Issue:

Is it possible to reset, delete or remove all or some events from the Events > Security Events page in the Elements Security Center Portal?

Resolution:

It is not possible to reset, delete or remove events from the Events > Security Events list in the Elements Security Center portal. The info alerts are stored for 7 days, warning alerts for 6 months and critical alerts for 13 months.

Once the event has been automatically removed from the portal, it cannot be recovered. 

Issue:

How long is the data retention period for Security Events in the Elements Security Center portal? For how long are the security events stored on the Events > Security Events page's list?  

Resolution:

Security Events retention period in Elements Security Center portal depends on the Severity level. The info alerts are stored for 7 days, warning alerts for 6 months and critical alerts for 13 months. 

Issue:

When will a device that is shown on the Elements Security Center portal's Environment > Devices > Manage removed devices  list be automatically removed from the list?

Resolution:

If the Elements Agent is uninstalled, then the device will be removed from portal after 6 months from the date it was uninstalled. 

If the device is manually removed from the portal (but not uninstalled), then the device will be removed from the list after 12 months from the date it was removed.

Issue:

Elements endpoint devices have suddenly disappeared from the Elements Security Center portal's Environment > Devices page and fewer licenses are in use. What might have happened to the devices? 

Resolution:

The most common reason for a visible drop in the endpoint count in the Elements Security Center is the "Manage automatic deletion" feature. If this feature is enabled on the company account, devices that have been offline for longer than the configured threshold are automatically removed from the portal.

You can check the Manage automatic deletion value by following these steps:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. Click on the three dots 
4. Select Manage automatic deletion
5. View the amount shown in the days field
6. Click Save

You can also from the Elements Security Center portal check when devices have been uninstalled or removed from the portal. Navigate to the Environment > Devices > three dots > Manage removed devices page. Here you can from the Device state column check if the reason for the removal was either uninstallation or if it was simply removed. 

From the Management > Audit Log page you can check who has issued the removal operation if it was done manually by an administrator. 

Issue:

Elements Endpoint Protection doesn't scan a USB drive when "Action when USB storage device is plugged in" is set to:

• "scan USB and show results to user" 
• "Silently scan USB" 
• "Force scan USB and show result to user" 
• "Ask user to scan USB" 

Resolution:

Make sure that the USB drive that you have connected to the computer is a USB thumb drive or an SD card. If it is an external HDD, it will not be scanned even if it would use a USB connection.

This is expected behavior since the "Action when USB storage device is plugged in" feature uses internal Windows device flags which tells Windows which type of device is connected. It's not using device ID or hardware ID.

Issue:

Error "Failed to save profile TX-ID: 0000-XXXXXXXX" when trying to edit or modify a setting with the profile editor in the Elements Security Center portal. 

Resolution:

If you receive a "Failed to save profile" error when saving an Elements profile, the issue is most of the time caused by a invalid setting in the Elements profile. Try to clone the profile and then make your modification and then try to save the newly cloned profile. If you receive the same error, you can either try to create a completely new profile or try to fix the original profile.

If you want to try to fix the original profile, check in the profile's navigation menu on the left side if there is a red stripe on the left side of any of the settings pages. That red stripe indicates that there is an invalid setting that you need to either remove or modify. 

If no red stripe is shown, then the issue is very likely due to a custom Application Control or Automated Tasks rule. Try to remove Application Control rules and Automated Tasks one by one and try to save each time you have removed a rule. Once you have found out which rule is causing the issue, you can remove or modify it and then save the profile. 

Issue:

Usage time of the Android mobile is reduced by 80% as long as Elements Mobile Protection is installed.

Resolution:

Elements Mobile Protection will always do a full scan of the system when the Android mobile device is restarted. If you restart the device daily or very often, the Elements Mobile Protection application can drain a significant amount of battery. 

Also check that you do not have scheduled scanning set to do a daily scan:

1. Log in to the Elements Security Center portal
2. Navigate to Security configurations > Profiles page
3. Go to the for Mobile tab
4. Click on the profile that is in use on the device
5. Go to the Malware protection settings page
6. Scroll down to the Scheduled scanning section
7. Make sure that the Scan frequency is not set to Daily
8. Click Save profile

If battery usage is still very high after checking the scanning settings, you can try to see if reinstallation of the app fixes the issue. 

Issue:

Elements Endpoint Protection Software updater (patch management) feature shows updates to be available for software which have already been uninstalled from a device. Why does Software Updater detect updates for software which no longer are present on a device? 

Resolution:

If Elements Endpoint Protection Software Updater feature would list updates to be available for software which no longer are installed on a device, we recommend to check that the software has been successfully uninstalled. In some instances, traces of registry entries of the uninstalled software can be still left on the system and that is the reason why Software Updater feature detects it and offers updates for it. 

Also check that there is no entry for the software on the Windows "Installed Apps" list. 

Issue:

How to collect the diagnostic file from Elements Mobile Protection?

Resolution:

If you have technical problems with your product, you can create and send a diagnostic file (wsdiag) to our technical support. The file contains information that can be used for troubleshooting and solving problems specific to your device.

To generate a log file with your smartphone:

1. Open the Elements Mobile Protection app.
2. Tap the main menu in the top-left corner, and select About. The About MOBILE PROTECTION page opens.
3. Tap seven times on the version number. The SEND LOG FILE button is displayed at the bottom of the screen.
4. Tap the SEND LOG FILE button and select your email sending method. If you need to provide the file to Withsecure support, send the file to your own email address initially and attach it to the support-ticket. The email message opens with the log file attached to it.
5. Describe the problem in the email.
6. Send the email.

To generate logs in case of problems with Mobile Protection activation, when About view is not available:

1. Open the Elements Mobile Protection app.
2. Tap ten times on the description text (This software requires a valid license for Endpoint Protection to work…) . The SEND LOG FILE button is displayed at the bottom of the screen.
3. Tap the SEND LOG FILE button and select your email sending method. The email message opens with the log file attached to it.
4. Describe the problem in the email.
5. Send the email.

A diagnostic file can also be requested remotely from the Elements Security Center portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. Open the Mobile devices tab
4. Click on a device (An Actions menu will appear)
5. Click Request diagnostic file 

Once a diagnostic file has been uploaded to the Elements portal it will be available for download on the device's Operations tab or if you on the Devices page click on the three dots and go to the Manage Operations page. 

Issue:

We have in our Elements profile for Elements Endpoint Protection for Server / Computers set the File scanning action as "Ask after scan", but files are still quarantined automatically when they scanned. Why are files still quarantined?

Resolution:

There are many reasons why the files could still get quarantined. First we recommend to go to the Security Events page in the Elements Security Center portal to check the detection for the quarantine event. From the detection you can check if the file in question was a malware, riskware or spyware. 

If the file has been detected as either riskware or spyware, they have separate actions available on the real-time scanning settings page in the profile:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Real-time scanning settings page
5. Scroll down to the File scanning section
6. Check the following actions that they are set as Ask after scan:
   1. Action on riskware
   2. Action on spyware
7. Click Save profile

Scheduled scans are considered manual scans, so if the file was quarantined during a scheduled or manual scan, you need to check the Manual scanning settings for the Action on infection. 

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Manual scanning settings page
5. Scroll down to the Manual scanning section
6. Make sure that the Action on infection is set as Ask after scan
7. Click Save profile

We also recommend to check in the profile on the End user rights page that all the settings are locked. If settings are left unlocked, a local user could have changed the settings locally.