Issue:

Elements endpoint devices have suddenly disappeared from the Elements Security Center portal's Environment > Devices page and fewer licenses are in use. What might have happened to the devices? 

Resolution:

The most common reason for a visible drop in the endpoint count in the Elements Security Center is the "Manage automatic deletion" feature. If this feature is enabled on the company account, devices that have been offline for longer than the configured threshold are automatically removed from the portal.

You can check the Manage automatic deletion value by following these steps:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. Click on the three dots 
4. Select Manage automatic deletion
5. View the amount shown in the days field
6. Click Save

You can also from the Elements Security Center portal check when devices have been uninstalled or removed from the portal. Navigate to the Environment > Devices > three dots > Manage removed devices page. Here you can from the Device state column check if the reason for the removal was either uninstallation or if it was simply removed. 

From the Management > Audit Log page you can check who has issued the removal operation if it was done manually by an administrator. 

Issue:

Elements Endpoint Protection doesn't scan a USB drive when "Action when USB storage device is plugged in" is set to:

• "scan USB and show results to user" 
• "Silently scan USB" 
• "Force scan USB and show result to user" 
• "Ask user to scan USB" 

Resolution:

Make sure that the USB drive that you have connected to the computer is a USB thumb drive or an SD card. If it is an external HDD, it will not be scanned even if it would use a USB connection.

This is expected behavior since the "Action when USB storage device is plugged in" feature uses internal Windows device flags which tells Windows which type of device is connected. It's not using device ID or hardware ID.

Issue:

Error "Failed to save profile TX-ID: 0000-XXXXXXXX" when trying to edit or modify a setting with the profile editor in the Elements Security Center portal. 

Resolution:

If you receive a "Failed to save profile" error when saving an Elements profile, the issue is most of the time caused by a invalid setting in the Elements profile. Try to clone the profile and then make your modification and then try to save the newly cloned profile. If you receive the same error, you can either try to create a completely new profile or try to fix the original profile.

If you want to try to fix the original profile, check in the profile's navigation menu on the left side if there is a red stripe on the left side of any of the settings pages. That red stripe indicates that there is an invalid setting that you need to either remove or modify. 

If no red stripe is shown, then the issue is very likely due to a custom Application Control or Automated Tasks rule. Try to remove Application Control rules and Automated Tasks one by one and try to save each time you have removed a rule. Once you have found out which rule is causing the issue, you can remove or modify it and then save the profile. 

Issue:

Usage time of the Android mobile is reduced by 80% as long as Elements Mobile Protection is installed.

Resolution:

Elements Mobile Protection will always do a full scan of the system when the Android mobile device is restarted. If you restart the device daily or very often, the Elements Mobile Protection application can drain a significant amount of battery. 

Also check that you do not have scheduled scanning set to do a daily scan:

1. Log in to the Elements Security Center portal
2. Navigate to Security configurations > Profiles page
3. Go to the for Mobile tab
4. Click on the profile that is in use on the device
5. Go to the Malware protection settings page
6. Scroll down to the Scheduled scanning section
7. Make sure that the Scan frequency is not set to Daily
8. Click Save profile

If battery usage is still very high after checking the scanning settings, you can try to see if reinstallation of the app fixes the issue. 

Issue:

Elements Endpoint Protection Software updater (patch management) feature shows updates to be available for software which have already been uninstalled from a device. Why does Software Updater detect updates for software which no longer are present on a device? 

Resolution:

If Elements Endpoint Protection Software Updater feature would list updates to be available for software which no longer are installed on a device, we recommend to check that the software has been successfully uninstalled. In some instances, traces of registry entries of the uninstalled software can be still left on the system and that is the reason why Software Updater feature detects it and offers updates for it. 

Also check that there is no entry for the software on the Windows "Installed Apps" list. 

Issue:

How to collect the diagnostic file from Elements Mobile Protection?

Resolution:

If you have technical problems with your product, you can create and send a diagnostic file (wsdiag) to our technical support. The file contains information that can be used for troubleshooting and solving problems specific to your device.

To generate a log file with your smartphone:

1. Open the Elements Mobile Protection app.
2. Tap the main menu in the top-left corner, and select About. The About MOBILE PROTECTION page opens.
3. Tap seven times on the version number. The SEND LOG FILE button is displayed at the bottom of the screen.
4. Tap the SEND LOG FILE button and select your email sending method. If you need to provide the file to Withsecure support, send the file to your own email address initially and attach it to the support-ticket. The email message opens with the log file attached to it.
5. Describe the problem in the email.
6. Send the email.

