Issue:

How to create password for a new administrator user account in the Elements Security Center portal?

Resolution:

When an administrator user is added to the Elements Security Center portal. the user will receive a Welcome email which includes a temporary password that the user should use when they log in first time to the Elements Security Center portal. 

During the first login, they will be asked to create a new password and set up two-factor authentication.

The password can always be changed from within the Elements Security Center portal by the user themselves. After logging in, click on the user icon in the top-right corner and go to My settings. There you will find a Change password button.  

If for some reason the temporary password in the Welcome email would not work, you can always use the "Forgot password?" feature to reset the password. The "Forgot password?" feature will work even if the user has not yet successfully logged in to the portal at any point. 

Issue:

Profile not visible on the Assign profile list when attempting to assign a profile for devices on the Elements Security Center portal's Environment > Devices page. 

Resolution:

If a profile is not listed on the Assign profile list after you have selected one or more devices from the Environment > Devices list and clicked Assign profile from the Actions menu, you need to check that both the profile and the device are of the same device type. 

For example, if you have created a profile For Windows Computers, that profile will not be listed if you have selected a Windows Server or Mac computer from the Devices list. 

We recommend to only select one device type at a time from the Devices list. You can make a Type filter if you want to only see one device type at a time on the Devices list. 

Issue:

How to receive an email alert when there's a file (WRITE) detected on a USB storage device by Elements Endpoint Protection Device Control? 

Resolution:

To receive an email alert when there's a file (WRITE) attempt detected on a USB storage device by Elements Endpoint Protection Device Control, you first need to enable detection of write attempts on a USB storage device:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Device control settings page
5. In the Removable mass storage devices section, enable Detect write attemps to USB storage devices
6.  Click Save profile

After you have enabled the alert in the profile, you will need to create a custom Security Event view which we can then use in an email report:

1. Navigate to the Events > Security Events page 
2. Click Clear all filters to remove existing filters
3. Create a new filter: Source – equals – Device control 
4. Open the View drop-down menu in the top-right corner 
5. Click Save as 
6. Click on the three dots on the right side of the view you created 
7. Select Copy to organization views 
8. Confirm action by clicking Copy to organization views 

By copying the view to organization views, it will be able to be selected as a data source when creating the email report.

Finally, create the email report:

1. Go to the Reports page
2. Open the Email notification and report tab
3. Click Add email report 
4. Add a name
5. As Data source, select Security Events 
6. As Template, select the device control view which you saved as an organization view
7. Set Schedule frequency as Continuous. Which means that emails are sent every 10 minutes
8. Enable Send only when report has content, which sends a new email only when there is new content on the Security Events page
9. Enter the recipients
10. Click Save

Issue:

We made a change to the Elements portal's Profile assignment rules and applied it to all existing devices accidentally.

Is it possible to revert a profile change made by the profile assignment rules feature? How can we find out what was the original profile that was in use on the devices? 

Resolution:

Unfortunately it is not possible to revert the changes made by Profile assignment rules if you have accidentally applied a profile changes to devices for which you didn't intend to. You would need to manually assign the correct profile to all the devices. 

You can check which profile a device has had before the change by checking the device's history:

1. Log in to the Elements Security Center portal 
2. Navigate to the Environment > Devices page
3. Click on a device
4. Click Show history 
5. Go to the Assigned profile page
6. Check the date of change and the value columns

Note: Device history shows changes from last 30 days (data collection started on 1 June 2023). 

Issue:

Does Elements Endpoint Protection Web Content Control feature have an alert only or report only mode? When Block is disabled for a category and only Alert is enabled, an alert is not sent to the Security Events page when a user visits a website belonging to that Web Content Control category.  

Resolution:

Elements Endpoint Protection Web Content Control feature does not have an "Alert only" or "Report only" -mode

What you are seeing is the expected behaviour of Web Content Control in WithSecure Elements Endpoint Protection: a security event is only generated when access to a category is actually blocked. When a category has Alert turned on but Disallowed (block) turned off, the site is allowed and no security event or device notification is created.

In practice the supported combinations are therefore Block only (Disallowed on, Alert off) and Block with Alert (Disallowed on, Alert on). An alert-only or monitoring mode for discovering which categories are being accessed without blocking them is not currently available. 

If you would like to assess the impact before enforcing a category across the environment, one option is to apply a profile with Disallowed and Alert enabled to a small pilot group of devices and review the resulting Web Content Control security events before rolling it out more widely.

Issue:

How to do a remote uninstall (silent) of Elements Agent for Mac from the Elements Security Center portal?  There is no "uninstall" operation listed in the Actions menu when a MacOS device is selected on the Environment > Devices page. 

Resolution:

Remote uninstallation from Elements Security Center is currently available for Windows devices only, so on macOS the agent has to be removed with a script pushed through your MDM or remote management tool (for example Jamf, Apple Remote Desktop or SSH). This can be done fully without user interaction as follows.

