LevelBlue Knowledge Base » Knowledgebase » Latest Articles

Upgrading SQL Reporting Services to SQL 2022

Charles Creegan — Fri, 22 May 2026 01:08:06 GMT

This article applies to:

Marshal Reporting Console
SQL Server and SSRS 2022

Question:

Can I install MRC with SQL 2022?
Can I upgrade the MRC SQL and SQL Reporting Services instances to SQL 2022?

Procedure:

MRC 2.6 cannot be directly installed with SSRS 2022. However it is possible to upgrade the standalone MRC instances to SQL 2022 and SSRS 2022.

This procedure assumes you have installed MRC using the bundled SQL Express 2016 Advanced installer, and tested operation. For installations using licensed SQL, adjust the selections as required.

This procedure can also be used for a new installation on Windows 2025 (SQL Express 2016 must be manually installed first - see the notes section below).

Install SQL 2016 Service Pack 3 for the MRC_SQLEXPRESS instance. A computer restart will be required after installation.
From the Start menu, open Reporting Services Configuration Manager.
- Note the Report Server Database Name (by default, ReportServer$MRC_SQLEXPRESS). If you have used custom credentials, note the settings.
- From the Encryption Keys page, back up the key to a file.
- Exit the Reporting Services Configuration Manager.
Install Microsoft SQL Server 2022 Reporting Services.
- Choose the free edition Express.
- On the Setup Complete screen, click Configure report server.
In the Report Server Configuration Manager:
- On the WebService URL page, click Apply to accept the default values.
- On the Database page, click Change Database. In the wizard,
  - Select Choose an existing report server database.
  - On the Database Server page, the Server Name is the local computer name with MRC_SQLEXPRESS. Do not choose "Encrypt".
  - On the Database page, select the database you noted in step 2.
  - On the Credentials page, if you have not used the default service credentials, enter the credentials you noted in step 2.
  - Complete the wizard, click Finish, and exit the wizard.
  - On the Encryption Keys page, restore the key from your backup. You will be asked for confirmation to remove other registered servers. Click OK to this question.
  - Exit the Reporting Services Configuration Manager.
Upgrade to SQL Server 2022 Express.
- On the Welcome screen, choose the Custom option.
- On the Installation Center screen, choose Upgrade.
- On the Select Instance screen, select MRC_SQLEXPRESS.
- On the Reporting Services Migration screen, check the box Uninstall Reporting Services.
- Complete the upgrade process.

Notes:

On Windows Server 2025 the MRC installer cannot be used to install SQL Express. However you can manually install SQL Express 2016 SP3 Advanced before installing MRC, and choose to use the existing installation.
- Download SQL Service Pack 3 2016 Express.
- Choose Custom install and ensure that the feature "Reporting Services - Native" is selected.
- Do not select installation of "R Services".
- Remember to select "Mixed Mode" authentication.
- You must also enable TCP connections to the SQL instance, using SQL Configuration Manager.
In some cases (where a current release of MailMarshal or WebMarshal Array Manager is installed on the same server), the installation of SQL 2022 may report an error on installation of MSOLEDBSQL.

This issue is due to SQL wanting to install a specific earlier version of MSOLEDBSQL.
You might be able to "ignore" the error, but installation will then fail at a later point.
To resolve the issue:
- Stop the MailMarshal and/or WebMarshal Array Manager.
- Uninstall the offending version of MSOLEDBSQL (usually 18.6.7).
- Upgrade SQL
- Re-install the version of MSOLEDBSQL. All versions are available for download from Microsoft.
- Start the Array Manager(s).

Upgrading SQL Reporting Services to SQL 2022

Charles Creegan — Fri, 22 May 2026 01:08:06 GMT

This article applies to:

Marshal Reporting Console
SQL Server and SSRS 2022

Question:

Can I install MRC with SQL 2022?
Can I upgrade the MRC SQL and SQL Reporting Services instances to SQL 2022?

Procedure:

MRC 2.6 cannot be directly installed with SSRS 2022. However it is possible to upgrade the standalone MRC instances to SQL 2022 and SSRS 2022.

This procedure assumes you have installed MRC using the bundled SQL Express 2016 Advanced installer, and tested operation. For installations using licensed SQL, adjust the selections as required.

This procedure can also be used for a new installation on Windows 2025 (SQL Express 2016 must be manually installed first - see the notes section below).

Install SQL 2016 Service Pack 3 for the MRC_SQLEXPRESS instance. A computer restart will be required after installation.
From the Start menu, open Reporting Services Configuration Manager.
- Note the Report Server Database Name (by default, ReportServer$MRC_SQLEXPRESS). If you have used custom credentials, note the settings.
- From the Encryption Keys page, back up the key to a file.
- Exit the Reporting Services Configuration Manager.
Install Microsoft SQL Server 2022 Reporting Services.
- Choose the free edition Express.
- On the Setup Complete screen, click Configure report server.
In the Report Server Configuration Manager:
- On the WebService URL page, click Apply to accept the default values.
- On the Database page, click Change Database. In the wizard,
  - Select Choose an existing report server database.
  - On the Database Server page, the Server Name is the local computer name with MRC_SQLEXPRESS. Do not choose "Encrypt".
  - On the Database page, select the database you noted in step 2.
  - On the Credentials page, if you have not used the default service credentials, enter the credentials you noted in step 2.
  - Complete the wizard, click Finish, and exit the wizard.
  - On the Encryption Keys page, restore the key from your backup. You will be asked for confirmation to remove other registered servers. Click OK to this question.
  - Exit the Reporting Services Configuration Manager.
Upgrade to SQL Server 2022 Express.
- On the Welcome screen, choose the Custom option.
- On the Installation Center screen, choose Upgrade.
- On the Select Instance screen, select MRC_SQLEXPRESS.
- On the Reporting Services Migration screen, check the box Uninstall Reporting Services.
- Complete the upgrade process.

Notes:

On Windows Server 2025 the MRC installer cannot be used to install SQL Express. However you can manually install SQL Express 2016 SP3 Advanced before installing MRC, and choose to use the existing installation.
- Download SQL Service Pack 3 2016 Express.
- Choose Custom install and ensure that the feature "Reporting Services - Native" is selected.
- Do not select installation of "R Services".
- Remember to select "Mixed Mode" authentication.
- You must also enable TCP connections to the SQL instance, using SQL Configuration Manager.
In some cases (where a current release of MailMarshal or WebMarshal Array Manager is installed on the same server), the installation of SQL 2022 may report an error on installation of MSOLEDBSQL.

This issue is due to SQL wanting to install a specific earlier version of MSOLEDBSQL.
You might be able to "ignore" the error, but installation will then fail at a later point.
To resolve the issue:
- Stop the MailMarshal and/or WebMarshal Array Manager.
- Uninstall the offending version of MSOLEDBSQL (usually 18.6.7).
- Upgrade SQL
- Re-install the version of MSOLEDBSQL. All versions are available for download from Microsoft.
- Start the Array Manager(s).

How do I notify LevelBlue of new Spam so MailMarshal files can be updated?

Charles — Tue, 19 May 2026 02:12:27 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal Exchange 5.1 through 5.3

Question:

How do I notify LevelBlue of new spam so MailMarshal files can be updated?
How do I upload spam messages for identification?
How do I report spam?
How do I report false positive spam identifications?
Is there an email address where people can send samples of spam emails that are getting past SpamCensor scripts?
How do I know my submission has been processed?

Before you start:

Please verify that your spam blocking configuration meets best practices.

In particular see the notes on excessive use of exceptions (Allow Lists) and other recommendations in article Q10810.
Check that SpamCensor and SpamProfiler are enabled and updating correctly. See article Q12992.

Procedures

Spam that was not identified:

Microsoft Report Button

You can deliver reports to LevelBlue using custom settings for the Microsoft Report button that is available in supported versions of Outlook.
For more information about this solution, see LevelBlue Knowledgebase article Q21235, Reporting Spam and Phishing to LevelBlue with the Microsoft Report Button.

Console Buttons/Forward

You can send samples of spam for analysis by providing the email message in its entirety to Spam@Marshal.com
- The preferred method is to forward the message file from the MailMarshal Console using the Spam button on the message history list. This option is only available for messages that have been archived or quarantined in MailMarshal.
- If you do not have access to the MailMarshal Console (or the message was not archived), you can forward messages from an email client. However, when forwarding from a client some additional steps are required to provide useful information.

Note: Advanced information can be found in the header of the original email. However, this header information is overwritten with your header information once you click "forward". If you are able, copy the original header information into your forwarded email Spam when sending to LevelBlue.

Manual Forward

Follow these steps for Microsoft Outlook to collect (then copy / paste) the original header information to forward with the emailed Spam to the email address above:

Open the spam email.

Within the email message, go to View | Options.

Look for the box labeled "Internet Headers".

Select all of the text within this box.

Go to Edit | Copy (or use Ctrl+C).

Click Forward to send the email to Spam@Marshal.com.

Paste the header information within the email body (Ctrl+P or Edit | Paste).

NOTE: The Spam@Marshal.com email address is ONLY a collection point for Spam. It is monitored by the labs team; however, this team does not respond to queries at that address. If you need help with a spam related issue please contact your Technical Support representative.

False positives:

Before submitting a false positive ("not spam" that was classified as spam), check which rule or function blocked the message.

Be sure you are submitting the report to the correct location.

For SpamCensor, Marshal IP Reputation Service, and SpamProfiler:
You can submit false positives by providing the email message in its entirety to NotSpam@Marshal.com
- The preferred method is to forward the message file from the MailMarshal Console using the Not Spam button on the message history list. This is possible only for messages that are currently in quarantine or archive folders.
For third party reputation services such as Spamhaus and SURBL (used in URL Censor), contact the reputation service provider directly.
- LevelBlue does not maintain the listings of these services, and LevelBlue does not have access to change the listings.

Processing of submissions

Due to the volume of reports received and the nature of processing, LevelBlue does not provide individual confirmation of submissions or changes.

For clear false positives or missed detections submitted to LevelBlue, an update to the detection is typically provided through the product automatic updater within two business days. If the issue is not resolved after that time, consider raising a case with your support provider. When raising a case, be ready with details of the issue and the submissions you have already made. You will need to provide specific messages and logs.

This article was previously published as:: NETIQKB39848

Engine stops with faulting module openvino.dll

Charles — Thu, 14 May 2026 23:01:30 GMT

This article applies to:

MailMarshal SMTP 10.2.X and above
Upgrade from 8.X to versions that support the direct upgrade
Import of configuration converted from an earlier version

Symptoms:

MailMarshal Engine stops when processing images
Application Event Log shows Faulting Module Name: openvino.dll

Causes:

The upgraded or restored configuration includes an obsolete file related to Image Analyzer functionality.

Resolution:

To correct this issue, locate and remove all copies of a file named plugins.xml as follows:

On the Array Manager, remove the file plugins.xml from the Config folder of the installation. You must do this first.
On each processing node (including the Array Manager server if it is also a processing node), remove the file plugins.xml from the NodeConfig folder of the installation.

