{"id":4471,"date":"2026-06-08T17:52:12","date_gmt":"2026-06-08T14:52:12","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4471"},"modified":"2026-06-08T17:52:12","modified_gmt":"2026-06-08T14:52:12","slug":"after-installation-of-elements-endpoint-protection-agent-protection-is-in-malfunction-state-and-unable-to-download-malware-definition-updates","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fi\/support-articles\/after-installation-of-elements-endpoint-protection-agent-protection-is-in-malfunction-state-and-unable-to-download-malware-definition-updates\/","title":{"rendered":"After installation of Elements Endpoint Protection Agent, protection is in malfunction state and unable to download malware definition updates"},"content":{"rendered":"<h3>Issue:<\/h3>\n<ul>\n<li>After installation, Elements Agent (EPP for Computers and EPP for Servers) is in <b>Protection malfunction<\/b> state<\/li>\n<li>Status shows\u00a0<b>Computer is not protected<\/b><\/li>\n<li><b>Check for updates<\/b>\u00a0page shows the product to be unable to download malware definition updates from the update server<\/li>\n<li>Elements Agent does not communicate to Withsecure cloud environment. Withsecure Connectivity tool shows everything as &quot;Green&quot; and working.<\/li>\n<\/ul>\n<h3>Resolution:<\/h3>\n<p>First check the\u00a0<strong>Updates\u00a0<\/strong>page in the Elements Agent settings and check if it is the\u00a0<strong>Ultralight Core (64-bit)\u00a0<\/strong>installation which fails. If it is failing, make sure that you have the required Windows updates for Azure Code Signing (ACS) support:\u00a0<a href=\"https:\/\/community.withsecure.com\/fi\/kb\/articles\/29714-changes-in-support-on-microsoft-windows-minimum-patch-level\" target=\"_blank\" rel=\"noopener\">Changes in support on Microsoft Windows \u2013 Minimum patch level. &#8211; WithSecure Community<\/a><\/p>\n<p>If you are pushing offline MSI through GPO every day, this can be a reason for failure, and uninstallation of Ultralight engine, leading to malfunction state.<\/p>\n<p>If the product is unable to contact the update server, it will not be able to download any virus definition updates and will begin to show the protection malfunction error and ask the user to restart the computer.\u00a0<\/p>\n<p>You can check the connectivity to the update server by clicking the <strong>view log file<\/strong> link in the product settings window &gt; Updates.<\/p>\n<p>If the connection to the update server fails, you need to ensure that your\u00a0firewall or proxy is not blocking the connectivity. You can run the Connectivity Tool to check for connectivity issues:\u00a0C:\\Program Files (x86)\\F-Secure\\PSB\\ui\\wsconnectionchecker.exe<\/p>\n<p>Just in case the product can reach the update server and download most of the updates but does not download\u00a0only certain update(s) (for example, Capricorn update, etc.), we propose to remove the product using the uninstallation tool, and then re-install:<\/p>\n<p>You can download the uninstallation tool here: <a href=\"https:\/\/download.sp.f-secure.com\/uninstallationtool\/FsUninstallationTool.exe\" target=\"_blank\" rel=\"noopener\">https:\/\/download.sp.withsecure.com\/uninstallationtool\/WsUninstallationTool.exe<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Elements EPP &#8211; Protection is malfunction and unable to download the definition updates<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-4471","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000011443","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:52:12","import_hash":"9e74025d2c363c6bca0a35322f64998e7947ea6d","vanilla_article_id":32532,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32532-after-installation-of-elements-endpoint-protection-agent-protection-is-in-malfunction-state-and-unable-to-download-malware-definition-updates","vanilla_kb_id":30,"vanilla_category_id":102,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article\/4471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/media?parent=4471"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article_product?post=4471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}