<> Trend Micro, Inc. July 6, 2018 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Trend Micro Safe Lock(TM) 2.0 Service Pack 1 Patch 3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ NOTE: This readme file was current as of the date above. However, all customers are advised to check the Trend Micro website for documentation updates at: http://docs.trendmicro.com/ Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro documents, please contact us at docs@trendmicro.com. Your feedback is always welcome. Please evaluate this documentation on the following site: http://www.trendmicro.com/download/documentation/rating.asp Contents =================================================================== 1. About Safe Lock 2. What's New 3. Documentation Set 4. System Requirements 4.1 Hardware Requirements 4.2 Supported Operating Systems 5. Installation 6. Post-Installation Configuration 6.1 Setting Up the Approved List 7. Known Issues 8. Release History 9. Contact Information 10. About Trend Micro 11. License Agreement =================================================================== 1. About Trend Micro Safe Lock ======================================================================== Trend Micro Safe Lock consists of an agent program called Safe Lock that resides on endpoints and a server program called Safe Lock Intelligent Manager that manages agents. Trend Micro Safe Lock protects fixed-function computers like Industrial Control Systems (ICS), Point of Sale (POS) terminals, and kiosk terminals from malicious software and unauthorized use. By using fewer resources and without the need for regular software or system updates, Safe Lock can reliably secure computers in industrial and commercial environments with little performance impact or downtime. Trend Micro Safe Lock Intelligent Manager provides centralized monitoring and management of Trend Micro Safe Lock agent deployment, status, and events. For example, administrators can remotely deploy agents, deploy initial agent Approved Lists, and change agent Application Lockdown states. Additionally, Safe Lock Intelligent Manager performs malware scans and administrators can view root cause information on files blocked from running by Safe Lock agents, reducing the time and effort needed to verify events and allowing quick responses to incidents. 2. What's New ======================================================================== Trend Micro Safe Lock agent 2.0 SP 1 Patch 3 includes the following new features and benefits: - Support for Windows 10 Professional, Fall Creators Update (Redstone 3), April 2018 Update (Redstone 4) and Windows Storage Server 2016. - Support for Fileless Attack Prevention to monitor processes, process chains and command line arguments. - Enhanced Windows Event Log with hash value of the blocked/allowed files added. - Default size of Windows Event Log increased to 10 MB. - Support for the Secure Boot option of Windows 10. - Support for new Setup.ini options to enable/disable the Trend Micro signature check for remote patch. - Support for updating NAT settings via SLCmd.exe commands or agent configuration import. - Enhanced debug log settings for Safe Lock agent in Setup.ini, to help user analyze problems. 3. Documentation Set ======================================================================== In addition to this readme.txt, the documentation set for this product includes the following: - Installation Guide (IG): Provides product overview, deployment plan, installation steps, and basic information intended to help you deploy Trend Micro Safe Lock. - Administrator's Guide (AG): Provides post-installation instructions on how to configure the settings to help you get Trend Micro Safe Lock "up and running". Also includes instructions on performing other administrative tasks for the maintenance of Safe Lock. - Knowledge Base: Provides a searchable database of known product issues, including specific problem-solving and troubleshooting topics. http://esupport.trendmicro.com 4. System Requirements ======================================================================== 4.1 Hardware Requirements ===================================================================== Trend Micro Safe Lock does not have specific hardware requirements beyond those specified by the operating system, with the following exceptions: - Available free disk space: 300MB - Monitor and resolution: VGA (640x480), 16 colors NOTE: CPU are only Intel 64 and IA-32 Architectures supported. 