Issue:

How to move current WithSecure Elements EPP for Computers or for Servers installations from one Elements Security Center portal company account to another company account without having to reinstall the Elements Agent client on the devices?

Resolution:

The ws_oneclient_logout tool allows you to log out from the Elements Agent on the device, so that you can change the subscription key that a device uses to connect the device to an another company account in the Elements Security Center portal.

This command-line tool removes the current Elements subscription from the Elements Agent, and returns the software to its initial state, before a subscription key was used. 

The tool can also be used to switch Elements Security Center portal instances. The available options are:

• psb1
• psb2
• psb3
• psb4
• psbsmieu

The ws_oneclient_logout.exe tool can be found and run from the Elements Agent installation folder:

1. Open a command prompt with administrator privileges.
2. Navigate to %ProgramFiles(x86)%\F-Secure\PSB
3. Run the tool in the command prompt.
   • To log out and activate a new subscription key, run the following command: ws_oneclient_logout.exe –keycode <enter subscription key here> 
     Elements Agent will log out and start using the subscription key that you entered immediately.
   • To log out and register to another Elements Security Center Portal instance (e.g. PSB1), run ws_oneclient_logout.exe –psb1 –keycode <enter subscription key here>
     When both portal and  –keycode are specified, the client is switched to specified portal and keycode is used during the switch.
     This way installation can be registered to a new portal without reinstallation.
     The product will log out and start using the subscription key that you entered immediately.
   • To remove the current subscription key, run \ws_oneclient_logout.exe –nokeycode.
     The product will stop working and asks you to enter a new subscription key manually when you open the main view of the application.

If the tool runs successfully, it returns 0 as the result. In other cases, for example if the network is unavailable or you enter an incorrect subscription key, the product will stay in the "expired" state and asks you enter the new subscription key manually.

Note: When ws_oneclient_logout.exe is run with the –keycode parameter and the same subscription key is used, the device will re-register to the Elements portal with a new Unique ID (UUID). 

Issue:

Microsoft Excel, Word and PowerPoint files including malicious URL were detected in SharePoint, OneDrive and Teams.

Malicious URL in text file(.txt) was not detected.
Also, malicious URL shared in teams chat was not detected.

Are these all expected bahavior?

Resolution:

This feature was implemented in our Security Cloud on February 2024

Regarding this question, our Security Cloud does not look at the file extension, but it looks at the file type.
File Types that are currently supported with this behavior are:

MicrosoftExcel 
MicrosoftWord 
MicrosoftPowerPoint 
PDF  
OpenDocumentPresentation 
OpenDocumentSpreadsheet 
OpenDocumentText

As for PDF file, URLs are needed to be linked with Hyperlink.
Press enter or space after typing in the URL before saving it as PDF, the URL will be linked with hyperlink, which will trigger detection.

Issue:

Is there any way to filter quarantined files by file name or URL in Exchange on Elements Collaboration Protection?
It seems that other cloud services like SharePoint, OneDrive and Teams have a filter by file name, but there's no such filtering rule for Exchange.

Resolution:

Unfortunately it is not possible to filter out by file name or URL name in Exchange, because the data is stored based on the email's Message ID, which is different compared to SharePoint, OneDrive and Teams.

Issue:

Maximum number of URLs that can be configured Exchange policy in Collaboration Protecion

Policies > Exchange > URL scanning > Trusted websites > Websites
Policies > Exchange > URL scanning > Blocked websites > Websites

Resolution:

There is no maximum number of URLs. but there is an limit for the entire policy settings all together (and not field-by-field limit).

Issue:

Installation of WithSecure Elements Endpoint Protection Agent shows "Check that your internet connection is working and try again" error after entering the subscription key during installation.

Resolution:

If you are connected to the internet and still getting the "Check that your internet connection is working and try again" error message during installation with a subscription key, follow the steps below to rule out other probable causes:

Check for connectivity issues with the WithSecure Connectivity Tool: 

Before installing any WithSecure products, you can use the F-Secure Connectivity Tool to check whether or not the host is able to connect to the F-Secure backend systems. Later if you encounter issues with the installed products, you can use the tool to rule out any issues related to connectivity.

1. Download the F-Secure Connectivity Tool
2. Run it and check for errors

Incorrect subscription key:

1. Check that you are using the correct subscription key during the installation
2. Double-check the spelling and verify from either your license certificate or from the Subscriptions page in the Endpoint Protection portal that you are using a valid license

Insufficient number of available licenses:

1. Check that there are still available licenses on the subscription key you're trying to use
2. In the Endpoint Protection portal, go to the Subscriptions page and check the Usage column for the license in question. If there are no more available licenses, you have two options: 
   • Remove old installations that are no longer in use to free up licenses, or;
   • Acquire more licenses by reaching out to your F-Secure reseller partner or F-Secure sales contact