Uninstalling MSOLEDBSQL for MailMarshal SQLExpress installation

Charles — Tue, 12 May 2026 19:20:29 GMT

This article applies to:

MailMarshal 10.1 or above installation "with SQL Express"
Microsoft OLE DB SQL installed
Error message: The Microsoft OLE DB SQL Drivers are already installed. Please manually remove them before installing MailMarshal with SQL Express.

Question:

Why is it necessary to remove OLE DB drivers?
What steps are required when installing the latest SQL Express versions?

Response:

Some versions of the Microsoft SQL Express installer (included in the MailMarshal "with SQL Express" package) check for an exact version of the OLE DB drivers and return an error if the same or a later version is already installed.

For installation of SQL Express to succeed, the later versions must be uninstalled.

Procedure:

To resolve this issue, uninstall Microsoft OLE DB Driver 19 from the Windows Control Panel or Installed Apps page. Then rerun the MailMarshal installer.

The SQL Express installer and MailMarshal installer will install the required versions of the OLE DB drivers.

Notes:

After installation is complete, you can verify the presence of the Microsoft OLE DB Driver from the Windows Control Panel or Installed Apps page.

Upgrading MailMarshal Service Provider Edition to a newer version

Charles — Thu, 07 May 2026 20:50:11 GMT

This article applies to:

MailMarshal SPE supported versions

Question:

What is the safe method to upgrade MailMarshal SPE from an earlier version to the currently released version?

Procedure:

To upgrade SPE, the general procedure is to upgrade the MailMarshal (SEG) servers first, then upgrade the SPE Marshal Interface Agent or console server and the SPE agents.

Product names in the installers and interfaces depend on the product versions. MailMarshal SPE (Service Provider Edition) is also known as MailMarshal SPE. MailMarshal is also known as MailMarshal SEG or MailMarshal SMTP.
This article assumes you are familiar with SEG and SPE concepts.
Before starting, review the Release Notes for the new version of SPE and SEG. Release Notes include version specific upgrade notes, such as previous version supported for direct upgrade.

The following steps are suggested to upgrade SPE safely and with minimal disruption to email flow.

Upgrading to version 5.3 from 5.2:

Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the MailMarshal Array Manager.
Take a snapshot of the MailMarshal database.
Start the MailMarshal Array Manager.
Upgrade the Array Manager server with the supported version of MailMarshal software. This will upgrade your configuration from the earlier version.
Upgrade the nodes with the MailMarshal software.
- At this point you will have a fully working MailMarshal solution running on the new software. You may wish to take an additional snapshot of the MailMarshal database.
Repeat steps 3-7 for each MailMarshal array.
Start your IIS server.
Upgrade the Management Interface and/or MIA server: run the SPE installer and upgrade the Management Interface and Marshal Interface Agent. The database wizard will also run and upgrade your SPE database.
Upgrade any other standalone Management Interface servers.
Verify that email processing and Management Interface functions are working correctly.

Upgrading to version 5.2 from 4.3:

From the MailMarshal Configurator, take a note of Inbound Security (TLS) settings for each processing node in each array.
Stop Marshal Agent services on all servers. This will always include Array Managers and processing nodes. Also check other servers with SPE components such as web consoles.
Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the MailMarshal Array Manager.
Take a snapshot of the MailMarshal database.
Start the MailMarshal Array Manager.
Upgrade the Array Manager server with the supported version of MailMarshal software (11.2). If necessary, first install version 8.3.3. This will upgrade your configuration from the earlier version.
Repeat steps 4-7 for each MailMarshal array.
Start your IIS server.
Identify the server where Marshal Interface Agent (MIA) is .
installed. This server might also include the Web Console/Management Interface. Run the SPE installer and upgrade MIA and any other components. The database wizard will also run and upgrade your SPE database.
If the Management Interface is not hosted on any of the servers already upgraded, then upgrade at least one Web Console/Management Interface server.
Open the Management Interface and log in. You may need to use CTRL-F5 to update client side scripts. Make sure the configuration appears correct.
Navigate to the Server Configuration/Arrays page. For each Array:
- For each Mail Server, navigate to the Inbound Security (TLS) page. Ensure settings match what you noted from the Configurator.
  - You may have to set Elliptic Curves. If none was selected in the Configurator, X25519 is a safe choice.
- Replication will be paused. Resume replication.
- Force a configuration reload.
- Wait for the status to indicate "Up to date".
Upgrade the processing nodes with the MailMarshal software.
For each processing node, if you have not restarted the node after the upgrade, restart the Controller service. This step ensures a full configuration update for all the processing services. Notably the "loopback" delivery of messages between customers may not work until you do this.
Upgrade any additional Web Console/Management Interface servers.
On all servers that have only the MailMarshal components (Array Manager and/or Nodes), uninstall SPE 4.X. The only SPE component affected is the Marshal Agent, which is no longer used in version 5.X.

Upgrading to version 4.X:

Stop all SPE services on all array managers and nodes (Depending on version this may include Marshal Agent, Replication Agent, Status Agent, Maintenance Agent, Reporting Agent).
Stop the Web Console services on the IIS server (either by stopping the website in the IIS Manager, or by typing net stop w3svc).
Take a snapshot of the SPE database.
Stop the SEG Array Manager.
Take a snapshot of the SEG database.
Start the SEG Array Manager.
To ensure ability to roll back, create a backup of the SEG configuration by running the MMExportCfg in the SEG directory (typically in SEG version 8.X: C:\Program Files\Trustwave\Secure Email Gateway)
- For instance: MMExportCfg MMBackupOct2008.xml
- For details of locations for earlier SEG versions, see article Q10832.
- For SEG 8.0 if DKIM is in use, also ensure you have exported DKIM keys. They are not included in SEG 8.0 backups.
Upgrade the array manager with the supported version of SEG software. This will upgrade your configuration from the earlier version.
Upgrade the nodes with the SEG software.
- At this point you will have a fully working SEG solution running on the new software. Take a configuration backup (as in step 7) and a snapshot of the SEG database.
Repeat steps 4-9 for each SEG array.
Start your IIS server.
Upgrade the Web Console and/or MIA server: run the SPE installer and upgrade the web console and Marshal Interface Agent (Maintenance Agent in earlier versions). The database wizard will also run and upgrade your SPE database.
When the installer and database wizard completes successfully, log into the SPE console and make sure the configuration appears correct. Arrays will not be connected at this stage.
Run the SPE installer on all Array Managers to upgrade the Replication Agent or Marshal Agent (depending on version).
Force a configuration reload on the SPE web console (Arrays->Force Reload).
Monitor the Array Manager logs for any errors. If you encounter any problems, stop and disable the SPE agent on the Array Manager (Marshal Agent for 3.8 and above, Replication Agent for earlier versions). Restore the SEG configuration (from the backup you took in step 7 above), and restart the Array Manager. You will not need to restore the SQL database. Do not proceed further but contact LevelBlue Technical Support for assistance.
Upgrade the Marshal Agents on the nodes.
If upgrading to a version below 3.6, upgrade the reporting agent. (3.6 and above does not use a separate reporting agent.)
Restore any custom branding. The upgrade creates a dated backup of the website directory, including the branding subdirectory. Move required items to the production website\branding folder.
If you use custom themes for the Customer Console or SQM, you may need to update the themes to cover new features. See the linked article below for more information.
- Release 4.0 includes breaking changes to the SQM login page.
- Release 3.6.2 includes significant changes in the Customer Console themes from 3.6.1.

Notes:

For some versions, the Release Notes recommend stopping all Marshal services including all SEG services during upgrade. This recommendation was to ensure that some settings are updated when services start. Normally you can follow the steps above and SEG services can remain running during the SPE upgrade.

For upgrade from SEG 8.0 or below with DKIM keys, in the rare case that you must roll back the SEG upgrade, you might need to re-import DKIM keys on the nodes. Contact LevelBlue for assistance.

What are the Release Notes for MailMarshal SPE 5.2?

Charles — Wed, 06 May 2026 22:29:41 GMT

This article applies to:

MailMarshal SPE 5.2

Question:

What are the Release Notes for MailMarshal SPE 5.2?

Information:

The Release Notes included with MailMarshal SPE 5.2 are accurate as of the date of publication.

Build 5.2.0.22293 was published on September 4, 2025.
This article provides any additional information generated after that date.
Full release notes are provided with the installation package.

Upgrade to 5.2 from 4.3.5 only

To upgrade from earlier versions, you must first upgrade to 4.3.5.

Detailed Upgrade Steps

For details of the upgrade process, including manual configuration and order of upgrade, see Knowledge Base article Q12201.

Disaster Recovery for MailMarshal SPE

Charles — Fri, 24 Apr 2026 01:36:13 GMT

This article applies to:

MailMarshal SPE

Question:

What is required to allow disaster recovery of a SPE installation?
What are best practices to move a SPE installation?

Procedure:

Disaster recovery of a SPE installation involves two parts: preparedness (backups), and re-installation.

This article assumes you are familiar with MailMarshal SPE and SEG (MailMarshal SMTP) concepts.

Note: Similar steps can be used to move an existing installation to a new environment (new machine names and IP addresses).

Preparedness

To be prepared for recovery, ensure that you have backed up all applicable items. Items to back up include:

The SPE configuration database.
The SEG databases from each array.
The SEG configuration from each array (using MMExportCfg).
- For versions below SPE 4.2 (below SEG 8.2), you must separately back up DKIM keys if any from SEG
The Quarantine folder contents from each Node of each array.
(If custom filetypes are used) The Filetype.cfg file from the SEG Array Manager server (this is also covered in the SPE database).
(MailMarshal SPE 2.X only) The website\branding folder. (In version 3.X, branding items are stored in the database.)
Ensure you have a record of which components are installed on which servers.

You could also use VM snapshots, particularly to move an installation.

Re-installation

Note: These steps do not apply for SPE 5.X and above. For current versions, generally restore SPE first.

Detailed instructions for current versions are in preparation.

For SPE 4.X:

To restore email flow most quickly, restore SEG arrays first.

For each SEG array:

Note: Do not install the SPE Agents at this stage (the Marshal Agent, and the Replication Agent for earlier versions).
- If you are using VM snapshots, stop the Agents and set to manual start before restoring the SPE Web Console server or Marshal Interface Agent server.
- To ensure array configuration and replication work as expected, the SPE Array settings must be updated before the Agents connect.

Install SEG software on the Array Manager. Use a temporary database to avoid unwanted changes from configuration import.
Import the configuration from backup.
Add a Registry entry as follows (assumes SEG 8.x):
- In Regedit, navigate to the key HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\
- Add a new DWORD named: inSPE
- Set the value to 1
- Commit configuration and restart services.
Request a new license key. Provide your customer ID in the request for automatic response. Using a license key associated with your account ensures that licensed features such as BTM are correctly configured.
Restore the production SEG database.
Use the Server Tool to connect to the restored production database.
Install SEG software on the Nodes and re-connect to Array Manager.
On each Node, restore Quarantine folders.
Restore Filetype.cfg (if required). Note that SPE will also restore this file when configuration is reloaded.
For SEG 8.0 with DKIM keys, if nodes were re-created, you must import DKIM keys on the nodes. Contact LevelBlue for assistance.

At this stage email flow should be restored.

