Issue:

When an Elements Endpoint Protection scheduled scanning task is missed, for example if computer is in sleep mode or turned off / shut down, will the task start immediately when device is turned on?

Resolution:

If you create a Scheduled scan for malware Automated task in the Elements Endpoint Protection profile, you can set the task to Never skip if the previous start time has been missed.

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to modify
4. Go to the Automated tasks settings page
5. Click Add task
6. Select Scheduled scan for malware from the Type drop-down menu
7. Use CRON expressions in the Schedule column to set the task start time
8. Enable Never skip toggle from the Never skip column
9. Click Save profile

Note: The Scheduled scanning setting on the Manual scanning settings page in the profile does not support any kind of Never skip setting. If a scheduled scan is missed when using the Manual scanning – Scheduled scanning setting, then the scan will start the next scheduled time. 

Issue:

We have Elements Agent installed on our devices with an Elements Endpoint Protection (Elements EPP for Computers or Servers) subscription. How can we from the Elements Security Center portal encrypt the system drive / disk? 

Resolution:

Turning drive encryption on or off is an advanced security feature that comes with the WithSecure Elements EPP for Computers Premium and the WithSecure Elements EPP for Servers Premium subscriptions.

Issue:

When exporting the self signed / self-generated certificate from the Elements Connector key store, I receive the error: 

• keytool error: java.lang.Exception: Keystore file does not exist: /var/opt/f-secure/fspms/data/​fspms-ca.jks

Resolution:

Issue:

Error message "WithSecure Linux Security 64 has already been activated" is shown during installation and activation of Elements Linux Protection (Elements EPP for Servers). What can cause this error to be shown during Elements Linux Protection activation? 
 

Resolution:

The message means that the Linux device already has a previous installation of Linux Security 64 on it. 

You need to uninstall Linux Security 64 from the device before you can install Elements Linux Protection on it.

To uninstall Linux Security 64: 

1. 1. Log in to the Linux host as root.
2. 2. Run the uninstallation command:

• RHEL-based distributions: rpm -e linuxsecurity-installer
• Debian-based distributions: dpkg -r linuxsecurity-installer

If the package removal command fails and Policy Manager Server is not installed on the same machine, run the following command: rm -rf /opt/f-secure /etc/opt/f-secure /var/opt/f-secure. This command removes the remaining files or systemd services if any. Finally, restart the system to make sure that all hanging services and processes are run down.

If you have installed Policy Manager Server on the same machine, do not delete the folders in full; instead, run the following commands to remove the necessary subfolders:

• rm -rf /etc/opt/f-secure/baseguard
• rm -rf /etc/opt/f-secure/fsbg
• rm -rf /etc/opt/f-secure/linuxsecurity
• rm -rf /opt/f-secure/baseguard
• rm -rf /opt/f-secure/fsbg
• rm -rf /opt/f-secure/linuxsecurity
• rm -rf /var/opt/f-secure/baseguard
• rm -rf /var/opt/f-secure/fsbg
• rm -rf /var/opt/f-secure/linuxsecurity

The uninstall command does not remove configuration files or log files that the product has generated. Check the product directories for remaining files and remove them if you are sure that you do not need them anymore.

Issue:

Subscription key expiration is shown as "Continuous" on the Elements Security Center portal's Management > Subscriptions page. What does it mean?
 

Resolution:

When the expiration date for an Elements subscription is shown as "Continuous" on the Elements Security Center portal's Management > Subscriptions page, it means that you have a subscription that is paid for monthly and it has no defined expiration date. The subscription needs to be explicitly manually terminated by the WithSecure reseller partner in case you want to cancel the subscription. 

This subscription type is also called "Evergreen" is the WithSecure Partner Portal, which partners use to sell WithSecure subscriptions.

WithSecure also offers Renewable type subscriptions for Elements products, which can be bought for a license period of 12, 24 or 36 months. That type of subscription has a defined expiration date and needs to be renewed by the WithSecure partner at the end of the license period. 

