Issue:

Elements Agent (EPP for Computers or EPP for Servers) does not take the new expiry date into use after the subscription key is renewed through the Partner Portal. 

Resolution:

If you have a Renewable (Yearly) subscription type, the new expiry date is updated to the Elements Security Center portal 12 hours before the previous expiry time. This can create a confusing situation, where partner has renewed the subscription weeks before the expiry date but during that time the old expiry date is shown in the Elements portal until the last day of the subscription. 

Issue:

When trying to enable Halo PSA integration in Elements Security Center portal on the Management > Integrations page, after configuring the Connection details, when you click on the Company mapping button the error "failed to load company mapping data" is shown. 

The HaloPSA connection is shown to be active, why is this error shown? 

Resolution:

The "failed to load company mapping data" error is shown most likely because the WithSecure app on the HaloPSA API side is missing the minimum required permissions. 

To fix the issue:

In Halo, navigate to Configuration > Integrations > HaloPSA API > View Applications > (the WithSecure app) > Permissions tab

tick at minimum read:customers and read:tickets + edit:tickets. Since WithSecure also does provisioning from recurring invoices, add read:invoices (and edit:invoices if provisioning is enabled). Save.

Then on the Elements Security Center portal side on the Management > Integrations page, click on the Sync sites button. Then try to map the companies again.

Issue:

How can I check which profile an Elements device had before it was assigned another profile? For example if I have assigned one or more devices accidentally a new profile, how can I view the profile history for a device to see which profile it had previously? 

Resolution:

You can view the profile history for an Elements device from the Elements Security Center portal by following these steps:

1. Log in to the Elements Security Center portal 
2. Navigate to the Environment > Devices page
3. Click on a device to enter the device details page
4. Click Show history from the top row
5. Go to the Assigned profile page in the Profile section

This will show you the history of profile assignments for a device for the last 30 days. It shows you the date of change and the value (profile name). 

Issue:

After installing Elements Agent client with EDR subscription, the message "Device sensor is not operational" is shown in the local Elements Agent user interface.

Resolution:

You need to ensure that you have allowed the network traffic to the following addresses in your network firewall. The client sensor silently collects activity from the endpoint on which it is installed and then submits a representation of this data to a backend.

To guarantee proper transmission, the endpoints need to be able to communicate over HTTP and HTTPS, port 443 with the services listed here:
https://community.withsecure.com/en/kb/articles/31217-network-addresses-for-withsecure-elements-cloud-managed-products

You should also allow connections to the digicert.com domain, as the Windows API may need to verify WithSecure services that are signed with a certificate that is issued by Digicert.

In case you have an SSL interceptor to intercept the network traffic, we recommend creating whitelisting on the SSL interceptor for the EDR addresses. EDR and Countercept use the same certificate pinning approach that prevents connectivity when TLS interception solutions are used.

Services that need to be whitelisted in the interceptor are:

• DIS
• Doorman
• FAMP/Response

If the connectivity is OK on the device and you still receive the error "Device sensor is not operational", you can check if the EDR sensor has at all been installed:

1. Right click the Elements Agent icon on the device
2. Click "Check for updates" 
3. Scroll down the "Update history" list and check if it includes an entry for WithSecure Sensor (64-bit) and that it shows status as "installed" 

If the WithSecure Sensor is completely missing or status is not installed, then the sensor installation failure can be due to a device having had Elements MDR or WithSecure Countercept installed on it before and the MDR or Countercept installation hasn't been fully uninstalled. 

Elements MDR and Countercept both have a similar WithSecure Sensor component and if it hasn't been uninstalled before installing Elements Agent, the installation of the Elements Agent version of the sensor will fail. 

To solve the issue, you will need to run the WithSecure uninstallation tool to uninstall both Elements Agent and Elements MDR / Countercept. You need to restart the device after running the uninstallation tool, then you can try to install Elements Agent back to the device. 

Issue:

Why doesn´t the Elements Security Center portal's Events > Security Events alert detections always show or include the Powershell command which was run one the device, if the detection process is Powershell?

Resolution:

The Powershell command is only shown in the Security Events alert detection if the detection source is DeepGuard. If the detection source is either File Scanning (Real-time scanning) or AMSI (Antimalware Scan Interface), then they do not include the command line information, because it depends on which detection engine produced the event. 

• DeepGuard events include the CommandLine field — this is where you'll typically see the full PowerShell invocation (e.g., the powershell.exe command with arguments). 
• File Scanning / Real-time scanning (OAS) events focus on the file being scanned, not the launching process. They include filePath and accessor info but typically not the command line of the process.
• AMSI detections have limited portal visibility

If you have Endpoint Detection and Response (EDR) included in your subscription, you can enable Response actions the Elements profile and then use the "Retrieve PowerShell history" investigative action to get more details about any PowerShell commands that have been run on a device. 

Steps how to enable advanced response actions: https://support.withsecure.com/userguides/product.html#business/edr/latest/en/task_09832986687949D783F3A086C43A2ADB-latest-en 

List of investigative response actions: https://support.withsecure.com/userguides/product.html#business/edr/latest/en/concept_C1A7FE15A7794BBDB0D5767C3903D005-latest-en

Issue:

How can I disable, deactivate or turn off all security features of of WithSecure Elements Endpoint Protection / Elements Agent (EPP for Computers and EPP for Servers)?

Resolution:

By default a local user is not allowed to turn off all security features from the local Elements Agent user interface. You will need to allow this from the profile that is in use on the device. 

