Issue:

I have an issue with Elements Endpoint Protection (EPP for Computers or EPP for Servers) Software Updater, where one or more updates are not auto-updating due to the status "Excluded from the automatic installation", even though these updates are not excluded in the Software Updater list of the profile that is assigned to the devices. 

Resolution:

When Microsoft updates are installing from both Software Updater (SWUP) and Windows Server Update Services (WSUS), it can cause possible conflict. 

You can choose from the following options:

1. Install updates manually from the Elements Endpoint Protection portal
2. Disable WSUS setup
3. Enable WSUS override. Steps:
   • Login to Elements Endpoint Protection portal
   • Go to Security Configurations > Profiles and select the profile to amend
   • Under Software Updater enable "If WSUS is in use, both Software Updater and WSUS install Microsoft updates"
4. Exclude the selected updates even from scanning on the portal so these updates are not seen, and just let WSUS manage these updates. 

Issue:

After creating a Real-time scanning > Excluded objects exclusion in the Elements Endpoint Protection profile for Elements EPP for Computers or EPP for Servers, the DeepGuard feature is still blocking an application when trying to run it. The file or folder is visible on the local App and file control list with the type Controlled by admin (real-time scanning). 

Resolution:

The Excluded objects exclusion on the Elements Endpoint Protection  profile's Real-time scanning settings page does not apply to DeepGuard. To exclude the file from DeepGuard, you can either exclude the path using the Exclude folders and files from all security scans list or create an SHA-1 exclusion from the DeepGuard settings.

Exclude folders and files from all security scans:

1. Login to the Elements Endpoint Protection portal
2. Go to the Profiles page
3. Select the profile
4. Go to the General settings > Exclude folders and files from all security scans section
5. Click Add exclusion 
6. Add the folder or file path
7. Click Save and Publish

DeepGuard SHA-1 exclusion:

1. Login to the Elements Endpoint Protection portal
2. Go to the Profiles page
3. Select the profile
4. Go to the Real-time scanning > DeepGuard section
5. Click Add rule
6. Enter the application SHA-1 hash
7. Click Save and Publish

If issue persists, you can add both SHA-1 hash and file path/name exclusions.

Issue:

Elements Agent shows "protection malfunction" status in the local user interface due to it being unable to download updates from the WithSecure update server.

AUA.log shows:

I: Update check failed, error=71 (protocol error)

Resolution:

If the Elements Agent device is unable to download malware definition or engine updates and error=71 is shown in the AUA.log file, first run the WithSecure Connection Checker tool to make sure that the connectivity towards the update servers is OK. The tool can be found in the Elements Agent installation folder: C:\Program Files (x86)\F-Secure\PSB\ui\wsconnectionchecker.exe

If the connectivity is OK towards the update servers, try to run the FSAUA-reset tool and restart the computer to see if that fixes the issue: https://support.withsecure.com/en/support/support-tools

If the device is a server, check if you can see similar errors in the logs:

• *I: [fslib] downloading updates list 'https://guts2.sp.f-secure.com/u;t=deepguard-db;hydra-win64;lynx-win64;oneclient-psb-win32;sccore-win64;ulcore-win64;ulupdater-win64;uss-win64;virgo-win64'
• *E: [fslib] WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR
  2023-01-31 09:29:31.744 [06bc.1b38] *E: [fslib] Error occurred during WinHttpSendRequest, error 12175, flags 0x80000000
• *W: [fslib] Got ERROR_WINHTTP_SECURE_FAILURE with only WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR in flags, retrying
• *E: [fslib] WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR

Usually this issue is caused by non-default or misconfigured Windows SSL/TLS settings in the Windows registry.

Follow this troubleshooting guide:

1. Download IIS Crypto GUI and run this tool https://www.nartac.com/Products/IISCrypto/Download
2. Navigate to Advanced tab and press Backup button to backup SSL/TLS settings as .reg-file. It can be used to compare the settings with working systems or for restoring the original settings.
3. Navigate to Templates tab, select "Server Defaults" item from the dropdown list and click Apply button. The tool will write the default Windows SSL/TLS settings to the registry.
4. Alternatively, "Best practices" or "Strict" templates could be used as well if you would like to use more strict SSL/TLS settings than default. We support those templates as well.
5. Reboot the system

Issue:

I am trying to install Elements Endpoint Protection Agent (EPP for Computers and EPP for Servers) on a Windows host and it failed between 80 to 99%.

