Release Notes
Websense® Web Security
Websense Web Filter
Version 7.1
New in this version
Websense Web Security and Websense Web Filter version 7.1 is an English-only release.

Expanded platform support
Websense Web Security and Websense Web Filter version 7.1 introduces support for Microsoft
Windows Server 2008 (Standard, Enterprise, and Datacenter) installed in 32-bit native mode.
This version also introduces support for Windows Active Directory 2008.

Websense Manager
Save All functionality has been enhanced. To ensure that changes are properly cached (or consciously
abandoned), a new feature disables the Save All and View Pending Changes buttons on some Policy
Management pages until you click OK or Cancel.
In addition, there are several new Health Alert messages (displayed in summary form on the Status >Today page, or at greater length on the Status > Alerts page). These include:

There is low disk space on a Websense Manager machine.
This can create problems generating presentation reports, or cause other performance problemson the machine.



There is low (warning) or critically low (error) disk space on a Log Server machine.
This can cause logging to become intermittent or to stop completely.



There is low disk space on a Filtering Service machine.
This condition can prevent Master Database downloads and updates.



There is low memory on a Filtering Service machine.
This can prevent Filtering Service from applying Master Database updates.



There is high CPU usage on the Filtering Service machine.
This can cause slow browsing or incorrect filtering for users, and may indicate a need for
additional Filtering Service instances.



There is low memory on a Network Agent machine.
This can prevent Network Agent from starting, or cause incorrect filtering.



There is high CPU usage on the Network Agent machine.
This can result in incorrect filtering and logging.



The ApacheTomcatWebsense service cannot connect to Log Server.
Version 7.1 Release Notes

1

When this occurs, presentation report jobs being scheduled are not saved properly, and are lostwhen the ApacheTomcatWebsense service is restarted. In addition, reports on the Status > Todayand History pages, or on the Presentation Reports page, may contain no data, even though data is
being stored properly in the Log Database.
One or more scheduled presentation reports failed.
Use the Presentation Reports > Scheduler page to find out which jobs failed.

Reporting
The process for creating and editing custom presentation reports has been simplified.
To better distinguish between reports that can and cannot be directly edited, predefined reports are
now called report templates, and marked with a template icon. Like before, generate reports from areport template by clicking Run, and selecting the dates to be included.
You can now click Save As to copy a report template and name the copy in a single step, creating acustom, editable report. Then, you can edit the report filter immediately, selecting specific clients,
categories, protocols, or actions to include. Alternatively, you can return to the Report Catalog andedit the report filter later.
Custom reports are now marked with a custom icon. Select any custom report and click Edit tomodify the report filter.
In addition, new Status > Today and History charts, as well as new presentation reports, provide
insight into the content scanning performed by Websense Content Gateway or Websense Web
Security Gateway. (Your subscription must include content scanning to enable this feature.)

Delegated administration
In order to allow administrators to log on to Websense Manager using their network logon, you must
use the Settings > Logon Directory page to configure communication with a directory service. Now,
if you are using the same directory to validate administrator logons that you use to identify directory
clients (users, groups, etc.), you can copy settings from the Directory Services page to the Logon
Directory page, rather than entering the same settings twice.

Fixed in this version
Several hotfixes (patches) created for previous releases have been incorporated into this version.

Installation and upgrade

Microsoft SQL Server and MSDE passwords are no longer recorded in plain text in Websense
log files.

Upgrading a system whose v6.x Policy Server configuration file (config.xml) contains an
exceptionally large number of category sets no longer causes Master Database load problems for
Filtering Service (v7.0 Hotfix 03).

Websense Manager (general)2When an internal error occurs, a generic error page is displayed, without a stack trace (v7.0
Hotfix 21).

Websense Web Security and Websense Web Filter

It is now possible to configure whether the User Service cache is rebuilt when changes are savedin Websense Manager to prevent potential filtering problems (v6.3.2 Hotfix 35).

Websense Manager (Policy Management > Filter Components)
Category names that include a comma can be edited correctly (v7.0 Hotfix 08).



Valid URLs can now be recategorized correctly (v7.0.1 Hotfix 01).

Websense Manager (Policy Management > Clients)


Directory entries (users, groups, and so on) are now displayed in alphabetical order on the Clients
page, with domains appearing first, then groups, then individual users (v7.0 Hotfix 13).

During the process of adding a client, results returned from the directory service are now
alphabetized. Additionally, when more than 500 objects are returned by Active Directory in
Mixed Mode, the pages appear in alphabetical order (v7.0 Hotfix 13).



An occasional problem with a Java error on the Clients page has been addressed, and Computer
and Network clients are now displayed correctly (v7.0 Hotfix 08).

A network client can be added without problems when the first value in the second IP address isgreater than 127 (for example, 1.1.1.1 - 128.0.0.0) (v7.0 Hotfix 08).