To restore SPE:

Restore the SPE Configuration database.
Install the core SPE server components using the restored database.
- For version 3.6 and above, this includes the Marshal Interface Agent and the Admin Console web server. If these are on separate servers, install MIA first.
- For version 3.5 and below, this is the Web Console server, which includes the Admin Console and core components on one server.
When the installer and database wizard completes successfully (including client configuration for version 3.6 and above), log into the SPE Admin Console and make sure the configuration appears correct. Arrays will not be connected at this stage.
- If IP addresses or server names have changed be sure to update all Array and Server settings in the SPE Web Console before proceeding to the next step.
Install SPE components on the SEG servers.
- For version 3.8, the Marshal Agent on Array Managers and nodes.
- For earlier versions, the Replication Agent on Array Managers and Marshal Agent or Status Agent on nodes.
- If the SEG servers were restored from VM snapshots, run the SPE Client Settings application on each SEG server, and then start the Agents and set to automatic start.
Force a configuration reload from the Admin Web Console (Arrays->Reload). Monitor the Array Manager logs for any errors.
Install any other SPE website servers (3.X only) and the Reporting Agent (Reporting Agent is for versions prior to 3.6).
(For version 2.X only) Restore any custom branding to the website\branding folder.

Notes:

Also consider backup/recovery of DNS and other infrastructure settings.
Advanced installations may need to preserve customizations to IIS. You could use Microsoft WebDeploy to back up IIS items.

Enabling Strong TLS for .NET

Charles — Thu, 16 Apr 2026 22:53:51 GMT

This article applies to:

MailMarshal SPE 4.X - Systems with TLS 1.0 disabled
Marshal Reporting Console - email TLS

Question:

How do I enable use of TLS 1.1 and 1.2 by .NET components in SPE 4.X?
How do I fix TLS related errors connecting from SPE to the SEG Array Manager?
How do I update the TLS version used for email connectivity in MRC?

Procedure:

To allow use of "Strong" TLS (1.1 and 1.2) by .NET, you must enable system settings and .NET specific settings on affected systems.

For SPE this is the Marshal Interface Agent server.
For MRC this is the server where the software is installed.

This article covers .NET specific settings.

Update the following Registry entries (see also the attached Powershell script):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
      "SystemDefaultTlsVersions" = dword:00000001
      "SchUseStrongCrypto" = dword:00000001

Notes:

SPE 5.X and above uses newer versions of .NET and does not require these settings.
The SchUseStrongCrypto setting allows .NET to use TLS 1.1 and TLS 1.2.
The SystemDefaultTlsVersions setting allows .NET to use the OS configuration.
For further information see Microsoft documentation.
These settings apply immediately. System or service restart is not required.

Supported Operating Systems and Prerequisite Versions

Charles — Thu, 16 Apr 2026 20:46:27 GMT

This article applies to:

MailMarshal (SEG) 10.0 and above
- MailMarshal Web Components (SQM)
WebMarshal 7.6
Marshal Reporting Console 2.6 (for SEG, ECM, and WebMarshal reports)

(For ECM/MailMarshal Exchange, see Q14131. For Service Provider Edition [SPE], see Q11588.)

Question:

What are the supported operating systems for MailMarshal and WebMarshal?
What version of SQL Server can be used with MailMarshal and WebMarshal?
What versions of SQL, IIS and ASP.NET are required and supported?

Information:

This article shows supported versions of operating systems and supporting software.

Notes:

OS and SQL versions earlier than those listed are not supported.

OS and SQL versions that are out of support from Microsoft are not supported.

The information reflects the latest versions of the named products. For details of previous versions, see the documentation for each version.

The information reflects server requirements. For details of requirements for all user interfaces, see the documentation for each product version.

VMWare deployments of the supported operating systems are also supported. See LevelBlue Knowledgebase article Q11828.

Key:

Symbol	Meaning
RTM	Release to Manufacturing, no service pack.
SPn KBnnn	Minimum required service pack or Microsoft Update. Later service packs are supported.
Qxxxxxx	Tested, Supported. See the KB article listed for known issues and workarounds.
	Not currently supported, obsolete, or known issues.
	Not specifically tested. Not yet supported. LevelBlue plans to test and provide support in a later product release. For details of the policy on new OS and SP versions, see Q13687.
(blank)	Not applicable to this product.

Operating Systems and Prerequisites

The table below lists minimum compatible operating system versions and service packs. The products have been tested with the minimum compatible service pack (and in some cases with later service packs).

Note on Service Packs and Operating System updates: If product functionality is affected by Service Packs or Microsoft updates, LevelBlue will work with customers to restore functionality. If a full resolution requires product development, it may not be available immediately.

The listed products do not support RISC architectures. x64 or x86 is the supported architecture.

Server Operating Systems

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows Server 2025	RTM	RTM	Q21228 (Limited testing performed)	RTM
Windows Server 2022	RTM	RTM	RTM	RTM
Windows Server 2019	RTM (Also with any SEG 8.X)	RTM	RTM	RTM
Windows Server 2016	RTM	RTM	RTM	RTM
Windows Server 2012 R2 See also SQL Server service pack requirements			KB2919355
Windows Server 2012 See also SQL Server service pack requirements	(10.0.6 is the last release that allows installation on Windows 2012)		RTM
Windows Server Core edition (any release)

Workstation Operating Systems
(for server installation)

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Windows 10 or 11 (32 and 64 bit) See also SQL Server service pack requirements	RTM (64 bit required. Permitted but not recommended)	RTM (Permitted but not recommended)		RTM (Permitted but not recommended)

Prerequisites

	MailMarshal 11.3	MailMarshal Web Components 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
Web Browser	The Management Console works with Microsoft Edge, Mozilla Firefox, Google Chrome and Safari. Internet Explorer is explicitly not supported.	SQM works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	MRC works with current versions of major browsers, such as Edge, Mozilla Firefox, Google Chrome and Safari.	Any browser can be used as client.
.NET Framework (minimum - later 4.X is also supported)	4.6.1 MailMarshal also automatically installs a version of the newer .NET technology (previously known as .NET Core) on Array Manager servers.	3.5 SP1 and 4.0	3.5 SP1 (Note that SQL 2016 requires .NET 4.6)	4.6.2

SQL Server Versions

	MailMarshal 11.3	Marshal Reporting Console 2.6	WebMarshal 7.6
SQL 2012 SQL Express 2012 (Microsoft ESU ends July 2025)	(10.0.6 is the last release that allows installation using SQL 2012)
SQL 2014 SQL Express 2014 (Microsoft ESU ends July 2027)	*(CAUTION: Upgrade from earlier versions fails under SQL 2014)*	SP3	SP3
SQL 2016 SQL Express 2016	*(CAUTION: Upgrade from earlier versions fails under SQL 2016)*	SP3	SP3
SQL 2017 SQL Express 2017	RTM		RTM
SQL 2019 SQL Express 2019	RTM		RTM
SQL 2022 SQL Express 2022	RTM	Can upgrade from SQL 2016 Q21228	RTM
Azure SQL Server	Supported where MailMarshal is deployed on Azure

Notes on MRC Installation

MRC 2.6 cannot be installed with SQL versions later than 2016 for the reporting database. However, after installation using the bundled SQL 2016 Express, the SQL Express instances can be upgraded. See Q21228.
MRC can report on data in MailMarshal or WebMarshal databases hosted on later SQL versions.

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

Charles — Mon, 13 Apr 2026 21:54:13 GMT

This article applies to:

MailMarshal (SEG) 7.X and above
MailMarshal ECM/MailMarshal Exchange 7.X

Question:

What is the version of the Unpacker and File Type DLLs for my version of SEG or ECM?
Is the Unpacker and File Type on my installation up to date?

Information:

LevelBlue provides updates to File Type identification and the Unpacker functionality with each product release.

LevelBlue can also provide updates through the automatic update function (SpamCensor updater) for File Type, Unpacker, and additional unpacking executables such as 7zip.

This article lists the most recent version of the Unpacker and File Type. The date listed (if any) is the date of the current update released through the automatic updater.

You can determine the version present in your installation by viewing the Properties > Details tab for each file. Files that can be automatically updated are found on the Array Manager, in the Config subfolder of the SEG installation.

Latest File Versions

Notes:

From May 2024, Unpacker and File Type releases are combined.
Available Release Notes for each release are linked in the tables below.
Updates are no longer published for SEG versions 8.2.6 and below, or for MailMarshal 10.0.0 through 10.0.6 Product support for these releases has ended.

MailMarshal (SEG) Supported Versions

Product Version File Type and Unpacker Version

10.0.7 through 11.3.0

2026.01.01
April 13, 2026

Product Version	File Type and Unpacker Version
10.0.7 through 11.3.0	2026.01.01 April 13, 2026

MailMarshal (SEG) Older Versions

Product Version File Type and Unpacker Version

8.3.2

2025.02.01
July 7, 2025

8.2.6
10.0.4 through 10.0.6

2024.04.01
December 5, 2024

10.0.3

2024.02.01
May 7, 2024

Product Version	File Type and Unpacker Version
8.3.2	2025.02.01 July 7, 2025
8.2.6 10.0.4 through 10.0.6	2024.04.01 December 5, 2024
10.0.3	2024.02.01 May 7, 2024

Product Version Unpacker Version File Type Version

8.2.0 through 8.2.4
10.0.0 through 10.0.2

2023.03.01
September 26, 2023 2023.03.01
September 26, 2023

8.1.0 through 8.1.3 8.1.11
October 4, 2021 8.1.6
October 4, 2021

8.0.1 through 8.0.7 8.0.10.556
October 20, 2020 8.0.6
October 6, 2020

8.0.0
8.0.0
July 18, 2017 8.0.0
July 18, 2017

7.5.8
7.5.7
7.5.6
7.5.5 2.5.5
February 26, 2019 7.14.6
January 24, 2019

7.5.1 2.5.2
December 5, 2017 7.14.4
March 6, 2018

7.5.0 2.3.3
December 1, 2015 7.13.2

7.3.6 2.5.2
December 5, 2017 7.14.4
March 6, 2018

7.3.5 2.5.1
October 4, 2017 7.14.0.317
July 20, 2017

7.3.0 2.1.5
May 3, 2015

7.2.3 2.0.8
February 17, 2015

7.2.2 2.0.3
May 16, 2015

7.2.1
7.2.0 2.0.3
January 8, 2014

7.1.2 1.0.0
December 8, 2014

Product Version	Unpacker Version	File Type Version
8.2.0 through 8.2.4 10.0.0 through 10.0.2	2023.03.01 September 26, 2023	2023.03.01 September 26, 2023
8.1.0 through 8.1.3	8.1.11 October 4, 2021	8.1.6 October 4, 2021
8.0.1 through 8.0.7	8.0.10.556 October 20, 2020	8.0.6 October 6, 2020
8.0.0	8.0.0 July 18, 2017	8.0.0 July 18, 2017
7.5.8 7.5.7 7.5.6 7.5.5	2.5.5 February 26, 2019	7.14.6 January 24, 2019
7.5.1	2.5.2 December 5, 2017	7.14.4 March 6, 2018
7.5.0	2.3.3 December 1, 2015	7.13.2
7.3.6	2.5.2 December 5, 2017	7.14.4 March 6, 2018
7.3.5	2.5.1 October 4, 2017	7.14.0.317 July 20, 2017
7.3.0	2.1.5 May 3, 2015
7.2.3	2.0.8 February 17, 2015
7.2.2	2.0.3 May 16, 2015
7.2.1 7.2.0	2.0.3 January 8, 2014
7.1.2	1.0.0 December 8, 2014

ECM

Product Version Unpacker Version

7.2.0
7.1.7
7.1.6
7.1.5 1.0.5
February 28, 2019

Product Version	Unpacker Version
7.2.0 7.1.7 7.1.6 7.1.5	1.0.5 February 28, 2019

What file types are recognized by MailMarshal (SEG) and ECM?

