Issue:

 Unable to login to the Elements Security Center portal. Error message: "Missing Authentication Token"

Resolution:

This notification can appear if you use any of the old URL addresses to try to access the portal. Try to login using the following updated URL : https://elements.withsecure.com/

Issue:

What rule do I need to configure to scan my computer on startup or reboot ?

Resolution:

On Elements Security Center profile, navigate to Automated Tasks :

1. Navigate to Security Configurations > Profiles on the sidebar
2. Select the desired profile
3. Go to Automated tasks
4. Make sure to enable automated tasks
5. Click Add task
6. In the Type column, select either:

1. "Quick Scan for Malware" which will scan the all folders except for compressed files
2. or "Scan for Malware in Folder" which you will have to specify a folder such as C:\
3. Set "Schedule" to "Reboot"

Issue:

After upgrading Elements Endpoint Protection Agent client to version 22.7, a user or monitoring software is unable to find F-Secure Hoster and F-Secure Hoster (restricted) service on the device. On device(s) with Elements Agent version 22.6 or earlier installed, these services are still there. Hence, monitoring tool shows that the product seems to have stopped working.

F-Secure Ultralight hosters, such as F-Secure Ultralight Hoster, F-Secure Ultralight Network Hoster, F-Secure Ultralight Protected Hoster can still be found on the device with Elements EPP client 22.7 in place.

What has happened to the service names?

Resolution:

The display name for these two services has been changed into "WithSecure Hoster" and "WithSecure Hoster (Restricted)".

In case you are using the display name to do the monitoring, you need to tweak the monitoring logic.

The display name for the rest of the product's services are subject to change in the near future too. We recommend to consider using the short name for the product service. For example, fshoster, fsnethoster, fsulhoster, etc, when monitoring the product's services. 

Issue:

When a user goes to a HTTPS website with their web browser, they get an ERR_SSL_PROTOCOL_ERROR and a message that says the site is not secure.
 

Resolution:

The ERR_SSL_PROTOCOL_ERROR occurs because the WithSecure Elements Browsing Protection or Connection Control feature has blocked access to the site, but you do not have the Browsing Protection by WithSecure browser extension installed or activated in your browser, so it can only give that error.

You need to make sure that the Browsing Protection by WithSecure browser extension is installed and enabled on all the browsers you are using (Google Chrome, Microsoft Edge, Mozilla Firefox).

To install the Browsing Protection by WithSecure browser extension / add-on, you will need to follow these steps:

1. Close all browsers open on your computer (e.g., Edge, Chrome, Firefox).
   • All browsers need to be closed because when the site/tab that activated the banking protection is closed, the banking protection will turn off automatically.
2. Right-click the Elements Agent icon in the bottom right corner of the screen and select Open Settings.
3. Go to the Secure Browsing tab and scroll to the bottom of the page.
4. Click on one of the following links:
   • Open Chrome Web Store
   • Open Edge Add-ons
   • Open Firefox Add-ons
5. Click to install the extension / add-on to your browser
6. Once the browser extension / add-on has been installed, make sure that it is enabled 

Now you can restart the browser and make sure that the extension works. You can make sure that the extension works by going with the browser to the following test domain: https://unsafe.fstestdomain[.]com (remove the brackets to make the link work). You should now receive a block page informing that the site has been blocked by WithSecure Browsing Protection.

Issue:

Why is the WMI Provider not working in Elements EPP for Computers or EPP for Servers on a Windows device?

Resolution:

WMI Provider is by default disabled. You can enable the WMI Provider from the Endpoint Protection device profile:

1. Log in to the Elements Endpoint Protection portal
2. Go to Profiles page 
3. Select the profile
4. Go to the General settings page
5. Scroll down to the Integrations section and enable WMI Provider
6. Click Save and Publish

Correct Command for WMI Integration:

$ Get-WmiObject -Namespace root/fsecure -Class AntiVirus | Invoke-WmiMethod -Name ScanComputer

Note: WMI must be enabled in the Elements device profile, and PowerShell should be run with admin rights.

