Issue:

How can we get training for WithSecure products? 

Resolution:

We have publicly available training courses for Elements Extended Detection and Response (XDR) and Elements Exposure Management: https://www.withsecure.com/en/support/technical-training

There are available trainings for the following products: 

• Elements Endpoint Protection (EPP) 
• Elements Endpoint Detection and Response (EDR)
• Elements Collaboration Protection (ECP)
• Elements Exposure Management (XM)

Issue:

How to create a profile for Elements Endpoint Protection (EPP for Computers and EPP for Servers) that blocks every internet website (URLs) except for allowed or whitelisted pages?

Resolution:

You can block everything except allowed sites by following these steps:

1. Log in to the Elements Security Center Portal 
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to edit
4. Go to the Browsing protection settings page
5. Scroll down to the Web content control section and enable it 
6. Scroll down to the Web site exceptions section
7. Enable "Enable web site exceptions"
8. Enable Block everything except allowed sites 
9. Click Save profile

Note: Web Content Control feature needs to be enabled in the profile for the "Block everything except allowed sites" feature to work.

To add sites to the allowed sites list:

1. Scroll down to the Web site exceptions section and enable it
2. Click the Add site button under Allowed sites 
3. Add the site domain address. Example: Google.com
4. Click Save profile

When a website is blocked by Browsing Protection, the user will receive a Website denied block page. This block page will show the message "You can only access these websites:" and then list all the allowed websites. 

If the user has administrator rights and local settings changes has been allowed from the profile, the user can click on Allow this website to allow the site they are currently trying to reach. If a local user wants to allow other sites, they can click on the Allowed and denied websites link on the block page and click Add new.

If you do not wish to block all websites, but just specific categories of websites, Elements Endpoint Protection products have the Web content control feature, which can restrict web browsing based off of the category filtering setting (example: "drugs", "adult", "games" etc.). If the website fits into one of the disallowed categories, access to the website can be blocked.

To enable Web Content control:

1. Log in to the Elements Security Center Portal 
2. Go to the Security configurations > Profiles page
3. Select the profile you want to edit
4. Go to the Browsing protection settings page
5. Scroll down to the Web content control section and enable it 
6. Enable the categories, which you want to block and select if you want an alert to be sent
7. Click Save profile

Note: Websites that are listed in the Allowed sites list will not be blocked even if the website belongs to a disallowed category.

If you do not want to have local users to be able to continue to blocked pages or add allowed sites locally, enable the following settings from the Endpoint Protection profile:

1. Go to the Browsing protection settings page
2. Disable Allow user to continue to blocked pages and lock the setting with the lock 
3. Go to the end user rights page in the profile
4. In the Browsing Protection section, enable the lock for Allowed and denied sites
5. Click Save profile

Issue:

When Elements Endpoint Protection Software Updater feature starts installing an update on a Windows computer, a Windows User Access Control (UAC) prompt is shown and it asks the local end-user to enter admin credentials (username and password) to continue with the update installation. If the end user selects "No" when getting the UAC prompt, they will be asked to reboot or restart the computer.

Resolution:

1. Log in to the Elements portal
2. Navigate to the Security configurations > profiles page 
3. Select the profile that is in use on the devices
4. Go to the Automated tasks settings page
5. Disable the automatic installation task from the Active column
6. Click Save profile

Issue:

Can I transfer, move or export an Elements Endpoint Protection (EPP for Computers or EPP for Servers) profile to another company account in the Elements Security Center Portal?

Resolution:

A WithSecure Solution Provider (SOP) partner with partner level access to the Elements Security Center portal can copy a profile between two partner managed customer companies in the Elements portal:

1. Log in to the Elements portal 
2. Select the customer company from the scope-selector drop-down menu
3. Navigate to Security Configurations > Profiles 
4. Click on the three dots on the right side of the profile
5. Select Copy profile to another account 
6. Select the destination company
7. Click Confirm

The Elements Portal also has a profile export and import feature, which you can use to export a profile and then import to another company account. 

