Issue:

Following a Elements Collaboration Protection change on September 10, mailbox usage reporting to the dashboard was unintentionally left disabled. As a result, the Active Mailboxes metric in the Home Dashboard may incorrectly show 0 active mailboxes from September 11 onward.

Resolution:

This issue was resolved on September 21st, 2026.

Issue:

Elements Linux Protection or Business Suite Linux Security 64 installation fails with error "Warning: Installation timed out on setting up SELinux integration.". 

Full error message: 

Installing WithSecure Linux Security 64
Setting up integration with SELinux

Warning: Installation timed out on setting up SELinux integration.

Product activation failed to complete successfully. Please check the product
installation and network connectivity requirements, and retry the installation
after making changes (if any) to the system configuration. Before contacting
WithSecure support, please run the command
/opt/f-secure/linuxsecurity/bin/fsdiag․sh
to generate a diagnostics package from this system, and attach the package
(whose file name the command will output) to the support request.
setup: timed out on setting up SELinux policy integration: failed to find SELinux module withsecure-linuxsecurity-services installed
2026-09-07 13:06:52 src/fsbootstrap.c:488[7] executing '/opt/f-secure/linuxsecurity/download/linuxsecurity-1200-linux-x86_64/1774510304/content/setup' failed, result 256
2026-09-07 13:06:52 src/fsbootstrap.c:244[7] install failed
activate: activation failed: exit status 2
Failed to activate the product!

Resolution:

If you have followed the uninstallation instructions to remove the previous Linux Security 64 or Elements Linux Protection installation and you still receive the "Warning: Installation timed out on setting up SELinux integration." error when trying to install the Linux client, check if you have SELinux in use. 

If you have SELinux in use and you receive the error message even though you have set SELinux into permissive mode, it could be that the SELinux policy modules of a previous Linux Security 64 or Elements Linux Protection installation cause a conflict with the new modules that the installer is trying to set up. 

You can use the semodule –list-modules command to list all the modules. If you can see in the resulting list any withsecure or fsecure related modules, please remove them using the semodule -r command.  Then run the command semodule -B to recompile the active policy. 

After you have done these steps you can try the client installation again. 

Issue:

Normally, the alert notification email from EDR will be sent when a detection with he risk level at "Severe", "High" and "Medium" has been added to the portal, but is it possible to configure the alert email that ONLY will be notified when "Severe" or "high" risk level has happened?  Is it possible to filter the email alerts coming from EDR? I don't want to get a lot of low risk alert emails, but only medium and higher. Or only higher or severe etc.

Resolution:

From the Management > Organization Settings > Detection and Reponse settings tab, it is not possible to edit which classification EDR detections would send emails.

In this case, you have to use this workaround to generate an email report that only goes when there is High or Severe level detection:

1. Log in to the Elements portal
2. Go to Events > Security Events
3. Apply these two filters:
   • Source Equals EDR 
   • Severity Equals Action needed
4. Open the view menu on the top right corner and select "Save as" at the bottom of the menu
5. Give the view a descriptive name and save it
6. Go to Reports > Email notification and report
7. Click Add email report
8. Give it a name you want to see in your email subject
9. For Data source select Security Events
10. For template select the view you previously created
11. Configure schedule and recipient (continuous will send email every even 10 minutes if a new event has appeared)
12. Leave the Send only when report has content toggle enabled
13. Click Save

This report report is sent whenever High or Severe level detection appears on that Security Events page. Unfortunately, it is not possible to choose to send emails only about Severe level detections, because on the Security Events page that Severity equals Action needed filter includes both High and Severe level detections.

We will be improving those reporting and email features this year, but there is no specific estimate at this time.

Here you need to note that if you are trying to send a test report from that new report using the Send test report button, remember to first temporarily disable Send only when report has content, because if there is no content in the report, the test report will not be sent either.

Here is an in more detail explanation why the test report is not being sent: https://community.withsecure.com/en/kb/articles/32337-no-test-report-sent-when-security-events-source-is-used-for-elements-email-notification-and-report

Issue:

How to reset two factor authentication (2FA) for a WithSecure Business Account (Elements, Partner Portal, eService Portal) user account. 

Example scenarios:

• User has a new mobile device and wants to move or transfer the authenticator to the new device 
• Device that had the multi factor authentication (MFA) application broke or has been lost 

Resolution:

If you still have access to the old authenticator device, you can move the authenticator to a new device by logging in with the existing authenticator to the Elements portal, where you can remove the old authenticator and add a new one: 

1. Log in to the Elements portal: https://elements.withsecure.com
2. Click on the user icon in the top-right corner 
3. Go to My settings 
4. Click on the Change button on the right side of the Multi-factor Authentication enabled text
5. Log in with your existing authenticator codes
6. Click on the Remove button on the right side of the Google authenticator or similar text
7. Confirm the removal by authenticating again with your username, password and authenticator code

Once the existing authenticator has been removed, simply click on the add button to add your new authenticator.

Note: Partner Portal and eService Portal users can also log in to the Elements portal and change the MFA settings.

If you do not have access to the old device, to reset the MFA, ask another administrator to delete your user account and then they can create a new administrator account for you. When the account is re-created, you will get a new Welcome email that includes a temporary password which you can use to log in to the account and then set up a new password and configure MFA. 

If you do not have another administrator on the company account and you have a Partner Managed subscription, you should contact your partner and they can delete the user account. 

To delete the user account, another administrator can follow these steps:

1. Log in to the Elements Security Center
2. Navigate to Management > Organization Settings > Security Administrators
3. Click on the user you want to delete
4. Click Delete 
5. Confirm the deletion 

NOTE: If you are a WithSecure partner with access to the Partner Portal or a WithSecure customer with access to the eService Portal using the same user account, you need to contact Customer Care to have the account removed. 

