Issue:

Customer or reseller partner would like to cancel an existing Evergreen (SaaS) WithSecure Elements subscription. How to cancel it?

Resolution:

If you have the product through a reseller partner, you need to contact them and they can request a termination of an existing Evergreen (SaaS) subscription. 

If you are a reseller partner, you can terminate a license through the Partner Portal by following these steps:

Partner Portal:

1. To terminate subscription(s) under a contract, proceed to the customer account from Sales > Accounts
2. Choose correct account and proceed to Deal Ordering & Subscriptions tab, click Amend Contracts
3. Select Terminate Subscriptions, click Next
4. Choose the contract and click Select
5. Choose which subscriptions under the contract will be terminated, to proceed click Next
6. Check that the details are correct, and confirm the termination by clicking Terminate
7. Termination is now completed, click Close

Note: Termination that is booked during the on-going month will take effect on the 1st day of the next month

If have purchased the product directly from WithSecure, you can contact your WithSecure sales contact or account manager. If you are unable to reach your WithSecure sales contact or account owner, proceed to contact WithSecure Support.

Issue:

When going in the local Elements Agent user interface to Quarantine and exclusions > Quarantined tab, the Allow button is grayed out and cannot be clicked to release a file from quarantine. How to allow local administrator user to release file from quarantine? 

Resolution:

To allow a local administrator user to release files from quarantine, you need to allow these two settings in the Elements profile that is in use on the device:

First allow user to create global exclusions:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the General > End user rights settings page
5. In the Scanning settings section, unlock Global exclusions
6. Click Save profile

Then allow user to release files from quarantine:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Scanning settings page
5. Scroll down to the Quarantine section and enable Allow users to release blocked and quarantined items
6. Click Save profile 

Once the profile changes have been updated to the device, the Allow button will no longer be greyed out in the local Elements Agents user interface In the App and file control > Quarantined tab. 

Issue:

Elements Agent (EPP for Computers or EPP for Servers) does not take the new expiry date into use after the subscription key is renewed through the Partner Portal. 

Resolution:

If you have a Renewable (Yearly) subscription type, the new expiry date is updated to the Elements Security Center portal 12 hours before the previous expiry time. This can create a confusing situation, where partner has renewed the subscription weeks before the expiry date but during that time the old expiry date is shown in the Elements portal until the last day of the subscription. 

Issue:

When trying to enable Halo PSA integration in Elements Security Center portal on the Management > Integrations page, after configuring the Connection details, when you click on the Company mapping button the error "failed to load company mapping data" is shown. 

The HaloPSA connection is shown to be active, why is this error shown? 

Resolution:

The "failed to load company mapping data" error is shown most likely because the WithSecure app on the HaloPSA API side is missing the minimum required permissions. 

To fix the issue:

In Halo, navigate to Configuration > Integrations > HaloPSA API > View Applications > (the WithSecure app) > Permissions tab

tick at minimum read:customers and read:tickets + edit:tickets. Since WithSecure also does provisioning from recurring invoices, add read:invoices (and edit:invoices if provisioning is enabled). Save.

Then on the Elements Security Center portal side on the Management > Integrations page, click on the Sync sites button. Then try to map the companies again.

Issue:

How can I check which profile an Elements device had before it was assigned another profile? For example if I have assigned one or more devices accidentally a new profile, how can I view the profile history for a device to see which profile it had previously? 

Resolution:

You can view the profile history for an Elements device from the Elements Security Center portal by following these steps:

1. Log in to the Elements Security Center portal 
2. Navigate to the Environment > Devices page
3. Click on a device to enter the device details page
4. Click Show history from the top row
5. Go to the Assigned profile page in the Profile section

This will show you the history of profile assignments for a device for the last 30 days. It shows you the date of change and the value (profile name). 

Issue:

Why doesn´t the Elements Security Center portal's Events > Security Events alert detections always show or include the Powershell command which was run one the device, if the detection process is Powershell?

Resolution:

The Powershell command is only shown in the Security Events alert detection if the detection source is DeepGuard. If the detection source is either File Scanning (Real-time scanning) or AMSI (Antimalware Scan Interface), then they do not include the command line information, because it depends on which detection engine produced the event. 

• DeepGuard events include the CommandLine field — this is where you'll typically see the full PowerShell invocation (e.g., the powershell.exe command with arguments). 
• File Scanning / Real-time scanning (OAS) events focus on the file being scanned, not the launching process. They include filePath and accessor info but typically not the command line of the process.
• AMSI detections have limited portal visibility

If you have Endpoint Detection and Response (EDR) included in your subscription, you can enable Response actions the Elements profile and then use the "Retrieve PowerShell history" investigative action to get more details about any PowerShell commands that have been run on a device. 

Steps how to enable advanced response actions: https://support.withsecure.com/userguides/product.html#business/edr/latest/en/task_09832986687949D783F3A086C43A2ADB-latest-en 

List of investigative response actions: https://support.withsecure.com/userguides/product.html#business/edr/latest/en/concept_C1A7FE15A7794BBDB0D5767C3903D005-latest-en

Issue:

How can I disable, deactivate or turn off all security features of of WithSecure Elements Endpoint Protection / Elements Agent (EPP for Computers and EPP for Servers)?

Resolution:

By default a local user is not allowed to turn off all security features from the local Elements Agent user interface. You will need to allow this from the profile that is in use on the device. 

