Issue:

Does WithSecure Software Updater on Elements Endpoint Protection (EPP Computers and for Servers) or Business Suite (Client Security and Server Security) products install Windows feature updates as part of the software update process?

Resolution:

Elements Software Updater does not install Windows feature updates or major operating system version upgrades. A move for example from Windows 11 25H2 to Windows 11 26H2 would not delivered through Software Updater, and these upgrades are not part of the security updates it installs. The same applies to Windows service packs.

What Software Updater does cover is the regular Microsoft updates for the installed Windows version, including security updates, as well as updates for supported third-party software. Windows optional updates are not included.

To upgrade devices to a new Windows feature version, please deploy the feature update with Microsoft's own tools, such as Windows Update, WSUS or your existing Microsoft management tooling. Once a device is on the new version, Software Updater keeps providing security updates for it as usual.

Issue:

How to check in Partner Portal when a customer's subscription has last been renewed? 

Resolution:

You can check a customer's subscription details in the Partner Portal by following these steps:

1. Log in to the Partner Portal: https://partner.withsecure.com/s/
2. Navigate to Sales > Accounts
3. Click on the customer company name 
4. Go to the Deal based & subscriptions tab 

Here you can check the ongoing orders, latest quotes and the assets (subscription keys) and to which contract they belong to.

You can also download the latest license certificates for the customer. 

Issue:

How to set the max nested level for scanning compressed files (archives) for manual scan?

Resolution:

You can change the max depth for a manual scan when scanning archives for Elements Agent (EPP for Computers and Servers, Client Security and Server Security by changing the ods.contained.maxdepth value in the Windows registry.

Follow these steps:

1. Open the Registry Editor on the Windows device
2. Navigate to [HKEY_LOCAL_MACHINE\SOFTWARE\FSecure\Ultralight\Settings\ods.container.maxdepth] "value"=dword:00000002
3. Change the "dword" value.
4. Restart the fsulhoster service or restart the computer for the change to take effect

Note: "00000002" is the nested level. For example, if it is set to 1, only the container will be scanned, 2 subfolders will not be scanned.

Issue:

Where can I find the administrator user guides for WithSecure products? For example user guides for:

• Elements Endpoint Protection (EPP for Computers and Servers)
• Elements Endpoint Detection and Response (EDR)
• Elements Collaboration Protection
• Elements Exposure Management 
• Elements Linux Protection 
• Elements Mobile Protection
• Business Suite: Policy Manager / Client Security / Server Security
• Linux Protection 64 
• Cloud Protection for Salesforce 

Resolution:

You can find all our user help guides from here: https://www.withsecure.com/userguides/

Issue:

When opening the hosts file on a Windows device, it only shows the following text: 

# 
# This is a HOSTS file created during malware removal. 
#
# Your original HOSTS file was infected and it was replaced 
# by this file containing only clean default entries. 
# The original HOSTS file may be restored from the product's
# quarantine feature.
#
127.0.0.1    localhost
::1            localhost

Resolution:

The Protect the Hosts file security feature monitors if there have been any changes made to the hosts file in a Windows system. If the feature detects changes, it will alert of a redirected hosts file and replace it with a hosts file with the content shown above. 

If a hosts file has been modified before the installation of Business Suite Client Security, Business Suite Server Security or Elements Agent (Elements Endpoint Protection), the modified hosts file will be detected during the first system scan.

If the hosts file is modified during a time when the Protect the hosts file feature has been disabled, the modified hosts file will be detected when the feature is turned back on. 

Follow these steps to turn off the Protect the hosts file feature:

For Business Suite products:

1. Log in to Policy Manager Console
2. Select the policy domain or host from the Domain Tree
3. Go to the Settings tab 
4. Navigate to Windows > Real-Time Scanning > Real-Time Scanning
5. Scroll down to the Actions on riskware/spyware detection (workstations) section
6. Disable the Protect the "Hosts" file setting
7. Distribute the policy (Ctrl + D)

For Elements Endpoint Protection products: 

1. Log in to the Elements Endpoint Protection portal
2. Go to the Security configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Real-time scanning settings page
5. Scroll down to the File scanning section
6. Disable Protect Hosts file 
7. Click Save profile

We do not suggest to exclude this file from scanning, but we do suggest to keep a backup file of the original or manually changed host by user itself.

Issue:

On a Windows computer, application loading / startup is slow or does not work at all when DeepGuard feature is enabled. What can be done if a software is having issues when DeepGuard is enabled? 

Resolution:

We recommend to check and ensure that the Security Cloud is enabled and that the endpoints are able to connect to the Security Cloud. 

You need to ensure that the connectivity to the Security Cloud. 

If necessary, you can run the Connectivity Tool to validate the connectivity state to the WithSecure services backend:

• Client Security: C:\Program Files (x86)\F-Secure\Client Security\ui\fsconnectionchecker.exe
• Server Security: C:\Program Files (x86)\F-Secure\Server Security\ui\fsconnectionchecker.exe
• Elements EPP for Computers and Elements EPP for Servers: C:\Program Files (x86)\F-Secure\PSB\ui\fsconnectionchecker.exe

Other than this, you may exclude the application from being monitored by DeepGuard by creating an exclusion for the application. 

