Issue:

Elements Endpoint Protection manual or scheduled scanning is slow and it takes a very long time, how to change the settings so that it takes shorter amount of time?

Resolution:

There are a few settings in the Elements Endpoint Protection profile that can make a scheduled scan to be quicker.

The settings are:

• Disable Run scanning as low priority 
• Disable Scan inside compressed files 
• Enable Scan only known file types during scheduled scanning

By disabling Run scanning as low priority, the scheduled scan scan will take more CPU resources but it will also scan the files faster.

By disabling Scan inside compressed files, the scheduled scan will skip archived files which saves a lot of CPU resources and does not decrease the security on the device since files inside compressed files aren't harmful until they are uncompressed. 

By enabling Scan only file types during scheduled scanning, it will skip certain file types. 

As for Manual scanning, you can make sure that Scanning priority is set at Normal priority and that Scan inside compressed files is disabled. 

How to change these settings:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the Manual scanning settings page
5. Here you can edit the previously mentioned settings
6. Click Save profile

Issue:

When a user tries to access some websites with their internet browser, they are shown the following error depending on the browser in use:

• Google Chrome and Microsoft Edge: "The connection for this site is not secure – <website address> sent an invalid response – ERR_SSL_PROTOCOL_ERROR
• Firefox: "Secure Connection Failed – The page you are trying to view cannot be shown because the authenticity of the received data could not be verified – Error code: SSL_ERROR_ACCESS_DENIED_ALERT" 

Why are these errors shown only on specific sites and how can we fix these errors from appearing?  

Resolution:

This error is shown because the Browsing Protection feature has blocked the website and the Browsing Protection by WithSecure browser extension / add-on is either not installed or activated in the browser. The extension / add-on is required to be able to show the Browsing Protection block page on HTTPS websites. On HTTP sites the block page can be shown even when the extension / add-on is not installed or active in the browser. 

A website can be blocked for example if:

• Website is rated as harmful or suspicious by Browsing Protection
• Website category has been blocked by the Web Content Control feature
• Connection Control is active and the website is not rated as safe for banking

You need to make sure that the Browsing Protection by WithSecure browser extension / add-on is installed and active in your browser. 

How to install the extension / add-on: 

1. Right-click the Elements Agent or Client Security icon in Windows the system tray
2. Click Open settings 
3. Go to the Browser extensions settings page
4. Follow the instructions to install the browser extension

Issue:

When a malicious file has been successfully put to quarantine, why does Elements Endpoint Protection sometimes want to reboot the computer?

Resolution:

If the file was detected by the Universal System Scanner (USS) component, it will ask to restart the computer because the infection cannot be completely cleaned up while Windows is running. 

You check the removal.log file in the wsdiag diagnostic file if you want to make sure that the detection was made by Universal System Scanner (USS). 

Issue:

When exporting the self signed / self-generated certificate from the Elements Connector key store, I receive the error: 

• keytool error: java.lang.Exception: Keystore file does not exist: /var/opt/f-secure/fspms/data/​fspms-ca.jks

Resolution:

Issue:

We have Elements Agent installed on our devices with an Elements Endpoint Protection (Elements EPP for Computers or Servers) subscription. How can we from the Elements Security Center portal encrypt the system drive / disk? 

Resolution:

Turning drive encryption on or off is an advanced security feature that comes with the WithSecure Elements EPP for Computers Premium and the WithSecure Elements EPP for Servers Premium subscriptions.

Issue:

When an Elements Endpoint Protection scheduled scanning task is missed, for example if computer is in sleep mode or turned off / shut down, will the task start immediately when device is turned on?

Resolution:

If you create a Scheduled scan for malware Automated task in the Elements Endpoint Protection profile, you can set the task to Never skip if the previous start time has been missed.

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to modify
4. Go to the Automated tasks settings page
5. Click Add task
6. Select Scheduled scan for malware from the Type drop-down menu
7. Use CRON expressions in the Schedule column to set the task start time
8. Enable Never skip toggle from the Never skip column
9. Click Save profile

Note: The Scheduled scanning setting on the Manual scanning settings page in the profile does not support any kind of Never skip setting. If a scheduled scan is missed when using the Manual scanning – Scheduled scanning setting, then the scan will start the next scheduled time. 

Issue:

Can the Elements Endpoint Proteciton Firewall Isolation profile be activated if there is a GPO rule to ignore locally defined rules?  What will happen if a firewall rule distributed by GPO to 'Ignore locally defined rules' and Elements Endpoint Protection tries to isolate the device from the network? 

