Issue:

Is there a way to disable the email notification alerts for detections in Elements Collaboration Protection? Users would not want to receive the notification emails when malware has been found in an attachment or an email has been quarantined because it included a malicious URL address.

Resolution:

Yes, it is possible to disable the notifications that are sent to the users about detections by Elements Collaboration Protection:

If you want to disable the user notifications for detection completely for when malware has been detected in an email:

1. Log in to the Elements Security Center portal
2. Navigate to the Collaboration Protection > policies page
3. Open the policy that is in use on your cloud service
4. Go to the Exchange > Malware
5. Untick the Notify the user about detections with the following severities:
6. Click Save

If you want to disable the user notifications for detection completely for when malicious URL or suspicious URL has been detected in an email:

1. Log in to the Elements Security Center portal
2. Navigate to the Collaboration Protection > policies page
3. Open the policy that is in use on your cloud service
4. Go to the Exchange > URL scanning page
5. Untick Notify the user about detections with the following severities under both Malicious URL and Suspicious URL
6. Click Save

If you want to disable the user notifications for detection completely for when a compromised account detection has been made towards the users email address:

1. Log in to the Elements Security Center portal
2. Navigate to the Collaboration Protection > policies page
3. Open the policy that is in use on your cloud service
4. Go to the Exchange > Compromised accounts page
5. Untick Notify the user about detections with the following severities
6. Click Save

If you only want to not send user notifications based on the severity of the alert:

1. Log in to the Elements Security Center portal
2. Navigate to the Collaboration Protection > policies page
3. Open the policy that is in use on your cloud service
4. Go to the General > Notifications page
5. From the User notifications based on severity, select the desired severity level that triggers a user notification:
   1. All (Low, Medium, High & Critical)
   2. Medium, High & Critical
   3. High & Critical
   4. Critical
6. Click Save

Issue:

Getting error "user already has access to another organization" when trying to self-register Elements Collaboration Protection.

Resolution:

If you are a customer who receives this error message when self registering your Elements Collaboration Protection subscription: 

• If you have already previously bought Elements subscriptions through the same reseller partner, you most likely do not need to follow the self-registration path since the subscription key should already be on your existing Elements company account if the partner sold you a Partner Managed subscription of Elements Collaboration Protection.
• If issue persists, try another email address or contact your reseller partner. 

If you are a partner and you are trying to self-register either an Elements Collaboration Protection NFR license or a commercial license you bought for your own organization:

• Make sure that the subscription key is not already in your Elements portal's company level account's Management > Subscriptions page. An administrator with Identity and Access Management right can from the Management > Organization Settings > Security administrators page grant everyone access to the Collaboration Protection product.
• If the Collaboration Protection subscription is not already on your Elements company level account, open a support case through the Partner Portal.

Issue:

Cannot delete or remove file from SharePoint quarantine that was quarantined by Elements Collaboration Protection

Resolution:

SharePoint Items that have been moved to quarantine by Elements Collaboration Protection cannot be manually deleted or removed. They are automatically deleted based on the time set in the Elements Collaboration Protection policy for your cloud service. 

1. Log in to the Elements Security Center portal
2. Navigate to the Collaboration Protection > Policies page
3. Open the profile which is in use on your cloud service
4. Select the SharePoint tab
5. Under Quarantine, from the drop-down menu, select a time period after which old items will be deleted automatically.
6. Click Save

Now the items will be automatically deleted after the amount of time you have set in the policy. 

Issue:

We have set up the Endpoint Detection and Response (EDR) Automated actions rule so that it automatically isolated devices from the network which have a received a Broad Context Detection that matches a specific risk level threshold.

We don't want for example our critical servers to ever be automatically isolated from the network. Can specific devices be excluded from being isolated automatically by the EDR Automated actions rule?  

