Issue:

Mobile Protection Network Protection (VPN) functionality shown as OFF in the user interface and is no longer be available to be enabled or turned on. 

Resolution:

It is by design that the Network Protection feature is greyed out and cannot be enabled in the Elements Mobile Protection user interface. VPN functionality was removed from version 24.1 for iOS and Android, since it will be replaced with the Network Gateway feature. 

Note: On Apple iOS devices, the VPN icon will still be visible in iOS user interface even if the Network Protection feature is disabled

Network Gateway component on the device will replace the current VPN functionality, with the introduction of Network Gateway will acts as a “device VPN”, intercepting all mobile application traffic and is used to validate any URLs visited with our reputation service, just the same as used in other WithSecure products.

This involves checking the domain names against a list of known URLs If the Network Gateway detects a malicious or phishing request, it will block it and notify the mobile phone app.

If the URL is categorized as Adult, Gambling, or one of many other categories, this information is returned to the Mobile Protection application, and can be used to block traffic based on profile settings set by the Security Administrator.

To check the full details of Network Gateway component and new version of Mobile Protection check our community release article: 

New Elements Mobile Protection Release – WithSecure Community

On 1st of April 2024 VPN will stop working on the devices, check that device is running the latest version of Mobile Protection.

For iOS devices Network Protection will be working as soon as Mobile Protection is up to date, currently under Apple review. 

And as of 2024-04-08, we have now released a version of Elements Mobile Security for Android, which enables the Network Gateway functionality. 
 

Issue:

Does Elements Endpoint Protection support non-persistent VDI environments? 

Resolution:

We do have the installation steps documented to support persistent deployment on Citrix and WMWare Horizon: 
 
Installation in persistent mode on Virtual Desktop Infrastructure (VDI) systems | Elements Endpoint Protection | Latest | WithSecure User Guides

For non-persistent VDI that does not keep the SMBIOS GUID, subscription need to be freed up every time that a VDI shuts down. Potential workaround is to use the automatic removal feature to delete the inactive devices, to free up the subscription usage. 

Automatically removing computers | Elements Endpoint Protection | Latest | WithSecure User Guides

Issue:

• We've disabled DataGuard in the Endpoint Protection profile using the Elements Endpoint Protection Portal, but devices using the profile are still getting applications blocked by DataGuard.
• Devices using another profile where DeepGuard is disabled entirely are not experiencing this issue.
• We've tried disabling DataGuard by turning off the DataGuard advanced behavioral blocking-setting from the DataGuard-settings in the Endpoint Protection profile.

Resolution:

For DataGuard to be completely disabled, two different settings need to be turned off in the profile:

1. Log in to the Elements Security Center
2. Go to Profiles
3. Select the profile you want to modify
4. Click on Dataguard
5. Turn on the setting DataGuard advanced behavioral blocking, if it is off
6. Turn off the setting Access control
7. Turn off the setting DataGuard advanced behavioral blocking
8. Save and Publish the profile

NOTE: To ensure policy enforcement, we recommend locking the settings in the profile too:

• End User Rights > DataGuard > DataGuard Advanced Behavioral Blocking
• End User Rights > DataGuard > Access Control

  To verify that both settings are disabled:

1. Open the Elements Agent user interface on the device
2. Go to settings
3. Select the Malware Protection page
4. Scroll down to the DataGuard section
5. Verify that both DataGuard switches are set to Off

Issue:

We are getting lot of Ransomware access control alerts caused by Elements Endpoint Protection feature DataGuard,  which is blocking C:\Windows\System32\svchost.exe
What is the root cause of this?

Resolution:

Ransomware access control is a DataGuard feature, which provides the user the ability to safeguard important data from ransomware. More info are provided in this article and in this Help Guide.

In this particular case, where DataGuard is enabled for specific folders to safeguard against ransomware. As from this, svchost.exe (a legit Windows application) might try to access the file that is available in those folders, which is immediately blocked by DataGuard. By Default svchost.exe is not a trusted application by DataGuard.

You can find more details about this detection from the Elements Endpoint Protection Portal:

1. Log in to the Elements Endpoint Protection Portal 
2. From the menu on the left, click Security Events PILOT
3. Click on the detection and you will see similar details:

This means that svchost.exe has tried to modify examplematerial.xlsx which is saved on the users Desktop protected by DataGuard.

DataGuard works differently from our other engines, as it tries to be as paranoid as possible (even detecting Microsoft Windows files). This is because some malwares will inject into legitimate Microsoft files, which explains why DataGuard is more paranoid compared to other engines. DataGuard only allows trusted applications to modify protected files. By default svchost.exe is not a trusted application. 

So, this leaves you with one choice, which is to either leave it as it is (Which we recommend) or add svchost.exe as a trusted application. If you want to do the latter, then you can follow the steps in the Help Guide.

You can also use Windows process monitor to figure out which svchost process exactly has tried to modify the file.
It can also be some windows or 3rd party feature using this process, and in case you don't need it, you can disable it, but it has nothing to do with our product – we just block write access to these files as we should
 

Issue:

Does Elements Agent have an "Early access to client software" feature to test upcoming features and product versions? 

Resolution:

We recommend assigning a small subset of endpoint devices to participate in the early access program. Selected workstations and servers receive updates approximately one week ahead of the general availability rollout.

You can from the profile set if a device should receive early access to client software.