In fsdiag, NetworkInstaller.log displays the following entry:

*E: MsiMessageCallback: MSI: Service 'F-Secure Hoster (Restricted)' (fsnethoster) failed to start.  Verify that you have sufficient privileges to start system services.
*E: MsiHandler::RunMsi: MSI returned code 1603

Resolution:

The error message you encountered suggests that there may be missing permissions in the root directory or broken components where the WithSecure product is being installed or was previously installed. Here are some steps you can try to resolve the issue:

1. Run the WsUninstallation Tool.
2. Restart your computer.
3. Open the Windows Registry Editor (regedit).
4. Remove the key: `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\F-Secure`.
5. Remove the `C:\Program Files (x86)\F-Secure\` folder.
6. Restart your computer again.
7. Try the installation once more, ensuring that you have local administrator rights. Before proceeding, please check the following checklist for a smooth installation:

   – Verify that the default permission set is in place. If you are using the default installation path (`C:\Program Files (x86)\F-Secure`), ensure that the `Program Files (x86)` directory has permissions set for `NT AUTHORITY\NETWORK SERVICE`.
   – If unsure, you can reset the permissions on that specific directory back to defaults and attempt the installation again.
   – Check if your Windows operating system is fully updated.
   – Verify or reinstall .NET Framework 4.7.2 or a later version.
   – Check or reinstall Universal CRT.
   –  There is a possibility that registry key HKEY_USERS\S-1-5-20 doesn't have the required permission for NETWORK SERVICE and fsnethoster is unable to create an entry there. Follow the steps below to fix the issue:

1. Click Start
2. Type regedit, and press Enter
3. Navigate to and select registry key

4. HKEY_USERS\S-1-5-20

5. Select Edit
6. Select Permissions
7. Click Add…
8. Type NETWORK SERVICE (if you are using a non English version of Windows, this name will be different. In German for example it is Netzwerkdienst)
9. Click Check Names (the name should get underlined)
10. Click OK
11. Check Allow checkbox for Full Control (also Read permission should be automatically allowed)
12. Click Apply
13. Click OK

By following these steps, you may be able to address the missing permissions issue and proceed with the installation of the WithSecure product.

If the above steps did not fix the issue, follow the workaround below to try fix the installation issue:

1. Rename following files to anything else (e.g. vcruntime140_old.dll):

• On 64 bit Windows: 

  • C:\Windows\SysWOW64\vcruntime140.dll
    C:\Windows\SysWOW64\msvcp140.dll

• ​On 32 bit Windows:

  • C:\Windows\System32\vcruntime140.dll
    C:\Windows\System32\msvcp140.dll

2. ​​Restart the computer.

Issue:

Elements Endpoint Protection portal's Security Events-tab shows a new event found during Manual / Scheduled scanning flagged for "Action required", but the threat description shows that no action was taken. 

Resolution:

If the detection shows that a harmful / malicious file has been located inside an archive file (for example a ZIP,RAR,7z,tar.gz, Chrome browser cache etc.), then it means you will have to remove the infected item from the archive manually, or delete the whole archive completely. 

Elements Endpoint Protection products cannot open an archive, remove an infected file and then re-archive the files, thus manual action is needed by the administrator. Note that a malicious file is harmless until you extract it from the archive. 

Try the following instructions to manually remove the detected item(s):

• Make sure you have the administrator right or permission to delete the file
• Some files may be hidden, so set your folder option to show hidden files, folders and drives

1. Open File Explorer
2. Copy the filepath (without the item filenames) where the detected item is located
3. Paste the copied path into the Address Bar in File Explorer
4. Delete the detected file / the whole archive manually

Note: If the file path indicates that the file is placed inside an email folder (Outlook, Thunderbird etc.) file, then you can delete all your emails with attachments and empty the trash, deleted and spam emails folders. It is possible to locate the file, but that process is complicated. The file is not dangerous, because the Elements Endpoint Protection program has identified the file, and will not allow the file to run on the computer. 

Issue:

The device status in the Elements Endpoint Protection Portal shows that the Malware protection status as Malfunction on the Mac device and Overall protection is shown with Malware issue status. How to get this fixed?

Resolution:

If the MacOS device's malware protection status is shown to be in malfunction status, the most likely reason is that Elements Agent has not been granted Full Disk Access and the WithSecure System extension hasn't been enabled. You can from the Elements portal check the status of both of these by opening the device details and then from the Protection status tab you expand the Security parameters drop-down list. From there you can make sure that both Full Disk Access and System extension are shown as Enabled. The software needs both of these to function as intended.

Normally after product installation there would appear a notification pop-up on the right side of the screen which would forward the user to the correct MacOS settings page where the user can allow Full Disk Access and the WithSecure System Extension for the Elements Agent. If the user did not click on the notification pop-up after product installation, they need to manually allow these from the MacOS settings.

You need to do the following:

1. Go to System Preferences (Apple logo menu from top left corner)
2. Click Security and Privacy
3. Click Privacy
4. Select Full Disk Access on the left pane
5. Click the lock in the bottom-left corner to make changes, and login with your Mac password (if prompted)
6. Tick the box next to WithSecure Elements Agent and WithSecure System Extension on the list
7. Click the lock again to prevent further changes

If for some reason the Full disk access list would be empty, try restarting the computer and try again. If all else fails, uninstall and reinstall Elements Agent and allow the Full Disk Access and the WithSecure System Extension immediately after installation.  