How to export a profile:

1. Log in to the Elements Portal
2. Go to the Security Configurations > Profiles page
3. Click a profile
4. Click on the three dots in the top-right corner and select Export profile 
5. Save the .json file

How to import:

1. Log in to the Elements Portal to the another company account
2. Go to the Security configurations > Profiles page
3. Click an existing profile or clone a new one by clicking the three dots and select clone profile
4. Click the three dots in the top right-corner and select Import profile
5. Select the .json file and click Open

The settings will now be overwritten with the settings from the imported profile.

Issue:

How to change, transfer or migrate two-factor authentication (2FA) / Multi-factor authenticator (MFA) to a new authenticator device? 

Resolution:

If you still have access to the old authenticator, you can move the authenticator to a new device by logging in with the existing authenticator to the Elements portal.

1. Log in to the Elements portal: https://elements.withsecure.com
2. Click on the user icon in the top-right corner 
3. Go to My settings 
4. Click on the Change button on the right side of the Multi-factor Authentication enabled text
5. Log in with your existing authenticator codes
6. Click on the Remove button on the right side of the Google authenticator or similar text
7. Confirm the removal by authenticating again with your username, password and authenticator code

Once the existing authenticator has been removed, simply click on the add button to add your new authenticator. 

Note: If you have only Partner Portal or eService portal access rights, you can still log in to the Elements portal and change the 2FA settings. The changes you make in Elements portal will also apply to your Partner Portal and eService user account. 
 

Issue:

How to configure Device control where all the USB devices are blocked unless whitelisted by its hardware ID or InstanceID? 

Resolution:

You can make rules of various USB Classes where you can set the access level to Block and than make a whitelist rule to allow the specific USB devices by the Instance ID. 

To know various Class please check this page, 

https://en.wikipedia.org/wiki/USB (Scroll down and find Device Classes) 

Once you have blocked it make another rule to whitelist the specific devices with the instance ID and Hardware ID. 

For Elements Endpoint Protection for Computers and Servers you can set restrictions on how users can access USB devices (for example, web cams and hard disks) and whether removable mass storage devices are allowed to execute installers.

To set up Elements Endpoint Protection Device control to disallow all USB mass storage devices:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Security configurations > Profiles page
3. Select the profile that is in use on the devices
4. Go to the Device control settings page
5. Turn Device control on.
   • Note: If Device control is on, all devices that are connected to the computer are visible on the device page under Connected devices on the Environment > Devices page
6. Scroll down to the Device access rules table and on the USB Mass Storage Devices row, click on the Access to device column and set it as Block 
7. Scroll up to the Device filtering rules table and click Add rule and add the Instance ID of the USB storage device you want to allow. 
   1. You can run with Powershell Get-PnpDevice -class USB | Select name, InstanceID, HardwareID command to get the necessary IDs what you can allow.
8. Click Save profile

If you only want to block write or executable access for USB mass storage devices, in the Removable mass storage devices section in the profile settings you can turn off one of the following options:

• Allow write access – when this option is off, users cannot copy files to a removable mass storage device. Removable mass storage devices can only read data.
• Allow executables to run – when this option is off, executing files from removable mass storage devices is prevented.

Note: For USB devices, Device ID can also be viewed with the Windows Device Manager:

Device Manager > Disk Drives > USB partition

The reason for checking USB partition because is when you insert USB device into a PC it is not necessarily detected as as a single device in Windows, because of the possibility of partitions. So, if some flash drive has several partitions on it, it will be detected as both "USB Mass Storage Device", with every partition presented as a separate 'device' under Disk Drive. This is reflected in Policy Manager alerts and Elements Security Events. 

