Issue:

How can I import a Policy Manager host policy to a Elements Endpoint Protection profile in the Elements Security Center Portal?

Resolution:

You can follow the steps below to export the WithSecure Client Security host policy using the Policy Manager Console:

1. Log in to the Policy Manager Console
2. Right-click the host in the Domain Tree
3. Select Export policy file 

Note: Client Security 13.x host policy cannot be imported to an Elements Endpoint Protection profile since it is in a .bpf format. The .json file format is required to be able to import the policy.

Import the Client Security host policy .json to an Elements Endpoint Protection profile:

1. Log in to the Elements Security Center
2. Navigate to the Security configurations > Profiles page
3. Select the profile to which you want to import the host policy
4. Click on the three dots
5. Select Import profile
6. Navigate to the .json file and click Open

Note: if you receive an error "Cannot import the given profile because the format of the file is unknown", you have exported the profile incorrectly by selecting Tools > Export policy settings. The policy must be exported by right-clicking the host in the Domain Tree. 

Issue:

When trying to create a new company account with an WithSecure Elements Endpoint Protection (EPP for Computers or for Servers) subscription key in the Elements Portal, user receives the following error: Subscription not found 
 

Resolution:

There are a couple of different reasons why a subscription key might not work when trying to create your Elements company account with it:

• If you have bought a Partner Managed Elements subscription, you do not need to add the subscription key yourself to your Elements account. It will be automatically added by the reseller partner. Most likely it has already been added to your account
• You already have created the Elements Company account before with that subscription key. If this is the case, try to log in with your user credentials or use the forgot password feature. 
• The key belongs to a different Elements portal than the Elements portal you are trying to create the company to. The subscription keys are portal specific. Check the license certificate for which Elements portal the subscription key belongs to and make sure you are trying to create the F-Secure Elements account to the correct portal.

Issue:

Receiving error "Could not find subscription key" when adding subscription key to an Elements portal company account with the Assign subscription button on the Management > Subscriptions page. 

Resolution:

Check that the subscription key code you ordered is correct for the account you have. 

If you have a Company Managed subscription key and the company account is placed under a reseller partner's Solution Provider account (SOP), you cannot add the code there. For that you need to have a Partner Managed subscription.

If you have a Partner Managed subscription key, the subscription key is automatically added to the company account and you cannot add it again. Check the Management > Subscriptions page to see if the subscription key is already found on the accoutn. 

A code cannot be used on a trial account either, a new account needs to be created or the trial account needs to be converted to a normal commercial account.

A reseller partner can directly contact Order Services to help you with this. 

If you're not sure what the issue is, please contact WithSecure Support for further assistance.

Issue:

I have forgotten my WithSecure Business Account password. How do I reset the password for my Elements business user account?

Resolution:

You can reset your password by clicking on "Forgot password?" on the Elements Security Center log in page. An email will be sent from which you can reset your password.

If you do not receive a password reset email, check if it has been sent to your email spam or trash folder.

If you have not received any email, open a support request and support can investigate the account issue.

Issue:

Is it expected to have both F-Secure and WithSecure services running when WithSecure Elements Agent is installed on a Windows computer? Some Elements Agent related services are still running under the "F-Secure" name on the Windows devices. 

Resolution:

Yes, it is expected to have both WithSecure and F-Secure named services running, as these components are common for both F-Secure and WithSecure, hence the name has been kept.

Currently, the following Elements Endpoint Protection services are still using F-Secure name:

• F-Secure Ultralight Hoster (fsulhoster)
• F-Secure Ultralight Network Hoster (fsulnethoster)
• F-Secure Ultralight Protected Hoster (fsulprothoster)

The following Elements Agent services are using the WithSecure name:

• WithSecure Device Control (fsdevcon)
• WithSecure Hoster (fshoster)
• WithSecure Hoster (Restricted) (fsnethoster)

Issue:

An information event "Connection control has blocked the network connection. The blocked application: chrome.exe / firefox.exe / edge.exe" was logged for Elements Endpoint Protection (EPP for Computers or EPP for Servers) on the Security Events page in the Elements Security Center portal

What does this block event mean? Why is no website address (URL) being listed?  
 

Resolution:

Connection Control is also known as "Banking Protection". It is the feature which activates when a user enters a banking site. When Connection Control is active, the browser only allows the user to visit trusted websites. 

If a full page is blocked, the user will receive a splash page which alerts the user that a page has been blocked, and if they need to access the page while Connection Control is active, they can allow the website. Sometimes simple analytics addresses are being blocked, which do not affect the user at all, which is why it can get unnoticed by the user and still an alert is sent to the Security Events page.