A problem that caused only a single computer client (IP address) to be added when an
administrator attempted to add a network client has been corrected (v7.0 Hotfix 13).

When an administrator adds directory clients in Websense Manager, more than one global catalog
server can be queried (v7.0 Hotfix 08).



When a root context is specified for an Active Directory forest, Websense Manager now displays
only objects beneath that context, instead of displaying the entire forest (v6.3.2 Hotfix 32).



A problem that caused an error—“The user cannot be added to the current role. A policy has
already been assigned to this user in role: Super Administrator”—to be displayed, even when theclient being added did not have a policy assigned in any role, has been corrected. WebsenseManager now ignores and overwrites managed clients that were mistakenly carried over during
the upgrade from 6.3.x (v7.0 Hotfix 21).

Websense Manager (Settings > General > Policy Servers)
The Policy Server list no longer includes duplicate entries after being edited (v7.0 Hotfix 13).

The page loads normally, regardless of the number of Policy Servers listed. Likewise, having
many Policy Servers no longer impacts the speed with which changes can be made on the page(v7.0 Hotfix 13).

When more than 25 Policy Server instances are associated with one Websense Manager, theentire list can be seen (v7.0 Hotfix 13).

Reporting tools (general)

The WebsensePing and TestLogServer tools now properly show custom URLs as recategorized(v7.0 Hotfix 03).



Log Server no longer continues to query the database without pause if no user is returned by abatch query, reducing CPU usage (v6.3.2 Hotfix 42).

After users are moved to a different Active Directory organizational unit (OU) or container, Log
Server now properly updates these users (v6.3.2 Hotfix 38, 42).

Version 7.1 Release Notes

3

When a URL exceeds the length allowed by the Log Database, the URL is truncated, and thecorresponding BCP cache files are moved to the database (v6.3.2 Hotfix 52).

When a Cisco PIX integration sends malformed records to Log Server that contain more than255 characters in the protocol field, those records can now be saved in the Log Database andincluded in reports (v6.3.2 Hotfix 38, 42).

A configurable LogServer.ini parameter has been added to resolve an issue that caused highCPU usage in networks that have many users, and assign each user to many groups (v6.3.2
Hotfix 31, 42).

At sites using multiple, distributed Log Servers, temporary log files in the cache folder are now
processed normally. This addresses issues with the cache folder size (v6.3.2 Hotfix 46).

Log Server now successfully moves cache files to the directory specified by the
MoveCacheFilePath parameter in the LogServer.ini file, and clears those files from the cachedirectory. If there is a sharing violation, Log Server retries the move until it is successful.
Additionally, Log Server now moves only cache files to the directory specified by the
MoveCacheFilePath parameter when the parameter is set to true. BCP files are not moved(v6.3.2 Hotfix 21, 42).

Database rollover to a new partition now occurs normally when the database path in on the
Settings > Reporting > Log Database includes non-English characters (v6.3.2 Hotfix 41).



The WebCatcher scheduler program now starts properly on European operating systems (v7.0.1
Hotfix 02).

Today and History reports


The Current Filtering Load chart no longer drops to zero after plotting the last data value, better
demonstrating that filtering is occurring successfully (v7.0 Hotfix 08).



Presentation reports and the Today and History reports now display properly when Microsoft
SQL Server uses a non-standard port (v7.0 Hotfix 13).

Investigative reports

4

Correct values now appear in detail reports that include source IP address and destination IP
address (v7.0.1 Hotfix 03).

The “Anonymous” option can now be used to hide both user name information and source (user)
IP addresses (v7.0 Hotfix 10).

Investigative reports can now successfully generate reports that include URL hostname from av6.3.x Log Database (v7.0 Hotfix 02).



The Help link and Help menu now display correctly on the User Detail by Day report wheninvestigative reports are generated from a v6.3.x Log Database (v7.0 Hotfix 02).



Investigative reports now use UTF-8 encoding, addressing various problems with the generationand display of reports containing non-ASCII characters. Any information with ISO-8859-1
encoding is converted to UTF-8 (v7.0 Hotfix 02).



Investigative reports are no longer truncated by default during export to PDF or Excel format if
there are more than 10,000 rows. Use the wse.ini flag "sendMulti=1" to revert to the previous
truncation to 10,000 rows (v6.3.2 Hotfix 20).



Investigative reports showing the top <element> by <element> (for example, Top URL
Hostnames by Category) can now be exported to PDF or Excel format (v7.0 Hotfix 10).

Websense Web Security and Websense Web Filter



Drill-down reports that show the top 50 or more <grouping> by <grouping> within a <grouping>(for example, Top 50 Categories by Action within a Risk Class, or Top 75 Users by Day
accessing a Protocol) can now be exported to PDF (v7.0.1 Hotfix 03).