How to edit a device profile to allow a local user to stop all security features:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Go to the Security Configurations > Profiles page from the menu on the left
3. Select the profile you want to edit
4. Go to the General settings page 
5. Scroll down to the bottom to the Security features section and enable Allow user to turn off all security features 
6. Click Save profile 

Once the profile has been taken into use, from the local of WithSecure Elements Agent user interface, a user can click on the three dots and select Turn off all security features. 

Note: If password for uninstallation is enabled, the same uninstallation password is required to be entered when turning off the security features. 

Alternatively, you can remotely using an operation stop the security features temporarily:

1. Log in to Elements Security Center portal
2. Go to the Environment > Devices page from the menu on the left
3. Select the device (a menu will appear from the bottom of the page)
4. Click Turn off security features > Turn off all security features
5. Select the time and then confirm the action by clicking "Turn off"

Please note that if you select a time, for example 5, 15 or 30 minutes, the security features will not be automatically turned on after computer restart. The security features will be automatically turned on after the set time limit has been reached. 

If you want to have the security features to turn on automatically at computer restart, you need to select the "computer restart" option. 

All security features can also be turned off using a Command Prompt by stopping the F-Secure Ultralight Hoster (fsulhoster) service. Simply run in the command line:

• net stop fsulhoster 
• net start fsulhoster

Note: Tampering Protection (Resource Protection) needs to be disabled in the Elements Endpoint Protection profile to allow a local user to stop and start services.

Issue:

Veeam Backup & Replication Console update fails when Elements Endpoint Protection Security Features are enabled. 

Installation fails with error: 

Deleting temporary folder Error: The process cannot access the file because it is being used by another process. Failed to delete file: [\\?\C:\Windows\Veeam\Backup\Upload\07f9fa15-dc61-40e8-9068-d0f4243ff9de\Veeam_B&R_Endpoint_x64.msi]. File '\\?\C:\Windows\Veeam\Backup\Upload\07f9fa15-dc61-40e8-9068-d0f4243ff9de\Veeam_B&R_Endpoint_x64.msi' locked by 0 processes: The specified directory cannot be removed: [\\?\C:\Windows\Veeam\Backup\Upload\07f9fa15-dc61-40e8-9068-d0f4243ff9de]. Failed to invoke rpc command

Resolution:

If Veeam Backup & Replication Console update fails when Elements Endpoint Protection security features are enabled (such as Real-time scanning and DeepGuard), you need to create Global scanning exclusions for the folders used by Veeam and process exclusions for Veeam processes. 

By default these should be enough if your Veeam installation is in a default location: 

Add to the Global exclusions from all security scans list: 

C:\Windows\Veeam\
C:\Program Files\Veeam\ 
C:\Program Files\Common Files\Veeam

Process exclusion list: 

C:\Windows\Veeam\Backup\VeeamDeploymentSvc.exe
C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Service.exe
C:\Program Files\Common Files\Veeam\Backup and Replication\Explorers Recovery Service\Veeam.StandBy.Service.exe
C:\Program Files\Veeam\Veeam Guest Interaction Service\Veeam.Guest.Interaction.Proxy.exe
C:\Program Files\Common Files\Veeam\Backup and Replication\Mount Service\Veeam.Backup.MountService.exe
C:\Program Files\Veeam\vPowerNFS\VeeamNFSSvc.exe
C:\Program Files\Veeam\Backup and Replication\Threat Hunter\Veeam.ThreatHunterService.exe
C:\Program Files\Veeam\Backup Transport\VeeamTransportSvc.exe

This Veeam documentation also includes other paths that they recommend to exclude: https://www.veeam.com/kb1999

Issue:

When opening a support request to WithSecure, a Technical Support Engineer may access your Elements company account when handling a support request. 

Resolution:

When you open a support request with WithSecure, the Technical Support Engineer assigned to your case may need to access your Elements company account in order to investigate the issue. In such cases, the Technical Support Engineer will be temporarily granted read-only access to the company account, allowing them to review any products associated with the Elements company account.
Once a Technical Support Engineer has been added to the company account, their user account will appear on the Security Administrators page of the Elements Security Center. Upon resolution of the support request, the user account will be promptly removed from the company account.

The support account used for this purpose is:
name+support@withsecure.com

You can read about WithSecure's privacy policy from here.

Issue:

User is unable to log in to the Elements Mobile Protection app using username and password. User receives "Incorrect username or password" error message. 

Resolution:

The Elements Mobile Protection username and password are one-time use upon installation. For example, if the Mobile Protection app has suddenly logged out on an Android or Apple iOS device, you will need to reinstall the product by sending a new invitation from the Elements portal.

You can uninstall the Mobile Protection app from the device, log in to the Elements portal, and remove the device from the portal under Environment > Devices > Mobile devices to free up the license for reuse. You can then follow these instructions to send a new installation link to the device: https://community.withsecure.com/en/kb/articles/29401-how-to-install-elements-mobile-protection-to-android-or-apple-ios-mobile-devices

You should remove the previous Elements Mobile Protection application from the device before installing it again from the new installation email. When the application is installed using the link in the installation email, the application will automatically register the license.

For installation across multiple mobile devices, please be sure each device receives their own invitation. An invitation link cannot be shared across multiple mobile devices.   

Note:
If you have used Apple iOS data migration to copy the app from the old device to the new device, you will need to uninstall the app and send a new installation and activation link from the Elements Endpoint Protection portal.