Issue:

We would like to only have users with a specific IP address range to be able to access our company account / organization in the Elements Security Center portal. Is is possible to limit the access to the Elements portal based on the IP address? 

Resolution:

It is not possible to restrict the access to an Elements organization based on the IP address. The Elements Security Center portal has enforced two-factor authentication as a security feature.  
 

Issue:

Does Elements Agent support usage of MacOS Migration Assistant to move installation to a new device? 

Resolution:

WithSecure Elements Agent for Mac doesn't support the use of Apple's Migration Assistant application. If an existing Elements Agent installation is synchronized from old laptop to new, it will most likely break because both the old and new devices would have the same Unique ID (UUID), therefore the Elements portal would recognize them as the one and the same device and only one would be visible in the Elements portal. 

Both software can cause also other issues with the Elements Agent installation. We therefore recommend to uninstall Elements Agent using the WithSecure uninstallation tool for Mac and to reinstall Elements Agent if you encounter any issues after using any of these Apple features. 

Issue:

If an Elements device was removed from the Elements Security Center portal's Environment > Devices page by the "Manage automatic deletion" feature, will the device return to the portal using the same license and Unique ID (UUID) if the device becomes active again?

Resolution:

If a device that was removed from the Elements portal by the Manage automatic deletion feature becomes active again, it will return to the same subscription key that it was assigned to and it will have the same Unique ID (UUID).

If the subscription key is full, the device will reappear in the Elements Security Center portal once there are available licenses on the subscription key. 

Issue:

How to change the default profile that is taken into use after installing Elements Endpoint Protection Agent (Elements EPP for Computers or Servers) or automate profile selection with Active Directory?

Resolution:

To change the default profile for Elements Endpoint Protection devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Go to the Profile assignment rules tab
4. In the Profile assignment rules table, in the Default rules section, click on the three dots on the right side of the client type for which you want to change the default profile
5. Select Edit
6. Select the profile from the Assign profile drop-down menu 
7. Click Save

On the Elements Security Center portal's Profile assignment rules tab you can enable Change tracking if you want to continuously evaluate rules for the devices, and change the profile and label assignments for each device when changes in the Active Directory Organizational Unit, IP, reverse DNS, WINS name or asset groups are detected.

To create a custom rule so that a device is assigned an Elements profile automatically based on its AD Organizational Unit path:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Go to the Profile assignment rules tab
4. In the Profile assignment rules section, click Add Custom rule
5. Select from the Condition drop-down menu either:
   1. Enter AD Organizational Unit path
   2. Select AD Organizational Unit path
6. Enter or select the AD Organizational Unit path
7. Select the client type:
   1. Windows workstations
   2. Windows servers
   3. Mac computers
8. Assigning asset group and labels is optional 
9. Click Add rule

Now the devices will be automatically assigned a profile based on their AD Organizational Unit path. 

Issue:

How to remove duplicate Elements EPP for Computers or EPP for Servers device from the Elements Security Center portal's Environment > Devices page?  

Resolution:

Unless you have the Manage automatic deletion feature set up, a device will not be automatically removed from the Elements Security Center Portal's Environment > Devices list even if it is a duplicate and there is an extended period of inactivity. Each duplicate inactive device needs to be removed manually and each device listed on the Devices page uses one license. 

To best view which duplicate device is the one no longer connected to the ElementsSecurity Center Portal, you can follow these steps:

1. Login to the Elements Endpoint Protection Portal
2. Go to the Environment > Devices page
3. Sort the devices according to Device name and determine from the Registration date and Status updated columns which is the device no longer connected to the Elements Security Center Portal
4. Select the duplicate device (a menu will pop-up)
5. Click Remove device 

Once the device has been removed, the license is released and can be used on another device. 

You can use the Manage automatic deletion feature to remove inactive devices automatically from the Elements portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. Click on the three dots and select Manage automatic deletion
4.  Enable Automatically delete devices that are offline for the selected period of time 
5. Enter the amount of days
6. Click Save

Devices which have been automatically deleted will be able to reappear on the Elements portal's Devices page if the device becomes active again and Elements Agent is still installed on the device.