Issue:

Several devices become slow if both Box application and EPP for Computers are installed.

The issue has started since 1/28, when Box new version 2.25.304 were applied.
If Box application is stopped, the issue is solved.
If EPP for Computers is uninstalled or disabled, the issue doesn't happen.
OS restart doesn't solve it.
 

Resolution:

Please do below to collect dump(Article Number 000028877)

#In some cases there's something preventing us from optimally scanning file I/O (our bugs, 3rd party intervention, hardware issues, etc.), scanning may become too slow and eventually some files are just timing out and cannot be scanned. Driver writes a message about this situation in event log : "event ID 1" from "F-Secure Gatekeeper" (with file name in content). To investigate those issues, R&D sometimes asks customer to provide a "crash-on-hang" dump. It might be unwelcome to some customers, as a) creating the dump is critical failure for the system, meaning that some data might be lost, and b) generated dump contains all memory contents of the machine at the time of event, including personal data.
Still, in case we're allowed to proceed with collecting the dump, instructions are:

• In HKLM\SYSTEM\CurrentControlSet\Services\F-Secure Gatekeeper\Parameters, create a DWORD value 'BreakOnHang" with value 1.
• In "advanced system properties" ("my computer", right click – "properties", "advanced system settings" on the left) pick "startup and recovery" and make sure "write debugging information" is enabled with "complete memory dump" option). Exact instructions could be different depending on exact OS.
• Make sure there's enough memory on boot partition (20Gb+)
• With all this, restart scanning platform including Gatekeeper driver (or just reboot)
• Reproduce the problem
• When the "hang" happens, computer would bluescreen instead of writing event log messages. 
• memory.dmp (usually in c:\windows) has to be collected; note that it's usually protected so that only elevated administrator can copy the file.

As a workaround so far. 

– Stop Box application and OS restart.
– Disable or uninstall EPP for Computers.
– Upgrade Box version to 2.25.306

Issue:

It appears that WithSecure Software Updater does not check if Zoom Client product is up to date.

Resolution:

The exe installer for Zoom is unsupported since it is a user-specific installation instead of machine-wide (it runs out of AppData within the user profile, does not lay down reg keys in HKEY_LOCAL_MACHINE). 

In order to be patched by our engine, the installation on the computer needs to be done using the msi installer. This installer is available on Zoom's website and it is named "Zoom Client for Meetings – MSI Installer": 

https://support.zoom.us/hc/en-us/articles/207373866-Zoom-Installers

Issue:

When looking at an forwarded Windows system event from the Events > Security Events page in the Elements portal, the reported user name shown in the Details drop-down does not match what is reported in the file downloaded using the Event XML: Download XML link or the system event itself when looked locally from the Windows Event Viewer

For example, in a Event ID: 4625 "An account failed to log on" event, The User Name and Principal User Name do not match with the actual account which failed to log on. Why is the wrong username listed in the detection details? 

Other Event ID:s which have the same issue: 

• A user account was locked out. Event ID: 4740, event source: Microsoft-Windows-Security-Auditing.

Resolution:

The User name and Principal User Name in the Details section in the Security Alert do not refer to the affected user of the alert, they are just information taken from the Device details page in the portal of the last successfully logged in user. 

You need to click on the Event XML: Download XML link to view the details of the actual user for this system event. 

Issue:

Is it possible to use wildcards with the Device name search in the Elements portal's Enviroment > Devices page? For exampe to search a device (e.g. EXAMPLE-PC123) in the Elements Security Center portal by using characters in the start, end or inside of the string (e.g. PC123)?

Resolution:

The search functionality on the Elements Security Center portal's Environment > Devices page will do a "contains" search, so you can search with any string that the device name might contain. You do not need to use an asterisk as a wildcard, simply enter the characters that the device name contains. 

Issue:

Elements portal's Security Events page shows that "OfficeClickToRun.exe" was blocked from changing the "fshoster64.exe" process , whereas "fshoster64.exe" can be any WithSecure service is generated.

Will selecting acknowledge allow the specific process to run? Or we still need to do manual whitelisting or exclusion?

Resolution:

We are aware of this issue and the alert is triggered because OfficeClickToRun.exe attempts to change WithSecure processes and the product therefore blocks the action, this is why the alert is expected. When this alert is shown, it means that we have only blocked the process from touching WithSecure processes, all other actions of the detected process can continue as normal. If the alert is triggered for example for an installer, the installer will still be able to complete its installation or update without issue.

