Issue:

Upon logging into WithSecure Elements Security Center, I get an error saying my login credentials are incorrect. Error: Wrong username or password/Incorrect login credentials.
 

Resolution:

You need to ensure that you use the correct URL to log into the WithSecure Elements Security Center and that you are using the correct username: https://elements.withsecure.com/

If you have forgotten your login password, you can click on "Forgot password?" option on the logon page, to request for a password reset.

If you do not receive the password reset email, we also recommend checking and ensuring that the password reset email does not end up in the spam folder in your mailbox. Check also that it isn't quarantined. The email is sent from no-reply@withsecure.com. If no email is found it could be that you no not have a user account with that email address in Elements Security Center portal. If you are a WithSecure Partner, please ask a colleague to check if they can find your user account on the Management > Organization Settings > Security Administrators page in the Elements portal. If you are an end-customer with a Partner Managed subscription, please ask your partner to check if they can find your user account. 

If no user account is found, your colleague or partner can create one for you. 

Issue:

When installing an WithSecure Elements Endpoint Protection product (Elements EPP for Computer or for Servers), user encounters an error about the subscription key they are trying to use:

• Error: "You cannot use the subscription key you entered for this computer anymore. If you need a new subscription key, contact your administrator."

Resolution:

This is most likely due to the Elements Endpoint Protection product having been installed on the computer before using the same subscription key and at some point the machine has been removed from the Elements Endpoint Protection portal. This adds the machine to a block list to prevent the software from automatically re-registering to the portal if the software is still installed after the machine is removed from the portal. To reinstall the product using the same subscription key on that computer, you need to first restore the devices from the blocklist for that subscription key:

1. Log in to the Elements Endpoint Protection portal
2. Open the Subscriptions page
3. Choose the subscription key which you are trying to use and click on the "triple dot button" on the right side of the page
4. Click on Restore devices from blocklist

This releases all the devices from the blocklist for that specific subscription key. Now the subscription key can be used again on that same computer.

Issue:

WithSecure EPP for Computers or for Servers Software Updater is displaying installation failed, try again for Windows 10 Cumulative Updates. As for Citrix and Java updates, I get a message that manual file download required, how can I fix this?

Resolution:

If you come across installation errors for Microsoft cumulative updates such as e.g. Return Code: -2145124329 in the Software Updater logs, this translates to error code 0xFFFFFFFF*80240017. You can refer to the Microsoft documentation explaining the error code.

Some updates such as Citrix or Java couldn’t be installed automatically for the following reasons: 

• End-user needs to enter the CAPTCHA
• End-user has to accept the End User License Agreement (EULA)
• End-user has to log in

If WithSecure Software Updater received the status that manual download required for some particular update, then it stops the installation of this update. In this case, you would need to proceed to download and install the updates manually.
 

Issue:

WithSecure Elements Endpoint Detection and Response (EDR) sensor does not activate on Ubuntu. The state appears as "Waiting for connection" in the Elements Endpoint Protection portal and the Elements Endpoint Detection and Response portal. 

Resolution:

Elements Endpoint Detection and Response functionality requires the auditd service to be installed and running on the system.

If Elements Endpoint Detection and Response sensor installation fails, an error like this will be printed to the system journal:

"Sep 29 14:07:37 localhost fsbg[6692]: update installation failed: /sensor/1601277158"

It is possible to fix the failed sensor installation by installing auditd and running the update command to let update system install the sensor automatically.

1. Run the command below to install auditd:
sudo apt-get install auditd

2. Fixing sensor installation:
sudo su

Note: sudo su will give the root shell, please execute the next command in that root shell

/opt/f-secure/baseguard/bin/update $(/opt/f-secure/baseguard/bin/update –list | grep sensor | cut -d ' ' -f 1)

Issue:

WithSecure Windows endpoint client has created multiple subfolders in C:\Users\All Users\F-Secure\NS\default and C:\ProgramData\F-Secure\NS\default The subfolders seem to be looping in an NS\default\NS\default pattern.

Resolution:

This is by design. The junction is part of product migration logic from an old version and removing it will break the product. For Elements Endpoint Protection (formerly known as PSB), the junction is present only if the product has been upgraded from an older version of the F-Secure endpoint client.

To get rid of the junction, you may re-install the WithSecure product.

