To stay updated on your favorite discussions, please create an account or log in. Then, click the Bookmark icon to subscribe and receive notifications.

Connect-ExchangeOnline Powershell Blocked by Withsecure Agent

Agente000mcm
Agente000mcm Posts: 2 Security Scout
edited October 15 in Elements Endpoint Detection and Response (EDR)

Hello Community,

I recently noticed, that the cmdlet "Connect-ExchangeOnline" in Powershell is not usable, unless we deactive the Agent for a brief time until we finished our changes.

Is this a known problem, do other people have it as well and is there a fix?

Thanks and have a nice day

Mattia

Answers

  • Sethu Laks
    Sethu Laks Staff, Moderator Posts: 287 W/ Moderator
    edited February 29

    Hi Mattia,

    Thanks for reaching out the WithSecure Community. We haven't heard similar reports from other customers. To help us get to the bottom of this, could you please tell us:

    • Which version of the WithSecure Agent are you using?
    • When you run "Connect-ExchangeOnline" in PowerShell, do you see any error messages?

    This information will give us important clues and help us troubleshoot more effectively. The sooner we have these details, the faster we can work on a solution for you.

    Best regards,
    Sethu
    Community Moderator | Technical Support Engineer
    WithSecure™ https://www.withsecure.com/en/home

  • Agente000mcm
    Agente000mcm Posts: 2 Security Scout

    @Sethu Laks

    Thanks for your patience, I have opened a Ticket at Withsecure, but with the suggestions we were given until now, we weren't successful.

    Agent Version: 24.1

    When Withsecure Agent is Active (also when disabling DataGuard and DeepGuard):

    image.png

    When Withsecure Agent is turned off the connection is successfull.

    No clue what the issue is. But I doubt, that we are the only ones that have that issue. Also it should be very easy to replicate.

    Best Regards

    Mattia

  • Sethu Laks
    Sethu Laks Staff, Moderator Posts: 287 W/ Moderator

    Hi Mattia,

    Thank you for submitting the support ticket and providing us with the screenshot of the PowerShell error. At this point, please wait for a response from our support as we need to analysis the logs to identity the reasons behind the command blockage.

    If you are certain that "Connect-ExchangeOnline" is a legitimate command, you can consider adding it to the exception list in your WithSecure exclusion settings. This action instructs the software to permit the specific command. (Note: Proceed with caution and only add commands to the exclusion list if you are confident about their safety.)

    Best regards,
    Sethu
    Community Moderator | Technical Support Engineer
    WithSecure™  https://community.withsecure.com/home/leaving?allowTrusted=1&target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fhome

This discussion has been closed.

Categories