Charles — Mon, 30 Mar 2026 21:23:58 GMT

This article applies to:

MailMarshal (SEG) current versions
MailMarshal ECM/MailMarshal Exchange 5.2 and above

Question:

What file types are recognized by MailMarshal (SEG)?
What file types are recognized by MailMarshal ECM 5.2 and above?

Information:

The following formats are recognized by current MailMarshal (SEG) and ECM versions.

Notes:

Some types are recognized only with current product versions, as noted. Items marked "Current SEG" were added before 2023. These items are not recognized by ECM.
Additional types are recognized with specific updates to the File Type DLL. For information about the File Type update for each MailMarshal version, see article Q20446.
- File Type updates are distributed through the MailMarshal Automatic Updates to installations with current maintenance.
Items recognized with a specific MailMarshal/SEG or FileType update are not recognized in MailMarshal Exchange/ECM.

In the tables below, Type Name refers to the name seen in the Engine log and rule listings. Description is the name as seen when selecting types in the email policy editor.

The Type Name is often the same as the usual file extension. However, file type detection is based on file structure and NOT on the file extension. If you rename a zip archive as ".TXT", it is still recognized as a zip archive by MailMarshal.

Type Name	Description
7Z	7Zip Archive
7Zcrypt	7Zip encrypted archive (Current SEG)
7Zsfx	7Zip self extracting archive
ACE	ACE archive
ACEsfx	ACE self extracting archive
IWA	Apple iWork Archive .IWA (Current SEG)
ARC	ARC archive
ARJ	ARJ archive
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
B64	Base64 (MIME) Encoding
B2A	BtoA Encoding
BZ2	bZIP2 archive
CABI	InstallShield CAB Archive
CPIO	CPIO archive
DEB	Debian Binary Package file (Current SEG)
GZ	GZIP archive
HQX	HQX (BinHex) archive
CABI	InstallShield CAB Archive
CDISO	ISO 9660 CD Filesystem
LYMESFX	LYME self extracting archive (Current SEG)
LZH	LZH archive
MacBIN	MacBinary I, II, or III archive
MDXMedia	MDX Extended Media Descriptor File (Current SEG)
CABM	Microsoft CAB/Expand Archive
SZDD	Microsoft SZDD archive
MAR	Mozilla Archive
MSI	MSI Windows Installer package
MSIX	MSIX Windows Installer Package (Current SEG)
PBIX	Power BI Report (FileType 2024-02-01 and above)
RAR	RAR archive
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
RARSpan	RAR spanned archive
RPM	Redhat Package Manager file (Current SEG)
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
SIT	SIT archive
SITEncrypt	SIT encrypted archive
TAR	TAR archive
UDF	Universal Disk Format (UDF) (Current SEG)
UUE	UUencoded Encoding
XZ	XZ archive (Current SEG)
Z	Z (compress) archive
ZIP	ZIP archive
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive
ZOO	ZOO archive
ZST	Zstd archive (FileType 2025-03-01 and above)

Azure IRM Protected Documents

New category and new items in MailMarshal/SEG 8.2.

Type Name	Description
RPMSGPLAIN	Decrypted restricted-permission message
XLSXIRM	Excel 2007+ document with IRM
XLSIRM	Excel document with IRM
PFILE	File protected with IRM
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM
PPSIRMcrypt	Password protected Powerpoint show with IRM
PPTIRMcrypt	Password protected Powerpoint with IRM
WordIRMcrypt	Password protected Word with IRM
PPTXIRM	Powerpoint 2007+ document with IRM
PPTIRM	Powerpoint document with IRM
PPSIRM	Powerpoint show with IRM
RPMSG	Restricted-permission message
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM

Document

Type Name	Description
MDB	Access database
MDW	Access system database
INDD	Adobe InDesign Document (Current SEG)
MSO	Document data
DVI	DVI TeX document
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word document
XLSB	Excel 2007+ Binary Document Includes later versions; see note below.
XLSX	Excel 2007+ document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLS	Excel document
XLSIRM	Excel document with IRM (Current SEG)
NFO	Folio Infobase
FM3	Lotus 123 FM3 sheet form
WK1	Lotus 123 WK1 sheet
WK3	Lotus 123 WK3 sheet
WK4	Lotus 123 WK4
SAM	Lotus AmiPro document
LWP	Lotus WordPro document
MCW	Mac Word document
ACCDB	Microsoft Access Database .ACCDB (Current SEG)
ONE	Microsoft OneNote (Current SEG)
VSDX	Microsoft Visio 2013 Drawing
DOCXML	Microsoft Word 2003 XML Document
OfficeMacroScript	Office Macro Script
Office2007Macro	Office 2007+ Macro Includes later versions; see note below.
OLE	OLE compound document
OREIRM	OLE compound document with IRM
ODC	Open Office chart file
OTC	Open Office chart template
ODB	Open Office database file
ODT	Open Office document file
OTT	Open Office document template
ODF	Open Office formulae file
OOoOTF	Open Office formulae template
ODM	Open Office global text document
OTH	Open Office global text template
ODG	Open Office graphics file
OTG	Open Office graphics template
ODI	Open Office image file
OTI	Open Office image template
ODP	Open Office presentation file
OTP	Open Office presentation template
ODS	Open Office spreadsheet file
OTS	Open Office spreadsheet template
OpenXML	OpenXML Document (Current SEG)
PM6	PageMaker document
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint Show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG)
PDF	PDF document
PDFXFAForm	PDF document - Dynamic XFA form (Current SEG)
PDFcrypt	PDF document - Encrypted
PDFInvalid	PDF document - Invalid header record (Current SEG; see Q16666)
PDFprotect	PDF document - Protected
PDFInvalidFormat	PDF Un-recognized file format
PS	PostScript document
PPTX	PowerPoint 2007+ document Includes later versions; see note below.
PPTXIRM	PowerPoint 2007+ document with IRM (Current SEG)
PPTIRM	PowerPoint document with IRM (Current SEG)
PPSX	PowerPoint 2007+ show
PPT	PowerPoint document
PPS	PowerPoint show
PPSIRM	PowerPoint show with IRM (Current SEG)
PRJ	Project document
PUB	Publisher document
QXD	Quark Express document
RTF	Rich Text document
Word2	Word 2 Document
DOCIRM	Word 2007+ doc with IRM in Word 2003 mode
DOCX	Word 2007+ Document Includes later versions; see note below.
DOCXIRM	Word 2007+ document with IRM (Current SEG)
DOC6	Word 6 Document
DOC	Word document
WPD	WordPerfect document
WPS	Works for Windows document
WRI	Write document
XPS	XPS Document (Current SEG)

Drawing

Type Name	Description
AI	Adobe Illustrator drawing
DWG	AutoCAD Drawing
DWF	AutoCAD Format
CTB	AutoCAD Plotting Support .CTB (Current SEG)
CMX	Corel Binary Meta file
CDR	Corel Draw Drawing
DXF	Drawing Interchange File DXF
FP3	FloorPlan Plus 3D
FH	Freehand drawing
VSDX	Microsoft Visio 2013 Drawing .VSDX (Current SEG - see note)
VXD	Microsoft Visio Drawing
NWD	Navisworks Document .NWD (Current SEG)
Solidworks	Solidworks CAD files (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT) (Current SEG)
STL	StereoLithography Drawing (Current SEG)

Encrypted

Type Name	Description
7Zcrypt	7Zip encrypted archive (Current SEG)
ARJcrypt	ARJ encrypted archive
ARJsfxcrypt	ARJ encrypted self extracting archive
AXCRYPT	AXCrypt Encrypted Data (Current SEG)
Switch	Egress Switch Encrypted Mail (Current SEG)
XLScrypt	Encrypted Excel document (Current SEG)
PPTcrypt	Encrypted PowerPoint Document (Current SEG)
PPScrypt	Encrypted PowerPoint Show (Current SEG)
DOCcrypt	Encrypted Word Document
XLSXIRM	Excel 2007+ document with IRM (Current SEG)
XLSIRM	Excel document with IRM (Current SEG)
PFILE	File protected with IRM
GPG	Gnu Privacy Guard file .GPG (Current SEG)
OREIRM	OLE compound document with IRM
XLSIRMcrypt	Password protected Excel with IRM (Current SEG)
PPSIRMcrypt	Password protected Powerpoint show with IRM (Current SEG)
PPTIRMcrypt	Password protected Powerpoint with IRM (Current SEG)
WordIRMcrypt	Password protected Word with IRM (Current SEG1)
PDFcrypt	PDF document - encrypted
PENC	Perl Encoded file .ENC (Current SEG)
PGP	PGP Encrypted Data
PPTXIRM	Powerpoint 2007+ document with IRM (Current SEG)
PPTIRM	Powerpoint document with IRM (Current SEG)
RARcrypt	RAR encrypted archive
RARsfxcrypt	RAR encrypted self extracting archive
RPMSG	Restricted-permission message
SEAEncrypt	SEA encrypted self extracting archive
SITEncrypt	SIT encrypted archive
P7A	SMime AuthEnveloped Data (FileType 2026-01-01 and above)
P7M	SMime Encrypted Data
DOCIRM	Word 2007+ document with IRM in Word 2003 mode
DOCXIRM	Word 2007+ document with IRM (Current SEG)
ZIPcrypt	ZIP encrypted archive
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIX	ZixCorp encrypted mail (Current SEG)

Executable

Type Name	Description
7Zsfx	7Zip self extracting archive
ACEsfx	ACE self extracting archive
ARJsfxcrypt	ARJ encrypted self extracting archive
ARJsfx	ARJ self extracting archive
CLASS	Java class file
APPL	Macintosh M68k executable
PEF	Macintosh PPC executable
CABM	Microsoft CAB/Expand Archive
COM	MSDOS Com executable
EXE	MS-DOS Executable
MSI	MSI Windows Installer Package
MSIX	MSIX Windows Installer Package (Current SEG)
NLM	NetWare Loadable Module
EXEO16	OS/2 16bit executable
DLLO32	OS/2 32bit DLL
EXEO32	OS/2 32bit Executable
PYC	Python bytecode file (Current SEG)
RARsfxcrypt	RAR encrypted self extracting archive
RARsfx	RAR self extracting archive
SEAEncrypt	SEA encrypted self extracting archive
SEA	SEA self extracting archive
CIF	UNIX CIF Executable
COFF	UNIX COFF Executable
ELF	UNIX ELF Executable
DLLW16	Win16 DLL
EXEW16	Win16 executable
DLLO16	Win16 VXD or OS/2 DLL
DLLW32	Win32 DLL
EXE32W	Win32 executable
ZIPsfxcrypt	ZIP encrypted self extracting archive
ZIPsfx	ZIP self extracting archive