Reports that include a URL Hostname with incomplete HTML tags or control characters whose
ASCII code is in the range 0x00-0x1F can now be exported to PDF (v6.3.2 Hotfix 28).



Reports that include full URLs can now be exported to PDF when the URL contains the unpaired
string “^^” (v6.3.2 Hotfix 41).

When Browse Time is one of the default columns in a summary report, it is now possible to click
Modify Report and change to a Detail report without removing the Browse Time column (v6.3.2
Hotfix 20).



Detail reports now display the domain correctly when an OU contains Traditional Chinesecharacters (v6.3.2 Hotfix 49).

A single quote (‘) in Active Directory group names or user names no longer prevents Favorite
reports from being saved or reports from being run on managed clients (v6.3.2 Hotfix 20).



Users defined in Active Directory are now correctly associated with groups in reports, regardlessof any special characters in the user’s path (v6.3.2 Hotfix 16).

User names defined in a Sun Java System directory service are correctly displayed according toadvanced directory attributes (v6.3.2 Hotfix 16).

Delegated administrators whose fully qualified domain name contains more than one backslash(\) can now access the Schedule link on the Favorites page (\) (v6.3.2 Hotfix 28).



Individuals whose fully qualified domain name includes the tilde (~) symbol now successfullyreceive emailed scheduled reports (v6.3.2 Hotfix 20).

When investigative reports request information from Policy Server, the response is now properly
validated, protecting Information Service from failures (v6.3.2 Hotfix 28).



Delegated administrators whose OU contains an ampersand (&) can now run or delete Favorite
reports (v6.3.2 Hotfix 28).



Delegated administrators with managed clients whose OU contains Traditional Chinesecharacters can now generate Internet Use by Ports reports (v6.3.2 Hotfix 49).

Delegated administrators with permissions to view investigative reports for managed clients only,
save Favorite reports, and schedule Favorite reports can now successfully access reporting inenvironments with a non-English version of Microsoft Windows 2003 and SQL Server 2005
(v6.3.2 Hotfix 41).

Presentation reports


The Top N reports did not allow administrators to specify more than Top 20. It is now possible tospecify up to the Top 200. Note that the graph may not display in the report when you use a large
Top N value. This is expected behavior (v7.0 Hotfix 08).



Presentation reports and the Today and History reports now display properly when Microsoft
SQL Server uses a non-standard port (v7.0 Hotfix 13).

Administrators can now successfully edit and save copied presentation reports (v7.0 Hotfix 13).

Version 7.1 Release Notes

5Filtering Service

A problem that prevented Filtering Service from downloading new databases when under heavyclient load has been corrected (v6.3.1 Hotfix 111, 126, v6.3.2 Hotfix 11).
If you enable the /3GB switch in the Windows Boot.ini file, Filtering Service uses the additional
memory available to improve download success for both the full Master Database andincremental database changes. (See Microsoft Knowledge Base article ID 823440 for
information on enabling this switch and fine-tuning the system performance.)When Filtering Service receives HTTP headers that do not adhere to HTTP protocol, instead of
rejecting the request, the non-compliant HTTP headers are processed, and normal filtering
occurs. No connections are lost (v6.3.1 Hotfix 104, 126, v6.3.2 Hotfix 11).



A problem in which URL strings with certain characteristics could cause Filtering Service tostop filtering has been corrected (v6.3.1 Hotfix 106, 126).

Enabling Real-Time Security Updates no longer causes an unexpectedly high increase in
Filtering Service CPU usage (v6.3.2 Hotfix 11).

User identification
User Service uses a more efficient LDAP search filter for Active Directory to speed up theprocess of applying policies to users (v6.3.1 Hotfix 130).

When a valid third-party certificate is issued by an intermediate certificate authority and installed
to enable Secure Manual Authentication, browsers no longer return certificate errors (v7.0 Hotfix
23).

A problem with users being correctly identified by transparent identification agents, and error
logs showed that communication between Filtering Service and the agent had stopped, has beencorrected. TCP Keep-alives have been enabled on the connections to improve the ability todetect and recover from this connectivity failure (v6.3.1 Hotfix 111, 126, v6.3.2 Hotfix 11).

When the ignore.txt file contains user names that include non-ASCII characters, as long as thefile is saved with UTF-8 encoding, DC Agent now correctly identifies the users (v6.3.2 Hotfix
26).



Websense DC Agent no longer incorrectly reports a user’s name with more than one domain
name, and the correct filtering policy is applied (v7.0 Hotfix 11).

Websense eDirectory Agent performs full query lookups with NMAS when QueryMethod=3 is
set in wsedir.ini (v7.0 Hotfix 07).



The logon application (LogonApp.exe) is now able to authenticate using NTLM on systems
patched with Microsoft Windows software update KB960803 (v7.0.1 Hotfix 15).

