Issue:

• User attaches a USB mass storage device but Device Control does not block access to it.
• Admin has disallowed writing to removable storage devices, this works correctly on USB thumb drives, however external USB disk drives can still be written to. How to ensure that writing to external disk drives is also blocked just like the USB thumb drives?

Resolution:

Note: This article is relevant to all WithSecure products using Device Control: Client Security, Server Security and Elements Endpoint Protection (EPP for Computers and EPP for Servers) 

In some cases external USB disk drives report themselves to Windows as standard drives, and due to this Device Control sees them as normal drives instead of external. In the event that USB thumb drives are blocked but not external disks, try the following:

For Elements Agent 24.5 onwards, enable following setting on profile from Elements Security Center.
 Device control > Removable mass storage devices > Detect write attempts to USB storage devices

For Client Security / Server Security, 
Device Control has an advanced device type recognition logic which is disabled by default, but can be activated by registry manipulation:

1. Under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\F-Secure Gatekeeper\Parameters create a value of type DWORD with name EnableHotplugResolving and set the value to 1
2. run cmd.exe with administrator priviledges 
3. net stop fsulhoster
4. net stop "f-secure gatekeeper"
5. net start fsulhoster

Test this out as it should resolve the problem.

A permanent fix for this issue is available in CS/SS 16.01 for BS.

Issue:

A harmless web site (URL) is blocked by WithSecure Browsing Protection component.

Resolution:

If you think that the website is safe and Browsing Protection has a false rating for this page. Please submit a Sample Validation ticket using the Elements portal:

1. Log in to the Elements Security Center Portal
2. Go the Requests page on the menu on the left
3. Select Create Request.
4. Open the Request type drop-down menu and select Submit sample for validation
5. Open the Sample type drop-down menu and select URL.
   1. Make sure you selected the correct sample type.
      1. URL-Based False Positive: A safe website is blocked by mistake. For example, https://partnerportal.company.com blocked as phishing.
      2. URL Categorization: Request to update or correct the URL category. For example, reclassifying a corporate blog from “Unknown” to “Business.”
      3. Unknown URL: A new or uncategorized domain requiring classification. For example, submitting https://newvendor.io for review.
      4. URL-Based False Negative: A harmful website is not blocked by the product. For example, http://malicious-site.ru remains accessible and serves malware.
6. Enter URL or IP address.
7. Open the Request reason drop-down menu and select one option:
   1. False Negative – Malicious URL not blocked
   2. False Positive – Trusted URL blocked
   3. CAT – URL has incorrect content category
   4. CAT – M – URL missing content category
8. Open the Product name drop-down menu and select the product
9. Add a short title for the request in the Title field
10. Write down a description of the file or summary of concern.
11. Select Create Request.

As a temporary workaround before the URL reputation has been fixed, you can exclude the blocked website address:

For Elements Endpoint Protection

1. Log in to the Elements portal: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to Profiles tab and edit the current profile
4. Select Browsing Protection  > Allowed sites
5. Scroll down to the Web site exceptions section 
6. Enable web site exceptions
7. Click Add site under the Allowed sites section and add the blocked URL shown in the block notification
8. Click Save profile

For Business Suite Client Security and Server Security:

1. Log in to the Policy Manager console
2. Select a host or policy domain from the domain tree
3. Click Settings tab 
4. Go to Web Content Control > Trusted sites
5. Click Add option and add the blocked sit
6. Distribute the policy (Ctrl + D)

Issue:

• Web Content control is blocking pages by claiming they have been rated, for example, as adult material, even though the web page has nothing to do with that rating. The category is wrong.
• How do I whitelist sites for WithSecure Elements Endpoint Protection for Computer and Server?
• How do I whitelist sites for Client Security and Server Security?
• I want to access a site but Browsing Protection blocks it. What can I do?

Resolution:

You can report wrongly blocked pages and websites with incorrect categories by opening a Sample Validation ticket through the Elements portal: Submitting a URL sample | Welcome to WithSecure Elements | Latest | WithSecure User Guides 

If you need to immediately have access to the website, you can whitelist the URL in the Elements profile that is in use on the device:

1. Log in to the Elements Endpoint Protection portal
2. Go to Security configurations > Profiles using the left-side menu
3. Open the profile you want to modify
4. Click on Browsing Protection from the left-side menu
5. Scroll down to Sites
6. Add the site you want to whitelist to the Allowed sites-list
7. Click Save profile 

To whitelist webpages using the Business Suite Policy Manager:

1. Log in to Policy Manager Console
2. Highlight a host or policy domain from the Domain Tree
3. Go to the Settings tab
4. Go to Web content control settings
5. Click Add from the right side of the Trusted sites list
6. Add the site or domain URL in the address field
7. Distribute the policy (Ctrl + D)

Observe that you might have to empty your web browser cache for the changes to take immediate effect. This applies to both set of instructions listed above and to when you receive a notification from the labs that they have updated a page rating.

Issue:

This article applies to the following WithSecure products:  Elements Agent (EPP for Computers and EPP for Servers), Business Suite Client Security and Server Security

The WithSecure Corporate product installation fails with the error below:
 

Example error:

-- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action Ultralight_Install, location: C:\Program Files (x86)\F-Secure\PSB\\UltralightInstaller\ul_536.exe, command: --aua-mode=true --install-directory="C:\Program Files (x86)\F-Secure\PSB\Ultralight\\" --product-directory="C:\Program Files (x86)\F-Secure\PSB\\" --doorman-url=dummy --doorman-id=dummy --doorman-hash=dummy

Resolution:

The 1722 error can appear if the WithSecure Ultralight component failed to install. Most likely there are some traces of an old WithSecure product installation on the computer, which then cause issues with a new installation.