You can manually suppress the alerts by following these instructions:

How to suppress the alerts

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Go to the Events -page
3. Choose Security Events
4. Locate the alert where DeepGuard has blocked "OfficeClickToRun.exe" from changing WithSecure processes
5. Click on the three dots under "Menu"
6. Click on Show similar events
7. Click on Acknowledge all

This will acknowledge and clear all alerts regarding OfficeClickToRun.exe. 

Note – Acknowledge will not allow the specific process to run. It is just about managing which items are handled and which are not.
 

If needed, you can also exclude the file or folder from scanning and DeepGuard monitoring:

How to exclude a file or folder from Real-Time Scanning or DeepGuard

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Security Configurations > Profiles page
3. Choose the profile which the devices are using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

How to exclude a process from DeepGuard monitoring using the SHA-1

1. Log in to the Elements Endpoint Protection portal 
2. Go to the Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Global exclusions from all security scans list
5. Click Save profile

Issue:

No company listed in the Organizations drop-down list after clicking Add rule on the Automated actions page in the Elements portal's Security Configurations > Automated actions page. The list is blank or empty.

Resolution:

This issue is most likely caused by the browser cache.

To fix the issue, you can try these steps:

1. Reset your browser cache for the address elements.withsecure.com
2. Clear your browser cache.
3. Use Incognito or In-Private browser window.

After this all the companies on the chosen scope should be listed in the Organizations drop-down list. 

Issue:

When user has set the report data source to be "Security Events" for the Elements Endpoint Protection portal's "Reports > Email notification and report" feature, no email is sent at all when user clicks the Send test report button. 

Resolution:

The reason why Send test report doesn't send an email when Security Events is used as the data source is because of the "Send only when report has content" setting, which is configured when creating the report. This setting can be a bit misleading, because it works more like "Send only when report has new content".

The report is sent only when an alert appears on the Elements portal's Security Events page that hasn't already been emailed before and is less than 24 hours old. Whenever an alert has been included in a sent email, it will be marked as sent. The report automatically uses the "Frequency = Continuous" setting, which means that precisely every ten minutes (e.g. 13:40 and 13:50, etc.) an email is automatically sent if Security Events contains unsent information.

This means that when you press the Send test report button, it is very likely that the Security Events list does not contain any new alerts and therefore no test email will be sent either. For the Send test report to work, the alert should have to arrive to the Security Events page for example at 10:51 and the Send test report button would be needed to be clicked before 11:00, when the report is automatically sent as per the continuous schedule.

As a workaround, you can temporarily disable the "Send only when report has content" setting in the report and then click on the Send test report button. This will send a report that still includes the link that will forward you to the Elements portal's Security Events page which the correct view automatically open. Remember to re-enable the "Send only when report has content" after you are done testing. 

Issue:

Licensing and activation in Office 365/Microsoft 365 are being blocked by Browsing protection/Web content control.  

Resolution:

Following domains/URL are necessary for Microsoft365/ Office365. Browsing protection category sometimes consider those as Webmail/SNS/Entertainment/etc depending on the site reputation report. Please allow those URL in your profile by adding Web site exceptions.
 

https://officecdn.microsoft.com
https://ols.officeapps.live.com/olsc
https://activation.sls.microsoft.com
https://odc.officeapps.live.com
https://crl.microsoft.com/pki/crl/products/MicrosoftProductSecureServer.crl
https://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl
https://crl.microsoft.com/pki/crl/products/MicrosoftProductSecureCommunicationsPCA.crl
https://www.microsoft.com/pki/crl/products/MicrosoftProductSecureCommunicationsPCA.crl
go.microsoft.com
office15client.microsoft.com

#Wrongly categorized url can be corrected via SAS(submit-a-sample) request. 
https://www.withsecure.com/en/support/contact-support/submit-a-sample

All the domains for Office/Microsoft 365 licensing can be found in this article step3.
https://docs.microsoft.com/en-my/office/troubleshoot/activation/issue-when-activate-office-from-office-365

#Those domains can be changing anytime and Withsecure cannot provide latest information. By allowing root domain can be workaround for that. This may cause lower security.
 

*microsoft.com
*live.com

Issue:

How to move current WithSecure Elements EPP for Computers or for Servers installations from one Elements Security Center portal company account to another company account without having to reinstall the Elements Agent client on the devices?

