Issue:

When creating a firewall rules to Windows Defender firewall with the Elements Endpoint Protection profile's firewall feature, the firewall rule doesn't work if a Windows User environment variable is used in the application path field.

For example, the firewall rule doesn't work when trying to use %LOCALAPPDATA% %HOMEPATH% %TEMP% %USERPROFILE% %OneDrive% in the application path field. 

Resolution:

Issue:

Admin would like to receive an email alert or notification when Elements Endpoint Protection Malware Protection feature has been disabled on a device for any reason. 

Resolution:

To receive a daily email report if any Elements devices have their Malware Protection disabled, you need to first create a custom view on the Elements Security Center portal's Environment > Devices page and then use that custom view as the data source for an email notification and report. 

How to create a custom view that lists all the devices which do not have malware protection enabled:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. From the View drop-down menu, select the Overall status view
4. Click Select field from the filter creator (top-left corner of table) and create the following filter:
   1. Malware Protection – Not equals – Enabled 
5. Click Apply

Then you need to save the new view and set it as an organization view so that it can be selected as a data source in an email notification and report:

1. Open the View drop-down menu in top-right corner 
2. Click Save as…
3. Enter a name 
4. Click Save
5. Open the View drop-down menu again
6. Click on the three dots on the right side of the newly saved view 
7. Click Copy to organization views

Now you can create an email notification and report using this view as a data source:

1. Go to the Reports > Email notification and report page
2. Click Add email report
3. Enter name and select Data source = Devices
4. From the Template drop-down, select the custom view which you just created
5. In the Schedule section, select Frequency as Daily 
6. Select the time
7. Enable Send only when report has content so that an empty report is not sent
8. Click Save

Issue:

How to make a custom view in the Environment > Devices page in the Elements Security Center portal? I want the Devices view always to open by default with the specific filters and info columns. The view should also be remembered when the browser window / tab is refreshed. 

Resolution:

You can create custom views with pre-defined filters and informational columns by following the steps below. 

Here is how you add, remove and sort informational columns: 

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Environment > Devices page in the Elements portal
3. Click on the three vertical lines on the top-right corner of the devices table and select the columns you want to have in your view from the Available columns section. Any selected columns will be added to the Visible columns section.
   1. Note: You can also drag the column names up and down in the Visible columns section. 

Here is how you add filters:

1. Click Clear all filters to remove currently selected filters
2. Open the Select field drop-down menu from the top-left corner of the devices table
3. Select the filter
4. Then select either Equals or Not equals 
5. Finally select the value and Click Apply
   1. Note: You can add several filters 

After you have the informational columns and filters to your liking, you can save the current view as the default custom view so that it will always show this view then you enter the Devices page:

1. Open the View drop-down menu in the top-right corner
2. Click Save as…
3. Enter a name for the view
4. Toggle Set as default 
5. Click Save

Note that when you create a view, it is by default a personal view for you and it wont be visible for other users. If you are a partner user, this view will be available for you under all customer organizations. 

If you wish to make the view visible to all users in your organization, you can follow these steps:

1. Open the Views drop-down menu
2. Hover your mouse on top of the view and click on the three dots
3. Select Move to organization views 

Issue:

Microsoft Windows DirectAccess connection disconnects / cuts off / drops intermittently when Elements Endpoint Protection firewall profile is enabled.
 

Resolution:

If you are using WithSecure firewall profile, it will by default block unknown outbound connections, so you will need to make sure that you have all the required firewall rules in place if you want to have the DirectAccess connection working. 

Please follow this Microsoft guide regarding Direct Access firewall rules: Step 1 Plan the Advanced DirectAccess Infrastructure | Microsoft Learn

Note that if you use GPO to configure the Windows Firewall, in most cases it is best to turn off the WithSecure firewall profiles to avoid conflicts, since GPO firewall rules will always override any WithSecure created firewall rules. To turn off the WithSecure firewall profile:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the Firewall settings page
5. In the Global setting section, from the WithSecure firewall mode drop-down menu, select Do nothing
6. Click Save profile

Issue:

After opening a banking website, other services or websites are being blocked when Elements Endpoint Protection Connection Control feature is active. How to allow a site so that is can be accessed when Connection Control is active? How to find out the blocked URL is no "block page" is shown to the user? 

Resolution:

The behavior is expected if a Connection Control has been triggered prior opening the websites. Connection Control is also known as "Banking Protection". It is the feature which activates when a user enters a banking site. When Connection Control is active, the browser only allows the user to visit trusted websites. 

The Connection Control will block access to other URL and in order for users to continue to other websites, the address needs to be added as trusted. A local user can from the Elements Agent local settings add the blocked website as trusted if the user has local admin rights and it has been allowed from the Elements profile.

An Elements portal administrator can add the website as trusted. You can add the website URL address to the allowed sites list in the profile used be the devices by following these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Open the Security Configurations section from the menu on the left
3. Go to the Profiles page
4. Click on the profile you want to edit
5. Go to the Browsing Protection settings page
6. Scroll down to the Web site exceptions section and enable it
7. In the Allowed sites section, click Add sites
8. Enter the site address which you want to allow
9. Click Save profile

Once the profile has been saved and published, all devices using the profile will be able to go to the allowed site even if Connection Control is activated.

If the access to a website or service is blocked by Connection Control in a way that no block page is shown to the user telling which URL was blocked, the easiest way to identify the blocked address is to create a test profile with the “Include the blocked URLs in all security events” setting enabled, so that the blocked address is shown on the Events > Security Events page in the Elements portal.