Delegated administration6Websense user accounts that include a hyphen (like “report-auditor”) can now be added todelegated administration roles (v7.0 Hotfix 08).



Policies that include a limited access filter (yes list) can be successfully applied to clients in adelegated administration role (v6.3.2 Hotfix 11).

Delegated administrators can now look up clients or URLs in Websense Manager without errors(v7.0 Hotfix 8).

Websense Web Security and Websense Web Filter

Block pages
The “more information” section of the block page displays the correct week day name when a siteis blocked based on a time-based policy on English-language operating systems (v6.3.2 Hotfix
11).

Continue block pages display a different “more information” message than standard block pages(v6.3.2 Hotfix 11).

Remote FilteringMachines with Remote Filtering Client installed can now access application services that use thesame IP address as Remote Filtering Server (v6.3.2 Hotfix 6).

On machines with Remote Filtering Client installed that use a wireless connection, quota time
can now be used (v6.3.2 Hotfix 40).

Services and daemons (general)

Websense Web Filter daemons stop gracefully when signaled to shut down (v7.0 Hotfix 15).

Websense services stop properly when signaled to do so (v7.0 Hotfix 20).

Integrations


If category descriptions are not successfully transmitted to NetCache, Filtering Service retries
until it is successful, minimizing the errors recorded in the NetCache log (v6.3.1 Hotfix 131).

When a Cisco PIX integration sends malformed records to Log Server that contain more than 255
characters in the protocol field, those records can now be saved in the Log Database and included
in reports (v6.3.2 Hotfix 38, 42).

Operation tips
To improve your experience with Websense Manager:

Make use of the Quick Start tutorials offered when you launch Websense Manager. The tutorials
can also be accessed from the Help menu.


If this is your first experience with Websense filtering software, use the New User Quick
Start tutorial to learn about basic configuration, filtering policy creation, and reporting.



If you have used previous versions of Websense filtering software, use the Upgrading User
Quick Start tutorial to orient yourself to the new features in version 7 (if upgrading fromversion 5.x or 6.x), or in version 7.1 (if upgrading from version 7.0 or 7.0.1).

Disable all browser pop-up blocking features.

Install or permanently accept the Websense security certificate the first time you launch
Websense Manager. Instructions are available from the Knowledge Base (kb.websense.com).



Avoid using the browser Back and Refresh buttons. Instead, use the breadcrumbs at the top of thepage or the left and right navigation panes.

After entering your subscription key, perform system configuration tasks on the Settings pages
while the Master Database downloads. After the download is complete, log off and log on again
before accessing any policy management features.

Version 7.1 Release Notes

7



Click OK at the bottom of each page in Websense Manager to cache changes made on thepage.
In some instances, when you are performing secondary tasks, you must click OK on thesecondary page, and then click OK again on the main page to cache your changes. Make sure
you see the “Changes have been cached” success message.



Click Save All (at the top of the right shortcut pane) to implement cached changes.
It can take up to 30 seconds for all Websense components to be updated with the changes.

To improve your experience with Websense reporting tools (Windows):
To create a new presentation report, click Save As to create and name a copy of the existing
report. You can then edit the report filter immediately, or return to the Report Catalog and edit
the report later.



If you install Websense Manager on a Windows machine, and later install Log Server, manuallyrestart the ApacheTomcatWebsense service on the Websense Manager machine. This ensuresthat reporting data appears in Websense Manager, and that scheduled jobs are properly stored in
the Log Database.

Known issues
Upgrade

During the process of upgrading to v7.1, the wse.ini file located by default in the C:\Program
Files\Websense\Webroot\Explorer directory is overwritten. Customizations to the file are lost. If
you have made changes to the file, make a backup copy before starting the upgrade process.

Uninstall

When uninstalling Websense distributed services on Linux, uninstall Policy Broker last. The
uninstall program does not check to make sure that other services have been removed before
uninstalling Policy Broker. If you encounter problems with uninstall functionality, contact yourTechnical Support representative or Sales Engineer for assistance.



If you uninstall Websense components on a Windows machine, do not cancel the uninstall
process. Attempts to cancel result in an error, and the Add/Remove Programs dialog box hangs.



If you have integrated your Websense software with Microsoft ISA Server, you must stop thefirewall before running the uninstall process in order to remove Websense files from theMicrosoft ISA Server directory.



If you remove Websense components from a Windows 2008 machine, either log in as the default
administrator to run the uninstall program, or make sure that the program runs with elevated (fulladministrator) permissions.

Websense Manager

8

If your Websense Manager session times out while a reporting page is open, you may be
prevented from logging back on with full administrator privileges. In most cases, restarting theApacheTomcatWebsense service resolves this issue.



