<> Trend Micro, Inc. April 27, 2017 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Trend Micro Safe Lock(TM) 2.0 Service Pack 1 Patch 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ NOTE: This readme file was current as of the date above. However, all customers are advised to check the Trend Micro website for documentation updates at: http://docs.trendmicro.com/ Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro documents, please contact us at docs@trendmicro.com. Your feedback is always welcome. Please evaluate this documentation on the following site: http://www.trendmicro.com/download/documentation/rating.asp Contents =================================================================== 1. About Safe Lock 2. What's New 3. Documentation Set 4. System Requirements 4.1 Hardware Requirements 4.2 Supported Operating Systems 5. Installation 6. Post-Installation Configuration 6.1 Setting Up the Approved List 7. Known Issues 8. Release History 9. Contact Information 10. About Trend Micro 11. License Agreement =================================================================== 1. About Trend Micro Safe Lock ======================================================================== Trend Micro Safe Lock consists of an agent program called Safe Lock that resides on endpoints and a server program called Safe Lock Intelligent Manager that manages agents. Trend Micro Safe Lock protects fixed-function computers like Industrial Control Systems (ICS), Point of Sale (POS) terminals, and kiosk terminals from malicious software and unauthorized use. By using fewer resources and without the need for regular software or system updates, Safe Lock can reliably secure computers in industrial and commercial environments with little performance impact or downtime. Trend Micro Safe Lock Intelligent Manager provides centralized monitoring and management of Trend Micro Safe Lock agent deployment, status, and events. For example, administrators can remotely deploy agents, deploy initial agent Approved Lists, and change agent Application Lockdown states. Additionally, Safe Lock Intelligent Manager performs malware scans and administrators can view root cause information on files blocked from running by Safe Lock agents, reducing the time and effort needed to verify events and allowing quick responses to incidents. 2. What's New ======================================================================== Trend Micro Safe Lock agent 2.0 SP 1 Patch 1 includes the following new features and benefits: - Support Windows 10 Enterprise (32-bit/64-bit), Windows 10 IoT Enterprise (32/64bit), and Windows 10 Anniversary Update. - Application lockdown is enhanced with pop-up notifications on managed endpoints to inform the latest application blocking. - Safe Lock can be configured to allow or block storage device access on managed endpoints. The storage devices include USB drives, CD/DVD drives, floppy disks, and network drives. - The agent Setup.ini can be encrypted to prevent unauthorized access. 3. Documentation Set ======================================================================== In addition to this readme.txt, the documentation set for this product includes the following: - Installation Guide (IG): Provides product overview, deployment plan, installation steps, and basic information intended to help you deploy Trend Micro Safe Lock. - Administrator's Guide (AG): Provides post-installation instructions on how to configure the settings to help you get Trend Micro Safe Lock "up and running". Also includes instructions on performing other administrative tasks for the maintenance of Safe Lock. - Knowledge Base: Provides a searchable database of known product issues, including specific problem-solving and troubleshooting topics. http://esupport.trendmicro.com 4. System Requirements ======================================================================== 4.1 Hardware Requirements ===================================================================== Trend Micro Safe Lock does not have specific hardware requirements beyond those specified by the operating system, with the following exceptions: - Available free disk space: 300MB - Monitor and resolution: VGA (640x480), 16 colors 4.2 Supported Operating Systems ===================================================================== Trend Micro Safe Lock can be installed on the following Microsoft Windows platforms: Windows Clients: - Windows 2000 (SP4) [Professional] (32bit) - Windows XP (SP1/SP2/SP3) [Professional] (32bit) - Windows Vista (NoSP/SP1/SP2) [Business/Enterprise/Ultimate] (32bit) - Windows 7 (NoSP/SP1) [Professional/Enterprise/Ultimate] (32/64bit) - Windows 8 (NoSP) [Enterprise] (32/64bit) - Windows 8.1 (NoSP) [Enterprise] (32/64bit) - Windows XP Embedded (SP1/SP2) (32bit) - Windows Embedded Standard 2009 (NoSP) (32bit) - Windows Embedded Standard 7 (NoSP/SP1) (32/64bit) - Windows Embedded 8 Standard (NoSP) (32/64bit) - Windows Embedded 8.1 Pro (NoSP) (32/64bit) - Windows XP Professional for Embedded Systems (SP1/SP2/SP3) (32bit) - Windows Vista for Embedded Systems (NoSP/SP1/SP2) (32bit) - Windows 7 for Embedded Systems (NoSP/SP1) (32/64bit) - Windows Embedded POSReady (32bit) - Windows Embedded POSReady 2009 (32bit) - Windows Embedded POSReady 7 (32/64bit) - Windows 10 Enterprise (32/64bit) Anniversary Update - Windows 10 IoT Enterprise (32/64bit) Anniversary Update Windows Server: - Windows 2000 Server SP4 (32bit) - Windows Server 2003 (SP1/SP2) [Standard/Enterprise/Storage] (32bit) - Windows Server 2003 R2 (NoSP/SP2) [Standard/Enterprise/Storage] (32bit) - Windows Server 2008 (SP1/SP2) [Standard/Enterprise/Storage] (32/64bit) - Windows Server 2008 R2 (NoSP/SP1) [Standard/Enterprise/Storage] (64bit) - Windows Server 2012 (NoSP) [Essentials/Standard] (64bit) - Windows Server 2012 R2 (NoSP) [Essentials/Standard] (64bit) - Windows Server 2003 for Embedded Systems (SP1/SP2) (32bit) - Windows Server 2003 R2 for Embedded Systems (NoSP/SP2) (32bit) - Windows Server 2008 for Embedded Systems (SP1/SP2) (32/64bit) - Windows Server 2008 R2 for Embedded Systems (NoSP/SP1) (64bit) - Windows Server 2012 for Embedded Systems (NoSP) (64bit) - Windows Server 2012 R2 for Embedded Systems (NoSP) (64bit) 5. Installation ======================================================================== For information, see the Installation Guide. 