If you're the only administrator on the Elements account, or the other administrators do not have necessary access rights to create new administrator user accounts, contact WithSecure Customer Care for further assistance.

Issue:

How does the network drive scanning work?

Resolution:

Scan network drives setting is enabled by default.

How does it behave?

• Scanning only happens upon execution of (executable) files on the network drive
• Basic open / close, copy / paste operations for a file are not scanned
  #For Elements EPP, users can enable real time scan for those actions by setting profile "Scan network drives" as "Scan on any file access".  Note:  scanning files on network drive on every file access can be very slow.

Testing with EICAR test file:

• The execution of an eicar.com file will only work on legacy 16-bit systems or those which support it. Most 64-bit systems do not support it and therefor a real time scan test will most likely not trigger an alert on that file.
• However, the manual/scheduled scan will still detect the file

Issue:

User has entered a valid 2-step authentication code from their mobile authentication application, but receive "The verification code that you entered is incorrect. Try again." error when trying to login to the Elements Security Center portal or Partner Portal.

Resolution:

If you have entered the correct code within the allowed time frame but you still receive the error, make sure the time and date is set correctly on your mobile device. Two factor authentication can fail if the date and time it set incorrectly on the mobile device. 
 

To fix the root-cause, configure your mobile to synchronize date and time from the network. For Android phone, use these steps.

• Go into your phone's Settings app
• Go into "System" and then "Date & Time" 
• Select the option to use is "Use network provided date and time" and "use network provided time-zone".

Issue:

Error: "Security administrator cannot be added to this organization." appears on the Management > Organization Settings > Security Administrators page when trying to add administrator in the Elements portal. 

Resolution:

This error usually means that the user already has access rights to an Elements organization. The other organization should delete the user from the organization so that you can add the user to your organization. 

This error can also appear if you try to add a user who has Partner Portal access rights to a company level Elements organization (account). A user who has Partner Portal access rights can only be added to the Solution Provider (SOP) or Service Provider (SEP) organization that has the same ID on both the Partner Portal organization and Elements organization. 

Partner users should not be added to the company level, since if customer has a Partner Managed subscription, a SOP level user can access the company using the scope-selector drop-down menu in the Elements Security Center portal. 

Issue:

After installation of Elements Agent, Elements EPP for Computers, EPP for Servers or Elements EPP for Mobiles host device is not listed on the "Devices" page in the Elements Security Center. Why is the device not found on the "Devices" page?

Resolution:

Follow this checklist to check that all is OK:

• Verify that the product has been installed
• Verify that host is able to communicate to backend servers. You can run the WithSecure Connectivity Tool (wsconnectionchecker.exe) from C:\Program Files (x86)\F-Secure\PSB\ui on the device, to validate the connectivity state to WithSecure backend.
• Confirm that you are using the correct Elements Endpoint Protection subscription key during installation
• If you have installed the Elements Endpoint Protection product on a clone image and are using the same clone image on several devices, it can be that several devices have the same Unique ID (UID). If the devices have identical Unique ID's, only one will be visible in the Elements Portal at a time. You can view the Unique ID from the product's Settings > Central Management page.  If two or more devices have the same UID, use the logout tool to reinitialize the product. This will create a new random UID to the device where you run the tool. For deployment using clone image, check this help guide.
• For installation in persistent mode on VDI systems, in case you have installed the Elements Endpoint Protection product to use SMBIOS GUID as the unique ID, following the steps documented in the help guide.

As a last resort, try uninstalling the product using the uninstallation tool. Then reinstall the product: https://download.withsecure.com/uninstallationtool/WsUninstallationTool.exe

Issue:

Customer or reseller partner would like to cancel an existing Evergreen (SaaS) WithSecure Elements subscription. How to cancel it?

Resolution:

If you have the product through a reseller partner, you need to contact them and they can request a termination of an existing Evergreen (SaaS) subscription. 

If you are a reseller partner, you can terminate a license through the Partner Portal by following these steps:

Partner Portal:

1. To terminate subscription(s) under a contract, proceed to the customer account from Sales > Accounts
2. Choose correct account and proceed to Deal Ordering & Subscriptions tab, click Amend Contracts
3. Select Terminate Subscriptions, click Next
4. Choose the contract and click Select
5. Choose which subscriptions under the contract will be terminated, to proceed click Next
6. Check that the details are correct, and confirm the termination by clicking Terminate
7. Termination is now completed, click Close

Note: Termination that is booked during the on-going month will take effect on the 1st day of the next month

If have purchased the product directly from WithSecure, you can contact your WithSecure sales contact or account manager. If you are unable to reach your WithSecure sales contact or account owner, proceed to contact WithSecure Support.

Issue:

When going in the local Elements Agent user interface to Quarantine and exclusions > Quarantined tab, the Allow button is grayed out and cannot be clicked to release a file from quarantine. How to allow local administrator user to release file from quarantine? 

Resolution:

To allow a local administrator user to release files from quarantine, you need to allow these two settings in the Elements profile that is in use on the device:

First allow user to create global exclusions:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the General > End user rights settings page
5. In the Scanning settings section, unlock Global exclusions
6. Click Save profile

Then allow user to release files from quarantine:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Scanning settings page
5. Scroll down to the Quarantine section and enable Allow users to release blocked and quarantined items
6. Click Save profile 

Once the profile changes have been updated to the device, the Allow button will no longer be greyed out in the local Elements Agents user interface In the App and file control > Quarantined tab.