In case WMI does not work after WMI provider has been enabled, re-installing the product might help.

You can find the Windows Management Instrumentation instructions for Elements products in this Help Guide.

Issue:

Elements Agent installed on a Windows Server causes the following error to be output in the Windows Event log:

fshoster32 (24224,D,50) WSResourceMonitorPlugin: An attempt to open the file "C:\Windows\Sysnative\sru\SRUDB.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8).

What is this event log about and how to get it fixed?

Resolution:

This is a known issue and it will be fixed in the Elements Agent for Windows version 24.6. You can follow the Elements Agent for Windows and Server changelog in our WithSecure Community to get notified when the latest release is available: Elements Agent for Windows and Server Changelog – Page 3 — WithSecure Community

Issue:

• When the Web traffic scanning (Advanced Network Protection) feature is enabled, some applications are unable to connect to an internal server and some website addresses (URLs) are inaccessible or some applications have connectivity or performance (slowness) issues 
• Java-based applications unable to connect to an internal server or there are connectivity issues.

Resolution:

If the Web Traffic Scanning feature is causing issues for an application that connects to an internal server, you can add the server address as trusted. This will exclude the network traffic from Web Traffic Scanning.

To confirm that the issue is caused by the Web Traffic Scanning feature, you can try disabling it from one device from the local  settings:

1. Open the Elements Agent user interface 
2. Click the Settings icon
3. Go to the Malware Protection tab
4. Disable Advanced Network Protection

Once you have disabled the feature, try to reproduce the issue. 

The Advanced Network Protection feature is called Web Traffic Scanning in the Elements Endpoint Protection Portal profiles. You can either exclude an application completely using a SHA-1 exclusion, file path exclusion or excluding the server address to which the application is having issues connecting reliably. 

Steps to create a SHA-1 application exclusion:

1. Log in to the Elements Portal: https://elements.withsecure.com
2. Go to the Security configurations > Profiles page
3. Select the profile you want to edit
4. Go to the Real-time scanning settings page
5. Add the application SHA-1 in the Applications excluded from Web traffic scanning list
6. Click Save and publish

Steps to create a file path exclusion: 

1. Log in to the Elements Portal
2. Go to the Security configurations > Profiles page
3. Select the profile you want to edit
4. Go to the General settings page
5. Click Add exclusion in the Exclude folders and files from all security scans section
6. Enter the full path of the process (Example: C:\ExampleFolder\Example.exe)
7. Click Save and publish

Steps to exclude an address:

1. Log in to the Elements Portal
2. Go to the Security configurations > Profiles page
3. Select the profile you want to edit
4. Go to the Browsing protection settings
5. Enable Web site exceptions 
6. Click Add site under Allowed sites and enter the server address or hostname
   • Note: Http:// or https:// doesn't need to be included
7. Click Save and publish

Issue:

When Elements Endpoint Protection Tamper Protection (Resource Protection) feature is enabled, an application / software / process is blocked and Tamper Protection alerts logged in the Security Event -page in Elements Endpoint Protection portal.

Alert source: Tamper protection
Alert Description: Tamper protection protected "<process name>" from "<process name>" 
Alert type: Process termination was blocked
Action Type: Process 
Request type: Terminate process

Resolution:

This type of block is the function of the Tamper Protection functionality. 

When the path shows a registry path, the Tamper protection functionality sees that some process tries to open a protected part of registry with write access rights. Even if the process would not try to modify the registry, the fact that it could it enough that is will be blocked by Tamper Protection.

When Tamper protection blocks an operation, the application gets an ACCESS_DENIED error. It should not affect the functionality of this application, but if it does – this is the problem in the 3rd party application.

