Issue:

Unable to access WithSecure Elements portal from the old elements.f-secure.com or emea.psb.f-secure.com addresses. 

Connection ends in errors such as: 

• Hmmm… can't reach this page. (Edge)
• This site can't be reached (Chrome)
• Hmm. We're having trouble finding that site (Firefox)

Resolution:

As announced early in 2023, we have changed all of our domain names used by WithSecure Elements to use the withsecure.com address space. Until recently, the old elements.f-secure.com redirected to elements.withsecure.com, but now that redirection has been removed as we no longer have any influence on f-secure.com.

Please always use https://elements.withsecure.com/ to access the Elements Security Center

Issue:

The Application Control rule "Block rare and unknown files in Temp folder" or "Block rare and unknown files in Downloads folder" in the Elements Endpoint Protection client (Elements EPP for Computers or Elements EPP for Servers) block an application from running.

How can we create an Application Control exclusion to allow the application to run?

Resolution:

The Application Control exclusion can be created using several different conditions. To view the details of the application or file which was blocked:

1. Log in to the Elements Security Center
2. Navigate to Events > Security Events
3. Click the arrow on the left of the corresponding security event to view the details.

From here, you can easily copy details such as the Target Product Name, Target Signature Signer Name, etc., of the blocked file.

Once you have the details of the blocked file, you can create an Application Control exclusion.

1. Navigate to Security Configurations > Profiles.
2. Select the profile that you want to edit.
3. Go to the Application Control settings.
4. Click Add a new top rule
5. Select Application start and module load from the Event drop-down menu and Allow from the Action drop-down menu.
6. Define the condition(s) accordingly, such as:
   • Target signer name > is equal to > Target signature signer name (copied from the corresponding security event details), or
   • Target Path > is equal to > Target path (copied from the corresponding security event details), etc.
7. Click Save profile

In step 6, you can also use any other condition that suits your needs. You do not have to use the Target signer name, or Target Path. Target product name, Target company, etc. are other conditions that could be used in this situation. All of these can be found from the block detection on the Security Events page.

Additionally, ensure that the newly created whitelisting rule is moved to the top, so it stays above the blocking rule. Application Control processes rules from top to bottom.

If necessary, you can refer to the product help guide for more information: Adding application control rules | Elements Endpoint Protection | Latest | WithSecure User Guides 

Issue:

When Windows Endpoint client is installed, in C:\Windows\Temp\, the folder fs-capricorn fills up hard disk with files named AV-malware-names until there is no free space left.

Resolution:

The files in the fs-capricorn folder are normally deleted when the computer is shut down. Unexpected system crashes can cause a situation where the files are not automatically removed. 

You can safely go ahead and manually remove the AV-malware-names files in the fs-capricorn folder. Take note that some of the files can be in use and locked and therefore they cannot be removed. You can skip the removal of those files.

Issue:

The "Save profile" button in an Endpoint Protection profile is grayed out hence unable to save the profile in the Elements Security Center Portal. 

Resolution:

There can be different scenarios that could cause the problem. Check the following:

• The active firewall profile is set to Automatic selection but no automatic selection rules have been set. You will not be able to save the profile until you have either set rules for the automatic selection, or switched to using a single firewall profile.
• There are duplicate firewall rules (same rule name) in the firewall profile. As it can be both, active and inactive rules causing this, enable the Show inactive rules in order to verify this. The affected rules should be marked with a red line on the left side of the rule so that they can be easily identified.
• There are duplicate entries in the existing denied sites list. You should remove these duplicate entries.
• There is an incorrect value configured for a setting in the profile.

There should be red and yellow highlights shown for the settings that have invalid values. Fix these invalid values and check if the "save profile" button can be clicked. 

Issue:

Trying to reset user account password for the Elements Portal/Business Account but no email is sent

Resolution:

If you don't get an email message when using the forgot password function in the Elements portal/Business Account try the following:

• Check that you are using the correct username or email address.
• Clear web browser cache and cookies. 
• Check your spam and junk email folders. If you have automatic sorting to different folders, check if the password reset email is found in one of them.
• If all login and password reset attempts fail, contact WithSecure Customer Service and they can investigate the issue.

Issue:

Elements Endpoint Protection portal's Security Events page shows Trojan:W32/GenInflated.B infection name for: 

• C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\6b9a4d43-a587-4b92-882f-398e6d291cb5\content.bin\[50] PowerAutomateDesktop-11.2401.31.0-x64.msix\[1] AdaptiveCards.dll

Alert type on_demand_scanner.file_infection.nothing

Example SHA-1: 

• 2dcf073e1c252d0b6106aa9e98ff7ee335fb29ac
• afc450c794c05185440a39076e7d766d25b31b7b
• c9612dd52736928d64c0c6c4a52f80f394752fea
• 52f4251fac3d15ce318a5ee7f963cbdece1c5c0e

Is this a false positive or not? 

Resolution:

This Trojan:W32/GenInflated.B detection for adaptivecards.dll detection occurs because the AdaptiveCards.dll  is over 800MB in size. We have released F-Secure Hydra Engine (64-bit) 2024-02-26_01) which should fix the issue. If you are still seeing this detection appearing on one or more devices, make sure you have the latest Hydra Engine version installed on the device.  You can check the version by right-clicking the Elements Agent icon in the taskbar and then selecting Check for updates.  

