Issue:

When running WithSecure Elements EPP for Servers on an Microsoft RDS server, where multi user can login to this RDS host, WithSecure Connection Control banner is shown for all users on the RDS host

WithSecure Connection Control banner prompts all connected users when one user goes to a banking web page, with the WithSecure banner at the top, for all users that have an active session on the RDS host.

How to only show the WithSecure Connection Control banner for the user, that has an active banking web page open?

Resolution:

The Elements Endpoint Protection "Connection Control" feature is not designed to be used in multi user environments, such as RDS. In order to avoid this scenario, WithSecure Connection Control needs to be disabled. To disable the Elements Endpoint Protection Connection Control feature from the Elements profile, follow the steps below:

1. Log in to the Elements Security Center Portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to edit
4. Go to the Browsing protection settings page
5. Scroll down to the Connection control section 
6. Disable Connection control
7. Click Save profile

Once the device fetches the new profile, Connection control will be disabled and will no longer display the banner when a user enters a banking web page. 

Issue:

Can WithSecure reset the secret key for Elements API connector?

Resolution:

WithSecure is unable to retrieve the secret key for you as it is confidential and as well it will only shown once on the page when it is created. The only alternate way is by deleting/removing the API client and recreate it back.

You may refer to this link for further details if you would like to proceed to delete and recreate it.

Note: Make sure to copy the secret and store it in a safe place. You will be not able to view or access the secret again.

Issue:

1. Can WithSecure endpoint protection clients Elements Linux Protection and Business Suite Linux Security 64 detect viruses and malware for Linux?
2. Are there any limitations? What if the binary is compiled on the host ie. the malware ships as source code. Do we still detect the source code portion ie. is the detection for both the compiled binary and/or the source code part?

Resolution:

1. Yes, we have detections for Linux malware and viruses on both Windows and Linux platforms.
2. Although some malicious source code is detected, we focus on detecting compiled Linux binaries (ELF binaries). Reasoning for this is that malicious source code that needs to be compiled is not an immediate threat as it cannot be executed by itself.

Issue:

Can I install Elements Endpoint Protection Agent on Amazon WorkSpaces Windows 10 and Office 2016 Bundle with an EPP for Computers subscription?

Resolution:

No, Elements Endpoint Protection for Computers cannot be installed on Amazon WorkSpaces Windows 10 and Office 2016 Bundle. Instead, you will need a Elements EPP for Computers license for virtual environments.

Reference
https://aws.amazon.com/about-aws/whats-new/2016/11/amazon-workspaces-introduces-windows-10-desktop-experience/

"Amazon WorkSpaces now offers bundles that come with a Windows 10 desktop experience, powered by Windows Server 2016." 

Issue:

Can Elements EPP for Computer firewall rules for Network Isolation firewall profile be used to allow remote access to the device?

Resolution:

Yes, as an administrator, you can add extra rules to the firewall profile used by the device if you need to provide extra access to isolated device. For example, you can allow remote access to the device so that a support engineer could access it and investigate issues.

For more information: Adding a firewall rule to a network isolation profile | Elements Endpoint Protection | Latest | WithSecure User Guides

Issue:

Can I install and update Elements Agent (EPP for Computers and EPP for Servers) in an offline or isolated environment with no internet access?

Resolution:

Elements Agent does not support offline or isolated environments, and therefore cannot be installed or updated without an internet connection. Internet connectivity is required for Elements products. 

The Business Suite products Client Security and Server Security can be installed and updated in environments with no or limited internet access. You can read more from this Help Guide.
 

Issue:

An application's network connectivity is blocked once Connection Control session has been activated when user visits a banking website. How to create a Connection Control exclusion for Elements EPP for Computers or EPP for Servers devices, so that the network connection is not blocked when Connection Control is active? 

Resolution:

When Connection Control is active, the processes other than banking browser and its children are seriously limited in connectivity. 

• Signed non-banking processes can only connect to safe IPs. The unrated IPs will be blocked.
• Unsigned processes are disconnected on IP level

If an application is being blocked by Connection Control, to resolve the issue, you need to ensure that the blocked application's binaries are digitally signed. 

If you do not know which file exactly is getting blocked by Elements Endpoint Protection Connection Control, you can view the detection from Security Events page in the Elements Security Center:

1. Navigate to Events > Security events page
2. Click on the filter icon on the right side of the page title
3. Select as Filter: Source, and as Value: Connection control 

From the results you can now easily view all Connection control events. Click on the arrow on the left side of the detection to view more details. 

As a workaround, you can exclude the software executable or the software installation folder from all security features, so that it will not be blocked by Connection Control when it is active.