Font

Type Name	Description
EOT	Embedded OpenType Font (Current SEG)
OTF	OpenType Font
TTF	True Type Font
AFM	Type 1 Adobe Font Metric
PFB	Type 1 Printer Font Binary
PFM	Type 1 Printer Font Metric
WOFF	Web Open Font Format (Current SEG)
FON	Windows Bitmap font
ODTTF	XPS Embedded font (ODTTF) (Current SEG)

Image

Type Name	Description
PSD	Adobe Photoshop Image
BMP	Bitmap image
CPT	Corel Photo-Draw Image
EPS	Encapsulated PostScript
EMF	Enhanced MetaFile Image
GIF	Gif image
HEIC	HEIF image (Current SEG)
ICO	Icon
JPG	Jpeg image
JBIG2	JBIG2 image (Current SEG)
JPEG2000	Jpeg2000 image
CIL	Microsoft ClipArt Gallery
MDI	Microsoft Document Image
MIX	Microsoft PhotoDraw Image
PSP	Paint Shop Pro image
PNG	Portable Network Graphics (PNG)
SVG	Scalable Vector Graphics (Current SEG)
TIF	Tiff image
WEBP	WebP Image File (Current SEG)
HDPHOTO	Windows HD Photo (Current SEG)
WMF	Windows MetaFile Image
PCX	Zsoft PCX Image

Mail Components

Type Name	Description
MBODY	Mail Body
MHDR	Mail Headers
MAIL	Mail message
TNEF	TNEF Exchange Mail Message
HTMLBody	TNEF Exchange Mail Message extracted HTML Mail Body
RTFBody	TNEF Exchange Mail Message extracted RTF Mail Body

Other

Type Name	Description
BPlist	Apple Binary Plist
AppleDouble	AppleDouble header
AppleSingle	AppleSingle formatted file
BIN	Binary Unknown (indicates a file of unrecognized type)
TORRENT	Bittorent .torrent metainfo file
ICS	Calendar Meeting Invitation (iCalendar) (Current SEG)
ICSDescription	Calendar Meeting Invitation Description (Current SEG)
ICSSummary	Calendar Meeting Invitation Summary (Current SEG)
TPS	Clarion TopSpeed File .TPS (Current SEG)
CHM	Compiled HTML Help file
DBF	dBase/xbase Data File .DBF (Current SEG)
DBT	dBase Memo Field File (Current SEG)
MDXdbase	dBase Multiple Index File (Current SEG)
SYS	DOS device driver (Current SEG)
VCF	Electronic Business Card .VCF (Current SEG)
ICM	Independent Color Matching .ICM (Current SEG)
InfoSlip	Infoslips document (Current SEG)
JOS	Java Object Serialized Data (Current SEG)
DSStore	Mac OSX Finder Info (Current SEG)
MAPIBlock	MAPI Encoded data
OST	MAPI Off-line Store
PAB	MAPI Personal Address Book
PST	MAPI Personal Store
MAT	MATLAB Data File (Current SEG)
PDB	Microsoft Debugging Symbols (Current SEG)
LIB	Microsoft Program Library (Current SEG)
MSBLDCACHE	MS Build Cache File (Current SEG)
RCM	MTXWIN95 Registry Command File
OracleRDF	Oracle Report Definition File (Current SEG)
Appointment	Outlook Appointment
Contact	Outlook Contact
MSG	Outlook message
Note	Outlook Note
Task	Outlook Task
P12	PKCS#12 Certificate Archive (FileType 2023-03-01 and above)
PCAP	Packet Capture (Current SEG)
PCAPNG	Packet Capture NG (Current SEG)
PEMCert	PEM encoded certificate .PEM (Current SEG - see note)
PFX	PFX Certificate Archive (Current SEG)
PGPPublicKey	PGP Public Key (Current SEG)
PGPSigned	PGP Signed Data
PBIXMashup	Power BI Data Mashup Archive (Current SEG)
PBIXMetadata	Power BI Data Metadata (Current SEG)
PBIXModel	Power BI Data Model (Current SEG)
PBIXBindings	Power BI Security Bindings (Current SEG)
PBIXSettings	Power BI Settings (FileType 2024-02-01 and above)
QBB	QuickBooks Backup .QBB (Current SEG)
QBW	QuickBooks Company file .QBW (Current SEG)
RTF Object	RTF Object
SHP	Shape file (.SHP) (Current SEG)
SHX	Shape Index file (.SHX) (Current SEG)
P7S	SMime Signed Data
SQLiteDB	SQLite Database (Current SEG)
EMC	Striata Encrypted Mail Communication (Current SEG)
TEXT	Text
VHD	Virtual Hard Disk Image .VHD (Current SEG)
VSSSCC	Visual Source Safe Source Code Control (Current SEG)
HLP	Windows Help file
MST	Windows Installer Setup Transform .MST (Current SEG)
URL	Windows Internet shortcut
EVT	Windows NT event log
REG	Windows Registry Data
WSF	Windows Script File .WSF (Current SEG)
LNK	Windows shortcut
EVTX	Windows Vista event log .EVTX (Current SEG)
XML	XML Document (Current SEG)

Sound

Type Name	Description
AAC	AAC audio
FLSA	Adobe Flash Audio (Current SEG)
AU	AU sound file
ENC	Encore Music Notation .ENC (Current SEG)
ASX	Microsoft Active Streaming link
MID	MIDI sound file
MP3	MP3 sound file
OGA	OGG stream for audio
RAM	Real Audio Link
RA	Real Audio sound file
RMP	Real Jukebox Metadata Package
Real	RealPlayer audio/video
WAV	WAV sound file
ASF	Windows Active Streaming Format

Video

Type Name	Description
3GPP	3GPP Video (Current SEG)
FLSV	Adobe Flash Video (Current SEG)
FLC	Animator Pro FLC file
FLI	Animator Pro FLI file
AVI	AVI video
DVM	DVM video
ASX	Microsoft Active Streaming link
MOV	Mov video
MPG	Mpeg video
OGV	OGG stream for video
Real	RealPlayer audio/video
SWF	Shockwave Flash
FLV	Shockwave Flash video
WEBM	WebM Video File (Current SEG)
ASF	Windows Active Streaming Format

Web Browsing

Type Name	Description
CSS	Cascading style sheet
CRL	Certificate Revocation List (CRL)
GIF	GIF Image
Goog	Google Safe Browsing Update
HTML	HTML Document
ICO	Icon
CLASS	Java class file
JS	JavaScript file
JPG	JPEG image
OCSPResponse	OCSP Response File
PNG	PNG image
SWF	Shockwave Flash
VBS	VBScript file (Current SEG)
FORMBIN	Web Page binary form data
FORMTEXT	Web page text form data
WEBM	WebM Video File (Current SEG)
WEBP	WebP Image File (Current SEG)

Non-Selectable Types

The following types cannot be selected in rules. They are used internally by MailMarshal and will be shown in logs as appropriate.

Type Name	Description
BIFF12	Binary File Format for Office 12
CHMBINOBJ	CHM Binary Object
ODTCache	Open Document Text Layout-cache
OLEStream	OLE Raw Stream
PDFStream	PDF Raw Stream
ZIPBig	Zip with massively redundant data

Notes:

Word, Excel, and PowerPoint "2007" or "2007+" file type is the default format used by all later versions (including Office 2010, 2013, and 2016). All documents saved in this format are recognized, regardless of the Office software version.
LevelBlue Knowledgebase articles for information about earlier versions have been withdrawn.

This article was previously published as:: NETIQKB40962

What is the Product Support Lifecycle for DbProtect and AppDetectivePRO?

Charles — Thu, 26 Mar 2026 20:42:13 GMT

This article applies to:

AppDetectivePRO (All Versions)
DbProtect (All Versions)

Question:

What is the AppDetectivePRO or DbProtect product support lifecycle?
How long is my version of AppDetectivePRO or DbProtect supported for?

Information:

Supported versions of the named products are the latest release, and the two previous releases.

Earlier releases are not supported.
For your convenience, a recent product support matrix is included below. Versions not listed are out of support.

Version upgrades are available to all customers that have current support and maintenance contracts.

Clients running unsupported software are strongly encouraged to plan for an upgrade or fresh installation of their licensed software. Newer releases of software offer better performance, new features and capabilities, and often resolve issues experienced in older releases of software.

As always, new releases of licensed software are available for download at no additional cost for clients with a current and valid maintenance agreement (for DbProtect) or software subscription (AppDetectivePRO).

Important Notes:

If you are running older, unsupported versions of licensed software that are more than two versions behind the current release, please contact dbsssupport@levelblue.com before attempting any in-place upgrade or fresh installation.
Requirements to successfully install AppDetectivePRO and DbProtect may have changed since you last installed software. Please check the relevant README and Installation/Upgrade Guide documents before attempting an upgrade or installation. Please contact dbsssupport@levelblue.com with any questions.

AppDetectivePRO:

Version	Software Release Date
AppDetectivePRO 10.13	March 2026
AppDetectivePRO 10.12	June 2025
AppDetectivePRO 10.11	November 2024

DbProtect:

Version	Software Release Date
DbProtect 6.7.0	March 2026
DbProtect 6.6.15	July 2025
DbProtect 6.6.13	November 2024

Product Licensing for DbProtect and AppDetectivePRO

Charles — Thu, 19 Mar 2026 20:41:37 GMT

This article applies to:

AppDetectivePRO
DbProtect

Question:

How many licenses do I need for my installation of AppDetectivePRO or DbProtect?
What are the asset granularity rules for AppDetectivePRO or DbProtect?
What is the scope of a unique database under protection?

Information:

LevelBlue licenses its AppDetectivePRO and DbProtect products based on the number and type of databases.

In the realm of structured and unstructured databases that can be deployed in standalone, SaaS, or PaaS architecture, the interpretation of a single licensed entity varies. The interpretation of a “unique database” is based on the boundary of a given database or datastore that allows for customization of security, configuration, patching and other variances. The definitions below specify the scope at which a license is considered as consumed for the database platform.

Database or Node Definitions by Platform

Database/Datastore Platform	Unit Under Protection Scope
Amazon Dynamo DB	Per AWS region and availability zone
Amazon RDS (MySQL, MSSQL, Oracle, MariaDB, PostgreSQL)	Per host/IP and port (and instance/SID where applicable)
Amazon RDS Aurora (MySQL, PostgreSQL)	Per host/IP and port
Azure SQL Database	Per database, host/IP and port
Azure SQL Managed Instance	Per instance, host/IP and port
Cassandra	Per host/IP and port
Couchbase	Per host/IP and port
Elasticsearch	Per instance/node, host/IP and port
IBM DB2 for z/OS	Per Db2 subsystem, host/IP and port
IBM DB2 LUW	Per instance and database, host/IP and port
MariaDB	Per host/IP and port
Microsoft SQL Server	Per instance (or each instance when multiple instances installed on the same host), host/IP
MongoDB (Enterprise Editions Only)	Per instance, host/IP and port
MySQL	Per host/IP and port
Oracle	Per SID, host/IP and port
Percona for MySQL	Per host/IP and port
PostgreSQL	Per host/IP and port
Redis Enterprise	Per host/IP and port
Sybase	Per instance (or each instance when multiple instances installed on the same host), host/IP
Teradata Database	Per host/IP and port

License expiry and overage behavior

A license usage banner is visible within the product, providing real-time insights into license compliance and validity. If there is any discrepancy between the number of licenses purchased and actual usage, users will be promptly notified. Additionally, notifications will alert users in cases of impending license expiry or any issues affecting license functionality, helping ensure uninterrupted access and compliance.

