Issue:

Elements Agent for Mac Overall Protection status showing critical on the Elements Security Center portal's Devices page.

Resolution:

Please click on Mac device on the Elements Security Center portal's Environment > Devices page to view all the protection details. on the Protection status tab you can check if both Malware protection and Browsing protection features are enabled. 

If they are disabled, try first to restart the device. If issue persists, make sure that neither feature has been disabled in the profile that is in use on the device:

How to check if malware protection is enabled in the Mac profile:

1. Log in to the Elements Security Center portal 
2. Navigate to the Security configurations > profiles page
3. Go to the For Mac tab 
4. Click on the profile that is in use on the devices
5. Go to the Real-time scanning settings page 
6. Make sure Real-time scanning is enabled
7. Click Save profile 

How to make sure Browsing Protection is enabled:  

1. Log in to the Elements Security Center portal 
2. Navigate to the Security configurations > profiles page
3. Go to the For Mac tab 
4. Click on the profile that is in use on the devices
5. Go to the Browsing protection settings page
6. Make sure Browsing protection is enabled 
7. Click Save profile 

Issue:

How to set up Elements Connector as ultimate proxy so that Elements Agents can validate subscription through it? For example if there are devices in an offline or restricted environment that needs to be able to connect to the Elements portal through the Elements Connector acting as a proxy.

Resolution:

It is possible to install the Elements agent in offline mode if the device can connect to an Elements Connector that acts as an Ultimate proxy, meaning all traffic between the endpoints and cloud services go through the Elements Connector: Elements Connector overview | Elements Connector | Latest | WithSecure User Guides 

First install an Elements Connector: Deploying Elements Connector | Elements Connector | Latest | WithSecure User Guides 

Then create a profile for the offline devices:

1. Log in to the Elements portal
2. Navigate to the Security configurations > profiles page
3. Click Create a profile
4.  Navigate to the Basic > Communication page
   1. Enter the Elements Connector address to the "Proxy servers and WithSecure Connectors" list and enable Proxy, WS Connector and Software Updater WS Connector
   2. Use HTTP proxy = Remotely managed
   3. Use WithSecure Elements Connector = If possible
5. Click Create profile

To proceed, make sure that the machine where you're installing the Elements Agent can connect to the Elements Connector you've installed. Here are the steps to check the connection towards Elements connector from that machine:

1. Go to browser of your Windows machine
2. Open the web browser
3. Enter the Elements connector's IP address using http and https protocol:
   1.  http://ip_adress_of_elementsconnector:http_portnumber
   2.  https://ip_adress_of_elementsconnector:https_portnumber
4. Make sure you see the Elements connector's status page, without any SSL certificate warning or other warning.
5. Also, make sure the Elements connector's http and https ports have been allowed and not using by other services

Now you can install the Elements agent using .EXE installer with the following command line parameter:

1. Navigate the location or path of installer has been saved in command prompt and execute the below command:
   1. installer_name.exe –connector-proxy http://ip_adress_of_elementsconnector:http_portnumber

Note: Please replace insaller_name.exe and ip_adress_of_elementsconnector:http_portnumber with actual value. Refer to the following link for more information on command-line parameters: Command-line parameters | Elements Endpoint Protection | Latest | WithSecure User Guides 

Once the device has appeared in the Elements Security Center portal's Environment > Devices page, you can assign the profile that you created for the offline devices so that all communication will go through the Elements Connector:

1. Navigate to the Environment > Devices page
2. Select the devices from the devices list
3. Click Assign profile 
4. Select the profile 
5. Click Assign profile

Issue:

Elements Agent displays 'Your subscription is not activated. Please enter a valid subscription key to start using the product' error in the local user interface. How do I fix it?

Resolution:

Most likely your Elements license key code has expired, or your device has been removed and cannot be reconnected to the WithSecure Elements portal.

Ensure you are using correct and valid product license key. You may also try to reboot the client device and check if the same error reappear.

If your subscription is shown to be valid on the Elements Security Center portal's Management > Subscriptions page and a device restart does not fix the issue, we recommend the re-enter the subscription key on the device using the ws_oneclient_logout.exe:

1. Open a Command Prompt as an administrator
2. Navigate to C:\Program Files (x86)\F-Secure\PSB\
3. Run the following command: ws_oneclient_logout.exe –keycode <subscription-key>

Issue:

Elements Endpoint Protection has detected a malicious file on a computer. How to check what action was taken on the malware / virus? 

Resolution:

You can check the removal.log for the actual action taken on the detection. The removal.log will show if the file was for example blocked, quarantined or deleted. 

You can collect a wsdiag diagnostic file by running the WithSecure Support Tool. It will create a wsdiag file to the desktop.

The removal.log file can be found at: f-secure\logs\system\FSAV\

Below are the sample of log that will be output:

[removal.log]
 Worm.WORM/LNK.Lodbak.Gen BEGIN
;
;Log created by USS version 5.8.255
;
Worm.WORM/LNK.Lodbak.Gen file "E:\CANON (16GB).lnk" quarantined success 
Worm.WORM/LNK.Lodbak.Gen file "E:\CANON (16GB).lnk" deleted success 
Worm.WORM/LNK.Lodbak.Gen END

Issue:

When using deploying / installing Elements Agent with the OfflineInstaller .msi file using a Third-party Management Tool, a duplicate device appears in the Elements Security Center portal's Devices page if the device is reinstalled. How to prevent a duplicate device from appearing if a device is reinstalled? 

