Issue:

If a scheduled scanning time has been set for Elements Endpoint Protection for Computers (Elements Agent), does scheduled scan start on the next startup, in case the system has been shut down or offline during the scheduled scan time?

Resolution:

The scheduled scan does not start on the next computer startup. It will start on the next scheduled time only when the computer is on. 

Issue:

DataGuard blocks SnippingTool as svchost.exe on Windows 10 and 11 devices when taking screenshots with the tool. Allowing Snippingtool.exe does not solve the issue. 

Resolution:

When you take a screenshot with Snipping Tool using the Win+Shift+S keyboard shortcut or with the print screen button, it takes the screenshot immediately and automatically tries to save the file to the users OneDrive folder. When using this method, it uses svchost.exe during this process and this causes svchost.exe to be the last process to access the protected folder. Since svchost.exe is not a trusted application, it will be blocked by DataGuard. 

We do not recommend to add svchost.exe as a trusted application.

There are a few workarounds for this issue: 

• You exclude the screenshots folder from DataGuard so that the folder is not protected
• You open Snipping Tool manually from the Windows Start Menu
• You use the Vaults feature for DataGuard

The first workaround is that you exclude the screenshots folder from DataGuard so that the folder is not protected. Example of an exclusion: 

1. Log in to the Elements Security Center portal (https://elements.withsecure.com)
2. Go to the Security configurations Profiles page
3. Select the profile that is in use on the affected devices
4. Go to the DataGuard settings page
5. Scroll down to the Manually excluded folders section 
6. Click Add path 
7. Add: %userprofile%\Onedrive*\Pictures\Screenshots\
8. Click Save profile

Note: The folder name and path can differ based on the Windows language, so this exclusion might not work for all users, but additional exclusions can be created similarly as in the above example. You can view the DataGuard block detection from the Security Events page in the Elements Endpoint Protection portal to see the path. 

The second workaround is that you can simply open Snipping Tool manually from the Windows Start Menu. When you open Snipping Tool manually and take a screenshot, you can yourself choose the location to which you want to save it. Using this workaround, you can save the file directly to a DataGuard protected folder since the last process to access the protected folder is SnippingTool.exe and it is by default a trusted application.

Third option would be to drop DataGuard completely and use the Vaults (it is subset of DataGuard). Unlike DataGuard, the Vaults defines list of user documents and only the explicitly defined applications allowed to operate over such documents. It doesn't consider a generic folders i.e. problematic location of screen shots as protected.  The Vaults should reduce false positive rates and still provide good level of protection.

Issue:

Installation of F-Secure Elements Computer Protection for Mac fails with error message: "product is not compatible with com.mcafee.menulet."
 

Resolution:

It is advised to disable password and tamper protection for McAfee Business End Point Products to allow F-Secure Sidegrade feature to work. Steps on how to uninstall McAfee can be found from the page: https://community.mcafee.com/t5/Mac-and-Linux-Products/How-to-uninstall-McAfee-Endpoint-Security-for-Mac/td-p/511441

If uninstallation is still unsuccessful, you may need to seek uninstallation assistance from McAfee. 

Issue:

Admin get the message "No more licenses available. To protect additional mailboxes, you need to get more licenses or turn off protection for others" when trying to protect a new mailbox with Elements Collaboration Protection 

Resolution:

The license usage for Elements Collaboration Protection is based on the amount of mailboxes that are being protected. If a Cloud Service tenant has more mailboxes than there are licenses, with the default Protect all mailboxes setting, it will protect the mailboxes in alphabetical order until no licenses are remaining.

To view the amount of licenses in use:

1. Log in to Elements Collaboration Protection portal
2. Go to the Cloud services page
3. Select the Subscription view tab from the top right corner
4. View the subscription usage column for each subscription key (you can open the drop-down menu to view which Cloud service is using the licenses)

If you want to select specifically which mailboxes to protect, you can use the Customize my protection setting. 

Instructions on how to set up protection for the mailboxes in a configured domain. To set up protection for the mailboxes:

1. Log in to the Elements Collaboration Protection portal
2. Select Cloud services on the sidebar
3. Select Configure protection in the row of the new connection in the Exchange column (or click on the protected / unprotected number)
4. In the page that opens, do the following:
   • Select Protect all mailboxes if you want to protect all the existing mailboxes in your account in Microsoft Exchange.
   • Select Customize my protection if you want to select the mailboxes that you want to protect.
     • Note: You can turn on Protect new mailboxes if you want to automatically protect all the new mailboxes. If this setting is off, you must manually select the new mailboxes to add them to the list of protected mailboxes.
   • To add protection for an existing unprotected mailbox on your account, select the mailbox from the mailbox list and at the bottom of the page, select Turn on protection. The status of the mailbox changes to "Protected".

Issue:

When logging in to Elements Security Center, the Collaboration Protection product subscription section shows "no access rights – You do not have rights to Collaboration Protection content of this organization" for it. 

