Issue:

When a malicious file has been successfully put to quarantine, why does Elements Endpoint Protection sometimes want to reboot the computer?

Resolution:

If the file was detected by the Universal System Scanner (USS) component, it will ask to restart the computer because the infection cannot be completely cleaned up while Windows is running. 

You check the removal.log file in the wsdiag diagnostic file if you want to make sure that the detection was made by Universal System Scanner (USS). 

Issue:

When exporting the self signed / self-generated certificate from the Elements Connector key store, I receive the error: 

• keytool error: java.lang.Exception: Keystore file does not exist: /var/opt/f-secure/fspms/data/​fspms-ca.jks

Resolution:

Issue:

We have Elements Agent installed on our devices with an Elements Endpoint Protection (Elements EPP for Computers or Servers) subscription. How can we from the Elements Security Center portal encrypt the system drive / disk? 

Resolution:

Turning drive encryption on or off is an advanced security feature that comes with the WithSecure Elements EPP for Computers Premium and the WithSecure Elements EPP for Servers Premium subscriptions.

Issue:

When an Elements Endpoint Protection scheduled scanning task is missed, for example if computer is in sleep mode or turned off / shut down, will the task start immediately when device is turned on?

Resolution:

If you create a Scheduled scan for malware Automated task in the Elements Endpoint Protection profile, you can set the task to Never skip if the previous start time has been missed.

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to modify
4. Go to the Automated tasks settings page
5. Click Add task
6. Select Scheduled scan for malware from the Type drop-down menu
7. Use CRON expressions in the Schedule column to set the task start time
8. Enable Never skip toggle from the Never skip column
9. Click Save profile

Note: The Scheduled scanning setting on the Manual scanning settings page in the profile does not support any kind of Never skip setting. If a scheduled scan is missed when using the Manual scanning – Scheduled scanning setting, then the scan will start the next scheduled time. 

Issue:

Can the Elements Endpoint Proteciton Firewall Isolation profile be activated if there is a GPO rule to ignore locally defined rules?  What will happen if a firewall rule distributed by GPO to 'Ignore locally defined rules' and Elements Endpoint Protection tries to isolate the device from the network? 

Resolution:

Firewall rules configured via Elements Security Center Portal are considered local, hence if there is a GPO rule to ignore local rules it WithSecure rules or profiles will no longer work. 

Our general recommendation is to choose one – either manage Windows Firewall with GPO, or with WithSecure profiles (or with the smallest possible input from GPO), otherwise in case of any conflicting settings GPO will have a higher priority and override WithSecure firewall rules. Also, if there are conflicts, it might impact the host performance negatively

Issue:

Alerts of "Connection refused" related to the doorman backend are being output frequently by Elements Linux Protection.

Example:
doormand: Failed to send request to Doorman: generic:111 = Connection refused

Resolution:

Make sure that the connections to the following Security Cloud domains are allowed on your Firewall and proxy.

Business Suite 16 onwards

• corp-reg.fsapi.com This server is used by Policy Manager for license registration. Blocking this server will prevent license validation.
  guts2.fsapi.com (also TCP/80) This server is used to deliver updates for scanning engines and detection rules, and for some products updates to the software itself. Blocking this server will completely stop security updates.
• a.karma.sc2.fsapi.com
• restmc.mind.sc2.fsapi.com
• mind-failover.sc2.fsapi.com
• api.doorman.fsapi.com Backend services needed for Security Cloud functionality
• api.prd.glb.us-prd.fsapi.com Used to control updates for Linux Security 64
• download.fsapi.com Used for the hotfix update mechanism for Linux Security 64

If you have allowed the connections, you could check the connectivity status to the domains by accessing to the following URLs from any affected server.

https://baseguard.doorman.fsapi.com/doorman/v1/healthcheck
https://doorman.sc.fsapi.com/doorman/v1/healthcheck
https://a.karma.sc2.fsapi.com/healthcheck

If you are using a proxy, check the connectivity status from your Linux server to the proxy server and make sure that it could be done successfully.

Issue:

Can we find out which device has been blocked by the Elements Endpoint Protection Device Control feature in the Elements Security Center portal?