4.2 Supported Operating Systems ===================================================================== Trend Micro Safe Lock can be installed on the following Microsoft Windows platforms: Windows Clients: - Windows 2000 (SP4) [Professional] (32bit) - Windows XP (SP1/SP2/SP3) [Professional] (32bit) - Windows Vista (NoSP/SP1/SP2) [Business/Enterprise/Ultimate] (32bit) - Windows 7 (NoSP/SP1) [Professional/Enterprise/Ultimate] (32/64bit) - Windows 8 (NoSP) [Pro/Enterprise] (32/64bit) - Windows 8.1 (NoSP) [Pro/Enterprise/with Bing] (32/64bit) - Windows 10 [Pro/Enterprise/IoT Enterprise] (32/64bit) Anniversary Update, Creators Update, Fall Creators Update, April 2018 Update - Windows XP Embedded (SP1/SP2) (32bit) - Windows Embedded Standard 2009 (NoSP) (32bit) - Windows Embedded Standard 7 (NoSP/SP1) (32/64bit) - Windows Embedded 8 Standard (NoSP) (32/64bit) - Windows Embedded 8.1 [Pro/Industry Pro](NoSP) (32/64bit) - Windows XP Professional for Embedded Systems (SP1/SP2/SP3) (32bit) - Windows Vista for Embedded Systems (NoSP/SP1/SP2) (32bit) - Windows 7 for Embedded Systems (NoSP/SP1) (32/64bit) - Windows Embedded POSReady (32bit) - Windows Embedded POSReady 2009 (32bit) - Windows Embedded POSReady 7 (32/64bit) Windows Server: - Windows 2000 Server SP4 (32bit) - Windows Server 2003 (SP1/SP2) [Standard/Enterprise/Storage] (32bit) - Windows Server 2003 R2 (NoSP/SP2) [Standard/Enterprise/Storage] (32bit) - Windows Server 2008 (SP1/SP2) [Standard/Enterprise/Storage] (32/64bit) - Windows Server 2008 R2 (NoSP/SP1) [Standard/Enterprise/Storage] (64bit) - Windows Server 2012 (NoSP) [Essentials/Standard] (64bit) - Windows Server 2012 R2 (NoSP) [Essentials/Standard] (64bit) - Windows Server 2016 (NoSP) [Standard] (64bit) - Windows Storage Server 2016 (64bit) - Windows Server 2003 for Embedded Systems (SP1/SP2) (32bit) - Windows Server 2003 R2 for Embedded Systems (NoSP/SP2) (32bit) - Windows Server 2008 for Embedded Systems (SP1/SP2) (32/64bit) - Windows Server 2008 R2 for Embedded Systems (NoSP/SP1) (64bit) - Windows Server 2012 for Embedded Systems (NoSP) (64bit) - Windows Server 2012 R2 for Embedded Systems (NoSP) (64bit) 5. Installation ======================================================================== For information, see the Installation Guide. 6. Post-Installation Configuration ======================================================================== 6.1 Setting-Up the Approved List ===================================================================== You must set up the Approved List before using the Safe Lock Application Lockdown feature for the first time. For information on setting up the Approved List, see the Installation Guide. 7. Known Issues ======================================================================== Known issues in this release: 7.1 Installation and Uninstallation ===================================================================== a. Safe Lock cannot be installed on endpoints with other Trend Micro products already installed. b. When installed on English versions of Windows, the Japanese version of Safe Lock may not correctly display all characters. c. Safe Lock does not support changing language versions during Safe Lock upgrades. d. If Safe Lock is installed silently, and the computer must be restarted, it must be restarted manually. e. After installing the Safe Lock agent on an endpoint running Windows Server 2008 without SP2, applications using IIS 7.0 may not work as expected. f. Safe Lock agents installed on tablets may be unable to resume from the suspense mode using a quick start button due to an internal error. Contact Trend Micro support for further assistance. g. The Windows Event Log may contain garbled characters after uninstallation of Safe Lock. h. After uninstallation, the following files are not removed by Setup, but can be removed manually: - Temp files - C:\Windows\Temp\INST_WKMsi.log - C:\Windows\Temp\tmdbg.ini - C:\Windows\Temp\TmDbg32.dll - C:\Windows\Temp\TmDbg64.dll - C:\Windows\Temp\wksptl.ini - Log files - C:\Documents and Settings\\Local Settings\ Application Data\Trend Micro\Safe Lock\*.log - C:\Users\\AppData\LocalLow\Trend Micro\Safe Lock\*.log - Installation folder If the Safe Lock service was stopped before uninstallation, you must manually remove the Safe Lock installation folder. i. OneDrive integration in Windows 10 Fall Creators Update and April 2018 Update is not supported. Ensure that OneDrive integration is disabled before installing Safe Lock. 7.2 General ===================================================================== a. Universal Windows Platform is not supported. b. Safe Lock does not support virtualized applications or applications encrypted at the file-system level. c. Windows 2000 SP4 (without Update Rollup), Windows XP SP1, and Windows Server 2003 (no SP) do not support the following features: DLL/Driver Lockdown, Script Lockdown, Integrity Monitoring, USB Malware Protection, Storage Device Blocking, Trusted Updater and Predefined Trusted Updater. d. All Safe Lock features require Windows Administrator privileges. e. Safe Lock displays incorrectly at DPI settings other than the Windows default. f. Safe Lock only supports configuration files using UTF-8 encoding. g. Safe Lock has the following maximum path lengths. Maximum path length limitation: - Installation directory path: 180 - File path in the Approved List: 238 - File path of the Trusted Updater: 238 - File path to export the