Issue:

How to reset the host UUID (Unique ID) of WithSecure Elements Agent (Elements EPP for Computers or Elements EPP for Servers) client?

Resolution:

You can use a tool called ws_oneclient_logout.exe which can be used to reset the GUID for existing Elements Agent installation.

1. Open a command prompt with administrator privileges
2. Navigate to the installation directory of WithSecure Elements EPP client: %ProgramFiles(x86)%\F-Secure\PSB\
3. To change the UID of the host use the following command:
   • ws_oneclient_logout.exe –keycode <enter your license keycode here>

For example:
ws_oneclient_logout.exe –keycode xxxx-xxxx-xxxx-xxxx-xxxx 

NOTE: If you use the ws_oneclient_logout.exe tool with this option (ws_oneclient_logout.exe –wait_uuid_changed), the system waits until the UUID is changed to make sure that the device registers with the correct, unique ID on the WithSecure Elements Endpoint Protection portal. This option works only if SMBIOS is used to identify the device. It has no effect if other identification methods are used. You can read more about this feature here: https://www.withsecure.com/userguides/product.html#business/psb-portal/latest/en/task_05B6F4B3D49D451CBD438312C41C15D3-psb-portal-latest-en

When the host UID is reset, the Elements Endpoint Protection portal will consider the host to be a new device. This can result in duplicate devices visible in the Elements Endpoint Protection Portal Devices page (each device takes a license into use). You can remove the old devices by selecting the device from the Devices list and from the Actions menu you can select Remove device > Remove device.

Issue:

How to deploy WithSecure Elements Agent (EPP for Computers or for Servers) using a clone image?

Resolution:

Follow the instructions here for installing the WithSecure Elements Agent using a clone image.

Issue:

Incoming email was delayed to be detected and quarantined on Elements Collaboration Protection and the receiver could see the email and has already sent reply it.

In the end, the reply was also quarantined but not sent to any destination addresses.
This issue happened only one time and cannot be reproduced again.

Resolution:

Generally, delays can happen because our Elements Collaboration Protection system is working in asynchronous way with Microsoft, therefore delays are expected to happen from time to time.

Issue:

How to deploy Elements EPP for Computers (Mac) using Intune?

Resolution:

You could follow the instructions below in order to deploy Elements EPP for Computer (Mac) using Intune to your Mac devices.

Note: Make sure that you have added your Mac devices to the Intune Company Portal before proceeding with this deployment. You may refer to the following Microsoft page for more details.

https://learn.microsoft.com/en-us/mem/intune/user-help/enroll-your-device-in-intune-macos-cp

1. Login to Microsoft Intune admin center (https://intune.microsoft.com/#home)

2. Create a new group by following the steps below
    2.1.    Go to "Groups"
    2.2.    Click on "New Group"
    2.3.    Select "Security" for the Group Type
    2.4.    Enter the name of the group at "Group Name"
    2.5.    Leave other settings as default
    2.6.    Click on "No members selected" link
    2.7.    Search for your Mac devices
    2.8.    Put a tick to select all Mac devices
    2.9.    Click on "Select" button at the bottom
    2.10.  Click on "Create" button to proceed with new group creation

    Note: You may skip creating a new group if there is an existing group for your Mac devices on Intune portal.

3. Create a new profile to allow WithSecure system extensions and etc
    Note: It is recommended to create the configuration profiles within Intune rather than using a separate Preference file (*.plist).

     In case of WithSecure system extensions:
     – Refer to the following documentation for more details on how to create a new profile with system extension settings.

Importing MDM profiles with system extension settings | Elements Endpoint Protection | Latest | WithSecure User Guides

     In case of Content Filtering: 
     – Refer to the following documentation for more details on how to create a new profile with content filtering settings.

Creating MDM profiles with content filtering settings | Elements Endpoint Protection | Latest | WithSecure User Guides

     In case of Full Disk Access:
     – Refer to the following documentation for more details on how to create a new profile with full-disk access settings.

Creating MDM profiles with full-disk access settings | Elements Endpoint Protection | Latest | WithSecure User Guides

     In case of User Notifications:
     – Refer to the following documentation for more details on how to create a new profile with notification settings.

Creating MDM profiles with notification settings | Elements Endpoint Protection | Latest | WithSecure User Guides

4. Deploy Elements EPP for Computers (Mac) to your Mac devices
      4.1.    Go to "Apps"
      4.2.    Select "macOS" from the list of available platforms
      4.3.    Click on "Add" button
      4.4.    Select "Line-of-business app" for App type
      4.5.    Click on "Select" button at the bottom
      4.6.    Click on "Select app package file" link
      4.7.    Click on "Select a field" field
      4.8.    Search for the installer file (*.pkg) of Elements EPP for Computer (Mac)
                 Note: There is a need to change the file extension of the installer from *.mpkg to *.pkg so that it would be recognized by Intune.
      4.9.     Click on "OK" button
      4.10.   Enter Name, Description and Publisher (use "WithSecure" in this case) for App Information
      4.11.   Select "macOS Monterey 12.0" for the Minimum operating system 
      4.12.   For the Included apps, maintain just the below bundle IDs and remove the rest of the unnecessary items

                  Note: 3.0.53367 indicates a build version, it is recommended to always use the latest build version

       4.13.   Leave other setting as default and click on "Next" button
       4.14.   Under Required category, click on "Add group"
       4.15.   Select your group from the list and click "Select" button
       4.16.   Click on "Next" button
       4.17.   Click on "Create" button

Note: It may take some time before Elements EPP for Computers (Mac) is being deployed to your mac devices silently in the background.

