Issue:

• After installing Elements Agent (EPP for Computers or for Servers), VPN connection stopped working and is blocked by the Windows firewall.
• How to create a custom Elements Endpoint Protection profile to allow the VPN connection?
• Which ports need to be opened to allow PPTP, L2TP and IPSec VPN connection through the firewall?

Resolution:

In this case, you have to start by creating a custom profile that can be edited.

Creating a custom profile:

1. Log in to the Elements Security Center Portal
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the circular symbol with three dots in the middle next to the profile you want to clone
5. Press on the clone profile
6. Enter the name and label of the new custom profile

After creating a custom profile, you can start creating new firewall rules.

Creating a new VPN firewall rule:

1. Select the profile you want to use
2. Go to the Firewall settings page
3. Go to Firewall rules and select add rule
4. Enter a name and description of the rule, e.g Allow VPN

The ports and protocols that need to be allowed vary between each VPN connection type. Verify with your VPN provider the type of VPN connection you are using and which ports to open.

To allow common PPTP VPN traffic:

• Allow PPTP tunnel maintenance traffic, open outbound TCP port 1723
• Allow PPTP tunneled data to pass through the router, open outbound protocol 47 (GRE)

To allow common IPSec VPN traffic:

• Allow Internet Key Exchange (IKE), open UDP port 500 outbound
• Allow IPSec Network Address Translation (NAT-T), open UDP port 4500 outbound
• Allow Encapsulation Security Payload protocol (ESP), open protocol 50 outbound
• Allow Authentication Header protocol (AH), open protocol 51 outbound
• Allow  IP-in-IP Encapsulation, open protocol 4 outbound.

If IPSec IKEv2 VPN connection is not working after creating the above firewall rules, enable Allow unknown outbound connections from the profile and see if it helps. By default Windows firewall has unknown outbound connections allowed, while the WithSecure firewall profile will block them. 

To allow common L2TP VPN traffic: 

• Allow L2TP traffic, open UDP port 1701 outbound
• Allow protocol 115 outbound

Once the firewall rules have been created, the profile needs to be assigned to the target devices. 

Assigning a profile:

1. Go to the Devices page
2. Choose the device(s) to which you want to assign a profile to
3. Click on Assign > Assign profile 
4. Select the profile with the VPN firewall rules and click Assign

Issue:

How to create a custom email report for Elements Endpoint Protection? How to have an email report include specific information, such as:

• Device name
• Client version
• Assigned profile
• Status updated
• Malware protection status
• Software updates status 

Resolution:

Elements Endpoint Protection has the Email notification and report feature, which you can use to create a custom report that you can have automatically sent periodically (daily, weekly, monthly). 

You need to first create a custom view on the Devices page, which can then be used as a template for the email report:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Environment > Devices page
3. Click on the three vertical lines on the right side of the devices list 
4. In the Visible columns leave only Type, Name and Client version and then close the list by clicking X 
5. Save the custom view by opening the View drop-down menu in the top-right corner and then clicking Save as > enter name > Save
6. To have the view visible for all users in the organization, click on the three dots on the right side of the newly created view and then select Move to organization views

After you have created the custom view, you can create the email report:

1. Go to the Reports page
2. Go to the Email notification and report tab
3. Click Add email report 
4. Enter report name and choose Devices as the Data source
5. Select the template that you have created previously on the Devices view
6. Set you preferred report frequency and schedule
7. Enter recipients and click Save 

Issue:

How do I create my company account in the Elements Endpoint Protection Portal?

Resolution:

Follow the steps below to create your company account in the Elements Endpoint Protection Portal:

1. In your License certificate that was provided by your WithSecure Reseller, verify your Elements subscription key.
2. After verifying the subscription key, go to the WithSecure Elements self-registration page: https://elements.withsecure.com/self-register
3. Enter your subscription key and click submit
4. Follow the on-screen instructions to enter the information of the first administrator user:

• The User name is the login name, not your email address.
• The Account name* should be defined exactly same as the Licensee* name found in the License certificate.

Once the administrator account has been successfully created, you will receive a welcome email from which you can log in for the first time to the WithSecure Elements portal and set up your password and two-factor authentication method. 
 

Issue:

How can I export the infection report from the Elements Endpoint Protection portal?

Resolution:

You can export the report the following way:

1. Login to Elements Endpoint Protection portal
2. Go to the Reports page
3. Go to the Infections tab
4. Click on the Action menu next to Infections (3 dots)
5. Select Export Report (CSV)

Issue:

How do I retrieve quarantined emails from the Collaboration Protection Portal?

Resolution:

Issue:

How to remotely change the subscription key of the Elements Endpoint Agent (EPP for Computers and EPP for Servers) via the Endpoint Protection Portal?

Resolution:

Follow these steps to remotely change a subscription key of a device using the Endpoint Protection Portal:  

1. Log into the Endpoint Security Center Portal: https://elements.withsecure.com
2. Open the Environment section from the menu on the left
3. Go to the Devices page
4. Select the devices (a menu will appear)
5. Click on Change subscription
6. Search for and select the subscription key from the drop-down list
7. Click Change subscription

Note:

• For company level users, both the old and new subscription keys have to be on the same Elements company account. You cannot change the subscription key if the keys belong to two different company accounts. 
• Users with SOP (Solution provider) or SEP(Service Partner) level access to the Elements Portal will be able to change subscription between company accounts if the accounts are both Partner Managed and listed under them. You need to have the Solution Provider/Service Partner level selected from the Scope-selector when you select the devices for Company A, so that the subscription for Company B is selectable in the Change subscription drop-down menu. (The listed subscription keys in the drop-down menu are based on the account you have selected from the scope-selector). A partner therefore needs to select their own Solution Provider/Service Partner account from the scope-selector drop-down menu and then go to the Devices page and add a Company name equals [customer name] filter to only show the one company's devices. After that you can select the devices and use the Change subscription operation.
• You cannot change subscriptions from Trial subscription key to another Trial subscription key.
• If an EPP subscription has been activated on the device, you cannot change to a stand-alone EDR or Stand-alone Vulnerability Management subscription using the Change subscription feature. You need to locally change the subscription key using ws_oneclient_logout.exe.