Approved List: 251 - File path to import the Approved List: 259 - File path to export settings: 259 - File path to import settings: 259 Note: The maximum length may be shorter if the path contains double-byte characters. h. If the system tray icon is enabled, local and remote users cannot open the Safe Lock console at the same time. i. The Safe Lock console and command line interface cannot be used at the same time by the logged on user or by simultaneously logged on Windows accounts. j. When the computer is restarted, the Service Stopped event (Event ID 1001) is not logged. k. Default value of Windows Event Log size (10240KB) for new installations. Upgrading Safe Lock agent does not change any user-defined WEL_SIZE values set in the previous installation. l. Secure Boot will not be supported in Windows 8 and 8.1. 7.3 Application Lockdown ===================================================================== a. Application Lockdown must be turned off to configure Windows screen saver. b. When a script is blocked, two messages are recorded in the Windows Event Log. For example, *.bat will be blocked twice by Trend Micro Safe Lock and will therefore create two block events. c. If an EXE file is moved from one folder to another, and the file is blocked, the old path is displayed in the Windows Event log and the Blocked Applications logs. d. Files to be added to the Approved List must have read access enabled when they are added. e. Safe Lock always resolves mapped drives to their UNC paths. For example, selecting a mapped drive Z: will actually select the UNC \\\ path. f. The message "The event log is full" may appear when creating or importing the Approved List for the first time. This message may not be accurate. g. Pop-up notification does not support guest accounts on systems running Windows XP. h. The recycle bin may not function properly if it is protected by Write Protection settings. i. After Safe Lock agents upgraded, the old blocking events without hash information may display as Hash: %6 in Windows Event Viewer. j. For Windows Vista SP0 x86, Safe Lock could only support process chain check, but could not support cmdline argument check. Windows XP, Vista SP1 and above will not have such issue. k. When a path length of an executable file is longer than 260, an executable file can be blocked, but the blocked event (Event ID 2509) is not logged. 7.4 Custom Action ===================================================================== a. The Custom Action of "Quarantine" is not supported on Windows XP and Windows Server 2003. b. If the Custom Action of "Ask Server" is specified, Safe Lock is unable to send files on mapped drives or UNC paths to Trend Micro Safe Lock Intelligent Manager. c. Safe Lock is unable to restore quarantined files to encrypted folders. 7.5 USB Malware Protection ===================================================================== a. USB Malware Protection will prevent Trend Micro Portable Security from running automatically. Run launcher.exe manually to scan the computer. 7.6 Network Virus Protection ===================================================================== a. Network Virus Protection can only be installed during the initial Safe Lock installation. To enable Network Virus Protection after installation, Safe Lock must be reinstalled. 7.7 Memory Randomization ===================================================================== a. Memory Randomization, API Hooking Prevention and DLL Injection Prevention are not supported on 64-bit platforms. b. The computer must be restarted for Memory Randomization to be enabled or disabled. c. Memory Randomization is not supported on systems running the latest version of Windows 10. 7.8 Trusted Updater and Predefined Trusted Updater ===================================================================== a. Safe Lock Trusted Updater or Predefined Trusted Updater do not support the installation of Trend Micro Safe Lock Intelligent Manager. Remove Safe Lock from the endpoint before installing Safe Lock Intelligent Manager. Safe Lock can be installed after installation of Safe Lock Intelligent Manager is complete. b. Using the Trusted Updater with an MSI file located on a network will result in high CPU usage. Copy MSI files to a local drive before using them with the Trusted Updater. 7.9 Windows Update Support ===================================================================== a. Known issues related to Windows Update Support: - Windows Update Support does not support OS upgrade. - Windows Update Support does not support major update for systems running Windows 10. For example, updating Windows 10 from Anniversary Update to Creators Update is not supported. - Windows Update Support is not applicable to Trend Micro Safe Lock installed on endpoints running systems older than Windows Vista. - Windows Update Support may not function when Microsoft KB2862330, KB3110329, or a part of .NET Framework is applied. - Windows Update Support may not work properly if Windows Service Pack is applied. We recommend installing Trend Micro Safe Lock after Windows Service Pack is installed. - Windows application updates may be blocked on systems running Windows 10. b. Files added by Windows Update may not be added to the Approved List and may remain blocked on the managed endpoints. Manually add these files to the Approved List or contact Trend Micro support for further assistance. 