If a delegated administrator attempts to create a new category filter based on a template the firsttime he or she logs on to Websense Manager, an internal error occurs. Subsequent attempts tocreate the filter succeed, and the error does not recur.

Websense Web Security and Websense Web FilterWhen Websense Web Filter or Websense Web Security is integrated with Websense Content
Gateway, and an administrator adds an entry to the Exceptions tab of the Settings > Scanningpage and clicks OK, the administrator is logged off of Websense Manager. This does not occur
with a Websense Web Security Gateway subscription.

Other components
On Linux machines, the Policy Server and User Service daemons do not restart automaticallywhen the system reboots after a power failure. In this situation, use the./ WebsenseAdmin stop command to manually stop all Websense daemons, use the kill -9
command to kill the Websense processes, and then use the ./WebsenseAdmin start command torestart the Websense daemons.



If you are using Logon Agent for transparent user identification, and users are logging on to
Microsoft Windows Vista machines, default Vista configuration prevents the logon applicationfrom sending information to Logon Agent.

Remote Filtering clients who use Mozilla Firefox 3 and fail to provide correct credentials when
prompted for logon information do not receive an error message to indicate why they cannot
access the Internet.

Windows 2008 ServerOperating system security settings may prevent a Websense Manager shortcut from appearing
automatically on the Windows 2008 Server desktop. If this occurs, you can create a shortcut
manually, or copy the shortcut file from the Windows temporary directory associated with theaccount used to install Websense Manager.

Websense tools, like the Log Server Configuration Utility and the Websense Backup Utility, mustbe run with administrative privileges to function correctly. To elevate the application’s privileges
at run time, right-click the executable and select Run as administrator. As an alternative,
configure the application to always run with elevated privileges (Properties > Compatibility >Privilege level). See technet.microsoft.com/en-us/library/cc709691.aspx#BKMK_S2 for more
information.

Version 7.1 Release Notes

9Further assistanceTechnical information about Websense software and services is available 24 hours a day at:www.websense.com/support/the latest release informationthe searchable Websense Knowledge Base

show-me tutorials



product documents



tips



answers to frequently asked questions



in-depth technical papers

For additional questions, click the Contact Support tab at the top of the page and fill out the online
support form.
If your issue is urgent, please call one of the offices listed below. You will be routed to the firstavailable technician, who will gladly assist you.

10

LocationContact information

North America+1 858-458-2940

FranceContact your Websense Reseller. If you cannot
locate your Reseller: +33 (0) 1 57 32 32 27

Germany

Contact your Websense Reseller. If you cannot
locate your Reseller: +49 (0) 69 51 70 93 47

UK

Contact your Websense Reseller. If you cannot
locate your Reseller: +44 (0) 20 3024 4401

Rest of Europe

Contact your Websense Reseller. If you cannot
locate your Reseller: +44 (0) 20 3024 4401

Middle East

Contact your Websense Reseller. If you cannot
locate your Reseller: +44 (0) 20 3024 4401

AfricaContact your Websense Reseller. If you cannot
locate your Reseller: +44 (0) 20 3024 4401

Australia/NZ

Contact your Websense Reseller. If you cannot
locate your Reseller: +61 (0) 2 9414 0033

Asia

Contact your Websense Reseller. If you cannot
locate your Reseller: +86 (10) 5884-4200

Latin America
and Caribbean+1 858-458-2940

Websense Web Security and Websense Web Filter

Third-Party software notice
Websense, Inc., provides software solutions that integrate with your existing environment. In thecomplex environments that are common in today’s marketplace, this involves interacting with avariety of third-party software products. In some cases, Websense, Inc., makes an effort to simplify
the acquisition of this third-party software. However, you must obtain any upgrades andenhancements to those products directly from the third-party vendor.
If you have questions, contact Websense Technical Support for additional information.

Subscription agreement
IMPORTANT - THIS SUBSCRIPTION IS PROVIDED ONLY ON THE CONDITION THAT THE SUBSCRIBER (REFERRED TO IN
THIS AGREEMENT AS “SUBSCRIBER”) AGREES TO THE TERMS AND CONDITIONS SET FORTH IN THE FOLLOWINGLEGAL AGREEMENT WITH WEBSENSE, INC. AND/OR ONE OF ITS SUBSIDIARIES (“WEBSENSE”). READ THISAGREEMENT CAREFULLY BEFORE ACCEPTING IT. BY CLICKING ON THE “I AGREE” BUTTON BELOW OR BY USING THE
SOFTWARE, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS AGREEMENT AND UNDERSTAND IT, AND THAT (1) YOU,ON BEHALF OF YOURSELF, OR (2) SUBSCRIBER, IF SUBSCRIBER IS A BUSINESS, AGREE TO BE BOUND BY ITS TERMS
AND CONDITIONS.

