Issue:

Why does not Elements Collaboration Protection automatically quarantine a high severity email detection, but an email with a medium severity detection is quarantined?

Resolution:

The Elements Collaboration Protection Severity level indicates whether an administrator action is needed to mitigate the immediate risk.

• Low: No action is needed because the item is coming from a trusted source.
• Medium: No action is needed. The item was automatically either quarantined or deleted.
• High: Action required. No automatic action is specified in the policy.
• Critical: Immediate action is required to mitigate the risk.

If some emails are quarantined and not others, it can be that in the policy you have set only specific content (URLs or files) to trigger a quarantine action.

In case of URLs, they are divided into harmful and suspicious in the policy. Both can be given differend actions. 

How to check the action for both malicious and suspicious URLs:

1. Log in to the Elements portal
2. Open the Collaboration Protection section from the menu on the left
3. Go to the Policies page
4. Open the policy that is in use on your cloud service
5. Open the Exchange tab and go to the URL scanning page

Here in the Action section you can make sure that both Malicious URL and Suspicious URL are set to Move the item to quarantine. Take no action would result in the admin having to manually delete or take action on the item (resulting in a high severity classification).

If the email with high severity classification includes a malicious file, make sure that the malware scanning action has been set up to quarantine the file:

1. Open the policy that is in use on the cloud service
2. Open the Exchange tab and go to the Malware scanning page
3. In the Action section, make sure that the action is set to Move whole item into quarantine

Issue:

What is the difference between Move to blocklist and Remove permanently after clicking Remove device on the Endpoint Protection portal devices page?

Resolution:

Move to blocklist: Moves the device to the blocklist. The license will be released and even if the Elements Agent (EPP for Computers or EPP for Servers) is still installed on a device, it will not be able to reconnect to the Elements Portal and reacquire a license. Devices moved to the blocklist can be restored from the Subscriptions page by clicking on the three dots and selecting Restore from blocklist.

Remove permanently: Removes the device permanently from the portal without it going to the blocklist. Since the device is not on the blocklist, if the installation is fully operational on the device, it will be able to reacquire the license. This feature can be used only on one device at a time and should only be used when reinstalling the Elements Agent on a device. 
 

Issue:

We have a client where an email address was deleted (in Office 365). Now, I see in the portal that there is a free license available, but when I try to assign the license to another user, it doesn’t seem to be available. Is it possible that the license is still linked to the deleted mailbox? I also cannot delete the user in the portal.

Resolution:

This is caused by Microsoft 365. Our Elements Collaboration Protection simply reflect the status provided by Microsoft. If Microsoft shows the mailbox, everything is fine. If not, we mark it as unavailable until Microsoft restores it. This doesn’t always indicate an issue with the mailbox but rather an incomplete response from Microsoft, which happens frequently. If the "unavailable" status persists for more than 1-2 days, you should verify whether the mailbox still exists (e.g., the AD user behind it may have been canceled or the mailbox may have been terminated).

Whenever a mailbox is unreachable, it is marked as "unavailable." Every 2-3 hours, we request an updated list of resources (mailboxes, sites, etc.) from Microsoft. If a mailbox previously existed in our system but is no longer returned by Microsoft, we mark it as unavailable. This status can occur due to temporary Microsoft issues, which are often resolved within a few hours. By marking mailboxes as unavailable instead of removing them, we can restore them to "unprotected" status if they reappear in future updates without needing to recreate them in the database.

Issue:

When trying to create an offline MSI installer for WithSecure Elements EPP for Computers or for Servers using the FSMSI tool, user receives error: "FsMsiTool is not recognized as an internal or external command."

Resolution:

You have to execute the FSMSI tool command from the directory where the tool is saved to or else you will get the error. Using the command prompt, navigate to the folder where you have saved the tool and then run the command mentioned in this help guide.

Issue:

Reseller partner has sold a subscription to a customer. However, when the reseller partner check in the Elements Security Center, they are unable to see / view the customer company or the subscription key / code under the reseller partner's solution provider/service partner account.

Resolution:

Make sure that you have logged in to the correct Elements user with the solution provider/service partner rights. If anyone else in your company has an  Elements user too, they can verify Elements user access level on the Management > Organization settings > Endpoint Protection Accounts page in the Endpoint Security Center. If you are the only Elements user, you may contact your WithSecure sales contact for assistance.