For Business Suites product, the junction present in new installation too.

Issue:

What exact permissions does the account used to connect between Microsoft 365 and WithSecure require?

Resolution:

The following permissions are required for the account which connects between Microsoft 365 and WithSecure:
Exchange:

• Read all users' full profiles
• Read all audit log data
• Read all usage reports
• Read and write mail in all mailboxes
• Read and write contacts in all mailboxes
• Read and write calendars in all mailboxes
• Read domains
• Read activity data for you organization
• Read service health information of you organization
• Use Exchange Web Services with full access to all mailboxes
• Sign in and read user profile
• Read directory data

Sharepoint and Teams:

• Sign in and read user profile
• Send channel messages
• Send user chat messages
• Read all groups
• Read domains
• Create, edit, and delete items and lists in all site collections
• Read and write items and lists in all site collections
• Have full control of all site collections

OneDrive:

• Read and write items and lists in all site collections
• Have full control of all site collections
• Sign in and read user profile
• Read and write files in all site collections
• Read all users' full profiles
• Read domains

Important note: Some of the above mentioned permissions sounds like a lot, but we are using the minimum permissions needed in order for our solution to operate correctly.
For example: in Sharepoint and Teams; the last one is "Have full control of all site collections"
This permission is only used by us to create the quarantine zone of which we send the files to.
WithSecure does not do anything else with this permission, but since this is the minimum one required, we have to request it.

Issue:

When installing WithSecure Elements Agent (EPP for Computers or for Servers) on a Windows computer, it uninstalls a VPN software called Forticlient from Fortinet inc. How to install Elements Agent without it uninstalling Forticlient?

Resolution:

The Elements Agent for Computers and for Servers installer can be run with an additional command line parameter to skip sidegrade (removal of incompatible products) for Forticlient.

1. Open a Command prompt as an Administrator
2. Navigate with the Command promp to the folder where you stored the Elements Agent installer
3. Run command:

<installername.exe> --skip-sidegrade "Forticlient"

You can also skip sidegrade for every incompatible product by using using "*". For example: 

<installername.exe> --skip-sidegrade "*"

Issue:

Let's say person A (which uses Microsoft 365) sends an email to person B on any other server. The used e-mail address is wrong or no longer existent and the server sends a response back, that this message couldn’t be delivered. In this notice there is the IP address of the responding server, which gets classified from our system as malicious. So, the message couldn’t be delivered is now going to quarantine and the user does not know, that it wasn’t or received any notifications. Hence is this the way it should work or is this an issue?

Resolution:

In terms of product behavior, the detected emails are handled according to the action setting configured in the policy on the Collaboration Protection portal where the default action setting is to move the item into quarantine. Of course, it is possible to change to other action setting during detection such as "Change Subject and unlink URLs" and etc by going to "Exchange" tab > "URL Scanning" > "Malicious URL" > "If a malicious URL is detected, the system will take the following action:" and select a desired action from the list.

As for your concern on the users/recipients who is not aware of the quarantined email, this could be avoided by enabling the setting of "Notify the user about detections with the following severities:" setting at the same place as the action setting above. Please refer to the attached screenshot for more details.

Issue:

WithSecure Elements Agent (Elements EPP for Computers or EPP for Servers) user interface displays the following message: "Restart required. WithSecure Elements EPP for Computers received a critical update. To keep you up to date, restart your computer". The message remains despite me restarting the computer a few times.

Resolution:

If restarting your device does not fix the issue, you can proceed to follow the workarounds below to try to fix this:

1. Run the FSAUA reset tool (available from https://www.f-secure.com/en/business/support-and-downloads/support-tools)
2. Reboot the computer
3. Right-click the F-Secure Elements Agent systray icon and click Check for updates

If this does not resolve the issue, proceed to reinstall WithSecure Elements Agent. If the issue persists after reinstallation of the F-Secure Elements Agent, contact support. For us to investigate the issue further at our end, you need to provide debug logs.

Issue:

Will WithSecure products for Mac support Apple M1 chip processor?

Resolution:

Yes, WithSecure™ Elements EDR and EPP for Mac product support Apple Silicon with Element Agent 22.3.45064 and onwards.

More information in this community article:
https://community.withsecure.com/discussion/comment/129345/#Comment_129345