1. Subscription and Grant of Right to Use.
Subject to the terms and conditions of this Agreement, Websense agrees to provide Subscriber the subscription services (“Subscription”) as
described in the purchase commitment mutually agreed upon between the parties (“Order”). Websense grants to Subscriber as part of the
Subscription a non-exclusive, nontransferable right to use certain proprietary software applications ("Software"), proprietary database(s) of
URL addresses, applications and other valuable information (“Databases”), changes to the content of the Databases (“Database Updates”)
and certain modifications or revisions to the Software (“Software Upgrades”), together with applicable documentation and the accompanying
media, if any, (collectively, the “Products”). The Products are provided for the number of Seats or servers for use in Subscriber’s own internalbusiness operations (not for the benefit of any other person or entity) for the time period set forth herein or in the applicable Order(“Subscription Term”), provided Subscriber has and continues to pay the applicable fees for the Products (“Subscription Fees”). Subject tocompliance with the terms of this Agreement, Subscriber may relocate or transfer the Product for use on a different server within its location.
All fees paid for the Products are nonrefundable. “Seat” means each computer, electronic appliance or device that is authorized to access or
use the Products, directly or indirectly. Subscriber may only exceed the number of ordered Seats if Subscriber increases its Order and pays
additional Subscription Fees. Websense may, at any time, audit the use of the Products remotely or, upon reasonable notice, at Subscriber’ssite. Unless specifically authorized in writing in advance by Websense, Subscriber may not rent, lease or timeshare the Products or provide
subscription services for the Products or permit others to do so. Any source code provided to Subscriber by Websense is subject to the termsof this Agreement. Subject to the terms of this Agreement, Subscriber may allow its agents and independent contractors to use the Products
solely for the benefit of Subscriber; provided, however, Subscriber remains responsible for any breach of this Agreement. Any other use of
the Products by any person, business, corporation, government organization or any other entity is strictly forbidden and is a violation of thisAgreement. Evaluation subscriptions to the Products are provided by Websense subject to the terms and conditions of this Agreement.
Evaluation subscriptions are available for a period of up to thirty (30) days, and may be used only to evaluate and facilitate Subscriber’s
decision to purchase a subscription to Products, and at the end of the evaluation period, Subscriber must pay the applicable Subscription Feesor this Agreement will automatically terminate and Subscriber must comply with the terms of Section 7 below.

2. Technical Support.
Standard technical support includes online website and/or portal access, a reasonable amount of telephone support during business hours,
and Software Upgrades for the Products during the Subscription Term upon payment of the Subscription Fees. Standard technical support isprovided pursuant to the terms of this Agreement and the then-current technical support policies which are available at www.websense.com.
Websense may require Subscriber to install Software Upgrades up to and including the latest release. Enhanced support offerings and services
are available for additional cost and are also subject to the terms of this Agreement. Database Updates and Software Upgrades will be
provided to Subscriber only if Subscriber has paid the appropriate Subscription Fees for all Seats and/or servers.

3. Intellectual Property Rights.
The Products and all intellectual property rights therein and related thereto are the sole and exclusive property of Websense and any third
party from whom Websense has licensed software for incorporation in or distribution with the Products. All right, title and interest in and to
the Products and any modifications, translations, or derivatives thereof, even if unauthorized, and all applicable rights in patents, copyrights,
trade secrets, trademarks and all intellectual property rights in the same shall remain exclusively with Websense and its licensors. The
Products are valuable, proprietary, and unique, and Subscriber agrees to be bound by and observe the proprietary nature thereof. The Products
contain material that is protected by patent, copyright and trade secret law, and by international treaty provisions. All rights not granted to
Subscriber in this Agreement are reserved to Websense. No ownership of the Products passes to Subscriber. Websense may make changes
to the Products at any time without notice. Except as otherwise expressly provided, Websense grants no express or implied right under
Websense patents, copyrights, trademarks, or other intellectual property rights. Subscriber may make a sufficient number of copies of the
Software for its authorized use and may maintain one (1) copy of the Software for backup purposes only. Subscriber may not remove any
proprietary notice of Websense or any third party from any copy of the Products.