Then assign this profile to one device and reproduce the issue on that device. You can then check the blocked address on the Events > Security Events page in the Elements portal.

Here is how you can clone your current profile and modify it so that the clone has “Include the blocked URLs in all security events” enabled:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the three dots on the right side of your current profile and select Clone
4. Go to the Browsing protection settings page
5. In Common settings, enable Include the blocked URLs in all security events
6. Click Clone profile

Note: Make sure that your current exception rules are retained in the clone.

Now the profile can be assigned to the device on which the issue will be reproduced:

1. Navigate to the Environment > Devices page
2. Select the device (a menu will appear)
3. Click Assign profile and select the cloned profile

Now that the device is using the cloned profile with the include URLs setting enabled, you can reproduce the issue on the test device.

After that, you can check the alerts for that device on the Events > Security Events page in the Elements portal, where the source is Connection Control. Check the address of the blocked page and create an exception rule for it in the Allowed sites list, found on the profile’s Browsing protection page.

Another workaround for the local user is to simply deactivate the Connection Control immediately after it has been activated after going to a bank page. The local user can to this by either closing the banking website first or to end the Connection Control session (green border / frames around the screen with check mark sign at the top of the screen).

Note: The is no setting to stop Connection Control from triggering on a web site that has been marked as a banking page. 

Issue:

How to update WithSecure Business User Account (administrator) username or email address in the Elements Security Center portal?

Resolution:

A user can change their own WithSecure Business Account email address using the Elements Security Center portal:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Click on the user icon in the top right corner
3. Select My settings 
4. Click the Change email button 
5. Edit the email address and click Save ​​​​​​​
   • Note: Your username is automatically made to match your email address. If currently your email address is already correct while your username isn't, you can temporarily change to a firstname.lastname+whatever@domain.com address and then change back to your correct firstname.lastname@domain.com address, so that you get your username and email address to match.

Note: If you are a Partner Portal user or eService portal user, your access rights to these portals' are tied to the email address, so changing your email address can lead to losing access to these portals.

If you are a partner, open a support request through the Partner Portal to have the email address changed. If you are a customer with eService portal access, open a support request through the eService portal. 

Issue:

Can I install Elements Endpoint Protection Agent (EPP for Computers or EPP for Servers) in an isolated environment where the only access to the internet is via a proxy server?

Proxy information is defined in the Endpoint Protection profile but the installer needs to be able to reach the portal to get it first, which prevents installations from within the isolated environment. How to configure the proxy already during installation of Elements Agent?

Resolution:

The Elements Agent installer can be run with the additional parameter –proxy to give the installer the proxy information without the need to fetch profile information from the Elements Endpoint Protection portal.

Example:
ElementsAgentinstaller.exe –proxy http://proxy.address:1234

More information found here: Command-line parameters | Elements Endpoint Protection | Latest | WithSecure User Guides 

Alternatively, you can use FsMsiTool to create a MSI installer with proxy server address included: Use the WithSecure MSI transformation tool | Elements Endpoint Protection | Latest | WithSecure User Guides 

If the isolated environment has no channel to the internet at all, installation of Elements security products will not be possible, since the Elements Agent needs to be able to connect to the Elements portal for license registration. 

Issue:

Why does Elements Endpoint Protection Application Control  feature not block an application, even if Global rule is set as "Block all untrusted applications". 

How to know which applications are allowed by the Application Control feature when Global rule is set as "Block all untrusted applications"

Resolution:

In case you set the Elements Endpoint Protection Application Control Global rule is to "Block all untrusted applications", Application Control will allow applications to run if they:

• Are running from SYSTEM account
• Have a target prevalence greater than 40 and reputation less than 9
• Application is a known clean application and trusted signed application
• Application has an explicit allow rule created for it

Here is an explanation of the target prevalence and reputation values:

Reputation properties

Prevalence property

We recommend to change the Global rule  to "Allow and monitor all applications" to monitor the situation at first, and slowly creating new Application Control rule(s) to allow the application running in your environment.

Issue:

Mac device missing from Elements portal after using Apple Time Machine or Migration Assistant. 

Resolution:

WithSecure Elements Agent for Mac doesn't support the use of Apple's Time Machine feature or Migration Assistant application. If an existing Elements Agent installation is synchronized from old laptop to new, it will most likely break because both the old and new devices would have the same Unique ID (UUID), therefore the Elements portal would recognize them as the one and the same device and only one would be visible in the Elements portal. 

Both software can cause also other issues with the Elements Agent installation. We therefore recommend to uninstall Elements Agent using the WithSecure uninstallation tool for Mac and to reinstall Elements Agent if you encounter any issues after using any of these Apple features. 

Issue:

How to prevent a local administrator from stopping the services or processes of Elements Agent (EPP for Computers or EPP for Servers) so that the security features cannot be turned off? 

Resolution:

WithSecure Elements Endpoint Protection products include the Tamper protection feature that is enabled by default. The Tamper Protection feature will prevent local users from stopping WithSecure services or from modifying the files of the WithSecure software.

It will also protect the WithSecure processes and files from other application what might try to stop the services or modify the files.

How to enable Tamper Protection feature for Elements Agent: 

1. Log in to the Elements Security Center Portal 
2. Go to the Security configurations > Profiles page
3. Click on the profile you want to edit
4. Go to the Scanning settings page
5. Scroll down to the Tamper protection section
6. Enable Turn on Tamper Protection
7. Click Save profile