Issue:

When using deploying / installing Elements Agent with the OfflineInstaller .msi file using a Third-party Management Tool, a duplicate device appears in the Elements Security Center portal's Devices page if the device is reinstalled. How to prevent a duplicate device from appearing if a device is reinstalled? 

Resolution:

When you reinstall the product on a device, a new unique identifier (UUID) is generated. As a result, a duplicate device is created in the Elements portal. 

You can use the UNIQUE_SIGNUP_ID=smbios parameter when installing with the MSI file. Using SMBIOS GUID as the unique identifier of this machine links the reinstalled product to the existing device and prevent a new entry from being created: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/concept_zh2_rfh_4bc-psb-portal-latest-en

You may also use the –use_smbios_guid parameter when installing with the EXE installer: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/command_line_parameters-psb-portal-latest-en

Note: If you use a new subscription key when you reinstall the product, a new device is created on the portal. Also, when you uninstall the product normally, it is automatically removed from the portal. Using smbios_guid as an identifier prevents the devices from being automatically removed.

Issue:

We have installed Elements Agent using an EDR subscription key. Why are the local settings in the Elements Agent user interface missing? 

Resolution:

When Elemenst Agent has been installed using an EDR for computers or EDR for Servers subscription key,  the local Elements Agent user interface does not include any settings because EDR doesn't have any local settings. 

In order to have the Elements local settings, you need to change the subscription key to an Elements EPP + EDR subscription key. You can change the subscription key either from the Elements Security Center portal by using the Change subscription operation or you can change the subscription key locally by using the ws_oneclient_logout.exe tool. 

How to use the Change subscription feature from the Elements portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. Select the devices from the list (an Actions menu will appear)
4. Click Change subscription 
5. Select the EPP + EDR subscription key
6. Confirm the subscription key change by clicking Change subscription

Devices will then immediately start using the new subscription key. 

How to change locally using the ws_oneclient_logout.exe:

1. Open a Command Prompt as an administrator
2. Navigate to C:\Program Files (x86)\F-Secure\PSB\
3. Run the following command: ws_oneclient_logout.exe –keycode <subscription-key>

Issue:

We have Web Content Control enabled and we have manually blocked websites with the "denied sites" feature. We receive a lot of alerts on the Security Events page in the Elements Security Center portal of the following type "Webpage was blocked due to domain name being blocked"

Is there an option to turn off sending of security events when a website (URL address) has been blocked by either the Web Content Control feature or if the URL has been added to the Denied sites list?
 

Resolution:

Yes, you can disable sending of security alerts when either Web Content Control has blocked a website due to a disallowed category or if the website is listed on the Denied sites list in the Elements profile.

Steps to disable sending of security alerts for Web Content Control blocks:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Browsing Protection settings page
5. Scroll down to the Web content control section
6. Disable the Alert for each category you do not want to receive an alert from 
7. Click Save profile

Steps to disable sending of alert when a website has been blocked due to it being on the Denied sites list:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Browsing Protection settings page
5. Scroll down to the Web site exceptions section
6. Disable Send security event about access to denied site
7. Click Save profile

Issue:

What does the Rollback feature do that has been added to Elements Endpoint Protection?

Resolution:

Rollback offers user a protection against of ransomware and allows to restore files and registry to a previous state before the ransomware infection.

The product keeps tracking activity of suspicious process and record changes made by this process (including file/registry modifications) at that location, and backup these to the backup folder when a suspicious process is detected with the rollback feature enabled.

Once the suspicious process is identified to be malicious, the rollback will happen immediately to restore the change(s) in the files/registries. After the session ends, the feature does not keep the backup and will drop it.

Rollback can be set up from the Elements profile for EPP for Computers devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Click on the profile that is in use on your devices
4. Go to the Rollback settings page
5. Enable rollback
6. Allow to restore reverted files
7. Click Save profile 

Issue:

Linux Protection or Elements EPP for Server (Linux) installation is not reporting to Elements Security Center and it does not appear in the Environment > Devices list on the portal.

