Issue:

Elements Endpoint Protection manual or scheduled scanning is slow and it takes a very long time, how to change the settings so that it takes shorter amount of time?

Resolution:

There are a few settings in the Elements Endpoint Protection profile that can make a scheduled scan to be quicker.

The settings are:

• Disable Run scanning as low priority 
• Disable Scan inside compressed files 
• Enable Scan only known file types during scheduled scanning

By disabling Run scanning as low priority, the scheduled scan scan will take more CPU resources but it will also scan the files faster.

By disabling Scan inside compressed files, the scheduled scan will skip archived files which saves a lot of CPU resources and does not decrease the security on the device since files inside compressed files aren't harmful until they are uncompressed. 

By enabling Scan only file types during scheduled scanning, it will skip certain file types. 

As for Manual scanning, you can make sure that Scanning priority is set at Normal priority and that Scan inside compressed files is disabled. 

How to change these settings:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the Manual scanning settings page
5. Here you can edit the previously mentioned settings
6. Click Save profile

Issue:

When a malicious file has been successfully put to quarantine, why does Elements Endpoint Protection sometimes want to reboot the computer?

Resolution:

If the file was detected by the Universal System Scanner (USS) component, it will ask to restart the computer because the infection cannot be completely cleaned up while Windows is running. 

You check the removal.log file in the wsdiag diagnostic file if you want to make sure that the detection was made by Universal System Scanner (USS). 

Issue:

When an Elements Endpoint Protection scheduled scanning task is missed, for example if computer is in sleep mode or turned off / shut down, will the task start immediately when device is turned on?

Resolution:

If you create a Scheduled scan for malware Automated task in the Elements Endpoint Protection profile, you can set the task to Never skip if the previous start time has been missed.

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to modify
4. Go to the Automated tasks settings page
5. Click Add task
6. Select Scheduled scan for malware from the Type drop-down menu
7. Use CRON expressions in the Schedule column to set the task start time
8. Enable Never skip toggle from the Never skip column
9. Click Save profile

Note: The Scheduled scanning setting on the Manual scanning settings page in the profile does not support any kind of Never skip setting. If a scheduled scan is missed when using the Manual scanning – Scheduled scanning setting, then the scan will start the next scheduled time. 

Issue:

We have Elements Agent installed on our devices with an Elements Endpoint Protection (Elements EPP for Computers or Servers) subscription. How can we from the Elements Security Center portal encrypt the system drive / disk? 

Resolution:

Turning drive encryption on or off is an advanced security feature that comes with the WithSecure Elements EPP for Computers Premium and the WithSecure Elements EPP for Servers Premium subscriptions.

Issue:

When exporting the self signed / self-generated certificate from the Elements Connector key store, I receive the error: 

• keytool error: java.lang.Exception: Keystore file does not exist: /var/opt/f-secure/fspms/data/​fspms-ca.jks

Resolution:

Issue:

Error message "WithSecure Linux Security 64 has already been activated" is shown during installation and activation of Elements Linux Protection (Elements EPP for Servers). What can cause this error to be shown during Elements Linux Protection activation? 
 

Resolution:

The message means that the Linux device already has a previous installation of Linux Security 64 on it. 

You need to uninstall Linux Security 64 from the device before you can install Elements Linux Protection on it.

To uninstall Linux Security 64: 

1. 1. Log in to the Linux host as root.
2. 2. Run the uninstallation command:

• RHEL-based distributions: rpm -e linuxsecurity-installer
• Debian-based distributions: dpkg -r linuxsecurity-installer

If the package removal command fails and Policy Manager Server is not installed on the same machine, run the following command: rm -rf /opt/f-secure /etc/opt/f-secure /var/opt/f-secure. This command removes the remaining files or systemd services if any. Finally, restart the system to make sure that all hanging services and processes are run down.

If you have installed Policy Manager Server on the same machine, do not delete the folders in full; instead, run the following commands to remove the necessary subfolders:

• rm -rf /etc/opt/f-secure/baseguard
• rm -rf /etc/opt/f-secure/fsbg
• rm -rf /etc/opt/f-secure/linuxsecurity
• rm -rf /opt/f-secure/baseguard
• rm -rf /opt/f-secure/fsbg
• rm -rf /opt/f-secure/linuxsecurity
• rm -rf /var/opt/f-secure/baseguard
• rm -rf /var/opt/f-secure/fsbg
• rm -rf /var/opt/f-secure/linuxsecurity

The uninstall command does not remove configuration files or log files that the product has generated. Check the product directories for remaining files and remove them if you are sure that you do not need them anymore.

Issue:

Subscription key expiration is shown as "Continuous" on the Elements Security Center portal's Management > Subscriptions page. What does it mean?
 

Resolution:

When the expiration date for an Elements subscription is shown as "Continuous" on the Elements Security Center portal's Management > Subscriptions page, it means that you have a subscription that is paid for monthly and it has no defined expiration date. The subscription needs to be explicitly manually terminated by the WithSecure reseller partner in case you want to cancel the subscription. 

This subscription type is also called "Evergreen" is the WithSecure Partner Portal, which partners use to sell WithSecure subscriptions.

WithSecure also offers Renewable type subscriptions for Elements products, which can be bought for a license period of 12, 24 or 36 months. That type of subscription has a defined expiration date and needs to be renewed by the WithSecure partner at the end of the license period. 

Issue:

We would like to only have users with a specific IP address range to be able to access our company account / organization in the Elements Security Center portal. Is is possible to limit the access to the Elements portal based on the IP address? 

Resolution:

It is not possible to restrict the access to an Elements organization based on the IP address. The Elements Security Center portal has enforced two-factor authentication as a security feature.  
 

Issue:

Does Elements Agent support usage of MacOS Migration Assistant to move installation to a new device? 

Resolution:

WithSecure Elements Agent for Mac doesn't support the use of Apple's Migration Assistant application. If an existing Elements Agent installation is synchronized from old laptop to new, it will most likely break because both the old and new devices would have the same Unique ID (UUID), therefore the Elements portal would recognize them as the one and the same device and only one would be visible in the Elements portal. 

Both software can cause also other issues with the Elements Agent installation. We therefore recommend to uninstall Elements Agent using the WithSecure uninstallation tool for Mac and to reinstall Elements Agent if you encounter any issues after using any of these Apple features. 

Issue:

If an Elements device was removed from the Elements Security Center portal's Environment > Devices page by the "Manage automatic deletion" feature, will the device return to the portal using the same license and Unique ID (UUID) if the device becomes active again?

Resolution:

If a device that was removed from the Elements portal by the Manage automatic deletion feature becomes active again, it will return to the same subscription key that it was assigned to and it will have the same Unique ID (UUID).

If the subscription key is full, the device will reappear in the Elements Security Center portal once there are available licenses on the subscription key.