Can I use PAC (Proxy auto-configuration) files with WebMarshal?

Charles — Sun, 15 Mar 2026 21:28:11 GMT

This article applies to:

WebMarshal

Question:

Do PAC files work with WebMarshal?
How do I use or deploy PAC files with WebMarshal?

Reply:

Yes, you can use PAC files with the WebMarshal proxy. PAC files are applied at the web browser level, and do not depend on the proxy software.

Usage and configuration of PAC files will depend on your environment. LevelBlue Technical Support is not responsible for authoring, reviewing or deploying PAC files.

The remainder of this article provides some general suggestions about usage and deployment of PAC files, and links to additional information.

PAC Usage:

Proxy Auto-configuration (PAC) files direct a browser to use specific proxy servers. Because PAC files are scripted, they can contain complex configuration such as:

A list of URLs that should be excluded from proxying
A list of one or more proxy server names (or IP addresses) and ports that can be used
Different proxy server usage depending on the client IP address (useful for laptops that may be browsing from different networks)

PAC files can be hosted on each workstation, or on an intranet server. PAC files and browser configuration can be updated using Windows Group Policy or other administration tools.

Sample PAC Configuration

The procedure given below is for a PAC file in its simplest form and should work for any web proxy software. It redirects all website requests from a client computer's browser to the WebMarshal proxy server (just as would happen by entering proxy information directly in the browser).

In the example, the name of the proxy server is webmarshal.local and the proxy port is the default 8080.
Substitute the correct name or IP address and port for your WebMarshal proxy.

Create a text file using Notepad.
Copy the script below into the file (replacing the name and port of the proxy server with the actual name or IP address and port of your WebMarshal server).
- If you use a name, ensure that it can be resolved to an IPv4 address.
function FindProxyForURL(url, host)
{
return "PROXY webmarshal.local:8080";
}
Save the file as C:\proxy.txt
- For testing you can save this file in any convenient location that your account has read and write access to.
To use this file:
- For browsers that honor Windows internet settings (such as Edge and Chrome):
  - Open the system Internet Options > Connections > LAN Settings
  - Select "Use automatic configuration script"
  - Enter the path as file://c:/proxy.txt (or the path where you saved the file). Note: the format is URL format with the "file" prefix.
  - Click OK as required to accept the changes.
- For Firefox (recent versions)
  - On the Firefox menu open Options > Options > Network, and click Settings
  - Select "Automatic proxy configuration URL"
  - Enter the path as file://c:/proxy.txt (or the path where you saved the file). Note: the format is URL format with the "file" prefix.
  - Click OK as required to accept the changes.
- For other browsers, please refer to their support documentation.
Browse to http://webmarshal.home and you should see the WebMarshal home page.
Browse to Internet sites. You should be able to see the activity from the specific computer in "Active sessions" within your WebMarshal Console.

Notes:

For information about using the Web Proxy Auto-Discovery Protocol (WPAD) with WebMarshal, please visit LevelBlue Knowledgebase article Q12228.

References:

http://en.wikipedia.org/wiki/Proxy_auto-config

Using WebMarshal with kiosk computers, smartphones and tablets with IP Authentication

Charles — Sun, 15 Mar 2026 21:24:52 GMT

This article applies to:

WebMarshal 6.X and 7.X

Question:

How can I set up Kiosk Computers, iPads and other mobile devices to use WebMarshal as the proxy?

Reply:

WebMarshal IP Authentication can be used to log and control web activity where the user does not have a network credential, or the device does not understand proxy authentication.

IP Address authentication is transparent to the end user. WebMarshal will use the IP Address of the connecting device/computer and will apply policy based on the address. You can apply any WebMarshal rule based on IP address.

Procedure:

To configure and enable IP Address based authentication:

The browser or other application on the Kiosk computer or mobile device must understand the concept of using a "web proxy" (it must have the relevant settings to configure which proxy and port to use). The application must be able to connect to WebMarshal using the configured web proxy settings, at the network connection level.
WebMarshal must accept IP based authentication. By default WebMarshal accepts IP based authentication on port 8081. To customize this setting, in the WebMarshal Console navigate to Tools > Global Settings > Proxy Settings > Ports and Authentication.
- Before changing the port, check that no other software is listening on the new port. See article Q12072.
WebMarshal must be configured with IP Address user groups that include the IP addresses you want to allow. To add an IP address group:
- In the WebMarshal Console, click User Groups.
- From the Action menu or the right pane menu bar, choose “New IP Address Group”.
- Enter a name and optionally a description.
- Enter a starting and ending IP address for the range.
  
  Note: WebMarshal adds the name or IP address of each computer in this range to the All Users list the first time that computer connects to WebMarshal. Once the computer names are included in the list, you can use them individually within Rules in the same way as any other User.
Configure the web browser or application software to use your WebMarshal proxy server and the port specified in step 2.
- To specify these settings on a client computer, open the control panel Internet options > Connections > LAN Settings.

For other browsers and applications, please refer to the application's support documentation for configuring proxy settings. Many applications allow you to set a custom proxy that is different from the configuration of IE or other browsers.
- As an example, in MailMarshal SEG you can configure this setting in the Configurator, Tools > MailMarshal Properties > Internet Access (and optionally in the Server Properties for each processing node).

After configuring proxy settings, browse to http://webmarshal.home
- The result should be a pages showing the name or IP address of your computer and other details regarding your WebMarshal proxy server.
- Any user or process on a computer with an IP address in the specified range (as in step 3) can browse through WebMarshal, subject to any rules you choose to apply on this IP Address group.
The recommended way to apply policy to an IP Address group is to add it to one of the standard groups created by default with WebMarshal (Power Users, Standard Users, Restricted Users). This approach is versatile and flexible as the application of the rules will remain the same regardless of any new users, computers or groups added or removed from a WebMarshal user group.
- It is best practice to NOT use any imported groups directly in policy.

Notes:

For more information on creating and managing WebMarshal groups and modifying your policy accordingly, please refer to the WebMarshal User Guide and help.
If you use IP authentication in an environment that assigns IP addresses dynamically (using DHCP), please note the following limitations:
- The IP address of a device could change.
- To ensure that IP based rules apply as expected in a DHCP environment, you should not set up special rules for individual device names or addresses.
- Where devices have resolvable names (for instance in a Windows domain environment), WebMarshal attempts to resolve the name and applies rules to devices by name if possible. This feature is designed to assist with policy and reporting if the IP address changes. However tracking by name is generally not possible for mobile devices, or if name resolution is not available.
- When WebMarshal cannot resolve a device name, it applies policy using the current IP address of the device.

Configuring authentication bypass with WMProxyLogon

Charles — Sun, 15 Mar 2026 21:23:40 GMT

This article applies to:

WebMarshal 6.9 and above
Windows operating system clients

Question:

Authentication problems when using Skype or iTunes through WebMarshal
Authentication problems with browser helper applications

Background:

In certain circumstances, browsers and browser plug-ins on Windows operating systems fail to authenticate with the Proxy. This may be due to an incompatibility, or simply software that does have proxy settings but does not provide for authentication.

The WMProxyLogon mechanism described here is a simple workaround designed to overcome this limitation in the client software. It is not limited to the named clients and could be used anywhere that a similar problem occurs.

Procedure:

WebMarshal includes a small utility called WMProxyLogon.exe. In earlier versions, this utility is used to allow NDS users to authenticate. In WebMarshal version 6.9 and above, this program also works with all Windows logins.

This utility runs on the user workstation.
By default the utility uses the Windows Internet Options settings so if these are not properly configured the logon procedure will not work. To override these settings see Options below.
If this program is added to the logon script it will run as a system tray icon and periodically inform the proxy server of the active Windows (or NDS) logon. While this program is running the user will not be prompted for authentication for any applications.
You do not need to make any change on the WebMarshal server.

Usage

WMProxyLogon.exe runs on the client workstation. Typically this software would be included as part of the user logon script for some or all users. The program is small enough that it can be run from its location on the WebMarshal server. Double-click the system tray icon to see the current user information and/or exit from the program.

Options

WMProxyLogon.exe has the following command line options:

/?: Shows help information.
/Proxy:<server>:<port>: Overrides the system settings and forces WMProxyLogon.exe to communicate with the stated proxy server. Note that the browser must still be configured correctly to use the proxy server.
/NoIcon: Disables display of the system tray icon.

Notes:

This solution allows access for ANY software running on the workstations that can use a proxy server (subject to WebMarshal Rules that control access).
- Potentially unwanted applications could also be allowed by this solution.
For another solution that can provide more granular control, see Q12734: Configuring the Authentication Bypass Cache

Considerations when investigating slow Web Browsing

Charles — Sun, 15 Mar 2026 21:15:32 GMT

This article applies to:

WebMarshal 6.X and 7.X

Question:

What should I consider when my WebMarshal installation is running slower than normal?
What factors can affect browsing and operational performance?

Items To Consider:

Is browsing really slower, or does it just seem slower?
- Time a page from click to complete.
- The images may seem to 'pop in' rather than displaying partially as they load, which can make the page loading seem slower. However, the total time taken to load the page is roughly the same.

Hardware and Server Specification

Does the WebMarshal server meet (or exceed) the recommended hardware requirements?
- If you are using a virtual machine, does the host have adequate resources to support all VMs?
Does the WebMarshal server have two NICs? If so are they listed in the correct order?
- On the WebMarshal server, navigate to Network Connections --> Advanced --> Advanced Settings --> Adapters and Bindings. Ensure the Local/Inside network is first in the list.

Client Configuration

Toggle use of HTTP 1.1 in the end-user's browser settings (normally 1.1 will give better performance)
- Edge, Chrome: Windows Internet Options --> Advanced
  - Setting: Use HTTP 1.1
  - Setting: Use HTTP 1.1 through proxy connections
- Firefox: In the Address Bar enter about:config
  - Filter for network.http
  - Setting: network.http.version
  - Setting: network.http.proxy.version
Is the speed impacted in only one browser or workstation?
- Is the speed acceptable in another browser?
- Are plugins enabled on the slow browser?
- Are "performance enhancers" loaded for the browser?
Do the end-users have web filtering applications installed locally such as an antivirus application?

Firewalls

Is there a firewall in place?
- Is the firewall inspecting Content/Packets?
- Are firewall resources running high?
- Is the firewall setting "Enforce Host Tag search for CFS" enabled? If so this should be disabled.