Follow these steps to check if the Windows installer service is running correctly:

1. In your keyboard, press Windows key + R
2. Type services.msc and press Enter
3. In the Services window, locate Windows Installer and check if the services are running
4. Right-click Windows Installer and select Properties
5. Set the Startup type to Automatic
6. Click OK
7. Proceed to install WithSecure software again.

After this, we recommend doing a system reboot.

If the issue remains after verifying that Windows Installer service is set to Automatic, it is possible that the previously failed installation has left broken traces and it's preventing the new installation to take place. To solve that, run the uninstallation tool to remove the previous installation traces.

NOTE: The WithSecure Uninstallation Tool (UninstallationTool.exe) uninstalls all WithSecure products installed on your computer.

1. Log on to the computer with administrator rights
2. Run the uninstallation tool
3. With UninstallationTool.exe, you can select which product or components you want to remove
4. Click Restart when prompted to remove remaining files

The uninstallation is complete when the computer has restarted. After the restart, you can retry the installation of the WithSecure product.

in case you are using the following offline installers to install Elements Agent, you need to keep in mind that the offline installer does not include any kind of side grade or capabilities to remove conflicting software. Follow these instructions on how to run the sidegrade.msi to remove conflicting software before trying to install using the offline installer: Deployment via Active Directory GPO | Elements Endpoint Protection | Latest | WithSecure User Guides

Issue:

This article applies to the following F-Secure products: WithSecure Server Security and WithSecure Elements Endpoint Protection for Servers

After having installed WithSecure Server Security or WithSecure Elements Endpoint Protection for Servers in a Windows Server 2019 host, Windows Security Center is not detecting or reflecting the WithSecure product installation. Windows Defender is still enabled after installation of WithSecure products. 

Resolution:

It is known behaviour that Windows 2019 server does not reflect any 3rd party antivirus products installed including WithSecure. 

For Windows Defender, the behaviour for servers is set to be active even after the installation of 3rd party antivirus products. For more information, you can refer to this Microsoft document.

Issue:

Windows Security Center Virus & Threat protection briefly shows a pop-up / toast notification alert that both Microsoft Defender Antivirus and WithSecure protection are both turned off. 

Full error message: "Check virus protection – Microsoft Defender Antivirus and WithSecure Elements Agent by F-Secure are both turned off. Tap or click to see installed apps".

Affected products: 

• Elements Agent (Elements Endpoint Protection for Computers and Servers)
• Business Suite Client Security 
• Business Suite Server Security 
• Email and Server Security

Resolution:

This Microsoft Windows toast notification can appear briefly when the WithSecure product is installing an Ultralight Core update. Even if this alert is shown, the WithSecure client remains active and functions normally.

Issue:

WithSecure Elements Agent, Business Suite Server/Client Security, or Countercept MDR installation fails with error "conflicting Oneclient product already installed"

Resolution:

This error indicates that a WithSecure Product has been previously installed on the computer. The uninstallation of the previous WithSecure product has left some leftover files on the computer which are conflicting with the new installation.

To resolve this issue:

1. Download the Oneclient-compatible uninstallation tool Support tools page.
2. Run the tool
3. Restart computer
4. Try the installation again

If you prefer to run the uninstallation silently, you can run the tool as follows:

WsUninstallationTool.exe –silent

Issue:

An application executable is blocked once I enabled the Application Control to block rare and unknown applications. I am working on creating a rule to whitelist the application executable.

However, whitelisting application with "Target file name" used in Application Control rule does not work.

Resolution:

"Target file name" used in the condition for an Application Control rule is not referring to the file name in the target path showing up in Application Control alert.

It is used for the "Original filename" for the application executable. To find out this, you need to do the following:

1. Right click on the application executable, and select "Properties".
2. Switch to "Details".
3. Look into "Original filename".

Alternatively, you can use the condition "Target path" together with the file path for the target application executable.

Issue:

Where to contact about payments and billing regarding WithSecure Business / corporate products.

Resolution:

If you are an end-customer, you need to contact your own WithSecure reseller partner if you have questions about billing. 

If you are a WithSecure reseller partner and you have questions about billing, please contact your WithSecure Sales contact, or email WithSecure Order Services. 

Issue:

This article applies to the following products: Client Security 15 and 16 , Server Security 15 and 16 and Elements Endpoint Protection products

I am seeing a lot of the following entries in the firewall blocks.log:

[xxxx.xxxx]  I: Type: FWPM_NET_EVENT_TYPE_CLASSIFY_DROP. Dropped by filter: Port Scanning Prevention Filter, This filter prevents port scanning. This many times means there are no listeners. If debugging ensure your scenario has one.

The connection parameters vary, with different local/remote ports and IP addresses. Do I need to modify my firewall rules for these massages to disappear?

Resolution:

These log entries are associated to the Stealth mode mechanism in Windows Firewall with Advanced Security. It is a built-in functionality, which silently drops outgoing ICMP unreachable and TCP reset messages, to prevent port scanning. This functionality reacts when there is no process listening on the port, which is targeted by the incoming request/traffic.

You can refer to this Microsoft Technet article for more information about this functionality.