4. Protection and Restrictions.
Subscriber agrees to take all reasonable steps to safeguard the Products to ensure that no unauthorized person has access thereto and that no
unauthorized copy, publication, disclosure or distribution, in whole or in part, in any form is made. Subscriber acknowledges that theProducts contain valuable, confidential information and trade secrets and that unauthorized use and/or copying is harmful to Websense.
Subscriber may not directly or indirectly transfer, assign, publish, display, disclose, rent, lease, modify, loan, distribute, or create derivative
works based on the Products or any part thereof. Subscriber may not reverse engineer (except as required by law in order to assure

Version 7.1 Release Notes

11interoperability), decompile, translate, adapt, or disassemble the Products, nor shall Subscriber attempt to create the source code from theobject code for the Software. Any third party software included in the Products may only be used in conjunction with the Products, and not
independently from the Products. Subscriber may not, and shall not allow third parties to, publish, distribute or disclose the results of any
benchmark tests performed on the Products without Websense’s prior written approval. Subscriber represents and warrants that it willcomply with all laws, rules and regulations which apply to its use of the Products. Subscriber further represents and warrants that theProducts will not be used to filter, screen, manage or censor Internet content for consumers without (a) permission from the affectedconsumers and (b) Websense’s express prior written approval which may be withheld in Websense’s sole and absolute discretion. Additionalcharges may apply if Subscriber assigns more than twenty (20) administrators to administer certain Websense products.

5. Limited Warranty.
For the Subscription Term, Websense warrants that the Products will operate in substantial conformance with the then-current Websense
published documentation under normal use. Notwithstanding the previous sentence, Websense does not warrant that: (i) Products will befree from defects; (ii) Products will satisfy all of Subscriber’s requirements; (iii) Products will operate without interruption or error; (iv)
Products will always locate or block access to or transmission of all desired addresses, applications and/or files; (v) Products will identify
every transmission or file that should potentially be located or blocked; (vi) addresses and files contained in the Products will beappropriately categorized; or (vii) algorithms used in the Products will be complete or accurate. Websense shall use reasonable efforts toremedy any significant Product non-conformance reported to Websense that Websense can reasonably identify and confirm. Websense or
its representative will repair or replace any such non-conforming or defective Products, or refund a pro-rata share of the Subscription Fees
paid for the then-current term, at Websense’s sole discretion. This paragraph sets forth Subscriber’s sole and exclusive remedy andWebsense's entire liability for any breach of warranty or other duty related to the Products. Any unauthorized Product modification,
tampering with the Products, Product use inconsistent with the accompanying documentation, or related breach of this Agreement shall void
the aforementioned warranty. EXCEPT AS EXPLICITLY SET FORTH HEREIN AND TO THE EXTENT ALLOWED BY LAW, THEREARE NO OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIESOF MERCHANTABILITY, NON-INFRINGEMENT, TITLE OR FITNESS FOR A PARTICULAR PURPOSE WITH RESPECT TO THE
PRODUCTS.

6. Limitation of Liability.
TO THE FULLEST EXTENT PERMITTED BY LAW, UNDER NO CIRCUMSTANCES WILL WEBSENSE, ITS AFFILIATES, ITS
LICENSORS OR RESELLERS BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, SPECIAL, PUNITIVE OR
INCIDENTAL DAMAGES, WHETHER FORESEEABLE OR UNFORESEEABLE, ARISING OUT OF OR RELATED TO THISAGREEMENT INCLUDING, BUT NOT LIMITED TO CLAIMS FOR LOSS OF DATA, GOODWILL, OPPORTUNITY, REVENUE,
PROFITS, OR USE OF THE PRODUCTS, INTERRUPTION IN USE OR AVAILABILITY OF DATA, STOPPAGE OF OTHER WORKOR IMPAIRMENT OF OTHER ASSETS, PRIVACY, ACCESS TO OR USE OF ANY ADDRESSES OR FILES THAT SHOULD HAVEBEEN LOCATED OR BLOCKED, NEGLIGENCE, BREACH OF CONTRACT, TORT OR OTHERWISE AND THIRD PARTY
CLAIMS, EVEN IF WEBSENSE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILLWEBSENSE’S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT EXCEED THE TOTALAMOUNT ACTUALLY PAID BY SUBSCRIBER TO WEBSENSE FOR THE APPLICABLE PRODUCTS OVER THE ONE YEARPERIOD PRIOR TO THE EVENT OUT OF WHICH THE CLAIM AROSE FOR THE PRODUCTS THAT DIRECTLY CAUSED THE
LIABILITY.

7. Termination.
This Agreement is effective until the end of the Subscription Term for such use as is authorized, or until terminated by either party.
Subscriber may terminate this Agreement at any time upon notification to Websense. However, Subscriber shall not be entitled to a refundof any prepaid or other fees. Websense may terminate this Agreement if Websense finds that Subscriber has violated the terms hereof. Upon
notification of termination by either party, Subscriber agrees to uninstall the Software, cease using and to destroy or return to Websense all
copies of the Products and to certify in writing that all copies thereof, including backup copies, have been destroyed. Section 3-7, 9 and 11
shall survive the termination of this Agreement.

8. Government Restricted Rights.
The Products are provided with "RESTRICTED RIGHTS." Use, duplication, or disclosure by the U.S. Government is subject to restrictions
as set forth in FAR 52.227-14 and DFAR 252.227-7013 et seq. or its successor. Use of the Products by the U.S. Government constitutes
acknowledgment of Websense's proprietary rights therein. Contractor or Manufacturer is Websense.