Issue:

How to reset biometric key device registration in the Elements Security Center portal?  For example if a device or computer was reinstalled and the biometric keys for it need to be added again for faster two-factor authentication (2FA)

Resolution:

Here are the steps on how to reset the biometric keys for a device: 

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Select Try another method when asked to Use fingerprint or face recognition to login
3. After you have logged in, click on the profile icon in the top-right hand corner and select My settings
4. Click on the Change button on the right side of the Multi-Factor Authentication enabled text
5. In the Biometric keys section, click remove for the existing key
6. Enter your username and password

Next time you login with your device, after the multi-factor authentication (MFA) step, you will be again asked if you want to enable faster login on the device.

Issue:

How to exclude file extensions from WithSecure Elements EPP for Computers and for Servers Real-time scanning using the WithSecure Elements Endpoint Protection portal?

Resolution:

Follow these steps to create an Real-time scanning exclusion for specific file extensions: 

1. Log in to the Elements Endpoint Protection portal
2. Go to the Profiles page
3. Select the profile you want to edit
4. Go to the Real-time scanning settings
5. In the File scanning section, enable Exclude files with the following extensions
6. In the Excluded extensions, enter the file extensions in format ABC instead of .ABC (use space between extensions if you enter multiple)
7. Click Save and Publish

Issue:

How to create a Connection Control exclusion, so that a URL or website address will not be blocked by Elements Endpoint Protection (EPP for Computers or EPP for Servers) Connection Control feature?

Resolution:

The site needs to be added to the allowed sites list, so that the user can continue to the website even if it would be blocked by the Connection Control feature. 

You can add the website URL address to the allowed sites list in the profile used be the devices by following these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Open the Security Configurations section from the menu on the left
3. Go to the Profiles page
4. Click on the profile you want to edit
5. Go to the Browsing Protection settings page
6. Scroll down to the Web site exceptions section and enable it
7. In the Allowed sites section, click Add sites
8. Enter the site address which you want to allow
9. Click Save profile

Once the profile has been saved and published, all devices using the profile will be able to go to the allowed site even if Connection Control is activated.

Note: there is no setting for stopping Connection Control from activating on a web site that has been marked as a banking site. with the Connection control sites setting you can only make Connection Control activate on non-banking sites. 

Issue:

How to create a Real-Time Scanning or DeepGuard exclusion for a file or folder for Elements Endpoint Protection (EPP for Computers or EPP for Servers) when the SHA-1 of the application changes with each update?

Resolution:

You can exclude a file or folder from all security measures by following these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Security configurations > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save

Note that you can use wildcards when creating the exclusions:
For example: C:\Users\*\AppData\Local\test\ 

This would exclude the AppData\Local\test\ folder and all its sub folders for all users.

If you want to locally on the device itself create the exclusion:

1. Open the Elements Agent user interface on the device
2. Go to Settings 
3. Go to the Malware protection settings page
4. Click view quarantine (enter administrator username and password if needed)
5. Select the Excluded tab
6. Click Add new 
7. Add the file path or folder path
8. Click OK

DeepGuard can also be excluded using the SHA-1 of the process:

1. Log in to the Elements Endpoint Protection portal 
2. Go to the Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Exclude folders and files from all security scans list
5. Click Save and publish

Issue:

How to report a false positive or negative for Elements Collaboration Protection?

• Harmless website / link / webpage / attachment file blocked and email has been quarantined (false positive)
• Harmful website / link / webpage / attachment file has been allowed through (false negative)

Resolution:

If you suspect the detection to be a false positive or negative, submit the file or URL sample to our labs to have the detection corrected. How to proceed for the submissions is documented in our Help Guide page with the link to our labs page: Creating and Viewing Sample Validation Requests in the Request Views | Welcome to WithSecure Elements | Latest | WithSecure User Guides 

It usually takes our labs 24-48h to have the file or URL analyzed and have the detection corrected. 

The URL can also be reported directly from the Elements Collaboration Protection portal's Security alerts page. 

If the email is urgent and the cause for the quarantine is a possibly malicious URL, you can add the URL to Trusted websites by using these steps:

1. Log in to the Elements Collaboration Protection portal
2. Go to the Policies page
3. Select a profile you want to edit
4. Select the Exchange online > URL scanning
5. Scroll down to the Trusted websites section and enable it
6. Enter the domain address in the Websites field
7. Click Save

Issue:

When the Tamper Protection (Resource protection) feature enabled on a device,  how can the Elements Agent be uninstalled if Tamper Protection is blocking the uninstallation using uninstallation tool and a local user is not allowed to use the Windows apps and features function to uninstall Elements Agent?

Resolution:

The WithSecure uninstallation tool will not run if Tamper Protection feature is enabled. If Tamper Protection is enabled from the Elements profile and local uninstallation is not allowed, you must modify the Elements profile so that local uninstallation is allowed and tamper protection is not enabled. 

To disable Tamper Protection, follow these steps:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Scanning settings page
5. Scroll down to the Tamper Protection section 
6. Disable Turn on Tamper Protection
7. Click Save profile

To allow local uninstallation with admin rights, follow these steps: 

1. Log in to the Elements portal: https://elements.withsecure.com
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the General settings page
5. Scroll down to the Security features section
6. Enable Allow user to uninstall the product
7. Click Save profile

If you are unable to change the profile settings for the device, you can as a last resort boot the computer to Windows Safe Mode with Networking and run the WithSecure Uninstallation Tool there.