If you do not want to receive further security alerts about this detection, you can exclude the SHA-1 from the Elements profile:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile that is in use on your devices
   • Note that only custom profiles can be edited. You can create a custom profile either by clicking "Create a profile" or cloning an existing profile
5. Go to the General settings page in the profile
6. Click Add exclusion in the Exclude folders and files from all security scans section 
7. Enter the SHA-1 value from the detection (Detections can be viewed from the Events > Security Events page)
   • If you want to add multiple SHA-1 values, create separate exclusions for them by clicking Add exclusion again
8. Click Save and publish

Issue:

• Unable to install Elements Agent (Elements Endpoint Protection Agent) due to .NET Framework 4.7.2 dependency. This affects multiple operating-systems, including Windows 7, 8 and Windows 10 and Windows Server.
• This can trigger the error: NET Framework of version 4.7.2 or greater is not installed – msi error 1603 during installation.

Resolution:

During the channel upgrade, the client requires .NET Framework 4.7.2 and installs it automatically if it is missing. This does not apply for the offline-installer, which assumes the depending .NET packages are installed.

In the event that .NET Framework fails to install, does not automatically install or requires manual installation, proceed with the manual installation of .NET Framework. It is highly recommended to ensure Windows Updates are fully updated to ensure successful installation of .NET Framework 4.7.2. Some Windows updates include the .NET Framework 4.7.2 update (example: KB4054530, KB4054542 etc.)

Note: Windows 10 versions before Windows 10 Anniversary Update (version 1607) do not support .NET Framework 4.7.2.

For more information refer to links below

• https://help.f-secure.com/product.html#business/computer-protection-windows/latest/en
• https://blogs.msdn.microsoft.com/astebner/2007/03/14/mailbag-what-version-of-the-net-framework-is-included-in-what-version-of-the-os/ 
• https://en.wikipedia.org/wiki/Windows_10_version_history 

Issue:

When multiple devices have been selected in the Elements Endpoint Protection Portal Devices list, only Move to blocklist can be selected while Remove permanently has been grayed out.

Resolution:

This is by design. The Move to blocklist will remove the device from the list, release the license and move the device to the blocklist. If the blocklist is emptied, the device will automatically take the license back into use and reappear on the devices list.

If the Remove permanently is used, the device will be immediately removed permanently without going through the blocklist. This feature should be used when the software needs to be reinstalled on the same device. 

Remove permanently is grayed out, to avoid anyone from mistakenly removing many or all devices permanently from the Elements Endpoint Protection Portal, which would require a manual reinitialization of the Elements Agent using the fs_oneclient_logout tool.

Issue:

Software Updater is unable to download Java updates.

Trying to use the same download link that is written in the logs leads to an error, so it can't be used manually.

Resolution:

Oracle has changed the way Java is licensed. A side effect of this is that Java updates can be downloaded only from the vendor's server with authentication. This stops Software Updater from downloading the Java update. 

We have published a change to Computer Protection to stop showing Java update as a missing update in Software Updater. After this, you will need to install Java update manually (not via F-Secure Software Updater). 

At the same time, we are not going to change the Software Updater behavior for the rest of the products. 

To stop Software Updater from trying to install the problematic Java update automatically, you can exclude the Java Update from the automatic installation by following these steps: 

If you have a Business Suite product (Client Security or Server Security) 

1. Log in to Policy Manager Console
2. Select the target group from the Domain Tree
3. Go to the Settings tab
4. Select Software Updater 
5. Click on Add from the right side of the Exclude software from automatic installation list
6. Use Java as the software name to exclude it

If you have an Elements Endpoint Protection product (EPP for Computers or EPP for Servers) 

1. Log in to the Elements Endpoint Protection Portal
2. Go to the Profiles page
3. Click the profile you want to edit
4. Select Software updater 
5. Click Add software below Exclude software from automatic installation 
6. Write Product=Java to exclude Java software from automatic installation

After the change, you will need to install the Java update manually. 

Issue:

After reformatting a device and reinstalling Elements Agent, the device is duplicated in Elements Endpoint Protection portal. The Elements Endpoint Protection portal's Devices page shows two devices with the same name. One device is in offline status, but the physical device is actually online.

How to reinstall Elements Agent without duplicating the device in the portal?

Resolution:

When Elements Agent is reinstalled, it will create a new device UUID automatically, since each new installation of Elements Agent has a random unique user ID. This will result in the new installation appearing as new device in the Elements Endpoint Protection Portal Devices view.

We have a guide available here which explain the steps of reinstalling Elements Agent without duplicating the device in the portal: https://www.withsecure.com/userguides/product.html?business/psb-portal/latest/en/concept_D5DAAA0BB40243FC8585E97100708D84-psb-portal-latest-en

You may try to use the following parameter during installation:

• –use_smbios_guid

By using the –use_smbios_guid parameter during the first installation, you can make sure that the Elements Agent installation is given an ID based on the SMBIOS ID. Any following installation that you perform on this device with the –use_smbios_guid parameter ensures that it will have the exact same ID.