Resolution:

Firewall rules configured via Elements Security Center Portal are considered local, hence if there is a GPO rule to ignore local rules it WithSecure rules or profiles will no longer work. 

Our general recommendation is to choose one – either manage Windows Firewall with GPO, or with WithSecure profiles (or with the smallest possible input from GPO), otherwise in case of any conflicting settings GPO will have a higher priority and override WithSecure firewall rules. Also, if there are conflicts, it might impact the host performance negatively

Issue:

Alerts of "Connection refused" related to the doorman backend are being output frequently by Elements Linux Protection.

Example:
doormand: Failed to send request to Doorman: generic:111 = Connection refused

Resolution:

Make sure that the connections to the following Security Cloud domains are allowed on your Firewall and proxy.

Business Suite 16 onwards

• corp-reg.fsapi.com This server is used by Policy Manager for license registration. Blocking this server will prevent license validation.
  guts2.fsapi.com (also TCP/80) This server is used to deliver updates for scanning engines and detection rules, and for some products updates to the software itself. Blocking this server will completely stop security updates.
• a.karma.sc2.fsapi.com
• restmc.mind.sc2.fsapi.com
• mind-failover.sc2.fsapi.com
• api.doorman.fsapi.com Backend services needed for Security Cloud functionality
• api.prd.glb.us-prd.fsapi.com Used to control updates for Linux Security 64
• download.fsapi.com Used for the hotfix update mechanism for Linux Security 64

If you have allowed the connections, you could check the connectivity status to the domains by accessing to the following URLs from any affected server.

https://baseguard.doorman.fsapi.com/doorman/v1/healthcheck
https://doorman.sc.fsapi.com/doorman/v1/healthcheck
https://a.karma.sc2.fsapi.com/healthcheck

If you are using a proxy, check the connectivity status from your Linux server to the proxy server and make sure that it could be done successfully.

Issue:

Can we find out which device has been blocked by the Elements Endpoint Protection Device Control feature in the Elements Security Center portal?

Resolution:

When Elements Endpoint Protection Device Control feature blocks a device that matches a Device access rule in the profile, an alert will be sent to the Elements Security Center portal's Events > Security Events page. By clicking on the arrow on the left side of the detection you can show all the details of the block, such as which rule caused the device to be blocked and the Device ID of the blocked device. 

If you want to allow the device which was blocked, you can copy the device id from the security event and follow these steps to create a device filtering rule:

1. Go to the Security Configurations > profiles page
2. Open the profile that is in use on the device
3. Go to the Device control settings page
4. Scroll down to the Device filtering rules list
5. Click Add rule
6. Enter the Device ID that was shown in the security event 
7. Click Save profile 

Now the device is which was shown in the security event will no longer be blocked by the Elements Endpoint Protection device control feature. 

Device Control can list all the devices which are connected to a computer in the Elements Security Center portal. To see the list of devices: 

1. Navigate to the Environment > Devices page
2. Click on a Device
3. Switch to the Connected Devices tab

Here you can see all the devices and their IDs.

Issue:

Browsing Protection by WithSecure is missing from Firefox on Elements Endpoint Protection for Computers (MacOs) with the error "Security application not found".  On macOS there's a constant popup about missing Firefox browser extension.

Resolution:

If you receive the error "Security application not found" and Browsing Protection by WithSecure browser extension is missing from Firefox, manually install the Browsing Protection by WithSecure extension for Firefox. 

1. To set up the browser extension for Firefox:
2. Select the product icon in the menu bar.
3. Select Settings… from the menu.
4. Open the Secure Browsing tab.
5. Select Install browser extension.
   1. The Browsing protection installation window opens.
6. From the drop-down, select Firefox and then Install now.
7. Select Add.
   1. Once the extension is installed, a user consent dialog opens. The browser extension requires your permission to access information about the web addresses you visit.
8. Select Accept.
   1. Note: If you decline to grant the permission, you will not be able to use the extension and Browsing protection cannot block harmful websites nor show search result ratings. Also, the extension will be removed from the browser.
9. To complete setting up the extension, select OK.

You can now use Firefox to browse the internet safely.

More details about the installation of Mac browser extensions and how to check if they are in use can be found in the User Guide: Checking that browser extensions are in use | Elements Endpoint Protection for Computers | Latest | WithSecure User Guides