You can do this in the Elements Security Center:

1. Navigate to Security Configurations > Profiles page
2. Select the profile that is in use on your devices 
3. Go to the Scanning settings page
4. Scroll down to the Global exclusions from all security scans and click Add exclusion
5. Enter the either the full path of the application or the folder path to the application, for example:
   • Application path: C:\Program Files (x86)\Example\ExampleApplication.exe
   • Folder path: C:\Program Files (x86)\Example\
6. Click Save profile

Once the profile has been saved and published, it will be taken into use by the devices in 5-15 seconds. 

In case excluding the application's executable or folder from all security features is not acceptable workaround, you need to whitelist the IP address, using the following setting through the Profile Editor: Browsing Protection > Web Site exceptions > Allowed sites

Issue:

• After installation, Elements Agent (EPP for Computers and EPP for Servers) is in Protection malfunction state
• Status shows Computer is not protected
• Check for updates page shows the product to be unable to download malware definition updates from the update server
• Elements Agent does not communicate to Withsecure cloud environment. Withsecure Connectivity tool shows everything as "Green" and working.

Resolution:

First check the Updates page in the Elements Agent settings and check if it is the Ultralight Core (64-bit) installation which fails. If it is failing, make sure that you have the required Windows updates for Azure Code Signing (ACS) support: Changes in support on Microsoft Windows – Minimum patch level. – WithSecure Community

If you are pushing offline MSI through GPO every day, this can be a reason for failure, and uninstallation of Ultralight engine, leading to malfunction state.

If the product is unable to contact the update server, it will not be able to download any virus definition updates and will begin to show the protection malfunction error and ask the user to restart the computer. 

You can check the connectivity to the update server by clicking the view log file link in the product settings window > Updates.

If the connection to the update server fails, you need to ensure that your firewall or proxy is not blocking the connectivity. You can run the Connectivity Tool to check for connectivity issues: C:\Program Files (x86)\F-Secure\PSB\ui\wsconnectionchecker.exe

Just in case the product can reach the update server and download most of the updates but does not download only certain update(s) (for example, Capricorn update, etc.), we propose to remove the product using the uninstallation tool, and then re-install:

You can download the uninstallation tool here: https://download.sp.withsecure.com/uninstallationtool/WsUninstallationTool.exe

Issue:

Resolution:

This is an issue with an application Control (AC) rule (not DeepGuard nor DataGuard) "Block rare and unknown files in Temp folder". It belongs to a set of pre-defined AC rules that come with the product and this rule appears to be disabled by default. 

There is two below solutions to solve this at the moment:
1. Workaround the issue turn the rule "Block rare and unknown files in Temp folder" from Block to Allow and monitor it as follows:
Profile > (select profile to edit) > Application Control > Rule name: "Block rare and unknown files in Temp folder" = Allow and monitor.
2. Other way to workaround this would be to add Application control exclusion rule: Profile > (select profile to edit) > Application Control > Rule name: "Allow trusted signature" (please have a look at screenshot 'Allow trusted signature rule.png' for more information).

Issue:

Can I configure the Elements Endpoint Protection (EPP for Computers or EPP for Servers) profile to force the Windows Firewall to turn ON if the end-user has turned it OFF?

Resolution:

The ON/OFF state of the Windows Firewall can be fully controlled from the Elements Endpoint Protection profile settings in Elements Endpoint Protection portal..

To modify the state of the firewall, you can do the following:

1. Log in to the Elements Security Center
2. Click on See more details under Endpoint Protection
3. Go to the Profiles page
4. Click on the profile you want to edit (observe that profiles with the READ ONLY flag cannot be edited)
5. Select the Firewall page from the options on the left
6. Under General settings, set the Use Windows Firewall-setting to the desired mode (to prevent anyone from being able to modify the setting locally, click the lock icon on the extreme right side of the setting, so that the lock is closed)

The Windows Firewall will always follow the setting in Elements Endpoint Protection. Users with sufficient rights can turn the firewall on or off directly through the firewall settings in Windows, but it will be forced back again in a few seconds.

Leaving the setting unlocked in the settings profile will allow for local settings to override the value stated in the profile, see the following examples:

Profile setting: Firewall ON, setting unlocked
Setting in Computer Protection UI: OFF
Result: the Windows Firewall will be forced OFF

Profile setting: Firewall ON, setting unlocked
Setting in Computer Protection UI: ON
Result: the Windows Firewall will be forced ON

Profile setting: Firewall ON, setting locked
Setting in Computer Protection UI: Will be forced ON
Result: the Windows Firewall will be forced ON

Note: Windows Firewall settings and rules created via Group Policy Objects (GPO) can not be overridden by Elements Endpoint Protection profiles.