Full disk access and WithSecure System Extension installation can also be automated using MDM: https://community.withsecure.com/en/kb/articles/31284-pre-announcement-new-withsecure-client-for-macos

If issue is not caused by the extensions, it is also recommended to check your firewall and proxy (if applicable) settings to make sure that the software can download all the required updates and connect to the Elements portal:

Port 443 (HTTPS)
Port 80 (HTTP)

*.f-secure.com
*.fsapi.com
*.digicert

ocsp.rootca1.amazontrust.com
crl.sca1b.amazontrust.com
ocsp.rootg2.amazontrust.com
ocsp.sca1b.amazontrust.com
crl3.digicert.com
crl4.digicert.com
ocsp.digicert.com

Issue:

When looking at the Malware protection column on the Elements Endpoint Protection portal's Devices page, the status for one or more devices is shown as Broken ACS. Overall protection shows "Malware issue" status when the device's details are viewed.   

Locally in the Elements Agent user interface, status is shown as "Your computer is at risk due to missing Windows patch".
 

Resolution:

Broken ACS refers to missing Azure Code Signing support on the device. The device's Windows installation must support Azure Code Signing for the product to function. You will need to install the required Windows update, which brings Azure Code Signing support: https://support.microsoft.com/en-gb/topic/kb5022661-windows-support-for-the-azure-code-signing-program-4b505a31-fa1e-4ea6-85dd-6630229e8ef4

After installing the required Windows update, restart the device and then the Elements Agent will be able able to install updates. 

You can read more about the ACS support requirement from this WithSecure Community article: https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level

Issue:

Elements Endpoint Protection infections email alerts are delayed or do not arrive to the recipients. The email alerts recipients are configured correctly from the Alerting configuration page in the Elements Endpoint Protection Portal. 
 

Resolution:

If you are using HTTP proxy in your environment, you need to configure your HTTP proxy from the Elements Endpoint Protection Portal for email alerting to work. How to configure EPP for Computers or EPP for Servers:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Profiles page and select the modify that is used the your devices
3. Go to the General settings page and scroll down to the Automatic Updates section
4. Enter the proxy address to the Manually defined proxy address field, for example: http://10.100.4.1:8080
5. For the option Use HTTP proxy, select Remotely managed from the drop-down list
6. Click Save and publish

Once the proxy address has been configured to the device profile and the profile has been taken into use by the devices, wait for a few hours and check with an eicar file if an email alert is now sent to the recipients. 

Email alerting configuration instructions can be found in this Help Guide.
 

Issue:

When the DataGuard features Access control and Discover trusted applications automatically are enabled for Elements EPP for Computers/Servers, DataGuard blocks Windows processes and applications installed in the Windows Users, AppData or System32 folder.

The Security Events tab in the Elements Security Center shows an alert with the Source as DataGuard and the Description "DataGuard has blocked an attempt to access"

Elements Agent Event History on the device shows "Application was blocked from accessing your files" and the Reason as Ransomware:AccessControl.
 

Resolution:

If the blocked application (OneDrive.exe, Firefox.exe, Chrome.exe, WhatsApp.exe etc.) is in the Windows Users or AppData directory, it is not by default a trusted application location and therefore it will be blocked if it tries to modify a file that is located in a protected path. You can view the currently trusted application paths in the Elements Security Center:

1. Select Environment from the left side bar
2. Go to the Devices page
3. Click the device that has DataGuard enabled
4. Under the Protection status tab, click on the DataGuard (Premium) section

This will show you the currently protected paths and the currently trusted application paths.

To prevent DataGuard from blocking an application, you can either:

• Install the application to a trusted path, such as C:\Program Files (x86)\
• Add the application path to the Manually added trusted applications and folders list

How to add the application path to the Manually added trusted applications and folders list in the Elements Security Center:

1. Select Security Configurations from the left side bar
2. Go to the Profiles page
3. Select the profile the device is using
4. Go to the DataGuard settings page
5. In the Access Control section, click Add path below Manually added trusted applications and folders
6. Add the full path of the application, example C:\Users\Username\Documents\exampleprogram\example.exe
7. Click Save and publish the profile

Note:  You can use system environment variables when you want to create an exclusion for many users. The supported environment variables are: %USERPROFILE%, %HOMEDRIVE%, %HOMEPATH%, %APPDATA%, %ProgramFIles%, %ProgramFiles(x86)% %ProgramData%, %windir%, %SystemRoot%, %SystemDrive%

Example: %USERPROFILE%\AppData\Local\Mozilla Firefox\firefox.exe

If you need to find out more about the detection (detection path, target path etc.), you can view it from the Security events page in the Elements Security Center:

1. Select Events from the left side bar
2. Go to the Security Events page
3. Click on the arrow on the left side of the DataGuard detection

From the Security Events page you can also add the application to the Manually added trusted applications and folders list:

1. Click on the Three dots on the right side of the DataGuard detection
2. Select Add the application to the Dataguard's trusted list
3. Click Save and publish

Issue:

Elements Mobile Protection received suddenly the following push notification on Android devices:

• "Test push msg android" "Hello Android MP in P3" 

This notification wasn't sent by any admin user from the portal and it isn't visible in the Notifications page in the application. 

What is this about? 

Resolution:

On 24th of September 2024, this push notification was sent by mistake by WithSecure to Android devices. We have identified the source internally and we are reviewing our processes to ensure such mistakes don't happen again. We apologize for the inconvenience.