Issue:

We have deleted some mailboxes from our Exchange / Microsoft Office 365 / Azure, but even after deleting the mailboxes the Elements Collaboration Protection Subscription usage still shows that the license is used. Why is the license not released immediately after deleting a mailbox? 

Resolution:

When a mailbox is deleted on the Azure side, it will take 24 hours before Elements Collaboration Protection marks it as "Unavailable". These Unavailable mailboxes don't get removed from the view immediately but they also do not reserve any licenses.

Issue:

How to change the default profile that is taken into use after installing Elements Endpoint Protection Agent (Elements EPP for Computers or Servers) or automate profile selection with Active Directory?

Resolution:

To change the default profile for Elements Endpoint Protection devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Go to the Profile assignment rules tab
4. In the Profile assignment rules table, in the Default rules section, click on the three dots on the right side of the client type for which you want to change the default profile
5. Select Edit
6. Select the profile from the Assign profile drop-down menu 
7. Click Save

On the Elements Security Center portal's Profile assignment rules tab you can enable Change tracking if you want to continuously evaluate rules for the devices, and change the profile and label assignments for each device when changes in the Active Directory Organizational Unit, IP, reverse DNS, WINS name or asset groups are detected.

To create a custom rule so that a device is assigned an Elements profile automatically based on its AD Organizational Unit path:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Go to the Profile assignment rules tab
4. In the Profile assignment rules section, click Add Custom rule
5. Select from the Condition drop-down menu either:
   1. Enter AD Organizational Unit path
   2. Select AD Organizational Unit path
6. Enter or select the AD Organizational Unit path
7. Select the client type:
   1. Windows workstations
   2. Windows servers
   3. Mac computers
8. Assigning asset group and labels is optional 
9. Click Add rule

Now the devices will be automatically assigned a profile based on their AD Organizational Unit path. 

Issue:

How to remove duplicate Elements EPP for Computers or EPP for Servers device from the Elements Security Center portal's Environment > Devices page?  

Resolution:

Unless you have the Manage automatic deletion feature set up, a device will not be automatically removed from the Elements Security Center Portal's Environment > Devices list even if it is a duplicate and there is an extended period of inactivity. Each duplicate inactive device needs to be removed manually and each device listed on the Devices page uses one license. 

To best view which duplicate device is the one no longer connected to the ElementsSecurity Center Portal, you can follow these steps:

1. Login to the Elements Endpoint Protection Portal
2. Go to the Environment > Devices page
3. Sort the devices according to Device name and determine from the Registration date and Status updated columns which is the device no longer connected to the Elements Security Center Portal
4. Select the duplicate device (a menu will pop-up)
5. Click Remove device 

Once the device has been removed, the license is released and can be used on another device. 

You can use the Manage automatic deletion feature to remove inactive devices automatically from the Elements portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. Click on the three dots and select Manage automatic deletion
4.  Enable Automatically delete devices that are offline for the selected period of time 
5. Enter the amount of days
6. Click Save

Devices which have been automatically deleted will be able to reappear on the Elements portal's Devices page if the device becomes active again and Elements Agent is still installed on the device.

Issue:

What is the Software updater scanning interval when "Scan automatically for missing updates" is enabled in the profile for Elements Endpoint Protection (Elements EPP for Computers and EPP for Servers)?

Resolution:

Elements Endpoint Protection Software updater automatically scans for missing updates at least every 24 hours. Software Updater will also can for missing updates upon system reboot start or when manual installation of an update is performed through the Elements Security Center portal. 

If you want to create a schedule to scan for missing Software Updater updates, you can do that with the Automated tasks feature in the Elements profile:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the Automated tasks settings page
5.  Click Add task 
6. Select from the Type drop-down menu Scan for missing updates 
7. Enter a schedule

Issue:

When Elements Agent is uninstalled either locally or with an uninstall operation sent from the portal, is the device removed automatically from the Elements Security Center portal's Environment > Devices list?

