Issue:

• User wants to move already existing Elements Agent (EPP for Computers or for Servers) installations from one Elements company account to another
• How to change the subscription key that is in use in the Elements Agent locally so that the devices would move to another Elements company account?
• I have setup the Elements Agent on a device using an incorrect subscription key and this device is showing up under the Devices view in the incorrect customer account now. How can I move this device back to the correct customer account?

Resolution:

If the Elements Company account is in the same Elements portal (EMEA1, EMEA2, APAC, AMER, SMIEU), you can use the Change subscription feature to change the subscription key of a device:

1. Login to the Elements Endpoint Protection Portal with your Solution Provider user account
2. Select the Solution Provider level from the scope-selector
3. Go to the Environment > Devices page
4. Filter the devices with the Company name filter
5. Select the device(s) to be transferred (a menu will appear)
6. Click on Change Subscription
7. Select from the available subscription keys and click on Change Subscription again

Note: Switching to a different Company can only be done on SOP level. If performed on company level, the function "Change Subscription" can be used to change a device's subscription key internally within the company

If the Elements Company accounts are in a different Elements portals, you can use the local ws_onclient_logout tool to change the subscription key and the portal the device is connected to. The ws_oneclient_logout tool allows you to log out from the Elements Agent, so that you can re-enter the subscription key to connect a device to the correct company in the Elements Endpoint Protection management portal. This command-line tool removes the current subscription from the Elements Agent and returns the software to its initial state, before a subscription key was used. The tool can be found and run from the Elements Agent installation folder:

1. Open a command prompt with administrator privileges
2. Navigate to the Elements Agent installation folder: %ProgramFiles(x86)%\F-Secure\PSB
3. Run the tool in the command prompt:

• To log out and register to WithSecure Elements Endpoint Protection Portal automatically, run \ws_oneclient_logout.exe –keycode <subscription-key> . Elements Agent will log out and start using the subscription key that you entered immediately.
• To remove the current subscription key, run \ws_oneclient_logout.exe –nokeycode. Elements Agent will stop working and asks you to enter a new subscription key manually when you open the main view of the application.
• You can switch registered clients between the different Elements portals by specifying one more command line parameter based on the portal name, for example, “–psb1”, “–psb2”, “–psb3”, “–psb4”, “–psbsmieu”. Do not use these parameters if you are not moving clients between portals. 

If the tool runs successfully, it returns 0 as the result. In other cases, for example if the network is unavailable or you enter an incorrect subscription key, Elements Agent will stay in the "expired" state and asks you enter the new subscription key manually.

Issue:

How to migrate Business Suite Server Security to Elements EPP for Servers for Windows using Policy Manager?
Does the server need to be restarted to finish the migration? 
how to migrate computers from WithSecure Client Security to WithSecure Elements EPP for Computers and from Server Security to WithSecure Elements EPP for Servers

Resolution:

Instructions on migrating computers from WithSecure Client Security to WithSecure Elements EPP for Computers and from Server Security to WithSecure Elements EPP for Servers for Windows can be found in our help guide, accessible here: Migrating computers | Elements Endpoint Protection | Latest | WithSecure User Guides

The migration may require the server to be restarted to finish the installation, so perform the migration during a time when the server can be restarted. 

Issue:

How to transfer or move an Elements Endpoint Protection (EPP for Computers or EPP for Servers) subscription from an old device to a new device? 

Resolution:

To transfer a license from an old device to a new device, you will need to remove the old device from the Elements Endpoint Protection portal to release the license. After releasing the license, you can install the product on the new device. 

Follow the steps below to transfer an Elements Endpoint Protection license from an old device to a new device: 

1. Log in to Elements Security Center: https://elements.withsecure.com
2. Expand the Environment category on the left pane
3. Click on Devices page.
4. Select the old device by selecting it from the list (an actions menu will appear)
5. Click Remove device > Remove device

After the old device has been removed from the Devices list, install Elements Agent on a new device by downloading the installer from the Management > Downloads page.

Issue:

How to remove an Elements EPP for Computers or EPP for Servers device in the Elements Security Center? How to release a license? 

Resolution:

You can remove devices from the Elements Security Center by following the steps below. Once a device has been removed from the Elements Security Center, the license it was using can be used on another device. 

Note: Removing a device from the Endpoint Security Center's Devices page does not uninstall Elements Agent from the device. If you want to uninstall Elements Agent remotely and at the same time release the license, you can follow the instructions at the end of this article.

