Issue:

When trying to change subscription key for an Elements Endpoint Protection device on the Elements Security Center portal's Environment > Devices page, the Change subscription button remains grey and is unclickable. Unable to change subscription key due to this issue.

Resolution:

The Change subscription button can stay grayed out because of a few reasons:

• There are no licenses remaining on the subscription key you have selected from the drop-down menu.
• You have not selected a subscription key at all from the drop-down menu. 

Note that in the new Devices view, you can no longer manually enter a subscription key, you need to select it from a drop-down menu. The drop-down menu is only filtered when you enter a subscription key to the search field.

The drop-down menu only includes the subscription keys from the scope you are currently in. So if you are a reseller partner and you want to move a device between two different company accounts, you will need to select the Solution provider scope from the scope-selector on top of the page so that the subscription key is listed in the drop-down menu. 

Since the Devices page shows all the devices under a partner, you can add a Company name equals filter to show only the devices of the one customer company for whom you want to change subscription keys for. 
 

Issue:

How to install WithSecure Elements Agent (EPP for computers or Servers) to a custom or non-default directory path and how to change the location of the Elements Agent installation for example to another drive than C: or D: drive or to another partition?
 

Resolution:

You can download the MSI installation-package from the Elements Security Center's Management > Downloads page and use the TARGETDIR parameter.

Example: msiexec /i C:\path\to\installer.msi /qn VOUCHER=aaaa-bbbb-cccc-dddd-eeee TARGETDIR="D:\installfolder"

Issue:

How to create a specific CRON expression for Elements Endpoint Protection Automated Tasks feature. I what format should the CRON expression be in the schedule field? 

Resolution:

Below you will find a detailed explanation of the format of schedule expressions. A CRON expression is a string composed of four fields (separated by white spaces) that represent a time schedule.

The general form is as follows:
<hours> <days of month> <months> <days of week>

Important: The same task cannot be executed more than once an hour, even if the task is specified to run more often.Use randomization (#) to prevent overloading the network.The accuracy of the task execution is always rounded up to an hour.

Issue:

We have noticed that the the profile on some Elements Endpoint Protection devices has changed to another profile. What can cause the device to get another profile assigned to it automatically? 

Resolution:

If one or more Elements devices has been automatically assigned a profile, check if you have create Profile assignment rules and that the rules and conditions are created correctly. 

You can access the profile assignment rules by following these steps:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Go to the Provide assignment rules tab

On this page you can find the Profile assignment rules section which includes rules about which profile should be automatically assigned to each type of device based on specific conditions. The conditions include:

• AD Organizational Unit path
• IPv4
• DNS
• Host name

So if you have a profile assignment rule that uses one of the mentioned conditions and that value on the device has changed, it can cause the profile assignment rule to automatically assign a different profile to a the device. 

Issue:

We have tried enabling Elements Collaboration protection for OneDrive, SharePoint and Teams on the Cloud services page in the Elements Security Center portal, but the protection status for them goes to disabled or disconnected state repeatedly even if we try to re-enable the proction.

Why is the protection status for OneDrive, SharePoint and Teams randomly disabled?

Resolution:

This can happen in two cases:

Permission issue: You need to make sure from Azure that the permissions for the Elements Collaboration Protection app have not been revoked. 

Microsoft issue (invalid token): Reauthentication is required. The should be a connect button under SharePoint tab when you are in the cloud services view and you have clicked the cloud service. Press that, and follow the on-screen instructions.

Issue:

Is it possible to automatically isolate a device from the network with Elements Endpoint Protection Agent when an infected / malicious file on a device is found?

Resolution:

If a file is detected as malicious by Elements Endpoint Protection's real-time scanning or DeepGuard features, the device cannot be automatically set to be isolated from the network. When real-time scanning or DeepGuard detect a file, the Elements Agent will either Block, Quarantine or Delete the file based on the action on infection setting in the device profile. 

Only if Elements Detection and Response (EDR) detects a medium or higher risk level detection on a device, can it be set to isolate the device from the network. This is done using the Automated actions rule which is an EDR feature. 

To create an Automated actions rule for your devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Automated actions page
3. Select the General page
4. Click Add rule
5. Enter a name for the rule
6. Select Rule type as Endpoint
7. Select response as Device isolation
8. Select the organizations the rule applies to (this setting is for partners)
9. Select if the rule should apply to also devices which have been classified as "critical"
10. Select the risk level when the rule should be triggered
11. Select schedule as Continuous
12. Click Add

Issue:

After clicking Export security events (JSON) on the Elements Security Center portal's Events > Security Events page, the .json file is never downloaded.  