6. Post-Installation Configuration ======================================================================== 6.1 Setting-Up the Approved List ===================================================================== You must set up the Approved List before using the Safe Lock Application Lockdown feature for the first time. For information on setting-up the Approved List, see the Installation Guide. 7. Known Issues ======================================================================== - Windows 2000 SP4 (without Update Rollup), Windows XP SP1, and Windows Server 2003 (no SP) do not support the following features: DLL/Driver Lockdown, Script Lockdown, Integrity Monitoring, USB Malware Protection, Storage Device Blocking, and Predefined Trusted Updater. - Memory Randomization, API Hooking Prevention and DLL Injection Prevention are not supported on 64-bit platforms. - The Custom Action of "Quarantine" is not supported on Windows XP and Windows Server 2003. - If the Custom Action of "Ask Server" is specified, Safe Lock is unable to send files on mapped drives or UNC paths to Trend Micro Safe Lock Intelligent Manager. - All Safe Lock features require Windows Administrator privileges. - The recycle bin may not function properly if it is protected by Write Protection settings. - Safe Lock cannot be installed on endpoints with other Trend Micro products already installed. - Network Virus Protection can only be installed during the initial Safe Lock installation. To enable Network Virus Protection after installation, Safe Lock must be reinstalled. - When installed on English versions of Windows, the Japanese version of Safe Lock may not correctly display all characters. - Safe Lock does not support changing language versions during Safe Lock upgrades. - Safe Lock Trusted Updater or Predefined Trusted Updater do not support the installation of Trend Micro Safe Lock Intelligent Manager. Remove Safe Lock from the endpoint before installing Safe Lock Intelligent Manager. Safe Lock can be installed after installation of Safe Lock Intelligent Manager is complete. - Safe Lock only supports configuration files using UTF-8 encoding. - Safe Lock has the following maximum path lengths (total bytes): - Install: 180 Unable to support DBCS for installation path on English platforms. - ADD/TU: 238 - Export DB: 251 - Import DB: 259 - Export/Import Configuration: 259 - If Safe Lock is installed silently, and the computer must be restarted, it must be restarted manually. - The computer must be restarted for Memory Randomization to be enabled or disabled. - If the Internet Explorer proxy setting is modified, import the Managed Mode configuration to apply that proxy setting (under Managed Mode). - Safe Lock does not support virtualized applications or applications encrypted at the file-system level. - Safe Lock is unable to restore quarantined files to encrypted folders. - Safe Lock displays incorrectly at DPI settings other than the Windows default. - The Safe Lock management console and command line interface cannot be used at the same time by the logged on user or by simultaneously logged on Windows accounts. - If the system tray icon is enabled, local and remote users cannot open the Safe Lock console at the same time. - Files to be added to the Approved List must have read access enabled when they are added. - Application Lockdown must be turned off to configure Windows screen saver. - When the computer is restarted, the Service Stopped event (Event ID 1001) is not logged. - Safe Lock always resolves mapped drives to their UNC paths. For example, selecting a mapped drive Z: will actually select the UNC \\\ path. - Using the Trusted Updater with an MSI file located on a network will result in high CPU usage. Copy MSI files to a local drive before using them with the Trusted Updater. - USB Malware Protection will prevent Trend Micro Portable Security from running automatically. Run launcher.exe manually to scan the computer. - When a script is blocked, two messages are recorded in the Windows Event Log. For example, *.bat will be blocked twice by Trend Micro Safe Lock and will therefore create two block events. - If an EXE file is moved from one folder to another, and the file is blocked, the old path is displayed in the Windows Event log and the Blocked Applications logs. - The message "The event log is full" may appear when creating or importing the Approved List for the first time. This message may not be accurate. - By default, no troubleshooting logs are collected. To collect diagnostic information, enable debug logging in the Diagnostic Toolkit. - Troubleshooting logs cannot be stored using mapped drive paths or UNC paths. - Extracting the log archive located in the installation folder