If you have logged in using the correct Elements user but are unable to see the customer company in the scope drop-down menu on your account, make sure that you have sold the Endpoint Protection product as Partner Managed and not Company Managed. If the product has been sold as Company Managed, neither the customer company nor the subscription will be shown in the reseller partner's account.

There is also a risk that something has gone wrong with the order itself. If the order provisioning fails it will be left pending a manual correction. These are done regularly and if this occurs, your order should become visible at the latest within the next business day (unless further information is required from you in which case you would be contacted). 

If you have accidentally purchased a Company Managed asset, and want to change it to be Partner Managed, or if you want to verify the state of your order, contact our Order Services team or your WithSecure Sales contact.

If you are unable to reach your WithSecure Sales contact, contact WithSecure Customer Care: https://www.withsecure.com/en/support/contact-support/email-support

Note: If customer has only Business Suite products, such as Client Security or Server Security, these products are not part of the Elements portfolio and therefore do not use the Elements Security Center.

Issue:

Why are the quick action buttons (such as “Isolate Affected Device” and “Scan Device”) under the Broad Context Detection detail's view greyed out in the Elements Security Center?

Resolution:

The remote operations (such as “Isolate Affected Device” and “Scan Device”) in the Elements Security Center are only available for a device with Elements agent installed using the Elements EDR for Computers/Elements EDR for Servers or Elements EDR and EPP for Computers/Elements EDR and EPP for Servers subscription.

If you have Business Suite product (Client Security/Server Security) installed on the device with the Endpoint Detection & Response sensor activated, we are unable to trigger remote operations from the Elements Security Center. We need to do this using Operations tab in the Policy Manager Console.

Issue:

In compromised account, there's private and public as breach type shown in the detection detail page.
What do those breach types mean?
 

Resolution:

Private – Breach details are not publicly available on the internet. Attackers are selling for cryptocurrency on Tor forums ("dark web")

Public – Breach details are easily found on the internet. Attackers have shared publicly online e.g. forums for script kiddies, pastebin etc
 

Issue:

What time is the scheduled report generated in Collaboration Protection?

Resolution:

Report generation starts at 3 AM (according to the timezone selected in report task) and takes up to a few minutes.
Generation frequency depends on a frequency selected in report tasks

daily: every day
weekly: every Monday
monthly: every 1st day of a month

Issue:

I am trying to uninstall WithSecure Elements Agent (EPP for Computers or Computer Protection for Mac) from my Windows or MacOS computer, but I get the error notification: 
"Uninstallation is not allowed, Settings do not allow local uninstallation. Contact your administrator."

Resolution:

This is due to the Elements Endpoint Protection profile setting that disallows a user from uninstalling the product locally. 

Please ask your Elements account administrator to change the following setting to allow local uninstallation:

1. Log in to the Elements Security Center Portal: https://elements.withsecure.com
2. Expand the Security Configurations category
3. Go to the Profiles page
4. Select the profile that is assigned to the computer 
5. Go to the General Settings page
6. Enable to Allow the user to uninstall the product 
7. Click Save profile

Now you can uninstall Elements Agent locally from the device.

Note: On Windows devices Tamper protection feature is enabled by default in the Elements profile. This will block wsuninstallationtool.exe from running. 

If the above fails on a Mac and the uninstallation is still not possible, try the following.
Remove the following file using the terminal command below and try the uninstallation again:

In case of build version 38681 and newer:

• sudo rm /Library/F-Secure/fsmac/sysconfig/.no_uninstall

In case of older build version than 38681:

• sudo rm /usr/local/f-secure/fsmac/sysconfig/.no_uninstall

Note: This will require root permissions, should only be used as a recovery measure and will no longer be available in future releases of PSB Computer Protection.

Issue:

* The message "Policy does not require the password" is seen next to the user properties under the device status in the Elements Security Center. What goes wrong with the user on the device in this case?
* The issue "Device at risk due to accounts for which password is not required" is showing up in the dashboard in the Elements Security Center. How can I get this fixed?

Resolution:

The message "Policy does not require the password" is showing up under the device status if the local user is not subject to the password policy regarding the length of password. We do not have the option to hide this issue in the portal without fixing this.

In this case, the local user can have a shorter password than it is required, or it may even have no password at all. You need to check and tweak the UserAccountControl attribute of the user to remove the flag "UF_PASSWD_NOTREQD" if it is found.

You may run the following command to validate the flag of the local user:

net user <username>

If password required flag is "NO" for the user, run the following command to fix it:

net user <username> /passwordreq:yes

We would recommend to get this fix soon as possible to avoid any password leak and other potential issues.