To generate logs in case of problems with Mobile Protection activation, when About view is not available:

1. Open the Elements Mobile Protection app.
2. Tap ten times on the description text (This software requires a valid license for Endpoint Protection to work…) . The SEND LOG FILE button is displayed at the bottom of the screen.
3. Tap the SEND LOG FILE button and select your email sending method. The email message opens with the log file attached to it.
4. Describe the problem in the email.
5. Send the email.

A diagnostic file can also be requested remotely from the Elements Security Center portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. Open the Mobile devices tab
4. Click on a device (An Actions menu will appear)
5. Click Request diagnostic file 

Once a diagnostic file has been uploaded to the Elements portal it will be available for download on the device's Operations tab or if you on the Devices page click on the three dots and go to the Manage Operations page. 

Issue:

We have in our Elements profile for Elements Endpoint Protection for Server / Computers set the File scanning action as "Ask after scan", but files are still quarantined automatically when they scanned. Why are files still quarantined?

Resolution:

There are many reasons why the files could still get quarantined. First we recommend to go to the Security Events page in the Elements Security Center portal to check the detection for the quarantine event. From the detection you can check if the file in question was a malware, riskware or spyware. 

If the file has been detected as either riskware or spyware, they have separate actions available on the real-time scanning settings page in the profile:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Real-time scanning settings page
5. Scroll down to the File scanning section
6. Check the following actions that they are set as Ask after scan:
   1. Action on riskware
   2. Action on spyware
7. Click Save profile

Scheduled scans are considered manual scans, so if the file was quarantined during a scheduled or manual scan, you need to check the Manual scanning settings for the Action on infection. 

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Manual scanning settings page
5. Scroll down to the Manual scanning section
6. Make sure that the Action on infection is set as Ask after scan
7. Click Save profile

We also recommend to check in the profile on the End user rights page that all the settings are locked. If settings are left unlocked, a local user could have changed the settings locally. 

Issue:

What exactly does the Mobile Protection Metered network scanning setting do? Does it somehow limit scanning when it's off?

Resolution:

The metered network scanning setting turns on the Metered Network Scan to allow the Elements Mobile Protection app to scan your device even when connected to a metered network. If the option is turned off scanning can only be performed on a non-metered networks = WiFi or tethered networks, so user will not use data from its paid internet data plan.

Note: A metered network connection has a limit on how much data can be used. Exceeding this limit may incur extra costs.
Note: This is for Android only.

Issue:

Emails sent from Elements Security Center / Elements portal from no-reply@withsecure.com or other withsecure.com addresses do not arrive to recipient Microsoft Office 365 users

Example actions where email does not arrive to recipient users and are quarantined:

• Password reset email does not arrive 
• When sending the Elements Mobile Protection / Elements Endpoint Protection device invitation emails from the Endpoint Protection portal with the Add new device feature, the invitation / welcome / installation emails do not arrive to the recipient user.
• Endpoint Protection Automatic AV infection alert emails sent from Security Events page do not arrive
• Endpoint Protection Monthly / Weekly Scheduled reports do not arrive
• After using Create new administrator to add user, the user does not receive the welcome email 

Resolution:

If user did not receive the welcome email, try the following:

• Check the spam folder and if you have any rules to move mail to subfolders in Outlook. If you are using Microsoft Office 365, ask the administrator to check the quarantine. 
• Make that the user has an Elements user account. Another administrator can check if the user's email address is listed on the Elements portal's Management > Organization Settings > Security administrators page. If you have a partner managed subscription, a partner can also check.
• If other users are receiving the emails in the same domain but issue affects only one or few users, try to delete the admin user from the Elements portal and then add user again. This can be done from the Management > Organization Settings > Security Administrators page 

Issue:

Malware protection status for a device is shown as "Not applicable" on the Elements Security Center portal's Environment > Devices page. 

Why is it showing such status? 

Resolution:

The status "Not Applicable" indicates that the subscription or client application does not support malware protection.

If the subscription used for the device is stand-alone "Elements Endpoint Detection and Response" or Elements Exposure Management, that product does not have malware protection functionality therefore it will show the status as "Not applicable".