If you would like to remove old installations that are no longer in use to free up licenses, follow the steps below:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Devices page
3. Select the device(s) you want to remove, using the checkbox on the left
4. Click Remove device from the options at the bottom of the screen
5. Select Move to blocklist or Remove permanently depending on your use case

After removing a device from the Endpoint Protection Portal, the device will be added to a blocklist so that it will not be able to connect to the portal anymore and take a license into use. To be able to reinstall Elements Agent on these devices, you need to remove these devices from the blocklist:

1. Login to the Endpoint Protection Portal
2. Go to the Subscriptions page
3. Open the action menu on the right side of the license
4. Click Remove devices from blocklist

Note: If a computer is on the blocklist and you try to use the subscription key on that computer, you will get the same "Check that your internet connection is working and try again" error message. You will need to remove the devices from the blocklist to install the software again on that computer.

Installation file has been downloaded from the wrong Endpoint Protection Portal:

The installation files for Elements Agent are portal specific. Make sure you have downloaded the installation file from the correct portal. You can verify the portal the subscription key belongs to from your license certificate. 

Its also suggested to check the uptime of the Computer, if its running from too long than reboot the workstation/server and then try to install it again. 

Issue:

How can I import a Policy Manager host policy to a Elements Endpoint Protection profile in the Elements Security Center Portal?

Resolution:

You can follow the steps below to export the WithSecure Client Security host policy using the Policy Manager Console:

1. Log in to the Policy Manager Console
2. Right-click the host in the Domain Tree
3. Select Export policy file 

Note: Client Security 13.x host policy cannot be imported to an Elements Endpoint Protection profile since it is in a .bpf format. The .json file format is required to be able to import the policy.

Import the Client Security host policy .json to an Elements Endpoint Protection profile:

1. Log in to the Elements Security Center
2. Navigate to the Security configurations > Profiles page
3. Select the profile to which you want to import the host policy
4. Click on the three dots
5. Select Import profile
6. Navigate to the .json file and click Open

Note: if you receive an error "Cannot import the given profile because the format of the file is unknown", you have exported the profile incorrectly by selecting Tools > Export policy settings. The policy must be exported by right-clicking the host in the Domain Tree. 

Issue:

When trying to create a new company account with an WithSecure Elements Endpoint Protection (EPP for Computers or for Servers) subscription key in the Elements Portal, user receives the following error: Subscription not found 
 

Resolution:

There are a couple of different reasons why a subscription key might not work when trying to create your Elements company account with it:

• If you have bought a Partner Managed Elements subscription, you do not need to add the subscription key yourself to your Elements account. It will be automatically added by the reseller partner. Most likely it has already been added to your account
• You already have created the Elements Company account before with that subscription key. If this is the case, try to log in with your user credentials or use the forgot password feature. 
• The key belongs to a different Elements portal than the Elements portal you are trying to create the company to. The subscription keys are portal specific. Check the license certificate for which Elements portal the subscription key belongs to and make sure you are trying to create the F-Secure Elements account to the correct portal.

Issue:

Receiving error "Could not find subscription key" when adding subscription key to an Elements portal company account with the Assign subscription button on the Management > Subscriptions page. 

Resolution:

Check that the subscription key code you ordered is correct for the account you have. 

If you have a Company Managed subscription key and the company account is placed under a reseller partner's Solution Provider account (SOP), you cannot add the code there. For that you need to have a Partner Managed subscription.

If you have a Partner Managed subscription key, the subscription key is automatically added to the company account and you cannot add it again. Check the Management > Subscriptions page to see if the subscription key is already found on the accoutn. 

A code cannot be used on a trial account either, a new account needs to be created or the trial account needs to be converted to a normal commercial account.

A reseller partner can directly contact Order Services to help you with this. 

If you're not sure what the issue is, please contact WithSecure Support for further assistance.

Issue:

I have forgotten my WithSecure Business Account password. How do I reset the password for my Elements business user account?

Resolution:

You can reset your password by clicking on "Forgot password?" on the Elements Security Center log in page. An email will be sent from which you can reset your password.

If you do not receive a password reset email, check if it has been sent to your email spam or trash folder.

If you have not received any email, open a support request and support can investigate the account issue.

Issue:

Is it expected to have both F-Secure and WithSecure services running when WithSecure Elements Agent is installed on a Windows computer? Some Elements Agent related services are still running under the "F-Secure" name on the Windows devices. 

Resolution:

Yes, it is expected to have both WithSecure and F-Secure named services running, as these components are common for both F-Secure and WithSecure, hence the name has been kept.

Currently, the following Elements Endpoint Protection services are still using F-Secure name:

• F-Secure Ultralight Hoster (fsulhoster)
• F-Secure Ultralight Network Hoster (fsulnethoster)
• F-Secure Ultralight Protected Hoster (fsulprothoster)

The following Elements Agent services are using the WithSecure name:

• WithSecure Device Control (fsdevcon)
• WithSecure Hoster (fshoster)
• WithSecure Hoster (Restricted) (fsnethoster)