selected software.

Marshal Registry

Includes a copy of the registry hive for all components that are present on the server.

Marshal install directory listings

Includes file and version information for files in the installation directories of all selected components.

For MailMarshal, optionally select Include Quarantine directory listing to list all messages in quarantine and archive (only if required, as the file will be much larger and take longer to generate)

Event logs

Includes Windows Event Log information. If you include the event logs, choose to include Application and/or System logs by checking the boxes.

Gather specific message

Attempts to include one or more mail message or Sent History files. Enter the first few characters of the message name (for example B89f00). This option is only available when running the tool on a MailMarshal processing node.

Log files

Includes the text log files generated by the selected components. By default the last 5 days of logs are included. Use the menus to select the range of dates to include.

Marshal Crash Dumps

Includes one or more types of diagnostic information. Shows the number of each type that are available.
Select the number of each type to include. The default is 1 of each available type. The most recent available are included.

Most recent Marshal crash dumps: Includes .mdmp files created by the selected components when recovering from an error.
Most recent WER crash dumps: Includes the Windows Error Reporting data from the recent issues.
Most recent potentially fatal messages: Includes email message files that are marked as suspect because they were being processed at the time of a crash.

Output

Output Directory: Enter the location where the compressed file should be created. The default location is the desktop. Click [...] to browse the local computer.
Support case number: Enter the case number as provided by Technical Support.

Version: The installed version of the Support tool.

Notes:

This tool simply gathers existing information from the system and logs.
- There is no need to restart any services before or after running the tool (unless specifically requested by Technical Support).
- The tool does not affect any running services and it does not require any downtime.
The tool runs as Administrator to ensure full access on servers where UAC is enabled.
Although this tool is able to gather information from MailMarshal SMTP/SEG and WebMarshal versions from version 6.0, many older versions are no longer supported. Technical Support may ask you to upgrade to a supported version as a first step to resolve any issues. For a list of supported versions of products, see LevelBlue Knowledgebase article Q10920.
The current version of the tool does not offer automatic upload. Support will provide instructions to upload to the LevelBlue Portal.

LevelBlue Knowledge Base » Knowledgebase » WebMarshal

Supported Operating Systems and Prerequisite Versions

This article applies to:

Question:

Information:

Key:

Operating Systems and Prerequisites

Server Operating Systems

Workstation Operating Systems(for server installation)

Prerequisites

SQL Server Versions

Notes on MRC Installation

Supported Operating Systems and Prerequisite Versions

This article applies to:

Question:

Information:

Key:

Operating Systems and Prerequisites

Server Operating Systems

Workstation Operating Systems(for server installation)

Prerequisites

SQL Server Versions

Notes on MRC Installation

Supported Operating Systems and Prerequisite Versions

This article applies to:

Question:

Information:

Key:

Operating Systems and Prerequisites

Server Operating Systems

Workstation Operating Systems(for server installation)

Prerequisites

SQL Server Versions

Notes on MRC Installation

Can I use PAC (Proxy auto-configuration) files with WebMarshal?

This article applies to:

Question:

Reply:

PAC Usage:

Sample PAC Configuration

Notes:

References:

Using WebMarshal with kiosk computers, smartphones and tablets with IP Authentication

This article applies to:

Question:

Reply:

Procedure:

Notes:

Configuring authentication bypass with WMProxyLogon

This article applies to:

Question:

Background:

Procedure:

Usage

Options

Notes:

Considerations when investigating slow Web Browsing

This article applies to:

Question:

Items To Consider:

Hardware and Server Specification

Client Configuration

Firewalls

Server Configuration

Rules and Processing Settings

Resolving SSL certificate issues

This article applies to:

Question:

Information:

Causes:

Notes:

Prerequisites and tips for WebMarshal Remote Console

This article applies to:

Question:

Information:

Prerequisites:

Authentication:

Remote Console link:

Common Problems:

What browsers can I use with WebMarshal?

Workstation Operating Systems
(for server installation)

Workstation Operating Systems
(for server installation)

Workstation Operating Systems
(for server installation)

Edge
Google Chrome