To stay updated on your favorite discussions, please create an account or log in. Then, click the Bookmark icon to subscribe and receive notifications.

Shared OneNote blocked once per month

Options
Slain
Slain W/ Member Posts: 4 Security Scout
in WithSecure Elements Endpoint Protection

Hi,

We are using a share OneNote (hosted on sharepoint) on 6 computers (all equipped with EPP).

About once per month, this shared OneNote becomes unavailable for 4 of the 6 computers - those 4 computers have the same profile for settings.

When I say the OneNote is unavailable, it just displays a white page in the browser (same behaviour in Chrome or Edge), and we have to deactivate browsing protection in order to get access to the page.

Then we can reactivate browsing protection.

We added some authorized sites, like site-my.sharepoint.com, frc-onenote.officeapps.live.com/*, login.microsoftonline.com/*, but the blocking comes back every month.

My provider added the * at the end of site-my.sharepoint.com last month, but we had the blank page back on friday, so I'm not sure it changes the game…

I guess that we have another URL which is called by OneNote but blocked by the browsing protection, but I don't know which URL it is nor where I can find this URL.

Does anyone know either if there is an answer (I asked on a well-known search engine, but didn't find) or where I can find a log of the browsing protection?

I found a topic where it mentioned C:\ProgramData\F-Secure\Log\FSNID\fs_ols_ni_plg_content.log, but his FSNID folder does not exist.

Oh, and sorry for my bad English, it's not my mother tongue ;)

Thank you

Slain

Answers

  • LiselotteP
    LiselotteP W/ Staff, W/ Community Manager Posts: 271 Community Manager
    edited August 2023
    Options

    Hi @Slain !

    I sincerely apologize for the inconvenience, your question has been retrieved from the spam queue and we'll provide you with a response in the next 12 hours.

  • JamesC
    JamesC W/ Partner, W/ Staff, W/ Moderator Posts: 509 Moderator
    Options

    Hi @Slain can you please submit a sample with the WSDiag logs to our detection team for further analysis to check which URL is blocking ?

    https://www.withsecure.com/en/support/contact-support/submit-a-sample

    You may follow these steps to create the WSDIAG log file from affected host:

    • Click Start.
    • Select All Programs > (Your F-Secure product) > Support Tool. The Support Tool window is displayed.
    • Click OK. The tool starts gathering information. It creates the output file on your desktop. The name of the archive file is fsdiag.tar.gz.

  • Slain
    Slain W/ Member Posts: 4 Security Scout
    Options

    Hello @JamesC,

    I will create a log file next time we have the problem, then I will post it to understand what can block us.

    Thank you

    Slain

  • Slain
    Slain W/ Member Posts: 4 Security Scout
    edited October 2023
    Options

    Hello,

    The problem came back today, here is the fsdiag.zip.

    Do you see which address we have to add in order to solve it?

    Thank you

    PII: [Removed fsdiag]

  • Sethu Laks
    Sethu Laks W/ Partner, W/ Staff, W/ Moderator Posts: 221 Moderator
    Options

    Hi @Slain

    As previously recommended, kindly submit a sample along with the WSDiag logs to our dedicated customer protection team (virus lab) here for further analysis. This will help us determine which URL is causing the blockage and address the issue accordingly.

    Best regards,
    Sethu
    Community Moderator | Technical Support Engineer
    WithSecure™ https://www.withsecure.com/en/home

  • Slain
    Slain W/ Member Posts: 4 Security Scout
    Options

    Hello,

    Sample submitted, sorry for misunderstanding (I thought I had to submit the sample here) 🙃

Categories