Server Configuration

What version of WebMarshal are you running?
- LevelBlue always recommends you use the latest version. Almost every release includes changes that can improve the browsing experience.
- If using a version below 6.5.6, check the trickle transfer rate setting (Server & Array Settings > Download Options). This setting can safely be increased to 90%.
- Sometimes page completion can be slower for large pages with a lot of text. WebMarshal returns the entire page to the browser after scanning, which means that the browser doesn’t get the opportunity to begin loading satellite resources while continuing to receive the page. From WebMarshal version 6.5, you can configure the holdback for text and binary files separately (Server & Array Settings > Download Options).
Is WebMarshal configured to use caching?
- Caching can help to reduce delays in fetching pages. Ensure that the cache folder is on a high quality disk with adequate free space.
- Note that WebMarshal does not cache the result of rule evaluation. Rules are re-run for every request.
Is WebMarshal configured to use an upstream proxy?
- If users access the web via the upstream proxy (bypassing WebMarshal), is there a change in performance?
- Does setting WebMarshal to access the web directly instead of via an upstream proxy increase the performance?
Consider disabling Reverse DNS lookups for client workstations:
- See Q11895
Does the timeout threshold need to be increased? (The current default setting is 300 seconds.)
- See Q12914
Has Advanced Logging been left on at some stage causing reduced performance due to the extra load?
Ensure that NetBIOS over TCP is enabled on the WebMarshal servers.

Rules and Processing Settings

Does disabling rule processing (the Access Policy) inside WebMarshal improve the performance?
Are complex or multiple text censor scripts being applied for many result pages?
Is URLCensor installed and enabled with WebMarshal?
- This feature depends on DNS lookups and can be slow to respond in a real-time environment. You should consider disabling it.
Are there large URL Categories? If so, these will slow down each request as the list is scanned.
Is HTTPS Content inspection enabled? This will increase the engine load and reduce performance.
If WebMarshal is configured to use virus scanners, is performance increased after disabling them?
- Are the "Extensive Virus Scanning" rules enabled?
- Is the Virus Scanner slow to respond?
- Is more than one scanner installed and enabled via the rule set? If so this will cause duplicate scanning to occur on every web request.

Resolving SSL certificate issues

Charles — Sun, 15 Mar 2026 21:11:15 GMT

This article applies to:

WebMarshal 6.X or 7.X
HTTPS Content Inspection

Question:

WebMarshal blocks HTTPS sites
Message: Certificate Chain is not Trusted

Information:

When WebMarshal HTTPS Content Inspection is enabled, WebMarshal attempts to check the validity of the SSL certificates used by each website.

Validation may be unsuccessful if the required Root Certificate and in some cases Intermediate Certificates are not present in the correct certificate stores on each WebMarshal processing server.

Causes:

Newer Windows releases install a very limited set of SSL CA certificates by default.
- To resolve this issue, you can install updated CA certificates from Windows Update. See LevelBlue Knowledge Base article 21016.
- Note that WebMarshal does not automatically retrieve root certificates in most cases.
In rare cases a required certificate for a site may not be included in the Microsoft certificate package.
- To resolve this issue, log on to the WebMarshal processing server as an administrator. Using Edge or Chrome, browse to the site in question WITHOUT passing through WebMarshal content inspection.
- When prompted, install (trust) required certificates. Normally, when you browse as an administrator, these certificates will be correctly installed in the computer certificate store and will be available to WebMarshal services.

You can also add certificates or verify the location of certificates using the MMC Certificates snap-in.

Run Microsoft Management Console (MMC.exe)
Choose to add a snapin and select the Certificates snap-in. Choose to manage certificates for the Computer account.
Add the Certificates snap-in again and choose to manage certificates for the current user account.
- You can check for the presence of certificates in the Computer section (for instance in Trusted Root Certification Authorities > Certificates.)
- If required, you can copy certificates from the User section to the Computer section.

After adding certificates, restart the WebMarshal Proxy service. Remember to repeat these steps on each WebMarshal processing server.

Notes:

WebMarshal 6.8 and above addresses some additional issues with determination of certificate validity.
From time to time Microsoft includes additional Root Certificates in Windows Update. LevelBlue recommends that you schedule update of Root Certificates.
WebMarshal currently checks certificate status only for the leaf certificate and not for root certificates.

Prerequisites and tips for WebMarshal Remote Console

Charles — Sun, 15 Mar 2026 21:09:47 GMT

This article applies to:

WebMarshal 6.8 and above
Remote Console functionality

Question:

What are the prerequisites for WebMarshal Remote Console?
What are common problems using the Remote Console?
What authentication methods are supported by Remote Console?
Why does the Remote Console link not appear on the WebMarshal Home page?

Information:

The WebMarshal Remote Console is implemented as a Microsoft ClickOnce application.

Note: Most administrators who require access to WebMarshal administration from their workstation should install the main WebMarshal Console application. Remote Console is provided for administrators who may want to connect without a software installation (for instance, from a user workstation)

This article details the prerequisites and other tips for use of the WebMarshal Remote Console. Prerequisites generally follow the prerequisites for the WebMarshal Console standard installation.

For some common error messages see the Common Problems section below.

Note: Issues using the Remote Console with UAC are resolved at WebMarshal 7.4.5

Prerequisites:

WebMarshal Remote Console requires the following items on the client workstation:

For version 7.X:
- .NET Framework 4.6.2
- Microsoft Visual C++ 2015 redistributable
For versions 6.10 through 6.12, .NET Framework 4.0
For 6.8 and 6.9, .NET 3.5 SP1
A web browser that supports the Microsoft ClickOnce functionality
- Edge Chromium, with ClickOnce support enabled (see edge://flags)
- Mozilla Firefox current versions may be usable with the ClickOnce extension from Breez (this extension is not supported or warranted functional by LevelBlue)
- Google Chrome may be usable with the ClickOnce extension from Menarva (this extension is not supported or warranted functional by LevelBlue)
Browser configured to use WebMarshal as proxy.
For any browser:
- You must have the Windows Internet Options proxy settings configured to use WebMarshal. The ClickOnce functionality uses these proxy settings.
- You may need to add http://webmarshal.home to the Trusted Sites zone.

Authentication:

To allow use of Remote Console you must grant access in two places:
1. Enable users to run the Remote Console, in WebMarshal Global Settings > Remote Console
2. Grant users access to Console features, using the WebMarshal Security Tool. The settings you make here affect access from both the Remote Console and the installed Console. By default, members of the Administrators group on the WebMarshal Array Manager server have full access.

Remote Console link:

Users access the Remote Console using a link on the WebMarshal Home page.

This link is generated as part of the {Options} tag found in the default template for the WebMarshal Home page. If you customized your WebMarshal Home page and removed this tag, the Remote Console link will not display.

To display the link, ensure the {Options} tag is included in the body of the WebMarshal Home page.

Common Problems:

Error message: "Cannot Start Application.": Cause 1: Using an unsupported browser (such as Google Chrome with no plugin).
Cause 2: Using another browser, but the system proxy setting is not configured to use the WebMarshal server. Both the system and browser proxy settings must be configured to use the WebMarshal Server.
Error message: "Failed to load snapin module" or "Could not load file or assembly": Cause: .NET Framework is not installed or not up to date.
Error message: "Cannot download the application" "Manifest.exe not found": Detailed error: Could not find file 'C:\Users\Administrator\Downloads\MarshalConsole.exe.manifest'; Cause: using Edge Chromium without enabling ClickOnce Support, or Google Chrome without third party extension.
Error message: "Deployment and application do not have matching security zones.": Cause: http://webmarshal.home is not added to the Internet Options Trusted Sites zone.
Error message: "The Execution level requested by this application is not supported.": Cause: UAC is enabled. This issue affects 7.X versions below 7.4.5. To resolve the error, upgrade to 7.4.5 or above.

What browsers can I use with WebMarshal?

Charles — Sun, 15 Mar 2026 21:06:11 GMT

This article applies to:

WebMarshal

Question:

What browsers can I use with WebMarshal?
Does WebMarshal work with handset browsers?
Does WebMarshal work with Apple browsers?

Reply:

WebMarshal supports client connections from current versions of major browser software running on any operating system, as well as non-browser applications that can use proxy servers.

WebMarshal also works with client software on handset devices that meet the technical requirements described below (subject to the limitations of the devices).

The relevant open standards are Internet RFC 2616 (HTTP 1.1) and Internet RFC 2617 (HTTP Authentication).

The following information applies to WebMarshal as a standalone proxy.

WebMarshal user authentication supports client connections from software that implements RFC 2616 and RFC 2617, and can be configured to use an explicit proxy server.
WebMarshal NTLM (Windows integrated) authentication requires client software that implements NTLM.
- WebMarshal NTLM authentication is known to work with most current web browsers on the Windows platform. Browsers on other platforms can usually work with some additional setup.
WebMarshal IP authentication supports connections from software that implements RFC 2616 and can be configured to use an explicit proxy server.

LevelBlue does not test third party browsers for conformance to the RFCs. However the following browsers are known to work with WebMarshal :

Microsoft Edge
Firefox current versions (Windows, Linux, Mac)
Google Chrome current versions (Windows, Mac, Android)
Safari 3.2.2 and above (Windows)
Safari (Mac) - latest versions
Opera 8 and 9 (Windows)
Google Chrome (Windows, Mac, Android)
Mobile-safari (iPod Touch, iPhone)
Opera Mobile (Symbian S60 v3)
Nokia browser (Symbian S60 v3)
Internet Explorer (although this browser is obsolete and deprecated)

Configuring advanced settings for FTP proxy

Charles — Sun, 15 Mar 2026 21:03:21 GMT

This article applies to:

WebMarshal 6.1 and above

Question:

What is the behavior of WebMarshal with proxied FTP connections?
Using non-browser FTP clients (such as FileZilla or WinSCP) through WebMarshal when HTTPS inspection is enabled

Information:

Non-browser FTP clients use a HTTP proxy such as WebMarshal by issuing a HTTP 1.1 CONNECT request to the proxy (requesting a connection to the remote FTP control port, usually port 21). The server replies with a passive FTP connection on a high port.

In WebMarshal 6.1 through 6.5.3, when HTTPS inspection is enabled, these connections fail. The initial CONNECT request is treated as a request to create a SSL tunnel. The FTP data connection is not allowed.
In WebMarshal 6.5.5 and above, WebMarshal examines the content of the CONNECT request to determine if it is a FTP connection. FTP connections that are established in this way are allowed and the content is inspected as with any other FTP connection.

Configuration:

You can choose to disable the checking of the CONNECT requests, or the inspection of the FTP content sent through these connections (in WebMarshal 6.5.5 and above).

Configure these settings by adding an entry in the WebMarshal Proxy Configuration file (WMProxy.config.xml) as follows:

<WebMarshal>   <Proxy>     <Config>        <FTP detectFtpTunnels="{value}" processTunnelFiles="{value}" />     </Config>  </Proxy></WebMarshal>

Where each value can be true or false.