appears to require a password. To access the archive's contents, copy the ZIP file to another folder, extract it, and leave the password field blank. - The computer must be restarted after uninstalling Safe Lock to remove the Diagnostic Toolkit. - The Windows Event Log may contain garbled characters after uninstallation of Safe Lock. - After uninstallation, the following files are not removed by Setup, but can be removed manually: - Temp files - C:\Windows\Temp\INST_WKMsi.log - C:\Windows\Temp\tmdbg.ini - C:\Windows\Temp\TmDbg32.dll - C:\Windows\Temp\TmDbg64.dll - C:\Windows\Temp\wksptl.ini - Log files - C:\Documents and Settings\\Local Settings\ Application Data\Trend Micro\Safe Lock\*.log - C:\Users\\AppData\LocalLow\Trend Micro\ Safe Lock\*.log - Installation folder If the Safe Lock service was stopped before uninstallation, you must manually remove the Safe Lock installation folder. - After installing the Safe Lock agent on an endpoint running Windows Server 2008 without SP2, applications using IIS 7.0 may not work as expected. - Known issues related to Windows Update Support: - Windows Update Support does not support OS upgrade. - Windows Update Support does not support major update for systems running Windows 10. For example, updating Windows 10 from Anniversary Update to Creators Update is not supported. - Windows Update Support is not applicable to Trend Micro Safe Lock installed on endpoints running systems older than Windows Vista. - Windows Update Support may not function when Microsoft KB2862330, KB3110329, or a part of .NET Framework is applied. - Windows Update Support may not work properly if Windows Service Pack is applied. We recommend installing Trend Micro Safe Lock after Windows Service Pack is installed. - Windows application updates may be blocked on systems running Windows 10. - Files added by Windows Update may not be added to the Approved List and may remain blocked on the managed endpoints. Manually add these files to the Approved List or contact Trend Micro support for further assistance. - Safe Lock agents installed on tablets may be unable to resume from the suspense mode using a quick start button due to an internal error. Contact Trend Micro support for further assistance. - Memory Randomization is not supported on systems running the latest version of Windows 10. - Universal Windows Platform is not supported. - Pop-up notification does not support guest accounts on systems running Windows XP. - Windows 2000 SP4 does not support debug log collection using Diagnostic Toolkit. To solve this issue, apply Update Rollup to the managed endpoint or disabling Self Protection of the Safe Lock agent while collecting debug logs. 8. Release History ======================================================================== Trend Micro Safe Lock 1.0 - November 30, 2012 Trend Micro Safe Lock 1.1 - June 7, 2013 Trend Micro Safe Lock 2.0 - December 15, 2014 Trend Micro Safe Lock 2.0 Patch 1 - May 12, 2015 Trend Micro Safe Lock 2.0 Service Pack 1 - April 21, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 - July 26, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 - October 7, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 Patch 1 - April 27, 2017 9. Contact Information ======================================================================== A license to the Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, Maintenance must be renewed on an annual basis at Trend Micro's then-current Maintenance fees. You can contact Trend Micro via fax, phone, and email, or visit us at: http://www.trendmicro.com Evaluation copies of Trend Micro products can be downloaded from our web site. Global Mailing Address/Telephone Numbers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ For global contact information in the Asia/Pacific region, Australia and New Zealand, Europe, Latin America, and Canada, refer to: http://www.trendmicro.com/en/about/overview.htm The Trend Micro "About Us" screen displays. Click the appropriate link in the "Contact Us" section of the screen. Note: This information is subject to change without notice. 10. About Trend Micro ======================================================================== Trend Micro Incorporated, a global leader in Internet content security and threat management, aims to create a world safe for the exchange of digital information for businesses and consumers. A pioneer in server-based antivirus with over 20 years of experience, we deliver top-ranked security that fits our customers' needs, stops new threats faster, and protects data in physical, virtualized and cloud environments. Powered by the Trend Micro(TM) Smart Protection Network(TM) infrastructure, our industry-leading cloud-computing security technology and products stop threats where they emerge, on the Internet, and are supported by 1,000+ threat intelligence experts around the globe. For additional information, visit www.trendmicro.com. Copyright 2017, Trend Micro Incorporated. All rights reserved. Trend Micro, the t-ball logo and OfficeScan are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other product or company names may be trademarks or registered trademarks of their owners. 11. License Agreement ======================================================================== Information about your license agreement with Trend Micro can be viewed at: http://us.trendmicro.com/us/about/company/user_license_agreements/ Third-party licensing agreements can be viewed by selecting the "About" option in the application user interface.