How to edit a device profile to allow a local user to stop all security features:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Go to the Security Configurations > Profiles page from the menu on the left
3. Select the profile you want to edit
4. Go to the General settings page 
5. Scroll down to the bottom to the Security features section and enable Allow user to turn off all security features 
6. Click Save profile 

Once the profile has been taken into use, from the local of WithSecure Elements Agent user interface, a user can click on the three dots and select Turn off all security features. 

Note: If password for uninstallation is enabled, the same uninstallation password is required to be entered when turning off the security features. 

Alternatively, you can remotely using an operation stop the security features temporarily:

1. Log in to Elements Security Center portal
2. Go to the Environment > Devices page from the menu on the left
3. Select the device (a menu will appear from the bottom of the page)
4. Click Turn off security features > Turn off all security features
5. Select the time and then confirm the action by clicking "Turn off"

Please note that if you select a time, for example 5, 15 or 30 minutes, the security features will not be automatically turned on after computer restart. The security features will be automatically turned on after the set time limit has been reached. 

If you want to have the security features to turn on automatically at computer restart, you need to select the "computer restart" option. 

All security features can also be turned off using a Command Prompt by stopping the F-Secure Ultralight Hoster (fsulhoster) service. Simply run in the command line:

• net stop fsulhoster 
• net start fsulhoster

Note: Tampering Protection (Resource Protection) needs to be disabled in the Elements Endpoint Protection profile to allow a local user to stop and start services.

Issue:

Veeam Backup & Replication Console update fails when Elements Endpoint Protection Security Features are enabled. 

Installation fails with error: 

Deleting temporary folder Error: The process cannot access the file because it is being used by another process. Failed to delete file: [\\?\C:\Windows\Veeam\Backup\Upload\07f9fa15-dc61-40e8-9068-d0f4243ff9de\Veeam_B&R_Endpoint_x64.msi]. File '\\?\C:\Windows\Veeam\Backup\Upload\07f9fa15-dc61-40e8-9068-d0f4243ff9de\Veeam_B&R_Endpoint_x64.msi' locked by 0 processes: The specified directory cannot be removed: [\\?\C:\Windows\Veeam\Backup\Upload\07f9fa15-dc61-40e8-9068-d0f4243ff9de]. Failed to invoke rpc command

Resolution:

If Veeam Backup & Replication Console update fails when Elements Endpoint Protection security features are enabled (such as Real-time scanning and DeepGuard), you need to create Global scanning exclusions for the folders used by Veeam and process exclusions for Veeam processes. 

By default these should be enough if your Veeam installation is in a default location: 

Add to the Global exclusions from all security scans list: 

C:\Windows\Veeam\
C:\Program Files\Veeam\ 
C:\Program Files\Common Files\Veeam

Process exclusion list: 

C:\Windows\Veeam\Backup\VeeamDeploymentSvc.exe
C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Service.exe
C:\Program Files\Common Files\Veeam\Backup and Replication\Explorers Recovery Service\Veeam.StandBy.Service.exe
C:\Program Files\Veeam\Veeam Guest Interaction Service\Veeam.Guest.Interaction.Proxy.exe
C:\Program Files\Common Files\Veeam\Backup and Replication\Mount Service\Veeam.Backup.MountService.exe
C:\Program Files\Veeam\vPowerNFS\VeeamNFSSvc.exe
C:\Program Files\Veeam\Backup and Replication\Threat Hunter\Veeam.ThreatHunterService.exe
C:\Program Files\Veeam\Backup Transport\VeeamTransportSvc.exe

This Veeam documentation also includes other paths that they recommend to exclude: https://www.veeam.com/kb1999

Issue:

When opening a support request to WithSecure, a Technical Support Engineer may access your Elements company account when handling a support request. 

Resolution:

When you open a support request with WithSecure, the Technical Support Engineer assigned to your case may need to access your Elements company account in order to investigate the issue. In such cases, the Technical Support Engineer will be temporarily granted read-only access to the company account, allowing them to review any products associated with the Elements company account.
Once a Technical Support Engineer has been added to the company account, their user account will appear on the Security Administrators page of the Elements Security Center. Upon resolution of the support request, the user account will be promptly removed from the company account.

The support account used for this purpose is:
name+support@withsecure.com

You can read about WithSecure's privacy policy from here.

Issue:

User is unable to log in to the Elements Mobile Protection app using username and password. User receives "Incorrect username or password" error message. 

Resolution:

The Elements Mobile Protection username and password are one-time use upon installation. For example, if the Mobile Protection app has suddenly logged out on an Android or Apple iOS device, you will need to reinstall the product by sending a new invitation from the Elements portal.

You can uninstall the Mobile Protection app from the device, log in to the Elements portal, and remove the device from the portal under Environment > Devices > Mobile devices to free up the license for reuse. You can then follow these instructions to send a new installation link to the device: https://community.withsecure.com/en/kb/articles/29401-how-to-install-elements-mobile-protection-to-android-or-apple-ios-mobile-devices

You should remove the previous Elements Mobile Protection application from the device before installing it again from the new installation email. When the application is installed using the link in the installation email, the application will automatically register the license.

For installation across multiple mobile devices, please be sure each device receives their own invitation. An invitation link cannot be shared across multiple mobile devices.   

Note:
If you have used Apple iOS data migration to copy the app from the old device to the new device, you will need to uninstall the app and send a new installation and activation link from the Elements Endpoint Protection portal. 

Issue:

How can we get training for WithSecure products? 

Resolution:

We have publicly available training courses for Elements Extended Detection and Response (XDR) and Elements Exposure Management: https://www.withsecure.com/en/support/technical-training

There are available trainings for the following products: 

• Elements Endpoint Protection (EPP) 
• Elements Endpoint Detection and Response (EDR)
• Elements Collaboration Protection (ECP)
• Elements Exposure Management (XM)