If you do not want to see Tampering Protection alerting notifications in Elements Endpoint Protection portal Security Events -page, you may filter them out by following these steps:

1. Go to Security Configurations > Profiles.
2. Select either For Windows Computers or For Windows Servers, depending on your environment.
3. Choose the profile you want to edit.
4. In the left-hand menu, click on Scanning settings.
5. Scroll down to the Tamper Protection section.
6. Click the Add exclusion button.
7. Enter the application path to exclude it from Tamper Protection.

​​​​​​​Note: You can use wildcards (*) and system environment variables in the application path.

The unauthorized access is still blocked with the exclusion in place, but no event is sent. Use this option to reduce the amount of tamper protection events that you receive.

Issue:

We are a solution provider and have noticed that Elements Endpoint Protection settings profiles created for specific customers are visible to the administrators belonging to other companies we manage. How can we see who has the rights to which profiles, and what can be done about administrators seeing profiles belonging to other companies on their Elements Endpoint Protection Profiles page?

How to prevent customers from seeing profiles belonging to other companies in the Elements Endpoint Protection Portal?

Resolution:

If the profile is created on the solution provider level, they will be visible to all companies under the solution provider. For a profile to only be visible to one individual company, it needs to be created on the company level in the portal.

To create a profile for an individual company, make sure that the correct company scope is selected from the drop-down menu in the upper left corner in the Elements Endpoint Protection portal. 

Profiles for Elements EPP for Computers and EPP for servers  will have an owner listed on the Profiles page. The profiles belonging to System are the default profiles that comes with the product. If the owner is a company, only that company can see the profile, while profiles belonging to solution providers are visible to all their customers. 

If a solution provider has created a profile on the solution provider level when the intention was to create it on the company level, the profile can be copied from the solution provider level to the company level. After the profile has been copied to the correct level, the newly created profile can be assigned to the devices and then the old profile can be deleted from the solution provider level. 

How to copy a profile to another account:

1. Log in to the Elements Endpoint Protection Portal 
2. Select the solution provider level from the drop-down menu
3. Go to the Profiles page
4. Click on the three dots on the right side of a profile and select Copy profile to another account 
5. Select the destination company to which you want to copy the profile to and click Confirm
6. Enter a name, label and description for the profile and click Save and publish 

Once the profile has been copied to another company, that company will be shown as the owner of the profile. The administrators belonging to that company and the solution provider will be able to edit the profile and no other company will see the profile. 

How to assign a profile to the devices:

1. Log in to the Elements Endpoint Protection Portal 
2. Select a company from the drop-down menu
3. Go to the Devices page
4. Select the devices you want to assign a profile to (a menu will appear)
5. Click Assign > Assign profile 
6. Select the profile and click Assign 

How to delete a profile:

1. Log in to the Elements Endpoint Protection Portal
2. Select the solution provider level from the drop-down menu
3. Go to the Profiles page
4. Click on the three dots on the right side of a profile and select Delete profile

Issue:

Elements Endpoint Protection (EPP for Computers or for Servers) subscription usage exceeds the maximum subscription size. For example, subscription size might be 200 and showing in the portal as 203/200.

Resolution:

This may occur when computers running older versions of Workstation Security (11.X and older) are upgrading to Computer Protection. This situation causes duplicate devices to appear for each upgraded computer in the PSB portal, as the new installation of Computer Protection appears as a separate device. At this stage, the new installation of Computer Protection will also use up an additional license seat in addition to the one already taken by the installation of Workstation Security.

In these cases, the subscription is allowed to exceed its own limit. This is to prevent a situation where a computer would be left without protection after the upgrade if there are no free license slots left.

To resolve this, go through the list of devices on the PSB-portal Devices-page and remove any Workstation Security-devices that also has a Computer Protection-equivalent device in the list. The duplicate devices can be recognized based on for example WINS or DNS names, or IP addresses. To get an overview of this info for all devices, change the Category-filter in the upper right corner of the Devices-page to Computer information.