With the default settings, due to regional legislation differences, the page address is only shown fully to the local user while in the Elements Endpoint Protection portal's Security Events page only the affected browser or process is listed. 

You can from the profiles change the following setting if you want the Security Events page to show the website URL:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Go to the Security configurations > Profiles page
3. Select the profile which is in use on the device
4. Go to the Browsing Protection settings page 
5. In the Common settings section, enable Include the blocked URLs in all security events 
6. Click Save profile

Note that you need to be sure that your regional legislation allows you to monitor users in such a way. 

Issue:

Is it possible to centrally send an operation for remote uninstallation of the Elements Agent from the Elements Security Center Portal?
Will removing a device from the Devices-list in the Elements Endpoint Protection Portal cause the client software to be uninstalled?

Resolution:

Removing a device from the Elements Security Center Portal with the Remove device operation does not trigger a local uninstallation of the Elements Agent, you will need to use a specific Uninstall operation from the portal if you want to remotely uninstall Elements Agent from a device.

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Go to the Environment > Devices page
3. Select the device(s) from the list by clicking the white box on the left side of the device (a menu will appear)
4. Click Uninstall from the menu
5. Confirm the uninstallation operation

This will send an uninstallation operation to the device and the Elements Agent will be silently uninstalled from the device. Once the Elements Agent has been uninstalled, the device will be removed automatically from the portal and the license will be released so that it can be used on another device.

If you want to uninstall Elements Agent using GPO, you can run the following command as administrator: 

• C:\Program Files (x86)\F-Secure\PSB\fs_uninstall_32.exe –silent

This will run the Elements Agent uninstallation silently and automatically remove the device from the Elements Endpoint Protection portal and release the license.

Issue:

How to forbid a local user from creating real-time scanning or DeepGuard exclusions for Elements Endpoint Protection (Elements EPP for Computers or Servers)?

Resolution:

You can block or disallow a local user from creating or adding new exclusions in the local Elements Agent user interface by changing a few settings in the profile that is in use on your devices. 

Follow these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Open the Security Configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile that is in use on your devices (note that only custom profiles can be edited)
5. Go to the General settings page
6. Scroll down to the Quarantine section and disable Allow users to release blocked and quarantined items 
7. Scroll back up a little to the Exclude folders and files from all security scans section and enable the lock on the right side of the exclusions table
8. Click Save and publish 

Now all the devices that have this profile in use will have it so that even local users with administrator rights cannot add exclusions, since the Add new button will be grayed out and the setting is locked. 

Issue:

How to install Elements EPP for Servers in persistent mode on Citrix Servers?
How to automatically assign a profile to a Citrix Server?

Resolution:

• When creating the image with the ElementsAgentinstaller.exe, you can either use a profile parameter or manually define what profile this image will use.
• There is currently no way to automatically assign a different profile for a new device deployed from the golden image for the first time (this is a real limitation). Device will automatically get the default company profile.
• Once you have deployed a new device from the image, you need to do manually assign the profile for this device if you want to use a different profile than what is on the golden image. All the subsequent deployments of that same device will receive the profile that was manually assigned to them.

You can follow the instructions from this Help Guide on how to install Elements EPP for Servers in persistent mode on Citrix servers.

How to set a profile can be found in this Help Guide.
 

Issue:

How to reset the host UUID (Unique ID) of WithSecure Elements Agent (Elements EPP for Computers or Elements EPP for Servers) client?

Resolution:

You can use a tool called ws_oneclient_logout.exe which can be used to reset the GUID for existing Elements Agent installation.

1. Open a command prompt with administrator privileges
2. Navigate to the installation directory of WithSecure Elements EPP client: %ProgramFiles(x86)%\F-Secure\PSB\
3. To change the UID of the host use the following command:
   • ws_oneclient_logout.exe –keycode <enter your license keycode here>

For example:
ws_oneclient_logout.exe –keycode xxxx-xxxx-xxxx-xxxx-xxxx 

NOTE: If you use the ws_oneclient_logout.exe tool with this option (ws_oneclient_logout.exe –wait_uuid_changed), the system waits until the UUID is changed to make sure that the device registers with the correct, unique ID on the WithSecure Elements Endpoint Protection portal. This option works only if SMBIOS is used to identify the device. It has no effect if other identification methods are used. You can read more about this feature here: https://www.withsecure.com/userguides/product.html#business/psb-portal/latest/en/task_05B6F4B3D49D451CBD438312C41C15D3-psb-portal-latest-en

When the host UID is reset, the Elements Endpoint Protection portal will consider the host to be a new device. This can result in duplicate devices visible in the Elements Endpoint Protection Portal Devices page (each device takes a license into use). You can remove the old devices by selecting the device from the Devices list and from the Actions menu you can select Remove device > Remove device.