For Elements Endpoint Protection:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Server Configuration > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Note that you can use wildcards when creating the exclusions. For example: C:\Users\*\AppData\Local\test\ 

For Business Suite products (Client Security and Server Security):

1. Log in to Policy Manager Console
2.  Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > Real-time scanning 
5. Scroll down to the Files and application excluded from scanning table
6. Enable Do not scan the following files and application 
7. Click Add from the right side of the table 
8. Select:
   1. File path if you want to enter the full file path to the application
   2. Application SHA-1 if you want to enter the SHA-1 hash value of the application to exclude it anywhere on the system
9. Click OK
10. Distribute the policy (Ctrl + D)

Issue:

Partner requests for Partner Portal instructions or User Guide on how to use the new Partner Portal:

• How to renew existing renewable subscriptions
• How to amend subscriptions (increase of decrease the amount of licenses or upgrade subscription to include EDR or Premium) 

Resolution:

You can find the latest Partner Portal user guide from the Partner Portal:

1. Log in to the Partner Portal
2. Navigate to Support > Documentation

Here you can find the deal-based user guide which includes instructions on how to do most of the actions in the Partner Portal and detailed explanations of the rules and limitations.

Issue:

I noticed that Software Updater is unable to install a software update. The installation ends with the error WA_VMOD_ERROR_CANNOT_TERMINATE_PRODUCT. 

Resolution:

The error suggests that the software was in use and unable to close when the software update installation kicked in. To work around the issue, you need to ensure that the software is not running during the software update installation.

If you prefer, you may have Software Updater to automatically close running applications. Change the following setting to allow the feature to close the application always before the software update installation starts:

For Elements Endpoint Protection (WithSecure Elements Agent | Elements EPP for Computers/Servers):

1. Log in to the Elements Endpoint Protection Portal
2. Go to the Security Configurations, Select Profiles page
3. Select the profile that is in use on the devices
4. Go to the Automated Tasks settings page
5. Turn on Automated Tasks
6. Click on Add rule
7. Under Type, select Install all updates from the drop down list
8. Tick the check box for  Terminate running applications.
9. Configure your schedule.
10. Click Save and publish

If you do not want to change the default Elements profile(s), you can also manually launch updates for selected host using the setting Close running application

1. Log in to the Elements Endpoint Protection Portal
2. Go to Devices, select one or computers 
3. Click Install software updates
4. Select the relevant Software Updater categories and check the option Close running application.
5. Click Install

This start the installation the selected devices, using the option which closes the running application before applying the update. 

For Client Security and Server Security, via Policy Manager:

1. Open the Policy Manager Console
2. Select a host or policy domain from the Domain tree
3. Go to the Settings tab (standard view)
4. Go to the Software updater settings page
5. Enable Force open applications to close without prompting when updates are required 
6. Click Distribute polices (Ctrl + D)

Note: All unsaved work will be lost if the software was closed.

Issue:

When a reseller partner submits an eorder via WithSecure Partner Portal, the order remains in "Provisioning Error" status. What to do if this happens? 

Resolution:

If the order has ended in Provisioning Error status, it means that it must be fixed manually by the WithSecure Order Services team. Initially, just wait a while (up to 2 hours). If the problem persist, open a support request and share a screenshot of the actual order (with the customer details and status visible).

Issue:

A lot of fsamsi64.dll file auditing error is being displayed in the Microsoft Windows security auditing event viewer.

"Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk devices error.

File name: \Device\HardiskVolume\ProgramFiles (x86)\F-Secure\Ultralight\ulcore\1701168861\fsamsi64.dll"

Or,

Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\F-Secure\Client Security\Ultralight\ulcore\1585820217\fsamsi64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Resolution:

Statement from our developers:

"Antimalware Scan Interface (AMSI) is an API that allows applications to request antimalware products installed on the computer to scan their data for harmful content, provided that such antimalware products have exposed their scanning services via AMSI.

Latest WithSecure products provide this scanning interface to the applications.

One of such applications is Windows Defender. Its manual scanning feature makes use of AMSI, loading the AMSI modules registered with the system into its processes.

However, the Defender itself has a security measure that prevents any DLLs which are not signed by Microsoft from being loaded into its processes. This means that in case a non-Microsoft AMSI provider is registered to the system, Defender will try to load it, but will reject it because it does not have a Microsoft signature, and an error will be written to the event log.

This appears to be an intentional design in Windows Defender to only allow Microsoft's own AMSI DLLs to be used with it. The event log error is a result of this design and can be ignored by the customers."

This is a known issue on Microsoft side and the following Microsoft KB article includes a filtering workaround in the "A file hash isn't valid" section: https://learn.microsoft.com/en-us/windows/win32/amsi/dev-audience