Windows computers or Windows servers:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Security Configurations page
3. Go to the Profiles page
4. Go to the For Windows Computers or For Windows Servers tab
5. Select a profile to edit
6. Go to the General Settings page
7. Enable the setting Early access to client software
8. Click Save and publish

MacOS:

1. Log in to the Elements Endpoint Protection portal
2. Navigate to the Security Configurations > Profiles page
3. Go to the For Mac tab
4. Select a profile to edit
5. Go to the General settings page
6. Enable Early access 
7. Click Save and publish

Linux: 

1. Log in to the Elements Endpoint Protection portal
2. Navigate to the Security Configurations > Profiles page
3. Open the For Linux tab
4. Select a profile to edit
5. Open the page General
6. Enable the setting Early access to client software
7. Click Save and publish

Now the devices with this profile assigned to it receives early access to client software. You can assign this profile to a small batch of devices to detect if there are any issues with a new release.

Issue:

When an administrator installs Elements Agent (EPP for Computers or for Servers) using .msi installer, the devices are not listed in the Elements Endpoint Protection portal Devices page.

Resolution:

There can be several reasons why the installation does not appear in the portal. 

• Elements Agent has not been installed correctly
• Elements Agent is unable to connect to all the necessary addresses

Make sure that the Elements Agent is found on the device and that the user interface shows "Your computer is protected".  For Group Policy (GPO) installation or third-party remote management tools and how to append the subscription key to the installer, you can refer to the following links: https://help.f-secure.com/product.html#business/psb-portal/latest/en/concept_5FFE42B3AC764C68A5FAC889B3B62F0B-psb-portal-latest-en

To make sure that the Elements Agent installation is able to connect to all the necessary addresses, you can run the fsconnectionchecker.exe that is found in the following location: C:\Program Files (x86)\F-Secure\PSB\ui

Issue:

Does WithSecure Elements Endpoint Protection Agent for MAC support macOS version 15 Sequoia?

Resolution:

The latest Elements Agent for MacOS 24.3.53367 does not yet support MacOS Sequoia. Official macOS 15 Sequoia support is coming with version number 24.4.

You can follow this WithSecure Community changelog to know when version 24.4 has been released: Elements Agent for Mac Changelog – Page 2 — WithSecure Community

Issue:

As a user enters the subscription key during installation of Elements Agent , they receive an error message saying "Could not verify the subscription code. Try again later".

Subscription key can be for any of the following Elements products:

• Elements Endpoint Protection (EPP for Computers and EPP for Servers)
• Elements Endpoint Detection and Response (EDR for Computers and EDR for Servers)
• Elements Vulnerability Management

Resolution:

Check that not all the licenses are in use:

1. Log in to Elements Security Center: https://elements.withsecure.com
2. Select Management
3. Select Subscription and check the number of licenses in use

If all licenses are in use, you can remove a previously installed device:

1. Select Environment
2. Select Devices
3. Click on the white square on the left side of the device
4. Click on remove device from the bottom of the screen
5. Try the installation again

If the installation still cannot verify the subscription key, the device could be blocked, and you can activate the device by doing the following steps:

1. Go to the Devices page
2. Click on the action button (three dots) on the right side of the Devices title
3. Click on Manage removed devices
4. Click on the three dots on the right side of the device and select "activate"

Ensure that you are installing WithSecure Elements Endpoint Protection on a supported operating system. If you try to activate an Elements product on an operating system it does not support, you will receive the error "Could not verify the subscription code. Try again later". For more information on supported operating systems, check the respective product help guides for Elements EPP for Computers and Elements EPP for Servers.

It is also possible that the network is blocking necessary traffic to our services. This community article has more information to help resolve such issues. You can run the Connectivity Tool to check connectivity to the required addresses.

From Elements Agent version 22.1 onwards, the connectivity requirements have changed for the Elements Agent and Elements Connector so that the error might be appear because Certificate Revocation Lists (CRL) URLs are not allowed to access by firewall or proxy. Proceed to verify that connections to CRL URLs work. If you see that clients cannot send data to the portal anymore or are unable to validate the subscription key, then most likely CRL URL is blocked. Here is the full list of URLs to allow:

Note: The following requires HTTP access, not HTTPS

• ocsp.rootca1.amazontrust.com
• crl.sca1b.amazontrust.com
• ocsp.rootg2.amazontrust.com
• ocsp.sca1b.amazontrust.com
• crl3.digicert.com
• crl4.digicert.com
• ocsp.digicert.com

If any of the above has not helped it's recommended to download the WsUninstallationTool.exe from https://download.withsecure.com/uninstallationtool/WsUninstallationTool.exe and run it on an affected computer. After the uninstallation, reinstall the Elements Agent and during the installation the subscription key will be registered, and the product will be installed normally.

Issue:

After changing locally a computer's hostname where Elements Agent (EPP for Computers or EPP for Servers) is installed, the device name is not updated to the new name in the Elements Security Center portal's Environment > Devices page.
 

Resolution:

If you have changed the hostname of a computer where Elements Agent is installed, the new device name will not update in the Elements Security Center portal until the device has either been restarted or a "Send full status" operation has been sent to the device. 

You can do the following:

1. Restart the computer 
2. Right-click on the Elements Agent icon in the Windows system tray and go to check for updates
3. Verify that the device name has been updated on the Elements Security Center portal's Environment > devices page

Issue:

Elements Connector cannot show welcome page after installation

Resolution:

By changing Connector port can help to resolve this issue. To change Connector http/https port, you can change registry entry to unused number.

> HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\ElementsConnector>HttpPortNum
> HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\ElementsConnector>HttpsPortNum