1. Deploy an MDM configuration profile that allows the WithSecure system extension to be removed. In the System Extensions payload add Team ID V928P8X763 with the extension com.withsecure.wsagent.wssystemextension both under Allowed System Extensions and under Removable System Extensions. This profile is what lets the extension be deactivated without a logged-in user approving it.
2. In Elements Security Center, make sure the Mac profile assigned to the devices allows the user to uninstall the product (Profiles > For Mac > General settings). If this is disabled, the uninstall script will fail.
3. Push a script that runs as root and executes these two commands in this order:
/Applications/WithSecure/WithSecure\ Agent.app/Contents/MacOS/wsagent –deactivate-system-extension
/Library/WithSecure/bin/uninstall_MacProtection
4. Once the agent is removed, delete the device from the Devices page in Elements Security Center to release the licence.

If the subscription has already expired and the profile can no longer be changed, the uninstall restriction can be lifted by deleting the file /Library/WithSecure/fsmac/sysconfig/.no_uninstall before running the script. 

Issue:

The "Add new device" option missing on the Environment > Devices page in the Elements Security Center portal when the three dots are clicked. Why is the button missing? 

Resolution:

If the Add new device option is missing on the Elements Security Center portal's Environment > Devices view in the Elements Security Center Portal when you click on the three dots, there are a few reasons why it can be missing:

• You are missing the full management rights for Elements Endpoint Protection
• You do not have valid licenses for the product you are trying to add
• If you are a partner user, you have the wrong level selected from the scope-selector

You are missing the full management rights for Elements Endpoint Protection

Make sure that your user account has full editing rights for Endpoint Protection:

1. Log in to the Elements Security Center portal
2. Navigate to the Management > Organization Settings > Security Administrators page 
3. Check the Endpoint Protection column for your user account and make sure that you have the correct rights

If you do not have the full editing rights for Endpoint Protection, ask a colleague to add the rights for you or if you have a Partner Managed subscription you can contact your partner to have the rights added. 

You do not have valid licenses for the product you are trying to add

The Add new device button can be missing if you do not have any relevant licenses attached to your company account. Make sure from the Management > Subscriptions page that you have valid licenses for one of the following:

• Elements EPP for Computers or Servers
• Elements EPP for Mobiles 

If you are a partner user, you have the wrong level selected from the scope-selector

If you are a partner, you need to select the customer company level from the Scope-selector drop-down menu. The Add new device button is not visible on the partner level because the partner level doesn't include any subscriptions.  The scope-selector is the drop-down menu shown in the top-left corner of the Elements Security Center portal. 
 

Issue:

When opening the browser, Elements Endpoint Protection Connection Control activates by itself automatically in Mozilla Firefox without the user entering a banking page. When Connection Control is active, many websites are blocked unnecessarily. 

Resolution:

If Connection Control (Banking Protection) automatically activates itself when you open Mozilla Firefox, it can be because among the most visited pages in a "new tab" view there is a banking website listed. Firefox preloads these pages and it can trigger the protection. 

Try to remove all banking related pages from the view when you open a new tab and then restart the browser to confirm if the issue still persists.

Issue:

Is it possible with Elements Endpoint Protection Device Control feature to block all network adapters, but allow a specific type, group or class of network adapter, such as virtual network adapters or specific vendor's network adapters?

Resolution:

Device Control can block devices based on their Hardware ID, Compatible ID or Class GUID (https://community.withsecure.com/en/kb/articles/5525-how-device-control-block-devices)

To allow or block all network adapters, a Class GUID rule for network adapters is required.: 

1. Log in to Elements Security Center Portal 
2. Go to the Environment > Profiles page
3. Select the profile which is in use on the devices
4. Go to Device control settings
5. Enable device control 
6. In Device access rules, click Add rule 
7. Add {4d36e972-e325-11ce-bfc1-08002be10318} in the Hardware ID field 
8. In Access to device, select either Block or Allow depending on your use case
9. Click Save profile

In this case the {4d36e972-e325-11ce-bfc1-08002be10318} is the Class GUID for all network adapters: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors?redirectedfrom=MSDN

If you want to allow only a specific vendor's network adapters, you can allow the network adapter's Compatible ID. The Compatible ID rule is created by following the same steps as for the Class GUID, except the Compatible ID is added to the Hardware ID field.

If the device is not blocked, the Hardware ID, Compatible ID and Class GUID can be viewed from the Elements Endpoint Protection Portal from the device's Connected devices list :

1. Log in to Elements Security Center Portal
2. Go to the Environment > Devices page
3. Select device 
4. Go to the Connected devices tab
5. Click on the arrow on the left to view ID details

The Compatible ID can also be acquired locally from the device by following these steps:

1. Open Device Manager
2. Right-click device > Properties
3. Go to Details tab
4. Select property as Compatible ID

If Compatible ID property is not selectable, then the device has none. 

Issue:

What is the data retention for audit logs and security events in the Elements Security Center portal? How long time are the audit logs and security events stored in the portal before they are automatically removed or cleared? 

Resolution:

For security events are available for a limited period of time dependent on their severity.

• Max 7 days for Info
• Max 6 months for Attention
• Max 13 months for Action Needed

For audit log sas of now there is no retention period.