Resolution:

If you are a customer who just bought Elements Collaboration Protection or a partner who has received Not for Resale (NFR) licenses, you need to create the first administrator account from the self-register page. When you use the same email address as your current WithSecure Elements account uses, it will simply add the user rights to your account. 

You can find the instruction steps and the link to the self-register page here: Quick Start – Elements Collaboration Protection | WithSecure™ 

If you already have a colleague with Elements Collaboration Protection access rights to your company's account, that colleague can add administrator user rights for you by following these steps: 

1. Log in to the Elements Security Center 
2. Navigate to Management > Organization Settings 
3. Go to the Security Administrators tab
4. Click Add administrator 
5. Enable Collaboration protection access
6. Click Next 
7. Click Add 

If you are a partner user (solution provider) who does not see the Elements Collaboration Protection product when you log in to the Elements Security Center, you can ask one of your colleagues who has the Management access rights to the Collaboration Protection solution to add the rights by following the earlier mentioned steps.

If no one in your reseller partner  Elements account has Elements Collaboration Protection rights and you do not have any users with Elements Collaboration Protection access rights, open a User Management Assistance support case using the Partner Portal. 

Issue:

We have certain email attachments that are blocked or quarantined by Elements Collaboration Protection due to disallowed content. The files are clean and how do we solve it?

Resolution:

To resolve the blocked attachment due to the "Disallowed content" verdict, you can either allow the file extension or add the trusted sender email address/domain to the tenant's Elements Collaboration Protection policy.

To allow the file extension:

1. Log on to the Elements portal (https://elements.withsecure.com/)
2. Go to Collaboration Protection > Policies
3. Select the tenant's policy
4. Go to Exchaneg > General > Malware scanning
5. In the Disallowed file types section, click on the Configure file types, and untick the target file type
6. Click Save
   

Add the sender address/domain to exclude attachment scanning:

1. Log on to the Elements portal (https://elements.withsecure.com/)
2. Go to Collaboration Protection > Policies
3. Select the tenant's policy
4. Go to Exchange > General
5. Turn on the 'Trusted senders' option
6. Add the sender email:
   1. email address to the Trusted email sender addresses list if you want to allow a specific email address
   2. domain to the Trusted sender domains list if you want to allow a whole domain
7. Click Save

Issue:

When running WithSecure Elements EPP for Servers on an Microsoft RDS server, where multi user can login to this RDS host, WithSecure Connection Control banner is shown for all users on the RDS host

WithSecure Connection Control banner prompts all connected users when one user goes to a banking web page, with the WithSecure banner at the top, for all users that have an active session on the RDS host.

How to only show the WithSecure Connection Control banner for the user, that has an active banking web page open?

Resolution:

The Elements Endpoint Protection "Connection Control" feature is not designed to be used in multi user environments, such as RDS. In order to avoid this scenario, WithSecure Connection Control needs to be disabled. To disable the Elements Endpoint Protection Connection Control feature from the Elements profile, follow the steps below:

1. Log in to the Elements Security Center Portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to edit
4. Go to the Browsing protection settings page
5. Scroll down to the Connection control section 
6. Disable Connection control
7. Click Save profile

Once the device fetches the new profile, Connection control will be disabled and will no longer display the banner when a user enters a banking web page. 

Issue:

Can WithSecure reset the secret key for Elements API connector?

Resolution:

WithSecure is unable to retrieve the secret key for you as it is confidential and as well it will only shown once on the page when it is created. The only alternate way is by deleting/removing the API client and recreate it back.

You may refer to this link for further details if you would like to proceed to delete and recreate it.

Note: Make sure to copy the secret and store it in a safe place. You will be not able to view or access the secret again.

Issue:

1. Can WithSecure endpoint protection clients Elements Linux Protection and Business Suite Linux Security 64 detect viruses and malware for Linux?
2. Are there any limitations? What if the binary is compiled on the host ie. the malware ships as source code. Do we still detect the source code portion ie. is the detection for both the compiled binary and/or the source code part?

Resolution:

1. Yes, we have detections for Linux malware and viruses on both Windows and Linux platforms.
2. Although some malicious source code is detected, we focus on detecting compiled Linux binaries (ELF binaries). Reasoning for this is that malicious source code that needs to be compiled is not an immediate threat as it cannot be executed by itself.

Issue:

Can I install Elements Endpoint Protection Agent on Amazon WorkSpaces Windows 10 and Office 2016 Bundle with an EPP for Computers subscription?

Resolution:

No, Elements Endpoint Protection for Computers cannot be installed on Amazon WorkSpaces Windows 10 and Office 2016 Bundle. Instead, you will need a Elements EPP for Computers license for virtual environments.

Reference
https://aws.amazon.com/about-aws/whats-new/2016/11/amazon-workspaces-introduces-windows-10-desktop-experience/

"Amazon WorkSpaces now offers bundles that come with a Windows 10 desktop experience, powered by Windows Server 2016."