Issue:

We have Web Content Control enabled and we have manually blocked websites with the "denied sites" feature. We receive a lot of alerts on the Security Events page in the Elements Security Center portal of the following type "Webpage was blocked due to domain name being blocked"

Is there an option to turn off sending of security events when a website (URL address) has been blocked by either the Web Content Control feature or if the URL has been added to the Denied sites list?
 

Resolution:

Yes, you can disable sending of security alerts when either Web Content Control has blocked a website due to a disallowed category or if the website is listed on the Denied sites list in the Elements profile.

Steps to disable sending of security alerts for Web Content Control blocks:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Browsing Protection settings page
5. Scroll down to the Web content control section
6. Disable the Alert for each category you do not want to receive an alert from 
7. Click Save profile

Steps to disable sending of alert when a website has been blocked due to it being on the Denied sites list:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Browsing Protection settings page
5. Scroll down to the Web site exceptions section
6. Disable Send security event about access to denied site
7. Click Save profile

Issue:

What does the Rollback feature do that has been added to Elements Endpoint Protection?

Resolution:

Rollback offers user a protection against of ransomware and allows to restore files and registry to a previous state before the ransomware infection.

The product keeps tracking activity of suspicious process and record changes made by this process (including file/registry modifications) at that location, and backup these to the backup folder when a suspicious process is detected with the rollback feature enabled.

Once the suspicious process is identified to be malicious, the rollback will happen immediately to restore the change(s) in the files/registries. After the session ends, the feature does not keep the backup and will drop it.

Rollback can be set up from the Elements profile for EPP for Computers devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Click on the profile that is in use on your devices
4. Go to the Rollback settings page
5. Enable rollback
6. Allow to restore reverted files
7. Click Save profile 

Issue:

Linux Protection or Elements EPP for Server (Linux) installation is not reporting to Elements Security Center and it does not appear in the Environment > Devices list on the portal.

Resolution:

If the installation of the client went through without errors, in case of WithSecure Elements EPP for Servers (Linux) / Linux Protection, there is still a need to run the following command to activate the product after the product was installed:

/opt/f-secure/linuxsecurity/bin/activate –psb –subscription-key SUBSCRIPTION-KEY

If you are using HTTP proxy, you can add an option of "–http-proxy" to the activation command mentioned above. More details regarding activating Linux Protection when proxy is used: https://support.withsecure.com/userguides/product.html#business/linux-protection/latest/en/task_activating_via_connector_proxy-latest-en 

You may refer to the following user guides for more details about Elements Linux Protection installation: https://support.withsecure.com/userguides/product.html#business/linux-protection/latest/en/installing_psb-latest-en

Apart from that, you may also want to check the connectivity status to our backend (*.fsapi.com) to make sure that the connection could be established successfully by running the commands below.

sudo curl http://guts2.fsapi.com 
sudo curl https://psb-emea.doorman.fsapi.com/doorman/v1/healthcheck

If the connection fails to be established successfully, there is a need to check your firewall configurations if such connection is being blocked that needs to be allowed. 

Issue:

We are installing Elements Agent but the installer found conflicting products it wants to remove, how can we install the Elements Agent without removing the other products?

Resolution:

You can install Elements Agent (e.g. via CMD) and use the –skip-sidegrade parameter to skip the sidegrade.

Example:

1. Open a Command prompt as an Administrator
2. Navigate with the Command prompt to the folder where you have stored the Elements Agent installer
3. Run command:

installername.exe –skip-sidegrade "product_name"

4. If the above command does not work, use this command to skip detection of all conflicting software.

installername.exe –skip-sidegrade "*"

For more detailed information about available command-line parameters and MSI properties, please visit our Help Guide:

• EXE installation parameters: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/command_line_parameters-psb-portal-latest-en
• MSI installation properties: https://support.withsecure.com/userguides/product.html#business/psb-portal/latest/en/concept_zh2_rfh_4bc-psb-portal-latest-en  

Issue:

How to in the Elements Security Center portal on the Environment > Devices list show only EPP and EDR devices that have been assigned the Critical importance level?  

Resolution:

You can on the Environment > Devices page in the Elements Security Center portal use a filter to only show devices with a specific importance level. 

Here are the steps:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. With the filter feature on top of the devices table, create a "Device importance – equals – Critical" filter
4. Click Apply

Now only the devices which have been assigned the Critical device importance will be listed on the Devices table. 