I only received the notification: "Your data is being prepared for export, which may take a few minutes. Then the download will begin automatically." 

Resolution:

When the .json file is successfully downloaded, it should the following two notifications after the "Your data is being prepared for export" notification:

• The export data has been successfully prepared. Downloading is starting.
• JSON file has been successfully downloaded. This file can be used for importing into MS Excel

If you do not receive these two notifications at the bottom of the screen, we recommend to first try to create a smaller .json file to export. The current maximum amount of events one export can include is around 10,000. We recommend to break the export to for example smaller time ranges. 

When you click on the Export security Events (JSON) button, it will try to prepare and download a .json that includes all the security events based on the current filters chosen on the Events > Security Events page. Try to modify the filters so that there are fewer events in one export. 

If issue would persist even if you fewer events per export, try to use an incognito / inprivate browser window or other browser altogether to see if that fixes the issue. 

Issue:

When I'm logging into the Elements Security Center portal, I get the following prompt:

• "Verify Your Identity – Check your preferred one-time password application for a code. "

What is this code that the Elements portal is asking for and where can I find it. 

Resolution:

The one-time password that the Elements Security Center portal is asking is the two-factor authentication (2FA) / multi-factor authentication (MFA) code. The 6 digit verification code can be found in the authenticator application on your mobile device. When you took the feature into use, you were able to choose yourself the authenticator application you wanted to use. 

Most popular authenticator applications are:

• Google Authenticator
• Microsoft Authenticator

There should be a WithSecure entry in the application that shows a 6 digit code that changes every 30 seconds. 

If you are unable to find the code:

• If you are an end-customer: Ask one of your colleagues to delete your administrator account from the Elements Security Center portal's Management > Organization settings > Security Administrators page. Then your colleague can add your adminstrator account again so that you will receive a new welcome email from which you can start over. If you do not have a colleague who can delete and re-create your account and you have a Partner Managed subscription, ask your WithSecure reseller partner to delete and re-create your user account.
• If you are a WithSecure partner with Partner Portal access rights on your user account, one of your colleagues must create a support request through the Partner Portal to have the user account deleted. If you do not have colleagues, contact your WithSecure sales contact. 

Issue:

How does Elements Mobile Protection license usage work on Android devices which have separate work and personal profiles? Will Elements Mobile Protection installed in the work profile protect the personal profiles configured on the Android device? 

Resolution:

Elements Mobile Protection is the mobile app accompanied with WithSecure Elements Endpoint Protection (EPP). With EPP, Mobile Protection is designed to complement and be deployed via third-party Mobile Device Management solutions.

Many of these MDM solutions are also designed to work with the Android Enterprise platform. The Android Enterprise platform offers a way of keeping work apps and data separate from personal apps and data by creating separate profiles, see this article. Profiles never share data, so this enables companies to manage their work apps and data without compromising employee privacy.

Companies may use different ways of managing their mobile fleets. For example, companies may allow the use of one's own device (BYOD=Bring Your Own Device) and deploy a work profile on that, or companies may offer fully-managed, company-owned devices intended exclusively for work purposes.

As Mobile Protection is an app offered as an enterprise solution, WithSecure cannot know which type of management solution the company offers. If Mobile Protection is installed on a device with both a work and personal profile in use, Mobile Protection is not able to protect any apps or data on the device's personal profile. This is due the design of the Android Enterprise Platform and how the division between work and personal profiles is managed.

If company offers fully-managed company-owned devices, this means that Mobile Protection can be installed and enabled using an enterprise license without the need to buy a separate license. 

Issue:

When trying to release an item from quarantine or allow a blocked app / file, Elements Endpoint Protection Agent – App and file control shows the following notification and asks for a password: 

"This app can harm your computer. Do you want to restore this app to its original location and let it run? The app is exempt from future malware scans."

What is the password I need to enter? 

Resolution:

The password is the password your administrator has set in the Elements Endpoint Protection profile as the Password for releasing blocked or quarantined items 

The password cannot be viewed from the profile, since it will only show an asterisk. If you have forgotten the password, you can change it by following these steps: 

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile which is in use on the devices
4. Go to the Scanning settings page
5. Scroll down to the Quarantine section
6. Enter a new password to the Password for releasing blocked or quarantined items (optional) field
7. Click Save profile