Resolution:

When you reinstall the product on a device, a new unique identifier (UUID) is generated. As a result, a duplicate device is created in the Elements portal. 

You can use the UNIQUE_SIGNUP_ID=smbios parameter when installing with the MSI file. Using SMBIOS GUID as the unique identifier of this machine links the reinstalled product to the existing device and prevent a new entry from being created: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/concept_zh2_rfh_4bc-psb-portal-latest-en

You may also use the –use_smbios_guid parameter when installing with the EXE installer: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/command_line_parameters-psb-portal-latest-en

Note: If you use a new subscription key when you reinstall the product, a new device is created on the portal. Also, when you uninstall the product normally, it is automatically removed from the portal. Using smbios_guid as an identifier prevents the devices from being automatically removed.

Issue:

We have Web Content Control enabled and we have manually blocked websites with the "denied sites" feature. We receive a lot of alerts on the Security Events page in the Elements Security Center portal of the following type "Webpage was blocked due to domain name being blocked"

Is there an option to turn off sending of security events when a website (URL address) has been blocked by either the Web Content Control feature or if the URL has been added to the Denied sites list?
 

Resolution:

Yes, you can disable sending of security alerts when either Web Content Control has blocked a website due to a disallowed category or if the website is listed on the Denied sites list in the Elements profile.

Steps to disable sending of security alerts for Web Content Control blocks:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Browsing Protection settings page
5. Scroll down to the Web content control section
6. Disable the Alert for each category you do not want to receive an alert from 
7. Click Save profile

Steps to disable sending of alert when a website has been blocked due to it being on the Denied sites list:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Browsing Protection settings page
5. Scroll down to the Web site exceptions section
6. Disable Send security event about access to denied site
7. Click Save profile

Issue:

What does the Rollback feature do that has been added to Elements Endpoint Protection?

Resolution:

Rollback offers user a protection against of ransomware and allows to restore files and registry to a previous state before the ransomware infection.

The product keeps tracking activity of suspicious process and record changes made by this process (including file/registry modifications) at that location, and backup these to the backup folder when a suspicious process is detected with the rollback feature enabled.

Once the suspicious process is identified to be malicious, the rollback will happen immediately to restore the change(s) in the files/registries. After the session ends, the feature does not keep the backup and will drop it.

Rollback can be set up from the Elements profile for EPP for Computers devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Click on the profile that is in use on your devices
4. Go to the Rollback settings page
5. Enable rollback
6. Allow to restore reverted files
7. Click Save profile 

Issue:

Linux Protection or Elements EPP for Server (Linux) installation is not reporting to Elements Security Center and it does not appear in the Environment > Devices list on the portal.

Resolution:

If the installation of the client went through without errors, in case of WithSecure Elements EPP for Servers (Linux) / Linux Protection, there is still a need to run the following command to activate the product after the product was installed:

/opt/f-secure/linuxsecurity/bin/activate –psb –subscription-key SUBSCRIPTION-KEY

If you are using HTTP proxy, you can add an option of "–http-proxy" to the activation command mentioned above. More details regarding activating Linux Protection when proxy is used: https://support.withsecure.com/userguides/product.html#business/linux-protection/latest/en/task_activating_via_connector_proxy-latest-en 

You may refer to the following user guides for more details about Elements Linux Protection installation: https://support.withsecure.com/userguides/product.html#business/linux-protection/latest/en/installing_psb-latest-en

Apart from that, you may also want to check the connectivity status to our backend (*.fsapi.com) to make sure that the connection could be established successfully by running the commands below.

sudo curl http://guts2.fsapi.com 
sudo curl https://psb-emea.doorman.fsapi.com/doorman/v1/healthcheck

If the connection fails to be established successfully, there is a need to check your firewall configurations if such connection is being blocked that needs to be allowed. 

Issue:

We are installing Elements Agent but the installer found conflicting products it wants to remove, how can we install the Elements Agent without removing the other products?

Resolution:

You can install Elements Agent (e.g. via CMD) and use the –skip-sidegrade parameter to skip the sidegrade.

Example:

1. Open a Command prompt as an Administrator
2. Navigate with the Command prompt to the folder where you have stored the Elements Agent installer
3. Run command:

installername.exe –skip-sidegrade "product_name"

4. If the above command does not work, use this command to skip detection of all conflicting software.

installername.exe –skip-sidegrade "*"

For more detailed information about available command-line parameters and MSI properties, please visit our Help Guide:

• EXE installation parameters: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/command_line_parameters-psb-portal-latest-en
• MSI installation properties: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/concept_zh2_rfh_4bc-psb-portal-latest-en  

Issue:

Wrong 'Update-Server' or proxy server address is shown in the Elements Agent's Updates page even if Network Location settings has been configured to change the proxy server address when device is in a new location. 

Resolution:

We recommend to first check your current setup on the Network locations settings page in the profile:

1. Log in to the Elements Security Center portal
2. Navigate to Security Configurations > Profiles
3. Click on the profile that is in use on the devices
4. Go to the Network location settings page
5. Make sure that the trigger or triggers that you have configured are correct
6. Make sure the rules you have chosen are correct
7. Click Save profile

We also recommend to lock the communication settings so that they cannot be changed locally:

1. Log in to the Elements Security Center portal
2. Navigate to Security Configurations > Profiles
3. Click on the profile that is in use on the devices
4. Go to the End user rights settings page
5. In the Communication settings section, lock each setting:
   1. User HTTP proxy (updates server)
   2. Use HTTP Proxy (Software Updater)
   3. Proxy servers and WithSecure Connectors
6. Click Save profile