To change the importance of a device, select the device from the list and then from the Actions menu at the bottom of the page click Update importance and select either minor, normal or critical from the drop-down menu and then click Update. 

Issue:

Wrong 'Update-Server' or proxy server address is shown in the Elements Agent's Updates page even if Network Location settings has been configured to change the proxy server address when device is in a new location. 

Resolution:

We recommend to first check your current setup on the Network locations settings page in the profile:

1. Log in to the Elements Security Center portal
2. Navigate to Security Configurations > Profiles
3. Click on the profile that is in use on the devices
4. Go to the Network location settings page
5. Make sure that the trigger or triggers that you have configured are correct
6. Make sure the rules you have chosen are correct
7. Click Save profile

We also recommend to lock the communication settings so that they cannot be changed locally:

1. Log in to the Elements Security Center portal
2. Navigate to Security Configurations > Profiles
3. Click on the profile that is in use on the devices
4. Go to the End user rights settings page
5. In the Communication settings section, lock each setting:
   1. User HTTP proxy (updates server)
   2. Use HTTP Proxy (Software Updater)
   3. Proxy servers and WithSecure Connectors
6. Click Save profile

Issue:

Elements EPP for Computers or EPP for Servers is showing Security Cloud status as not connected or Status Updated as "not latest" in the local user interface Settings > Updates page.

Resolution:

We recommend to run the Connectivity Tool (wsconnectionchecker.exe) from C:\Program Files (x86)\F-Secure\PSB\ui on the device, to validate the connectivity state to the WithSecure backend services.

If this device requires a connection via HTTP proxy to access reach Internet, you have to enable HTTP proxy usage via the Elements Security Center profile editor and enter the proxy address

Steps:

1. Log in to the Elements Security Center portal
2. Navigate to Security configurations > Profiles page
3. Click on the profile that is in use on the devices 
4. Navigate to the Communication settings page
5. Select Remotely Managed from the "Use HTTP Proxy" drop-down menu  
6. Scroll down to the Proxy servers and WithSecure connectors section
7. Click Add address 
8. Enter the proxy address
9. Click Save profile

Also make sure that Security Cloud is enabled in the profile:

1. Log in to the Elements Security Center portal
2. Navigate to Security configurations > Profiles page
3. Click on the profile that is in use on the devices 
4. Go to the Real-time scanning settings page 
5. In the File scanning section, select either Upload all suspicious files or Upload suspicious executables only from the drop-down menu for Upload suspicious samples to WithSecure Security Cloud
6. Click Save profile

Issue:

How to have an Elements Endpoint Protection device restart automatically at a pre-defined time if Patch Management (Software Updater) has installed an update and a restart is required to finish the update? 

Resolution:

Issue:

In the Elements Security Center portal the portal shows that the system disk drive is encrypted for a device but it is unable to collect the bitlocker recovery key. 

On the device details page for a device, it shows under "Endpoint encryption > Encrypted Drives" the following details and error message:

Drive C (system disk)

• Encrypted
• Recovery information error (An error occurred during data collection for the recovery information. Please review the logs.)
• Pin-code: set 

Why does Elements Endpoint Protection (Elements Agent) fail to retrieve the BitLocker key from the device? 

Resolution:

For example, if BitLocker was enabled using: manage-bde -on C: -tpmandpin

then it is possible that only a TPM+PIN protector was created and no recovery password protector exists.

You can run the following command to display the BitLocker protectors configured on the volume: manage-bde -protectors -get C:

If you only see:

• TPM
• TPM And PIN

and there is no "Numerical Password" protector, then there is no recovery key stored on that device to retrieve.

manage-bde -protectors -get C: should display the 48-digit recovery password locally.

When scripting BitLocker deployment, ensure a recovery password protector is added, for example: manage-bde -protectors -add C: -RecoveryPassword <NumericalPassword>

Issue:

I get the following error: "failed to invite multiple devices via CSV file!", when trying to invite multiple devices to Elements Endpoint Protection portal for Elements EPP for Mobiles (Mobile protection).

Resolution:

Make sure you are importing the details in the following CSV format:

<owner email>;<owner last name>;<owner first name>;<alias>

Example CSV content:

test@exampledomain.com;Doe;John;examplealias
example@testdomain.com;Doe;Jane;examplealias2

Note: It is recommended to use a text editor which preserves the original encoding, such as basic Windows Notepad. Using some other editor that doesn't preserve the original encoding can break it.