Issue:

EDR Sensor Disabled status is shown in the Elements Security Center for a device even after uninstall/re-installation.

Resolution:

If EDR sensor status is shown as disabled in the Elements portal's Devices page, make sure that the EDR Sensor is enabled in the profile that is in use on the device:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the device
4. Go to the General settings page 
5. In the Integrations section, make sure that EDR Sensor is set as enabled
6. Click Save profile

If the issue persists, check that the following registry entries have administrator permissions:

Registry

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA

Permission

“Local Service” and “Network Service”

 This is most probably caused by system roll back software. 

Issue:

When an administrator installs Elements Agent (EPP for Computers or for Servers) using .msi installer, the devices are not listed in the Elements Endpoint Protection portal Devices page.

Resolution:

There can be several reasons why the installation does not appear in the portal. 

• Elements Agent has not been installed correctly
• Elements Agent is unable to connect to all the necessary addresses

Make sure that the Elements Agent is found on the device and that the user interface shows "Your computer is protected".  For Group Policy (GPO) installation or third-party remote management tools and how to append the subscription key to the installer, you can refer to the following links: https://help.f-secure.com/product.html#business/psb-portal/latest/en/concept_5FFE42B3AC764C68A5FAC889B3B62F0B-psb-portal-latest-en

To make sure that the Elements Agent installation is able to connect to all the necessary addresses, you can run the fsconnectionchecker.exe that is found in the following location: C:\Program Files (x86)\F-Secure\PSB\ui

Issue:

Does WithSecure Elements Endpoint Protection Agent for MAC support macOS version 15 Sequoia?

Resolution:

The latest Elements Agent for MacOS 24.3.53367 does not yet support MacOS Sequoia. Official macOS 15 Sequoia support is coming with version number 24.4.

You can follow this WithSecure Community changelog to know when version 24.4 has been released: Elements Agent for Mac Changelog – Page 2 — WithSecure Community

Issue:

As a user enters the subscription key during installation of Elements Agent , they receive an error message saying "Could not verify the subscription code. Try again later".

Subscription key can be for any of the following Elements products:

• Elements Endpoint Protection (EPP for Computers and EPP for Servers)
• Elements Endpoint Detection and Response (EDR for Computers and EDR for Servers)
• Elements Vulnerability Management

Resolution:

Check that not all the licenses are in use:

1. Log in to Elements Security Center: https://elements.withsecure.com
2. Select Management
3. Select Subscription and check the number of licenses in use

If all licenses are in use, you can remove a previously installed device:

1. Select Environment
2. Select Devices
3. Click on the white square on the left side of the device
4. Click on remove device from the bottom of the screen
5. Try the installation again

If the installation still cannot verify the subscription key, the device could be blocked, and you can activate the device by doing the following steps:

1. Go to the Devices page
2. Click on the action button (three dots) on the right side of the Devices title
3. Click on Manage removed devices
4. Click on the three dots on the right side of the device and select "activate"

Ensure that you are installing WithSecure Elements Endpoint Protection on a supported operating system. If you try to activate an Elements product on an operating system it does not support, you will receive the error "Could not verify the subscription code. Try again later". For more information on supported operating systems, check the respective product help guides for Elements EPP for Computers and Elements EPP for Servers.

It is also possible that the network is blocking necessary traffic to our services. This community article has more information to help resolve such issues. You can run the Connectivity Tool to check connectivity to the required addresses.

From Elements Agent version 22.1 onwards, the connectivity requirements have changed for the Elements Agent and Elements Connector so that the error might be appear because Certificate Revocation Lists (CRL) URLs are not allowed to access by firewall or proxy. Proceed to verify that connections to CRL URLs work. If you see that clients cannot send data to the portal anymore or are unable to validate the subscription key, then most likely CRL URL is blocked. Here is the full list of URLs to allow:

Note: The following requires HTTP access, not HTTPS

• ocsp.rootca1.amazontrust.com
• crl.sca1b.amazontrust.com
• ocsp.rootg2.amazontrust.com
• ocsp.sca1b.amazontrust.com
• crl3.digicert.com
• crl4.digicert.com
• ocsp.digicert.com

If any of the above has not helped it's recommended to download the WsUninstallationTool.exe from https://download.withsecure.com/uninstallationtool/WsUninstallationTool.exe and run it on an affected computer. After the uninstallation, reinstall the Elements Agent and during the installation the subscription key will be registered, and the product will be installed normally.

Issue:

After changing locally a computer's hostname where Elements Agent (EPP for Computers or EPP for Servers) is installed, the device name is not updated to the new name in the Elements Security Center portal's Environment > Devices page.
 