Resolution:

Yes, the device is removed automatically from the Elements Security Center Portal's Devices list if the Elements Agent is uninstalled either locally or via an uninstall operation and the device has an internet connection and can connect to the Elements Security Center portal. 

If there is no internet connectivity on the device, to remove the device from the Elements Security Center Portal, proceed as follows:

1. Log in to the Elements Security Center Portal
2. Go to the Environment > Devices from page
3. Select the device you want to remove from the portal by checking the box placed next to it
4. Select Remove device from the menu at the bottom 

When a device is removed from the Elements portal, the license will be released.

Issue:

Alerts of "Connection refused" related to the doorman backend are being output frequently by Elements Linux Protection.

Example:
doormand: Failed to send request to Doorman: generic:111 = Connection refused

Resolution:

Make sure that the connections to the following Security Cloud domains are allowed on your Firewall and proxy.

Business Suite 16 onwards

• corp-reg.fsapi.com This server is used by Policy Manager for license registration. Blocking this server will prevent license validation.
  guts2.fsapi.com (also TCP/80) This server is used to deliver updates for scanning engines and detection rules, and for some products updates to the software itself. Blocking this server will completely stop security updates.
• a.karma.sc2.fsapi.com
• restmc.mind.sc2.fsapi.com
• mind-failover.sc2.fsapi.com
• api.doorman.fsapi.com Backend services needed for Security Cloud functionality
• api.prd.glb.us-prd.fsapi.com Used to control updates for Linux Security 64
• download.fsapi.com Used for the hotfix update mechanism for Linux Security 64

If you have allowed the connections, you could check the connectivity status to the domains by accessing to the following URLs from any affected server.

https://baseguard.doorman.fsapi.com/doorman/v1/healthcheck
https://doorman.sc.fsapi.com/doorman/v1/healthcheck
https://a.karma.sc2.fsapi.com/healthcheck

If you are using a proxy, check the connectivity status from your Linux server to the proxy server and make sure that it could be done successfully.

Issue:

We are using Endpoint API to generate a CSV report but the headers in the CSV are in the wrong or incorrect language. How to have the output to be in a specific language? 

Resolution:

The language the CSV headers are output in is determined by the user account's language settings. To change the language settings for the user:

1. Log in to the Elements Security Center portal
2. Click on the user icon in the top-right corner 
3. Click My Settings 
4. Select your desired language from the Language drop-down menu
5. Click Save

Issue:

What are the supported Windows, Linux and Mac Operating Systems (OS) or platforms for Elements Endpoint Protection?

Resolution:

The currently supported Operating Systems (OS) for all Elements Endpoint Protection products can be found in the user guides: WithSecure User Guides 

Each user guide has a System requirements section which will show the supported systems for each product. 

Issue:

If we have new users added to our Microsoft Azure tentant, how to have Elements Collaboration Protection protect newly-added mailboxes, SharePoint and Teams assets and OneDrive drives?

Resolution:

To have newly added users assets automatically protected by Elements Collaboration Protection, follow these steps:

1. Log in to the Elements Security Center portal
2. Navigate to the Collaboration Protection > Cloud services page
3. Click on the cloud service 
   1. From the Exchange tab, enable Automatically protect newly-added mailboxes
   2. From the SharePoint tab, enable Automatically protect newly-added SharePoint and Teams assets
   3. From the OneDrive tab, enable 

Note that Teams shares this setting with SharePoint. 

Issue:

Is it possible to configure Elements Security Center portal to send Security Events email alert notifications only for devices assigned with a specific Elements profile? 

Resolution:

There is no in-built feature in the Elements Security Center portal to only send email alerts if an Elements Endpoint Protection device has been assigned a specific Elements profile. 

You would need to use this workaroud:

1. Assign a label to each of the devices that has the profile
2. Create a custom view on the Events > Security Events page that has the filter Device Label = <your-label-here>. Then save the view as an Organization view. 
3. Go to the Reports > Email notification and report page and create an email report that uses the recently created security event view as the data source and then schedule the email report frequency to be Continuous. Enable Send only when report has content.

This way a report will be sent every 10 minute interval when a new security event has appeared on the devices.