Resolution:

The ws_oneclient_logout tool allows you to log out from the Elements Agent on the device, so that you can change the subscription key that a device uses to connect the device to an another company account in the Elements Security Center portal.

This command-line tool removes the current Elements subscription from the Elements Agent, and returns the software to its initial state, before a subscription key was used. 

The tool can also be used to switch Elements Security Center portal instances. The available options are:

• psb1
• psb2
• psb3
• psb4
• psbsmieu

The ws_oneclient_logout.exe tool can be found and run from the Elements Agent installation folder:

1. Open a command prompt with administrator privileges.
2. Navigate to %ProgramFiles(x86)%\F-Secure\PSB
3. Run the tool in the command prompt.
   • To log out and activate a new subscription key, run the following command: ws_oneclient_logout.exe –keycode <enter subscription key here> 
     Elements Agent will log out and start using the subscription key that you entered immediately.
   • To log out and register to another Elements Security Center Portal instance (e.g. PSB1), run ws_oneclient_logout.exe –psb1 –keycode <enter subscription key here>
     When both portal and  –keycode are specified, the client is switched to specified portal and keycode is used during the switch.
     This way installation can be registered to a new portal without reinstallation.
     The product will log out and start using the subscription key that you entered immediately.
   • To remove the current subscription key, run \ws_oneclient_logout.exe –nokeycode.
     The product will stop working and asks you to enter a new subscription key manually when you open the main view of the application.

If the tool runs successfully, it returns 0 as the result. In other cases, for example if the network is unavailable or you enter an incorrect subscription key, the product will stay in the "expired" state and asks you enter the new subscription key manually.

Note: When ws_oneclient_logout.exe is run with the –keycode parameter and the same subscription key is used, the device will re-register to the Elements portal with a new Unique ID (UUID). 

Issue:

Installation of WithSecure Elements Endpoint Protection Agent shows "Check that your internet connection is working and try again" error after entering the subscription key during installation.

Resolution:

If you are connected to the internet and still getting the "Check that your internet connection is working and try again" error message during installation with a subscription key, follow the steps below to rule out other probable causes:

Check for connectivity issues with the WithSecure Connectivity Tool: 

Before installing any WithSecure products, you can use the F-Secure Connectivity Tool to check whether or not the host is able to connect to the F-Secure backend systems. Later if you encounter issues with the installed products, you can use the tool to rule out any issues related to connectivity.

1. Download the F-Secure Connectivity Tool
2. Run it and check for errors

Incorrect subscription key:

1. Check that you are using the correct subscription key during the installation
2. Double-check the spelling and verify from either your license certificate or from the Subscriptions page in the Endpoint Protection portal that you are using a valid license

Insufficient number of available licenses:

1. Check that there are still available licenses on the subscription key you're trying to use
2. In the Endpoint Protection portal, go to the Subscriptions page and check the Usage column for the license in question. If there are no more available licenses, you have two options: 
   • Remove old installations that are no longer in use to free up licenses, or;
   • Acquire more licenses by reaching out to your F-Secure reseller partner or F-Secure sales contact

If you would like to remove old installations that are no longer in use to free up licenses, follow the steps below:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Devices page
3. Select the device(s) you want to remove, using the checkbox on the left
4. Click Remove device from the options at the bottom of the screen
5. Select Move to blocklist or Remove permanently depending on your use case

After removing a device from the Endpoint Protection Portal, the device will be added to a blocklist so that it will not be able to connect to the portal anymore and take a license into use. To be able to reinstall Elements Agent on these devices, you need to remove these devices from the blocklist:

1. Login to the Endpoint Protection Portal
2. Go to the Subscriptions page
3. Open the action menu on the right side of the license
4. Click Remove devices from blocklist

Note: If a computer is on the blocklist and you try to use the subscription key on that computer, you will get the same "Check that your internet connection is working and try again" error message. You will need to remove the devices from the blocklist to install the software again on that computer.

Installation file has been downloaded from the wrong Endpoint Protection Portal:

The installation files for Elements Agent are portal specific. Make sure you have downloaded the installation file from the correct portal. You can verify the portal the subscription key belongs to from your license certificate. 

Its also suggested to check the uptime of the Computer, if its running from too long than reboot the workstation/server and then try to install it again.