For Business Suite Client Security and Server Security:

To block USB mass storage devices:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Go to the Windows > Device control settings page
5. Enable Device Control by checking the box for Device control enabled
6. Scroll down to the Device access rules table 
7. In the USB Mass Storage Devices row, change the Access level column to be Blocked

To allow a specific USB device:

1. Click Add on the right side of the Device access rules table
2. Set the rule as Active
3. Enter a Display name for the rule
4. Enter the InstanceID of the USB device to the Hardware ID column
   1. You can run with Powershell Get-PnpDevice -class USB | Select name, InstanceID, HardwareID to get the necessary IDs.
5. Set the Access level for the rule to be Full access
6. Distribute the policy (Ctrl+D)

Devices can also report device IDs to the Policy Manager:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Go to the Windows > Device control settings page
5. Enable Report installed devices 
6. Distribute the policy (Ctrl+D)

Now when you select the specific host from the policy domain tree, you can click on the View devices link in the Windows > Device control settings page to view a list of devices. 

Issue:

Unable to change the settings in an Elements EPP for Computers or Elements EPP for Servers profile in the Elements Endpoint Protection Portal due to the "save profile" button being grayed out.

Resolution:

The profile editor includes extra validation checks to make sure all settings are complete and correct.

If any required fields are incomplete or incorrectly configured, they will be highlighted in red or orange.

To solve the issue:

1. Go through all sections of the profile.

2. Look for fields marked with red or orange borders.

3. Correct or complete those fields.

Once everything is filled in correctly, the "Save profile" button will become active, and you’ll be able to save the changes.

Issue:

1. When trying to create a new Elements administrator user account, the management portal gives the error message informing that email address is already in use even though the account is not listed on the Security Administrators or Endpoint Protection Accounts tabs in the Elements portal's Management > Organization Settings page. User has had a Elements administrator user account before but it has been deleted or removed
2. The user was added to another company account before this. When I try to add the user to a new company account, I receive the error "User cannot have EPP access to this organization". However, I need to allow this user to access more than one account. How can I achieve this?

Resolution:

You can create a user account using a sub-addressed email format, such as:
firstname.lastname+tag@domain.com

Anything added after the “+” sign is ignored by most email systems, so the message will still be delivered to firstname.lastname@domain.com. This can be useful for testing or organizing user accounts.

Alternatively, in case you prefer to remove the account completely, you can open a support ticket to have the account completely removed so that you can re-create it.

Issue:

How to uninstall WithSecure Server Security  from a Windows Server using the Uninstallation Tool?

Resolution:

If you cannot uninstall WithSecure Server Security from the program and features, you can uninstall it using the WithSecure Uninstallation Tool. Which uninstallation tool you should use depends on the WithSecure Server Security version that is installed on the Windows server. 

Note: If you have WithSecure Email and Server Security installed on the server, do not use the Uninstallation Tool since a removal can cause issues with the email flow. 

Note: If you have F-Secure Policy Manager Server installed on the same server, running the UninstallationTool.exe will remove it.  

WithSecure Server Security 12.x:

1. Download this uninstallation tool: https://download.f-secure.com/support/tools/uitool/UninstallationTool.exe
2. Open the Command Prompt
3. Navigate to the folder where you have stored the tool
4. Run the following command: UninstallationTool.exe -a –server

WithSecure Server Security 14.x, 15.x, 16.x: 

1. Download this uninstallation tool: https://download.withsecure.com/uninstallationtool/WsUninstallationTool.exe
2. Run the uninstallation tool
3. Follow the on-screen instructions

This tool can be ran silently using the command prompt and adding the parameter –silent

There is a readme in following link 
download.withsecure.com/uninstallationtool/readme.txt 

Issue:

RDP connections for computers are being blocked by WithSecure Elements Endpoint Protection (EPP) firewall.

Resolution:

The default WithSecure Office (open) firewall rules blocks RDP connection. If you have a current profile where Firewall rule allows RDP access, select the list of devices and assign the profile accordingly. If you do not have an existing profile, create a new profile in WithSecure Elements portal profiles and create a new firewall rule manually to allow RDP connection.

• Steps to create a new profile can be found here
• Go here for steps creating a new Firewall rule in a profile

If creating a firewall rule to allow RDP access does not fix the issue, make sure that the Block all inbound connections setting is not enabled in the firewall profile. This setting would block all inbound connections even if there is a specific firewall rule in place.