Issue:

Receiving error "Could not find subscription key" when adding subscription key to an Elements portal company account with the Assign subscription button on the Management > Subscriptions page. 

Resolution:

Check that the subscription key code you ordered is correct for the account you have. 

If you have a Company Managed subscription key and the company account is placed under a reseller partner's Solution Provider account (SOP), you cannot add the code there. For that you need to have a Partner Managed subscription.

If you have a Partner Managed subscription key, the subscription key is automatically added to the company account and you cannot add it again. Check the Management > Subscriptions page to see if the subscription key is already found on the accoutn. 

A code cannot be used on a trial account either, a new account needs to be created or the trial account needs to be converted to a normal commercial account.

A reseller partner can directly contact Order Services to help you with this. 

If you're not sure what the issue is, please contact WithSecure Support for further assistance.

Issue:

We have changed our domain name, but Microsoft 365 tenant itself is same as before.
In this case, do we need to change any settings in Elements Collaboration Protection(ECP) side?
So far, old domain name remains in some places in portal.
For example, there are some old domain records remaining in Exchange page and the status is shown as unavailable. Will those old domain records be deleted automatically?
 

Resolution:

Customer doesn't need to do anything, as the old domain should be deleted automatically in 14 days of being unavailable.

Every time we open summary page in portal, which shows tenant's detailed info, ECP will send API to Microsoft to get the information displayed.
Specifically which part of Microsoft is referred to, or what API is used, is not disclosed.

Issue:

I have forgotten my WithSecure Business Account password. How do I reset the password for my Elements business user account?

Resolution:

You can reset your password by clicking on "Forgot password?" on the Elements Security Center log in page. An email will be sent from which you can reset your password.

If you do not receive a password reset email, check if it has been sent to your email spam or trash folder.

If you have not received any email, open a support request and support can investigate the account issue.

Issue:

Is it expected to have both F-Secure and WithSecure services running when WithSecure Elements Agent is installed on a Windows computer? Some Elements Agent related services are still running under the "F-Secure" name on the Windows devices. 

Resolution:

Yes, it is expected to have both WithSecure and F-Secure named services running, as these components are common for both F-Secure and WithSecure, hence the name has been kept.

Currently, the following Elements Endpoint Protection services are still using F-Secure name:

• F-Secure Ultralight Hoster (fsulhoster)
• F-Secure Ultralight Network Hoster (fsulnethoster)
• F-Secure Ultralight Protected Hoster (fsulprothoster)

The following Elements Agent services are using the WithSecure name:

• WithSecure Device Control (fsdevcon)
• WithSecure Hoster (fshoster)
• WithSecure Hoster (Restricted) (fsnethoster)

Issue:

An information event "Connection control has blocked the network connection. The blocked application: chrome.exe / firefox.exe / edge.exe" was logged for Elements Endpoint Protection (EPP for Computers or EPP for Servers) on the Security Events page in the Elements Security Center portal

What does this block event mean? Why is no website address (URL) being listed?  
 

Resolution:

Connection Control is also known as "Banking Protection". It is the feature which activates when a user enters a banking site. When Connection Control is active, the browser only allows the user to visit trusted websites. 

If a full page is blocked, the user will receive a splash page which alerts the user that a page has been blocked, and if they need to access the page while Connection Control is active, they can allow the website. Sometimes simple analytics addresses are being blocked, which do not affect the user at all, which is why it can get unnoticed by the user and still an alert is sent to the Security Events page.

With the default settings, due to regional legislation differences, the page address is only shown fully to the local user while in the Elements Endpoint Protection portal's Security Events page only the affected browser or process is listed. 

You can from the profiles change the following setting if you want the Security Events page to show the website URL:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Go to the Security configurations > Profiles page
3. Select the profile which is in use on the device
4. Go to the Browsing Protection settings page 
5. In the Common settings section, enable Include the blocked URLs in all security events 
6. Click Save profile

Note that you need to be sure that your regional legislation allows you to monitor users in such a way. 

Issue:

A lot of emails from trusted senders are quarantined due to including malicious URLs. Is it possible to add a domain or address as a trusted sender in Cloud Protection for Microsoft 365?

Resolution:

If a lot of emails are quarantined due to malicious URLs from trusted senders, you can add them to the trusted senders list by following these steps:

1. Log into Cloud Protection Portal
2. Go to Policies 
3. Select policy
4. Go to the General settings
5. Turn on the Trusted senders feature
6. Add the trusted email sender or domain addresses
7. Click Save

From the Cloud services page in the portal you can assign different policies for your cloud services. 
 

Issue:

Admin received a notification that there is a suspicious inbox rule, advise user to remove the rule. Admin wants to verify that suspicious rule is already removed. 

Resolution:

At the moment Collaboration Protection will only report those suspicious inbox rules but do not list the user's rules, admin needs to check directly with user or check if the same suspicious rule is reported again. 

Issue:

Is it possible to centrally send an operation for remote uninstallation of the Elements Agent from the Elements Security Center Portal?
Will removing a device from the Devices-list in the Elements Endpoint Protection Portal cause the client software to be uninstalled?

Resolution:

Removing a device from the Elements Security Center Portal with the Remove device operation does not trigger a local uninstallation of the Elements Agent, you will need to use a specific Uninstall operation from the portal if you want to remotely uninstall Elements Agent from a device.

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Go to the Environment > Devices page
3. Select the device(s) from the list by clicking the white box on the left side of the device (a menu will appear)
4. Click Uninstall from the menu
5. Confirm the uninstallation operation

This will send an uninstallation operation to the device and the Elements Agent will be silently uninstalled from the device. Once the Elements Agent has been uninstalled, the device will be removed automatically from the portal and the license will be released so that it can be used on another device.

If you want to uninstall Elements Agent using GPO, you can run the following command as administrator: 

• C:\Program Files (x86)\F-Secure\PSB\fs_uninstall_32.exe –silent

This will run the Elements Agent uninstallation silently and automatically remove the device from the Elements Endpoint Protection portal and release the license.

Issue:

How to forbid a local user from creating real-time scanning or DeepGuard exclusions for Elements Endpoint Protection (Elements EPP for Computers or Servers)?

Resolution:

You can block or disallow a local user from creating or adding new exclusions in the local Elements Agent user interface by changing a few settings in the profile that is in use on your devices. 

Follow these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Open the Security Configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile that is in use on your devices (note that only custom profiles can be edited)
5. Go to the General settings page
6. Scroll down to the Quarantine section and disable Allow users to release blocked and quarantined items 
7. Scroll back up a little to the Exclude folders and files from all security scans section and enable the lock on the right side of the exclusions table
8. Click Save and publish 

Now all the devices that have this profile in use will have it so that even local users with administrator rights cannot add exclusions, since the Add new button will be grayed out and the setting is locked. 

Issue:

How to install Elements EPP for Servers in persistent mode on Citrix Servers?
How to automatically assign a profile to a Citrix Server?

Resolution:

• When creating the image with the ElementsAgentinstaller.exe, you can either use a profile parameter or manually define what profile this image will use.
• There is currently no way to automatically assign a different profile for a new device deployed from the golden image for the first time (this is a real limitation). Device will automatically get the default company profile.
• Once you have deployed a new device from the image, you need to do manually assign the profile for this device if you want to use a different profile than what is on the golden image. All the subsequent deployments of that same device will receive the profile that was manually assigned to them.

You can follow the instructions from this Help Guide on how to install Elements EPP for Servers in persistent mode on Citrix servers.

How to set a profile can be found in this Help Guide.