Enter the values in lower case, not including the {} braces, but including the quote marks.

detectFtpTunnels indicates whether the Proxy will sniff CONNECT tunnels to see if they are for an FTP control channel. This is needed to pick out the IP address and port that the client will attempt to connect to. Default (if not present): true. If set to false, and HTTPS inspection is enabled, these connections will fail.

processTunnelFiles indicates whether the Proxy should intercept the data connections and treat them as file requests instead of SSL tunnels. This is what allows the WebMarshal Engine to process the files as standard FTP requests. If set to false, the data connections will simply be treated as non-inspected SSL connections and the content will NOT be scanned in any way. Default (if not present): true.

Notes:

This article does not apply to web browsers accessing FTP. They do not use the method described here. Connections from browsers should succeed regardless of HTTPS inspection.
The issue with connections from non-browser clients only applies when HTTPS content inspection is enabled.
WebMarshal cannot proxy connections that use FTPS (FTP over TLS/SSL).
For general information about editing XML settings files, see article Q12705.

WebMarshal HTTPS inspection and SSL/TLS versions

Charles — Sun, 15 Mar 2026 21:02:05 GMT

This article applies to:

WebMarshal 6.1 and above
- Note changes at version 7.3, 6.12, and 6.11
HTTPS Content Inspection
SSL/TLS version settings

Question:

How does WebMarshal HTTPS content inspection affect SSL/TLS settings?

Information:

SSL (secure sockets layer) and TLS (Transport Layer Security) are the protocols that allow web browsers and web sites to communicate securely using HTTPS.

The following versions of SSL/TLS algorithms are currently supported by WebMarshal:

SSLv2 (the original protocol, less secure and now deprecated)
SSLv3 (also considered less secure)
TLSv1.0
TLSv1.1 (WebMarshal 6.11 and above)
TLSv1.2 (WebMarshal 6.11 and above)
TLSv1.3 (WebMarshal 7.3 and above)

When a web browser connects to a site using HTTPS, the browser and the site negotiate an encryption algorithm, based on the algorithms that they share (usually the most secure available). This algorithm is used to create the encrypted connection.

Some recent security standards (such as the US Government FIPS) require use of TLSv1.0 (or above).
All recent web browsers support the latest TLS versions.
Some recent web browsers have completely disabled support for legacy options by default.

How WebMarshal affects SSL

When WebMarshal HTTPS Content Inspection is enabled, two secure connections are required: one between the browser and WebMarshal, and another between WebMarshal and the web site. These connections are negotiated separately. WebMarshal supports all three algorithms.

If a remote site does not support the strongest algorithms, by default WebMarshal will use any available algorithm. The algorithm used is not reported to the browser. Therefore, even if a user sets their browser to refuse SSLv2, the Internet connection through WebMarshal could still be using SSLv2.

WebMarshal SSL Options

You can configure WebMarshal HTTPS rules to accept or refuse a SSL protocol (using the rule condition "Where the security protocol is". WebMarshal can warn a user, or block a connection, if a lower security algorithm is in use.

If SSL security is important to your organization, and you are using WebMarshal HTTPS inspection, you should configure WebMarshal rules in support of your SSL security policy.

Change in version 7.3 and above

TLSv1.3 is supported in 7.3 and above.

Change in version 6.12 and above

SSLv2 is no longer supported through WebMarshal.
All configuration options related to SSLv2 are removed from WebMarshal as of version 6.12.
When HTTPS inspection is enabled, LevelBlue recommends you use the rule condition "Where SSL/TLS could not be negotiated" to block any attempt to connect with SSLv2.
A rule to block connections "Where SSL/TLS could not be negotiated" is created and enabled on new installation and on upgrade.
SSLv3 is blocked by default as for version 6.11 (see below).

Change in version 6.11

When HTTPS Content Inspection is enabled, connections that use SSLv2 or SSLv3 are blocked by default regardless of rule conditions. To configure the list of SSL and TLS protocols that will be negotiated and allowed, see LevelBlue Knowledge Base article Q20067.

Notes:

When WebMarshal HTTPS Content Inspection is not enabled, or if HTTPS Content Inspection is not enabled for a particular site, the secure connection is made directly between the browser and the site. The settings in the browser control the protocols that are accepted.
You can select TLS/SSL options for Internet Explorer from the Windows Internet Options > Advanced tab, Security section.

How do I configure my web browser to use the WebMarshal HTTPS Root Certificate?

Charles — Sun, 15 Mar 2026 20:58:34 GMT

This article applies to:

WebMarshal 6.X and 7.X
Edge browser
Firefox
Chrome
Opera
Safari
Windows services

Question:

How do I configure my web browser to use the WebMarshal security certificate?
How do I configure an application that runs as a Windows service to use HTTPS Root Certificate?

Information:

The WebMarshal HTTPS Root Certificate can be used by any web browser. For help on its installation, see your web browser's help. This article provides guidance for some common browsers.

If you use Edge or other compliant browsers in a Windows domain, the easiest way of setting up the HTTPS Root Certificate is with Group Policy. For details, see the following article:

Q12014 : How do I push the WebMarshal HTTPS Root Certificate to all users in an organization using Microsoft windows group policy?

If you use other browsers and applications, there are a number of other ways to set up use of the WebMarshal HTTPS Root Certificate.

The recommended way is by accessing the http://webmarshal.home/ website from your web browser. See below.
The alternative way is to export the WebMarshal HTTPS Root Certificate which is detailed further below.
For applications that run as Windows services and update over the web, you can import the WebMarshal HTTPS Root Certificate to the Local Computer Certificate Store.
For the Sun Java Runtime Environment (JRE), you may need to import the WebMarshal HTTPS Root Certificate to the Java Certificate Store.

Edge
Google Chrome

Click Install Root content inspection certificate. Then click Open file.
Click Install Certificate and click Next.
Select Place all certificates in the following store.
Browse to the Trusted Root Certification Authorities store and click OK.
Click Next then Finish. Click Yes to the Security Warning.

Note: In some versions of Windows the option 'automatically select the certificate store' does not select the Root store. The above instructions work for all versions as of the date of this article.

Opera

Click Install Root content inspection certificate.
Click Install and click OK.

Firefox

Click Install Root content inspection certificate. Check the Trust this CA to identify web sites box.
Click OK.

Safari

Click Install Root content inspection certificate.
Press CTRL and click the Mouse Button. Click Open.
Click OK to add the Certificate to the KeyChain for the login.
Click Always Trust. Enter the Administrators Username and Password.
Click Lock the Login Key Chain.

Note: Some versions of Safari may not display the http://webmarshal.home/ website correctly.

Other Applications

To allow Windows services to access HTTPS sites through WebMarshal, import the Root Certificate into the Local Computer certificate store.

Note: MailMarshal SMTP does not require this action. For help with MailMarshal SMTP SpamCensor updating, see article : Q11718.

Click Install Root content inspection certificate. Then click Open file.
Click Install Certificate and click Next.
Select Place all certificates in the following store. Click Browse.
On the Select Certificate Store window, check the box Show Physical Stores.
From the list, expand Trusted Root Certification Authorities, and select the Local Computer entry.
Click OK.
Click Next then Finish.

Installing an exported WebMarshal HTTPS Root Certificate

Follow the instructions below if you want to install a HTTPS security certificate that was exported from WebMarshal.

Edge or Chrome

Generally use the system install method mentioned above. For advanced customization of certificates:

In Edge or Chrome settings, select Privacy, Search, and Services.
Select Security > Manage Certificates.
You can choose to manage the system store, or install custom certificates. If you install custom certificates, you may need to install both trusted and intermediate certificates.

Firefox

In Firefox settings, search for Certificates and click View Certificates.
Select the Authorities tab.
Click Import and browse to the certificate exported from WebMarshal.
Click OK.

Opera

Open Opera click on Tools and select Preferences.
Select the Advanced tab and then the Security option in the left pane.
Click the Manage Certificates button.
Click Import. Select All Files from the Files of type field. Browse to the certificate exported from WebMarshal.
Click OK and OK again.

Safari

Safari uses Apple's KeyChain technology for managing Security certificates.

How do I push the WebMarshal HTTPS Root Certificate to all users in an organization using Microsoft windows group policy?

Charles — Sun, 15 Mar 2026 20:21:08 GMT

This article applies to:

WebMarshal 6.X and 7.X

Question:

How do I push the WebMarshal HTTPS Root Certificate to all users in an organization using Microsoft windows group policy?

Procedure:

Follow the steps below to push the WebMarshal HTTPS Root Certificate to all users on the network:

Log onto the Domain Controller machine and open Administrative Tools.
Double click on Active Directory Users and Computers.
Right click on the domain and select Properties. Select the Group Policy tab.
Click New to create a new Group Policy Object.
Select a relevant name for the new object. Click Edit on the new object.
In Group Policy Object Editor expand Computer Configuration and then expand Windows Settings.
Expand Security Settings then Public Key Policies and right click on Trusted Root Certification Authorities in the left pane and select Import.
Follow the prompts and select the Security Certificate you have exported from the HTTPS Content Inspection window on the Server and Array Properties dialogue window in WebMarshal - Tools > Server and Array Properties. See User Guide and Help for more information.
Close all the windows.

Notes:

To configure the Security Certificate for use with browsers that do not use the Windows certificate store, see the following article.

Q12015 How to configure your web browser to use the WebMarshal HTTPS Root Certificate

LevelBlue Knowledge Base » Knowledgebase » Latest Articles

Upgrading SQL Reporting Services to SQL 2022

This article applies to:

Question:

Procedure:

Notes:

Upgrading SQL Reporting Services to SQL 2022

This article applies to:

Question:

Procedure:

Notes:

How do I notify LevelBlue of new Spam so MailMarshal files can be updated?

This article applies to:

Question:

Before you start:

Procedures

Spam that was not identified:

Microsoft Report Button

Console Buttons/Forward

Manual Forward

False positives:

Processing of submissions

Engine stops with faulting module openvino.dll

This article applies to:

Symptoms:

Causes:

Resolution:

Uninstalling MSOLEDBSQL for MailMarshal SQLExpress installation

This article applies to:

Question:

Response:

Procedure:

Notes:

Upgrading MailMarshal Service Provider Edition to a newer version

This article applies to:

Question:

Procedure:

Upgrading to version 5.3 from 5.2:

Upgrading to version 5.2 from 4.3:

Upgrading to version 4.X:

Notes:

What are the Release Notes for MailMarshal SPE 5.2?

This article applies to:

Question:

Information:

Upgrade to 5.2 from 4.3.5 only

Detailed Upgrade Steps

Disaster Recovery for MailMarshal SPE

This article applies to:

Question:

Procedure:

Preparedness

Re-installation

Notes:

Enabling Strong TLS for .NET

This article applies to:

Question:

Procedure:

Notes:

Supported Operating Systems and Prerequisite Versions

This article applies to:

Question:

Information:

Key:

Operating Systems and Prerequisites

Server Operating Systems

Workstation Operating Systems(for server installation)

Prerequisites

SQL Server Versions

Notes on MRC Installation

Latest versions of Unpacker and Filetype for MailMarshal (SEG) and ECM

This article applies to:

Question:

Information:

Latest File Versions

MailMarshal (SEG) Supported Versions

MailMarshal (SEG) Older Versions

ECM

What file types are recognized by MailMarshal (SEG) and ECM?

This article applies to:

Workstation Operating Systems
(for server installation)