How to remove a device and blocks the device to register back:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Select Environment
3. Go to the Devices page 
4. Click on the white box on the left side of the device name, a menu will pop-up from the bottom
5. Click on the Remove device button
   • Leave the "Block device from returning" checkbox empty if you plan to reinstall Elements Agent to the device
   • Tick the "Block device from returning" checkbox if you don't want the device to be able to reconnect to the portal
6. Click Remove device

If you have ticked the "Block device from returning"  and want to re-install Elements Agent on that device, you will need to restore the device from the block list.

To restore devices from block list:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Select Environment
3. Go to the Devices page
4. Click on the three dots on the right side of the Devices title
5. Click Manage removed devices
6. Click on the three dots on the right side of the device that has Device State as blocked 
7. Click Activate device

How to remotely uninstall Elements Agent:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Select Environment
3. Go to the Devices page 
4. Select the device (a menu will appear from the bottom of the page)
5. Click Uninstall > Uninstall device

Note: Remote uninstall operation is only available for Windows devices 

Once the operation has gone through, Elements Agent will be uninstalled from the device and the device will be automatically removed from the Devices page and the license will be released. 

Issue:

How to create or add an Elements Endpoint Protection Application Control exclusion rule if an application has been blocked for example by a default rule.  

Resolution:

If an application has been blocked by an Application Control rule, you need to first check the block details from the Elements Endpoint Protection portal's Security Events page so that you can create an exclusion based on that information. How to view detection details:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Events > Security Events page

You can filter the Security Events page to only show Application Control events by adding a "Source equals Application control" filter. 

Open the Application Control block details by clicking the blue downwards arrow on the left side of the detection to view all the details. You can copy paste the details to a text editor to use them later when creating the exclusion rule. 

Note: If multiple applications are being blocked by the same application control rule, you need to create separate exclusion rules for each application. Do not add for example several condition paths to several applications in one rule.

How to create the Application control exclusion rule: 

1. Log in to the Elements Endpoint Protection portal
2. Go to the Security Configurations > Profiles page
3. Select the profile which is in use on the devices
4. Go to the Application Control settings page
5. Click Add a new top rule
   • Note: The rules in the table are applied in a priority order: rules are checked from top to bottom. So the exclusion needs to be up top.
6. Add the following:
   • Rule name, example: Exclusion for application x
   • Select the Event type to be the same as shown in the detection 
   • Select as Action Allow 
7. Add a condition. You can from the block details you saved to a text editor check what details need to be used. For example: Target path contains C:\Example\Example.exe
   • Note: If you add multiple conditions, the conditions are based on the AND principle. All conditions must apply for the rule to take effect. When adding multiple conditions, add each condition one by one an test between each added condition.
8. Click Save and publish

Issue:

Importing or exporting JSON file for Elements Endpoint Protection (EPP for Computers or for Servers) Browsing Protection configuration

Resolution:

You can follow the steps below to import or export JSON file in the Elements Endpoint Protection portal for Browsing Protection configuration:

1. Login to Elements Endpoint Protection Portal
2. Go to Profiles
3. Select the used profile 
4. Open Browsing Protection
5. Scroll down to Web Sites Exceptions (Ensure it is enabled)
6. The following steps are applicable for both Allowed sites and Denied sites
7. Select 

Issue:

How to disable Web Traffic Scanning (Advanced Network Protection) for Elements Endpoint Protection (EPP for Computers and EPP for Servers) in the portal?

Resolution:

The Advanced Network Protection feature is called Web Traffic Scanning in the Computer Protection PSB Portal profile. 

You can disable or enable it by following these steps:

1. Log in to the Elements Endpoint Protection Portal 
2. Go to the Profiles page
3. Select the profile you want to edit
4. Go to the Real-time scanning settings 
5. Disable or enable Web traffic scanning

NOTE: To enforce the setting, you will need to lock it. If the setting is not locked, local setting changes override the profile settings.

On the Real-time scanning settings page you will also find the Applications excluded from Web traffic scanning list where you can add a SHA-1 exclusion to exclude a single application from Web traffic scanning.

If it is a browser based application, you can instead exclude the address. This can be done in the Browsing protection settings by first enabling Web site exceptions and then adding the server address to the allowed sites list. 

Issue:

How to exclude a file, folder or application that is incorrectly blocked by Elements Endpoint Protection (EPP for Computers or EPP for Servers) DeepGuard feature?

Resolution:

If a file, that you are sure to be safe, is being blocked by DeepGuard, you can exclude a file or folder from all security measures by following these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Server Configuration > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Note that you can use wildcards when creating the exclusions. For example: C:\Users\*\AppData\Local\test\ 

This would exclude the AppData\Local\test\ folder and all its sub folders for all users.

If you want to locally on the device itself create the exclusion:

1. Open the Elements Agent user interface on the device
2. Go to Settings 
3. Go to the Malware protection settings page
4. Click view quarantine (enter administrator username and password if needed)
5. Select the Excluded tab
6. Click Add new 
7. Add the file path or folder path
8. Click OK

DeepGuard can also be excluded using the SHA-1 of the process:

1. Log in to the Elements Security Center portal 
2. Go to the Events > Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Global exclusions from all security scans list
5. Click Save profile

The SHA-1 can also be added manually to the DeepGuard protection rules. Follow the steps below to manually add an SHA-1 exclusion in DeepGuard:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to add the exclusion to
4. Go to the Real-time scanning page
5. Scroll down to DeepGuard settings
6. Click on Add rule
7. Fill in the SHA1-hash and a note about the application
8. Click Save profile

Note: If DeepGuard is blocking software that you see as trusted, it is recommended to report the executable to WithSecure Labs for potential whitelisting: Submitting a file sample | Welcome to WithSecure Elements | Latest | WithSecure User Guides 

Issue:

How to disable TLS versions 1.0 and 1.1 for Elements Connector?

Resolution:

You may refer the below steps to disable the TLS 1.0 and 1.1 encryption by using Windows registry editor:

1. Run Windows Registry Editor (Regedit) as administrator.
2. Create the following string registry key:
   • For Elements Connector (Windows) \HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\ElementsConnector\additional_java_args
3. Set the value -DenableVistaInteroperability=false
4. Open a Command Prompt as an administrator and run commands "net stop wsconnector" and "net start wsconnector" to restart the services.

After service restart, TLS 1.0 and 1.1 is disabled on Elements Connector.

Issue:

• After installing Elements Agent (EPP for Computers or for Servers), VPN connection stopped working and is blocked by the Windows firewall.
• How to create a custom Elements Endpoint Protection profile to allow the VPN connection?
• Which ports need to be opened to allow PPTP, L2TP and IPSec VPN connection through the firewall?

Resolution:

In this case, you have to start by creating a custom profile that can be edited.

Creating a custom profile:

1. Log in to the Elements Security Center Portal
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the circular symbol with three dots in the middle next to the profile you want to clone
5. Press on the clone profile
6. Enter the name and label of the new custom profile

After creating a custom profile, you can start creating new firewall rules.

Creating a new VPN firewall rule:

1. Select the profile you want to use
2. Go to the Firewall settings page
3. Go to Firewall rules and select add rule
4. Enter a name and description of the rule, e.g Allow VPN

The ports and protocols that need to be allowed vary between each VPN connection type. Verify with your VPN provider the type of VPN connection you are using and which ports to open.

To allow common PPTP VPN traffic:

• Allow PPTP tunnel maintenance traffic, open outbound TCP port 1723
• Allow PPTP tunneled data to pass through the router, open outbound protocol 47 (GRE)

To allow common IPSec VPN traffic:

• Allow Internet Key Exchange (IKE), open UDP port 500 outbound
• Allow IPSec Network Address Translation (NAT-T), open UDP port 4500 outbound
• Allow Encapsulation Security Payload protocol (ESP), open protocol 50 outbound
• Allow Authentication Header protocol (AH), open protocol 51 outbound
• Allow  IP-in-IP Encapsulation, open protocol 4 outbound.

If IPSec IKEv2 VPN connection is not working after creating the above firewall rules, enable Allow unknown outbound connections from the profile and see if it helps. By default Windows firewall has unknown outbound connections allowed, while the WithSecure firewall profile will block them. 

To allow common L2TP VPN traffic: 

• Allow L2TP traffic, open UDP port 1701 outbound
• Allow protocol 115 outbound

Once the firewall rules have been created, the profile needs to be assigned to the target devices. 

Assigning a profile:

1. Go to the Devices page
2. Choose the device(s) to which you want to assign a profile to
3. Click on Assign > Assign profile 
4. Select the profile with the VPN firewall rules and click Assign