7.10 Managed Mode ===================================================================== a. If the Internet Explorer proxy setting is modified, import the Managed Mode configuration to apply that proxy setting (under Managed Mode). 7.11 Diagnostic Toolkit ===================================================================== a. By default, no troubleshooting logs are collected. To collect diagnostic information, enable debug logging in the Diagnostic Toolkit. b. Troubleshooting logs cannot be stored using mapped drive paths or UNC paths. c. Extracting the log archive located in the installation folder appears to require a password. To access the archive's contents, copy the ZIP file to another folder, extract it, and leave the password field blank. d. The computer must be restarted after uninstalling Safe Lock to remove the Diagnostic Toolkit. e. Windows 2000 SP4 does not support debug log collection using Diagnostic Toolkit. To solve this issue, apply Update Rollup to the managed endpoint or disabling Self Protection of the Safe Lock agent while collecting debug logs. f. Windows 10 environment which Windows Defender real-time protection enabled may occure performance down when agent debug mode is enabled. To avoid this issue, add agent modules below to Windows Defender's exception process before you enabling debug mode. C:\Program Files\Trend Micro\Safe Lock\WKSrv.exe C:\Program Files\Trend Micro\Safe Lock\SLCmd.exe NOTE: The module path may vary depending on the environment. 8. Release History ======================================================================== For more information about updates to this product, go to: http://www.trendmicro.com/download Previous releases include the following: Trend Micro Safe Lock 2.0 - December 15, 2014 Trend Micro Safe Lock 2.0 Patch 1 - May 12, 2015 Trend Micro Safe Lock 2.0 Service Pack 1 - April 21, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 - July 26, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 - October 7, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 Patch 1 - April 27, 2017 Trend Micro Safe Lock 2.0 Service Pack 1 Patch 2 - December 27, 2017 Trend Micro Safe Lock 2.0 Service Pack 1 Patch 3 - July 6, 2018 9. Contact Information ======================================================================== A license to the Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, Maintenance must be renewed on an annual basis at Trend Micro's then-current Maintenance fees. You can contact Trend Micro via fax, phone, and email, or visit us at: http://www.trendmicro.com Evaluation copies of Trend Micro products can be downloaded from our web site. Global Mailing Address/Telephone Numbers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ For global contact information in the Asia/Pacific region, Australia and New Zealand, Europe, Latin America, and Canada, refer to: http://www.trendmicro.com/en/about/overview.htm The Trend Micro "About Us" screen displays. Click the appropriate link in the "Contact Us" section of the screen. Note: This information is subject to change without notice. 10. About Trend Micro ======================================================================== Trend Micro Incorporated, a global leader in Internet content security and threat management, aims to create a world safe for the exchange of digital information for businesses and consumers. A pioneer in server-based antivirus with over 20 years of experience, we deliver top-ranked security that fits our customers' needs, stops new threats faster, and protects data in physical, virtualized and cloud environments. Powered by the Trend Micro(TM) Smart Protection Network(TM) infrastructure, our industry-leading cloud-computing security technology and products stop threats where they emerge, on the Internet, and are supported by 1,000+ threat intelligence experts around the globe. For additional information, visit www.trendmicro.com. Copyright 2018, Trend Micro Incorporated. All rights reserved. Trend Micro, the t-ball logo and Safe Lock are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other product or company names may be trademarks or registered trademarks of their owners. 11. License Agreement ======================================================================== Information about your license agreement with Trend Micro can be viewed at: http://us.trendmicro.com/us/about/company/user_license_agreements/ Third-party licensing agreements can be viewed by selecting the "About" option in the application user interface.