Resolution:

When Elements Endpoint Protection Device Control feature blocks a device that matches a Device access rule in the profile, an alert will be sent to the Elements Security Center portal's Events > Security Events page. By clicking on the arrow on the left side of the detection you can show all the details of the block, such as which rule caused the device to be blocked and the Device ID of the blocked device. 

If you want to allow the device which was blocked, you can copy the device id from the security event and follow these steps to create a device filtering rule:

1. Go to the Security Configurations > profiles page
2. Open the profile that is in use on the device
3. Go to the Device control settings page
4. Scroll down to the Device filtering rules list
5. Click Add rule
6. Enter the Device ID that was shown in the security event 
7. Click Save profile 

Now the device is which was shown in the security event will no longer be blocked by the Elements Endpoint Protection device control feature. 

Device Control can list all the devices which are connected to a computer in the Elements Security Center portal. To see the list of devices: 

1. Navigate to the Environment > Devices page
2. Click on a Device
3. Switch to the Connected Devices tab

Here you can see all the devices and their IDs.

Issue:

Browsing Protection by WithSecure is missing from Firefox on Elements Endpoint Protection for Computers (MacOs) with the error "Security application not found".  On macOS there's a constant popup about missing Firefox browser extension.

Resolution:

If you receive the error "Security application not found" and Browsing Protection by WithSecure browser extension is missing from Firefox, manually install the Browsing Protection by WithSecure extension for Firefox. 

1. To set up the browser extension for Firefox:
2. Select the product icon in the menu bar.
3. Select Settings… from the menu.
4. Open the Secure Browsing tab.
5. Select Install browser extension.
   1. The Browsing protection installation window opens.
6. From the drop-down, select Firefox and then Install now.
7. Select Add.
   1. Once the extension is installed, a user consent dialog opens. The browser extension requires your permission to access information about the web addresses you visit.
8. Select Accept.
   1. Note: If you decline to grant the permission, you will not be able to use the extension and Browsing protection cannot block harmful websites nor show search result ratings. Also, the extension will be removed from the browser.
9. To complete setting up the extension, select OK.

You can now use Firefox to browse the internet safely.

More details about the installation of Mac browser extensions and how to check if they are in use can be found in the User Guide: Checking that browser extensions are in use | Elements Endpoint Protection for Computers | Latest | WithSecure User Guides 

Issue:

Can Elements Mobile Protection (Elements EPP for Mobiles) be used to remotely wipe data or lock a stolen phone?

Resolution:

Elements Mobile Protection does not include features to lock a phone or wipe the data from the phone if it has for example been stolen.
 

Issue:

The "Add new device" option missing on the Environment > Devices page in the Elements Security Center portal when the three dots are clicked. Why is the button missing? 

Resolution:

If the Add new device option is missing on the Elements Security Center portal's Environment > Devices view in the Elements Security Center Portal when you click on the three dots, there are a few reasons why it can be missing:

• You are missing the full management rights for Elements Endpoint Protection
• You do not have valid licenses for the product you are trying to add
• If you are a partner user, you have the wrong level selected from the scope-selector

You are missing the full management rights for Elements Endpoint Protection

Make sure that your user account has full editing rights for Endpoint Protection:

1. Log in to the Elements Security Center portal
2. Navigate to the Management > Organization Settings > Security Administrators page 
3. Check the Endpoint Protection column for your user account and make sure that you have the correct rights

If you do not have the full editing rights for Endpoint Protection, ask a colleague to add the rights for you or if you have a Partner Managed subscription you can contact your partner to have the rights added. 

You do not have valid licenses for the product you are trying to add

The Add new device button can be missing if you do not have any relevant licenses attached to your company account. Make sure from the Management > Subscriptions page that you have valid licenses for one of the following:

• Elements EPP for Computers or Servers
• Elements EPP for Mobiles 

If you are a partner user, you have the wrong level selected from the scope-selector

If you are a partner, you need to select the customer company level from the Scope-selector drop-down menu. The Add new device button is not visible on the partner level because the partner level doesn't include any subscriptions.  The scope-selector is the drop-down menu shown in the top-left corner of the Elements Security Center portal.