9. Third Party Products.
The Products include software products licensed from third parties. Such third parties have no obligations or liability to Subscriber under
this Agreement but are third party beneficiaries of this Agreement.

10. Export.
Certain Products provided under the Agreement are subject to export controls administered by the United States and other countries (“Export
Controls”). Export or diversion contrary to U.S. law is prohibited. U.S. law prohibits export or re-export of the software or technology toCuba, Iran, North Korea, Sudan and Syria or to a resident or national of those countries (“Prohibited Country” or “Prohibited Countries”).
It also prohibits export or re-export of the software or technology to any person or entity on the U.S. Department of Commerce Denied
Persons List, Entities List or Unverified List; the U.S. Department of State Debarred List; or any of the lists administered by the U.S.
Department of Treasury, including lists of Specially Designated Nationals, Specially Designated Terrorists or Specially DesignatedNarcotics Traffickers (collectively, the “Lists”). U.S. law also prohibits use of the software or technology with chemical, biological or
nuclear weapons, or with missiles (“Prohibited Uses”). Subscriber warrants that it is not located in, or a resident or national, of any
Prohibited Country; that it is not on any Lists; that it will not use the software or technology for any Prohibited Uses; and that it willotherwise comply with Export Controls.

11. General.
Websense may periodically send Subscriber messages of an informational or advertising nature via email. Subscriber may choose to “optout” of receiving these messages by sending an email to optoutlegal@websense.com requesting the opt-out. Subscriber acknowledges andagrees that by sending such email and “opting out” it will not receive emails containing messages concerning upgrades and enhancements
to Products. However, Websense may still send emails of a technical nature. Subscriber acknowledges that Websense may use Subscriber's
company name in a list of Websense customers. Subscriber may not transfer any of Subscriber’s rights to use the Products or assign thisAgreement to another person or entity, without first obtaining Websense’s prior written approval. Notices sent to Websense shall be sent tothe attention of the General Counsel at 10240 Sorrento Valley Road, San Diego, CA 92121 USA. Any dispute arising out of or relating tothis Agreement or the breach thereof shall be governed by the federal laws of the United States and the laws of the State of California, USA
for all claims arising in or related to the United States, Canada, or Mexico; and Dublin, Ireland for all other claims, without regard to or
application of choice of laws, rules or principles. Both parties herby consent to the exclusive jurisdiction of (1) the state and federal courts
in San Diego, California, USA, for all claims arising in or related to the United States, Canada or Mexico, or (2) the competent courts in
Dublin, Ireland for all other claims. Both parties expressly waive any objections or defense based upon lack of personal jurisdiction or venue.

12

Websense Web Security and Websense Web Filter

Neither party will be liable for any delay or failure in performance to the extent the delay or failure is caused by events beyond the party’s
reasonable control, including, fire, flood, acts of god, explosion, war or the engagement of hostilities, strike, embargo, labor dispute,
government requirement, civil disturbances, civil or military authority, disturbances to the Internet, and inability to secure materials ortransportation facilities. This Agreement constitutes the entire Agreement between the parties hereto. Any waiver or modification of thisAgreement shall only be effective if it is in writing and signed by both parties or posted by Websense at http://www.websense.com/global/
en/downloads/terms. If any part of this Agreement is found invalid or unenforceable by a court of competent jurisdiction, the remainder ofthis Agreement shall be interpreted so as to reasonably effect the intention of the parties. Websense is not obligated under any otheragreements unless they are in writing and signed by an authorized representative of Websense.

Copyright and Trademarks©1996–2009, Websense Inc.
All rights reserved.
10240 Sorrento Valley Rd., San Diego, CA 92121, USA
The products and/or methods of use described in this document are covered by U.S. Patent Numbers 6,606,659 and 6,947,985 and other patents
pending.
This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machinereadable form without prior consent in writing from Websense, Inc.
Every effort has been made to ensure the accuracy of this document. However, Websense Inc., makes no warranties with respect to thisdocumentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Websense Inc. shall not be liable
for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples
herein. The information in this documentation is subject to change without notice.

Trademarks
Websense is a registered trademark of Websense, Inc. in the United States and certain international markets. Websense has numerous otherunregistered trademarks in the United States and internationally. All other trademarks are the property of their respective owners.
Microsoft, Windows, Windows NT, Windows Server, and Active Directory are either registered trademarks or trademarks of Microsoft
Corporation in the United States and/or other countries.
Red Hat is a registered trademark of Red Hat, Inc., in the United States and other countries. Linux is a trademark of Linus Torvalds, in the
United States and other countries.
Other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies and are the soleproperty of their respective manufacturers.

Version 7.1 Release Notes

13

14

Websense Web Security and Websense Web Filter