Resolution:

If the installation of the client went through without errors, in case of WithSecure Elements EPP for Servers (Linux) / Linux Protection, there is still a need to run the following command to activate the product after the product was installed:

/opt/f-secure/linuxsecurity/bin/activate –psb –subscription-key SUBSCRIPTION-KEY

If you are using HTTP proxy, you can add an option of "–http-proxy" to the activation command mentioned above. More details regarding activating Linux Protection when proxy is used: https://support.withsecure.com/userguides/product.html#business/linux-protection/latest/en/task_activating_via_connector_proxy-latest-en 

You may refer to the following user guides for more details about Elements Linux Protection installation: https://support.withsecure.com/userguides/product.html#business/linux-protection/latest/en/installing_psb-latest-en

Apart from that, you may also want to check the connectivity status to our backend (*.fsapi.com) to make sure that the connection could be established successfully by running the commands below.

sudo curl http://guts2.fsapi.com 
sudo curl https://psb-emea.doorman.fsapi.com/doorman/v1/healthcheck

If the connection fails to be established successfully, there is a need to check your firewall configurations if such connection is being blocked that needs to be allowed. 

Issue:

We are installing Elements Agent but the installer found conflicting products it wants to remove, how can we install the Elements Agent without removing the other products?

Resolution:

You can install Elements Agent (e.g. via CMD) and use the –skip-sidegrade parameter to skip the sidegrade.

Example:

1. Open a Command prompt as an Administrator
2. Navigate with the Command prompt to the folder where you have stored the Elements Agent installer
3. Run command:

installername.exe –skip-sidegrade "product_name"

4. If the above command does not work, use this command to skip detection of all conflicting software.

installername.exe –skip-sidegrade "*"

For more detailed information about available command-line parameters and MSI properties, please visit our Help Guide:

• EXE installation parameters: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/command_line_parameters-psb-portal-latest-en
• MSI installation properties: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/concept_zh2_rfh_4bc-psb-portal-latest-en  

Issue:

How to in the Elements Security Center portal on the Environment > Devices list show only EPP and EDR devices that have been assigned the Critical importance level?  

Resolution:

You can on the Environment > Devices page in the Elements Security Center portal use a filter to only show devices with a specific importance level. 

Here are the steps:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. With the filter feature on top of the devices table, create a "Device importance – equals – Critical" filter
4. Click Apply

Now only the devices which have been assigned the Critical device importance will be listed on the Devices table. 

To change the importance of a device, select the device from the list and then from the Actions menu at the bottom of the page click Update importance and select either minor, normal or critical from the drop-down menu and then click Update. 

Issue:

Wrong 'Update-Server' or proxy server address is shown in the Elements Agent's Updates page even if Network Location settings has been configured to change the proxy server address when device is in a new location. 

Resolution:

We recommend to first check your current setup on the Network locations settings page in the profile:

1. Log in to the Elements Security Center portal
2. Navigate to Security Configurations > Profiles
3. Click on the profile that is in use on the devices
4. Go to the Network location settings page
5. Make sure that the trigger or triggers that you have configured are correct
6. Make sure the rules you have chosen are correct
7. Click Save profile

We also recommend to lock the communication settings so that they cannot be changed locally:

1. Log in to the Elements Security Center portal
2. Navigate to Security Configurations > Profiles
3. Click on the profile that is in use on the devices
4. Go to the End user rights settings page
5. In the Communication settings section, lock each setting:
   1. User HTTP proxy (updates server)
   2. Use HTTP Proxy (Software Updater)
   3. Proxy servers and WithSecure Connectors
6. Click Save profile

Issue:

Elements EPP for Computers or EPP for Servers is showing Security Cloud status as not connected or Status Updated as "not latest" in the local user interface Settings > Updates page.

Resolution:

We recommend to run the Connectivity Tool (wsconnectionchecker.exe) from C:\Program Files (x86)\F-Secure\PSB\ui on the device, to validate the connectivity state to the WithSecure backend services.

If this device requires a connection via HTTP proxy to access reach Internet, you have to enable HTTP proxy usage via the Elements Security Center profile editor and enter the proxy address

Steps:

1. Log in to the Elements Security Center portal
2. Navigate to Security configurations > Profiles page
3. Click on the profile that is in use on the devices 
4. Navigate to the Communication settings page
5. Select Remotely Managed from the "Use HTTP Proxy" drop-down menu  
6. Scroll down to the Proxy servers and WithSecure connectors section
7. Click Add address 
8. Enter the proxy address
9. Click Save profile

Also make sure that Security Cloud is enabled in the profile:

1. Log in to the Elements Security Center portal
2. Navigate to Security configurations > Profiles page
3. Click on the profile that is in use on the devices 
4. Go to the Real-time scanning settings page 
5. In the File scanning section, select either Upload all suspicious files or Upload suspicious executables only from the drop-down menu for Upload suspicious samples to WithSecure Security Cloud
6. Click Save profile

Issue:

How to have an Elements Endpoint Protection device restart automatically at a pre-defined time if Patch Management (Software Updater) has installed an update and a restart is required to finish the update? 

Resolution: