Issue:

How to install WithSecure Elements Agent (EPP for computers or Servers) to a custom or non-default directory path and how to change the location of the Elements Agent installation for example to another drive than C: or D: drive or to another partition?
 

Resolution:

You can download the MSI installation-package from the Elements Security Center's Management > Downloads page and use the TARGETDIR parameter.

Example: msiexec /i C:\path\to\installer.msi /qn VOUCHER=aaaa-bbbb-cccc-dddd-eeee TARGETDIR="D:\installfolder"

Issue:

How to create a specific CRON expression for Elements Endpoint Protection Automated Tasks feature. I what format should the CRON expression be in the schedule field? 

Resolution:

Below you will find a detailed explanation of the format of schedule expressions. A CRON expression is a string composed of four fields (separated by white spaces) that represent a time schedule.

The general form is as follows:
<hours> <days of month> <months> <days of week>

Important: The same task cannot be executed more than once an hour, even if the task is specified to run more often.Use randomization (#) to prevent overloading the network.The accuracy of the task execution is always rounded up to an hour.

Issue:

We have noticed that the the profile on some Elements Endpoint Protection devices has changed to another profile. What can cause the device to get another profile assigned to it automatically? 

Resolution:

If one or more Elements devices has been automatically assigned a profile, check if you have create Profile assignment rules and that the rules and conditions are created correctly. 

You can access the profile assignment rules by following these steps:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Go to the Provide assignment rules tab

On this page you can find the Profile assignment rules section which includes rules about which profile should be automatically assigned to each type of device based on specific conditions. The conditions include:

• AD Organizational Unit path
• IPv4
• DNS
• Host name

So if you have a profile assignment rule that uses one of the mentioned conditions and that value on the device has changed, it can cause the profile assignment rule to automatically assign a different profile to a the device. 

Issue:

After clicking Export security events (JSON) on the Elements Security Center portal's Events > Security Events page, the .json file is never downloaded.  

I only received the notification: "Your data is being prepared for export, which may take a few minutes. Then the download will begin automatically." 

Resolution:

When the .json file is successfully downloaded, it should the following two notifications after the "Your data is being prepared for export" notification:

• The export data has been successfully prepared. Downloading is starting.
• JSON file has been successfully downloaded. This file can be used for importing into MS Excel

If you do not receive these two notifications at the bottom of the screen, we recommend to first try to create a smaller .json file to export. The current maximum amount of events one export can include is around 10,000. We recommend to break the export to for example smaller time ranges. 

When you click on the Export security Events (JSON) button, it will try to prepare and download a .json that includes all the security events based on the current filters chosen on the Events > Security Events page. Try to modify the filters so that there are fewer events in one export. 

If issue would persist even if you fewer events per export, try to use an incognito / inprivate browser window or other browser altogether to see if that fixes the issue. 

Issue:

When I'm logging into the Elements Security Center portal, I get the following prompt:

• "Verify Your Identity – Check your preferred one-time password application for a code. "

What is this code that the Elements portal is asking for and where can I find it. 

Resolution:

The one-time password that the Elements Security Center portal is asking is the two-factor authentication (2FA) / multi-factor authentication (MFA) code. The 6 digit verification code can be found in the authenticator application on your mobile device. When you took the feature into use, you were able to choose yourself the authenticator application you wanted to use. 

Most popular authenticator applications are:

• Google Authenticator
• Microsoft Authenticator

There should be a WithSecure entry in the application that shows a 6 digit code that changes every 30 seconds. 

If you are unable to find the code:

• If you are an end-customer: Ask one of your colleagues to delete your administrator account from the Elements Security Center portal's Management > Organization settings > Security Administrators page. Then your colleague can add your adminstrator account again so that you will receive a new welcome email from which you can start over. If you do not have a colleague who can delete and re-create your account and you have a Partner Managed subscription, ask your WithSecure reseller partner to delete and re-create your user account.
• If you are a WithSecure partner with Partner Portal access rights on your user account, one of your colleagues must create a support request through the Partner Portal to have the user account deleted. If you do not have colleagues, contact your WithSecure sales contact. 

Issue:

How does Elements Mobile Protection license usage work on Android devices which have separate work and personal profiles? Will Elements Mobile Protection installed in the work profile protect the personal profiles configured on the Android device? 

Resolution:

Elements Mobile Protection is the mobile app accompanied with WithSecure Elements Endpoint Protection (EPP). With EPP, Mobile Protection is designed to complement and be deployed via third-party Mobile Device Management solutions.

Many of these MDM solutions are also designed to work with the Android Enterprise platform. The Android Enterprise platform offers a way of keeping work apps and data separate from personal apps and data by creating separate profiles, see this article. Profiles never share data, so this enables companies to manage their work apps and data without compromising employee privacy.

Companies may use different ways of managing their mobile fleets. For example, companies may allow the use of one's own device (BYOD=Bring Your Own Device) and deploy a work profile on that, or companies may offer fully-managed, company-owned devices intended exclusively for work purposes.

As Mobile Protection is an app offered as an enterprise solution, WithSecure cannot know which type of management solution the company offers. If Mobile Protection is installed on a device with both a work and personal profile in use, Mobile Protection is not able to protect any apps or data on the device's personal profile. This is due the design of the Android Enterprise Platform and how the division between work and personal profiles is managed.

If company offers fully-managed company-owned devices, this means that Mobile Protection can be installed and enabled using an enterprise license without the need to buy a separate license. 

Issue:

When trying to release an item from quarantine or allow a blocked app / file, Elements Endpoint Protection Agent – App and file control shows the following notification and asks for a password: 

"This app can harm your computer. Do you want to restore this app to its original location and let it run? The app is exempt from future malware scans."

What is the password I need to enter? 

Resolution:

The password is the password your administrator has set in the Elements Endpoint Protection profile as the Password for releasing blocked or quarantined items 

The password cannot be viewed from the profile, since it will only show an asterisk. If you have forgotten the password, you can change it by following these steps: 

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile which is in use on the devices
4. Go to the Scanning settings page
5. Scroll down to the Quarantine section
6. Enter a new password to the Password for releasing blocked or quarantined items (optional) field
7. Click Save profile

Issue:

As a customer, we do not want the solution provider partner or service provider partner to be able to manage our Elements Exposure Management related devices and services. How can we restrict partner access to our Elements Exposure Management organization? How to isolate our organization from the partner? 

Resolution:

A customer company can restrict partner access to their Elements Exposure Management and Elements Collaboration Protection related affairs by following these steps:

1. Log in to the Elements Security Center portal
2. Navigate to the Management > Organization Settings > General page
3. Click on Access policies in the Organization information section
4. Enable Restrict Partner access 
5. Click Save

When Restrict Partner Access is enabled, the partner cannot access any pages in your organization that are related to Elements Exposure Management or Elements Collaboration Protection. 

Note that his feature is only available for Elements Exposure Management and Elements Collaboration Protection. If you have a partner managed subscription for Elements Endpoint Protection or Elements Endpoint Detection and Response, the partner will still be able to access those products in your organization. 

Issue:

When looking a security event on the Elements Security Center portal's Events > Security Events page, the Website URL address is not visible when the alert source is either:

• Browsing Protection
• Web Content Control 
• Connection Control 

Why is the website URL address not listed or shown in the security event? How can I find out what address was blocked?  

Resolution:

By default the website URL address is only shown in the security event if the website URL address has been blocked due to it being rated either harmful (malicious), suspicious or prohibited. This is due to regional privacy laws. 

This means that since if a website is blocked due to any of the following reasons, the website's URL address is not included in the security event alert:

• When the website has been blocked due to it being on the manually added Denied sites list
• When the website has been blocked due to the site being included in a blocked Web Content Control category 
• When a website has been blocked due to Connection Control being active when a user has entered a banking site and the site they are trying to access is not rated as safe for banking

Note that in each of these scenarios, the blocked website URLs are not inherently malicious or harmful. 

If you wish to show the website URL address in all security events, you can change the following setting in the Elements profile that is in use on the devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the devices
4. Navigate to the Browsing protection settings page
5. In the Common settings section, enable Include the blocked URLs in all security Events 
6. Click Save profile

Note that you need to make sure to check and follow regional laws before turning on this feature or that you have asked the permission from the users. 

Issue:

Elements Agent installation with ElementsAgentOfflineInstaller.msi using GPO fails with error "Conflicting Oneclient Product already installed"

Resolution:

Make sure a previous installation of WithSecure Elements Agent or other WithSecure product is not already installed when you run the installer.

The ElementsAgentOfflineInstaller.MSI installer does not include sidegrade, so it does not have any way of uninstalling any conflicting products. If there are conflicting products already installed on the devices, they need to be uninstalled first.