Resolution:

If you have changed the hostname of a computer where Elements Agent is installed, the new device name will not update in the Elements Security Center portal until the device has either been restarted or a "Send full status" operation has been sent to the device. 

You can do the following:

1. Restart the computer 
2. Right-click on the Elements Agent icon in the Windows system tray and go to check for updates
3. Verify that the device name has been updated on the Elements Security Center portal's Environment > devices page

Issue:

When trying to install Elements Agent (EPP for Computers or for Servers) in a Windows computer or server, but the installation failing with error "Something went wrong"

Resolution:

Proceed to check if you can find any information in the server's Event Viewer (application) that indicates this installation error. As an example:

• Product: F-Secure One Client PSB 4.10.859 — Installation failed.
• Windows Installer installed the product. Product Name: F-Secure One Client PSB 4.10.859. Product Version: 4.10.859.0. Product Language: 1033. Manufacturer: F-Secure Corporation. Installation success or error status: 1625.

The Windows MSI installer error code 1625 translates to "This installation is forbidden by system policy. Contact your system administrator." You can refer to the Microsoft documentation for the list of MSI error codes.

You can refer to the Microsoft TechNet portal on a list of workaround available to fix this installation error.

This error often indicates that either Elements Agent, Client Security or Server Security has been previously installed on the computer. The uninstallation of the previous WithSecure product has left some leftover files on the computer which are conflicting with the new installation.

To try to resolve this issue:

1. Download the WithSecure Uninstallation Tool: https://download.withsecure.com/uninstallationtool/WsUninstallationTool.exe
2. Run the tool
3. Restart the device
4. Try the installation again

Issue:

When trying to install WithSecure Elements Agent (EPP – Elements Endpoint Protection for Computers) on a Microsoft Surface Pro X, the installation seems to stop promptly and never finishes. Is it because the product doesn't support the processor?

Resolution:

The Microsoft Surface Pro X has an ARM-based processor, so you need to have Windows 11 installed on it to be able to install Elements Agent . 

Elements Agent for Computers for Windows supports the following operating system versions:

• Microsoft Windows 11 Enterprise LTSC / IoT Enterprise LTSC version 24H2
• Microsoft Windows 11 (all 64-bit editions, including ARM64)
• Microsoft Windows 10 Enterprise LTSC / IoT Enterprise LTSC versions 2016, 2019 or 2021
• Microsoft Windows 10 (all 32-bit and 64-bit editions), ARM-based tablets are not supported

You may find the latest system requirements here.

Issue:

Elements Connector cannot show welcome page after installation

Resolution:

By changing Connector port can help to resolve this issue. To change Connector http/https port, you can change registry entry to unused number.

> HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\ElementsConnector>HttpPortNum
> HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\ElementsConnector>HttpsPortNum

Issue:

Elements Agent (EPP for Computers or EPP for Servers) local user interface displays the error message: "Your subscription for this device has expired or it has been removed"

Resolution:

Check that the device has not been removed from the Elements Endpoint Protection Portal

1. Log in to the Elements Endpoint Protection Portal
2. Go to the Devices page
3. Check if the device is shown on the devices list

If the device has been removed and added to the blocklist, follow these steps to restore devices from blocklist to allow the device to reconnect to the Elements Endpoint Protection Portal:

1. Go to the Devices page
2. Click on the action button (three dots) on the right side of the Devices title
3. Click on Manage removed devices
4. Click on the three dots on the right side of the device and select "activate"

Once the device has been reactivated, it will be allowed to reconnect to the Endpoint Protection Portal. If the device still does not appear in the portal, follow the steps in this help guide to reinitialize the Elements Agent.

Check that the license key is still valid

1. Log in to Elements Endpoint Protection Portal 
2. Go to the Subscriptions page
3. Check the Expiration column to see the expiry date

If subscription has expired, you need to contact your WithSecure reseller partner to renew the subscription. 

Check for connectivity issues with the Elements Endpoint Protection Portal

• Make sure the client can connect to the Elements Portal. You can find the URL addresses in this WithSecure Community article
• Use the connectivity tool found on the device to check for connection issues: C:\Program Files (x86)\F-Secure\PSB\ui\wsconnectionchecker.exe

Issue:

If a scheduled scanning time has been set for Elements Endpoint Protection for Computers (Elements Agent), does scheduled scan start on the next startup, in case the system has been shut down or offline during the scheduled scan time?

Resolution:

The scheduled scan does not start on the next computer startup. It will start on the next scheduled time only when the computer is on.