On Windows devices, the subscription key, which the Elements Agent uses, can also be changed locally on a client or server using our ws_oneclient_logout.exe tool.
The tool can be found in the products installation folder. 

1. Open a Command Prompt as an administrator
2. Navigate to C:\Program Files (x86)\F-Secure\PSB\
3. Run the following command: ws_oneclient_logout.exe –keycode <subscription-key>

(Enter the subscription key between < >and then remove them)

The WithSecure Elements Agent installation will then immediately start using the new subscription key and connect to the correct Elements account.

On Mac OSX devices, when the device is managed by WithSecure Elements Security Center (ESC), the local UI is intentionally locked. Therefore, the license cannot be changed locally on the device. The subscription/license key must be updated from the ESC portal, and the change will be pushed to the device automatically.

Environment > Devices > Change subscription 

Issue:

How to create an exclusion for a certain software update with the WithSecure Software Updater feature in the Elements Security Center Portal for EPP for Computers or EPP for Servers devices? I do not want to have Software Updater installing updates automatically or have the user manually installing the update.

Resolution:

Prerequisite: You need to have a non-default profile before you can configure your software updater settings.

You can exclude specific software updates from automatic installation or you can include specific software updates in automatic installation by following these steps:

1. Log in to the Elements Portal: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile you want to modify
5. Go to Software updater settings tab
6. Under Exclude from automatic installation, click Add exclusion
7. Select from the Conditions drop-down menu one of the following:
   • Update name contains
   • Software name contains
   • Vendor name contains 
   • Severity equals to
   • Bulletin ID equals to
8. Then depending on the rule you've chosen, enter the value to the remaining field. Examples:
   • Update name contains: Google Chrome 89.0.4389.82 (Note: for Microsoft updates, do not include the version number. Use for example only the KB number)
   • Software name contains: Google Chrome
   • Vendor name contains: Google Inc.
   • Severity equals to: Critical Security / Important Security 
   • Bulletin ID equals to: FSPM-41-64283-4 (Note: Same update can have several different Bulletin IDs due to for example Operating system version)

You can view the update details from the Software Updater page in the Endpoint Protection Portal.

Note: 

• Only one software per exclusion is supported. If you need to add multiple software, click Add exclusion again.
• You can add several conditions in one rule, if you want to combine for example Software name contains and Severity equals to conditions, click Add condition in the Conditions column.

After the profile has been saved and published, the exclusion/ will be taken into use on the devices that have this profile assigned. 

If you would like to hide the update completely from being detected as missing by Software Updater, you need to exclude it via the following setting in the Endpoint Protection Portal profile editor:

1. Log in to the Elements Portal
2. Under Security Configurations, select Profiles on the sidebar.The Profiles page opens.
3. Select the For Windows Servers tab or For Windows Computers tab, and then select the profile that you want to edit. The Profile for Windows Servers or for Windows Computers opens
4. Select the profile you want to modify
5. Go to Software updater settings tab
6. Scroll down to the Exclude from scanning section
7. Click Add exclusion

When the update is hidden with this rule, the update will not be listed at all in the Software Updates Missing updates tab in the Endpoint Protection portal. It will also not be visible locally on the device for the user.

Issue:

How to add trusted email sender in Elements Collaboration Protection?

Resolution:

Follow these steps to add an email address as a trusted sender:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Navigate to the Collaboration Protection > Policies page
3. On the Policies page, select the policy you want to modify.
   • Note: Default WithSecure owned policies cannot be modified. 
4. Select the Exchange tab.
5. Under Trusted senders, do the following to add trusted senders.
   1. Select ON
   2. Select Scan and alert (low severity) when harmful content detected if you want the system to alert if harmful content is detected.

      Note: When this option is selected, emails are still scanned but no action is taken and the email items are still passed through.

   3. In the Trusted email sender addresses field, add the email addresses of those senders whose email messages are not quarantined or deleted.
   4. In the Trusted sender domains field, add those sender domains that you consider trusted. Email messages coming from those domains are not quarantined or deleted.

Visit the product admin guide for more information:

https://www.withsecure.com/userguides/product.html#business/fse4ms365/latest/en/task_7177D009B59245F38D9051D201AF825E-latest-en

Issue:

How to change Elements Collaboration Protection Exchange online mailbox type between user and non-user? 

Resolution:

The mailbox type listed in the Elements Collaboration Protection portal has to do with the type of Microsoft 365 tenant / account itself. There are no settings in Elements Collaboration Protection portal to change the mailbox account type.

The mailbox type will be recognized accordingly by Elements Collaboration Protection portal when a new Microsoft for Office 365 tenant / account has been added to the cloud service, so if the type is wrong currently in the Elements Collaboration Protection portal's Exchange view, you will need to check your mailbox settings from the Microsoft for Office 365 side. 

Some Microsoft for Office 365 accounts are meant for meetings or other shared uses, thus they are considered as non-user mailboxes.
 

Issue:

I want to give a different device name to the computer on which I have installed Elements Agent (EPP for Computer or EPP for Servers), how to change the device name (alias) in the Element Security Center Portal?
 

Resolution:

Follow these steps to change device name in the Elements Security Center Portal:

1. Log in to the Elements Security Center Portal: https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. Click on the device in the list
4. Click add alias on the right side of the device name
5. Enter the new name and click Save