Resolution:

Yes, specific devices can be excluded so that the EDR Automated actions device isolation rule doesn't isolate them from the network. The Automated actions rule can be set to only apply to non-critical devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Automated actions page
3. Click on the automated actions rule
4. Click Edit from the bottom of the page
5. from the Applies to section, tick only Non-critical devices and leave the Critical devices option unticked
6. Click Save

Now you can assign the Critical importance to the devices which you do not want to have automatically isolated by the automated actions feature:

1. Navigate to the Environment > Devices page
2. Select the devices from the list
3. Click Update importance 
4. Select Critical
5. Click Update

Issue:

After creating an advanced response task for Elements Endpoint Detection and Response (EDR), the State is shown as Finished but the Progress column shows the task Failed.

What can cause the advanced response task to fail? 

Resolution:

If the EDR advanced response tasks fail, first you need to make sure that the Advanced response actions are enabled in the Elements profile:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the General settings page
5. In the Integrations section, make sure that Advanced response is enabled
6. Click Save profile

Also make sure that the required network connections are allowed. For that you can run the wsconnectionchecker.exe tool found in the Elements Agent installation folder: C:\Program Files (x86)\F-Secure\PSB\ui

The connection checker tool has tests for WithSecure EDR Response Server, which need to succeed for the advanced response actions to work. 

If response actions are enabled in the profile and the connections show OK status, but the response action tasks would still fail, you need to make sure that the task you have created does not have any errors. For example if you have created a retrieve files task, you need to make sure that the folder path is valid. 

Issue:

We have a device isolation rule created with the automated actions feature for Elements Endpoint Detection and Response (EDR) that should isolate the device from the network, but after a Broad Context Detection (BCD) occurred on a device, either:

• The automated actions device isolation rule did not trigger at all
• Device protection status is shown as "isolated from network" in the Elements Security Center portal but device is still able to access the local network resources and / or some parts of the internet

Resolution:

If the automated action isolate device rule did not trigger at all and the device status is not shown as "isolated from the network", you need to make sure that the risk level (severity) of the Broad Context Detection (BCD) was high enough to trigger the automated actions device isolation rule. 

To view the Broad Context Detection risk level:

1. Log in to the Elements Security Center portal
2. Navigate to the Events > Broad Context Detections page
3. View the risk level from the Risk column

To view which risk level triggers the Automated actions device isolation rule:

1. Log in to the Elements Security Center
2. Navigate to the Security Configurations > Automated actions page
3. Click on the rule which has the response "Device isolation"
4. View the risk level from the Risk level field

If for example the Broad Context Detection risk level (severity) was Medium or High, and the automated actions device isolation rule was set to trigger only to Severe risk level detections, you need to edit the rule. 

If the automated actions device isolation rule has triggered but the device is still able to access the local network resources and / or some parts of the internet, you need to make sure that you do not have any firewall rules created by Group Policy Object (GPO). 

The WithSecure network isolation feature is based on the Windows Firewall functionality. While this approach has its own merits, it also has a lot of limitations, including inability to override any GPO firewall rules.

If you do not have GPO rules, make sure that you have not created too open Network isolation rules in the Elements profile. The Network isolation rules are taken into use then device isolation is triggered. 

1. Log in to the Elements Security Center
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the device
4. Go to the Firewall settings page
5. Scroll down to the Network isolation section
6. Check the current Firewall rules for WithSecure profile: Network isolation and then the Allowed domains settings to make sure that they do not give too wide access for the device when it has been isolated from the network

Issue:

How to uninstall Elements Endpoint Protection Agent if the device was removed permanently from the Elements Security Center Portal Environment > Devices list and the profile that was assigned has the setting "Allow the user to uninstall the product" set to disabled.

Resolution:

If local uninstallation of Elements Agent is disallowed and Tamper Protection feature is also enabled in the Elements profile that was left on a device when the device was removed from the Elements Security Center portal, then you have two options:

• Reboot Windows to Safe Mode with Networking and uninstall the software using the WithSecure Uninstallation Tool, which you can download from the WithSecure Support Tools website. The uninstallation tool will be able to uninstall Elements Agent when if Windows Safe Mode, since there the WithSecure services do not start automatically.
• Reconnect the device to the Elements portal by reactivating the subscription key on the device by using the ws_oneclient_logout.exe tool. Once device is visible in Elements portal use either the Uninstall operation to uninstall Elements Agent or assign the device a profile that allows local uninstallation.

