{"id":4393,"date":"2026-06-08T17:53:00","date_gmt":"2026-06-08T14:53:00","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4393"},"modified":"2026-06-08T17:53:00","modified_gmt":"2026-06-08T14:53:00","slug":"elements-portal-shows-malware-protection-malfunction-status-for-an-elements-endpoint-protection-for-mac-device","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/elements-portal-shows-malware-protection-malfunction-status-for-an-elements-endpoint-protection-for-mac-device\/","title":{"rendered":"Elements portal shows Malware protection malfunction status for an Elements Endpoint Protection for Mac device"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>The device status in the Elements Endpoint Protection Portal shows that the <strong>Malware protection<\/strong> status as <strong>Malfunction<\/strong> on the Mac device and Overall protection is shown with <strong>Malware issue\u00a0<\/strong>status. How to get this fixed?<\/p>\n<h3>Resolution:<\/h3>\n<p>If the MacOS device&#39;s malware protection status is shown to be in malfunction status, the most likely reason is that Elements Agent has not been granted Full Disk Access and the WithSecure System extension hasn&#39;t been enabled. You can from the Elements portal check the status of both of these by opening the device details and then from the <strong>Protection status<\/strong> tab you expand the\u00a0<strong>Security parameters\u00a0<\/strong>drop-down list. From there you can make sure that both\u00a0<strong>Full Disk Access\u00a0<\/strong>and\u00a0<strong>System extension\u00a0<\/strong>are shown as\u00a0<strong>Enabled<\/strong>.\u00a0The software needs both of these to function as intended.<\/p>\n<p>Normally after product installation there would appear a notification pop-up on the right side of the screen which would forward the user to the correct MacOS settings page where the user can allow Full Disk Access and the WithSecure System Extension for the Elements Agent. If the user did not click on the notification pop-up after product installation, they need to manually allow these from the MacOS settings.<\/p>\n<p>You need to do the following:<\/p>\n<ol>\n<li>Go to <strong>System Preferences<\/strong> (Apple logo menu from top left corner)<\/li>\n<li>Click <strong>Security and Privacy<\/strong><\/li>\n<li>Click <strong>Privacy<\/strong><\/li>\n<li>Select <strong>Full Disk Access<\/strong> on the left pane<\/li>\n<li>Click the <strong>lock<\/strong> in the bottom-left corner to make changes, and login with your Mac password (if prompted)<\/li>\n<li>Tick the box next to WithSecure Elements Agent and WithSecure System Extension on the list<\/li>\n<li>Click the <strong>lock<\/strong> again to prevent further changes<\/li>\n<\/ol>\n<p>If for some reason the Full disk access list would be empty, try restarting the computer and try again. If all else fails, uninstall and reinstall Elements Agent and allow the Full Disk Access and the WithSecure System Extension immediately after installation.\u00a0\u00a0<\/p>\n<p>Full disk access and WithSecure System Extension installation can also be automated using MDM:\u00a0<a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/31284-pre-announcement-new-withsecure-client-for-macos\" target=\"_blank\" rel=\"noopener\">https:\/\/community.withsecure.com\/en\/kb\/articles\/31284-pre-announcement-new-withsecure-client-for-macos<\/a><\/p>\n<p>If issue is not caused by the extensions, it is also recommended to check your firewall and proxy (if applicable) settings to make sure that the software can download all the required updates and connect to the Elements portal:<\/p>\n<p><span style=\"font-family: Courier New,Courier,monospace;\">Port 443 (HTTPS)<br \/>Port 80 (HTTP)<\/p>\n<p>*.f-secure.com<br \/>*.fsapi.com<br \/>*.digicert<\/p>\n<p>ocsp.rootca1.amazontrust.com<br \/>crl.sca1b.amazontrust.com<br \/>ocsp.rootg2.amazontrust.com<br \/>ocsp.sca1b.amazontrust.com<br \/>crl3.digicert.com<br \/>crl4.digicert.com<br \/>ocsp.digicert.com<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The device status in the Elements Endpoint Protection Portal shows that the Malware protection status as malfunction on the Mac device. How to get this fixed?<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-4393","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000013019","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:53:00","import_hash":"bd028ac6a5f92a724b30697a2d6139ddb0a55a37","vanilla_article_id":32488,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32488-elements-portal-shows-malware-protection-malfunction-status-for-an-elements-endpoint-protection-for-mac-device","vanilla_kb_id":30,"vanilla_category_id":102,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4393"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}