1. 1. Open a Command Prompt as administrator
   2. Navigate to C:\Program Files (x86)\F-Secure\PSB
   3. Run command:
      1. ws_oneclient_logout.exe –keycode XXXX-XXXX-XXXX-XXXX-XXXX

Issue:

Unable to uninstall Elements Agent for Windows because Tamper Protection is enabled and the subscription has expired. How to uninstall Elements Endpoint Protection Agent when the license has expired? 

Resolution:

When the Elements Endpoint Protection (Elements EPP for Computers or Servers) subscription has expired, it is no longer possible to change the settings of the Elements Agent through the Elements Security Center portal. 

Tamper Protection is enabled by default in the Elements profile, which means that the WithSecure Uninstallation Tool for Windows cannot be used to uninstall the Elements Agent. 

By default, local uninstallation with administrator rights is allowed in the Elements profile, so you can go to the Installed apps list in Windows to uninstall Elements Agent. If you have a custom profile in use that has local uninstallation disallowed, you need to reboot into Windows Safe Mode with Networking and then run the WithSecure Uninstallation Tool there, since in Windows Safe Mode the WithSecure services do not start automatically and therefore Tamper Protection cannot block wsuninstallationtool.exe from running.

You can download the WithSecure Uninstallation Tool from the WithSecure Support Tools page: https://support.withsecure.com/en/support/support-tools 

Issue:

How to locally disable or turn off Connection Control for an Elements Endpoint Protection (EPP for Computers or EPP for Servers) device?

Resolution:

To disable Connection Control locally from the Elements Agent local user interface:

1. Open the Elements Agent user interface
2. Go to Settings
3. Go to the Secure Browsing settings page
4. Scroll down to the Connection Control section and disable the feature

Note: Administrator rights are required to edit settings. Click on the Edit settings button on the left to log in with your administrator rights.

If you want to only temporarily disable the Connection Control feature, we recommend to simply use the End button from the Connection Control banner when it appears when you enter a banking website. This way Connection Control is stopped only during this browsing session. 

Issue:

Error when updating Azure Entra ID Identity script;

"ERROR during Azure deployment: Cannot validate argument on parameter 'Tenant'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.
Collecting information on failed deployments…"

Resolution:

Do make sure that any older or previous script is removed before running a newer script.

1. Go to Azure and open the Cloud Shell
2. Cleanup the old script files from their Azure shell using rm -r withsecure
3. Upload the new script to the shell and unzip it
4. Change directory to the withsecure folder using cd withsecure
5. execute the update command: ./deploy.ps1 -update $true

Issue:

The remove button is greyed out for some items or applications in the App and file control's Excluded tab in the Client Security or Server Security user interface.

Resolution:

The Remove button in the App and file control window's Excluded tab can be grayed out and unclickable for specific items or applications on the list because the exclusion has been created by an administrator as a policy distributed from the Policy Manager Console. You can ask your administrator to remove the exclusion. 

In the Policy Manager Console, the exclusion can be removed like by following these steps:

1. Open the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to the Windows > Real-time scanning settings page
5. Scroll down to the Files and applications excluded from scanning table
6. Select the file path from the list 
7. Click Clear row
8. Distribute the policy (Ctrl + D)

The Remove button can also be grayed out and unclickable if the administrator has prevented local users from creating exclusions locally on the devices. To allow local users to add exclusions:

1. Open the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to the Windows > Real-time scanning settings page
5. Scroll down to the Files and applications excluded from scanning table
6. Uncheck the Prevent users from adding scanning exclusion option under the table
7. Distribute the policy (Ctrl + D)