<> Trend Micro, Inc. January 21, 2019 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Trend Micro Safe Lock(TM) 2.0 Service Pack 1 Patch 4 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ NOTE: This readme file was current as of the date above. However, all customers are advised to check the Trend Micro website for documentation updates at: http://docs.trendmicro.com/ Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro documents, please contact us at docs@trendmicro.com. Your feedback is always welcome. Please evaluate this documentation on the following site: http://www.trendmicro.com/download/documentation/rating.asp Contents =================================================================== 1. About Safe Lock 2. What's New 3. Documentation Set 4. System Requirements 4.1 Hardware Requirements 4.2 Supported Operating Systems 5. Installation 6. Post-Installation Configuration 6.1 Setting Up the Approved List 7. Known Issues 8. Release History 9. Contact Information 10. About Trend Micro 11. License Agreement =================================================================== 1. About Trend Micro Safe Lock ======================================================================== Trend Micro Safe Lock consists of an agent program called Safe Lock that resides on endpoints and a server program called Safe Lock Intelligent Manager that manages agents. Trend Micro Safe Lock protects fixed-function computers like Industrial Control Systems (ICS), Point of Sale (POS) terminals, and kiosk terminals from malicious software and unauthorized use. By using fewer resources and without the need for regular software or system updates, Safe Lock can reliably secure computers in industrial and commercial environments with little performance impact or downtime. Trend Micro Safe Lock Intelligent Manager provides centralized monitoring and management of Trend Micro Safe Lock agent deployment, status, and events. For example, administrators can remotely deploy agents, deploy initial agent Approved Lists, and change agent Application Lockdown states. Additionally, Safe Lock Intelligent Manager performs malware scans and administrators can view root cause information on files blocked from running by Safe Lock agents, reducing the time and effort needed to verify events and allowing quick responses to incidents. 2. What's New ======================================================================== Trend Micro Safe Lock agent 2.0 SP 1 Patch 4 includes the following new features and benefits: - Support for Windows 10 October 2018 Update (Redstone 5). - Include additional enhancements to the DLL/Driver Lockdown feature to improve the performance of hash checks done on the Approved List. - Improve event handling for situations when the Approve List is not yet initialized. - Add the option to exclude a folder path or file extension from automatic file enumeration during Approved List initialization. 3. Documentation Set ======================================================================== In addition to this readme.txt, the documentation set for this product includes the following: - Installation Guide (IG): Provides product overview, deployment plan, installation steps, and basic information intended to help you deploy Trend Micro Safe Lock. - Administrator's Guide (AG): Provides post-installation instructions on how to configure the settings to help you get Trend Micro Safe Lock "up and running". Also includes instructions on performing other administrative tasks for the maintenance of Safe Lock. - Knowledge Base: Provides a searchable database of known product issues, including specific problem-solving and troubleshooting topics. http://esupport.trendmicro.com 4. System Requirements ======================================================================== 4.1 Hardware Requirements ===================================================================== Trend Micro Safe Lock does not have specific hardware requirements beyond those specified by the operating system, with the following exceptions: - Available free disk space: 300MB - Monitor and resolution: VGA (640x480), 16 colors NOTE: Only supported CPU architectures are Intel 64 and IA-32. 4.2 Supported Operating Systems ===================================================================== Trend Micro Safe Lock can be installed on the following Microsoft Windows platforms: Windows Clients: - Windows 2000 (SP4) [Professional] (32bit) - Windows XP (SP1/SP2/SP3) [Professional] (32bit) - Windows Vista (NoSP/SP1/SP2) [Business/Enterprise/Ultimate] (32bit) - Windows 7 (NoSP/SP1) [Professional/Enterprise/Ultimate] (32/64bit) - Windows 8 (NoSP) [Pro/Enterprise] (32/64bit) - Windows 8.1 (NoSP) [Pro/Enterprise/with Bing] (32/64bit) - Windows 10 [Pro/Enterprise/IoT Enterprise] (32/64bit) Anniversary Update, Creators Update, Fall Creators Update, April 2018 Update, October 2018 Update - Windows XP Embedded (SP1/SP2) (32bit) - Windows Embedded Standard 2009 (NoSP) (32bit) - Windows Embedded Standard 7 (NoSP/SP1) (32/64bit) - Windows Embedded 8 Standard (NoSP) (32/64bit) - Windows Embedded 8.1 [Pro/Industry Pro](NoSP) (32/64bit) - Windows XP Professional for Embedded Systems (SP1/SP2/SP3) (32bit) - Windows Vista for Embedded Systems (NoSP/SP1/SP2) (32bit) - Windows 7 for Embedded Systems (NoSP/SP1) (32/64bit) - Windows Embedded POSReady (32bit) - Windows Embedded POSReady 2009 (32bit) - Windows Embedded POSReady 7 (32/64bit) Windows Server: - Windows 2000 Server SP4 (32bit) - Windows Server 2003 (SP1/SP2) [Standard/Enterprise/Storage] (32bit) - Windows Server 2003 R2 (NoSP/SP2) [Standard/Enterprise/ Storage] (32bit) - Windows Server 2008 (SP1/SP2) [Standard/Enterprise/ Storage] (32/64bit) - Windows Server 2008 R2 (NoSP/SP1) [Standard/Enterprise/ Storage] (64bit) - Windows Server 2012 (NoSP) [Essentials/Standard] (64bit) - Windows Server 2012 R2 (NoSP) [Essentials/Standard] (64bit) - Windows Server 2016 (NoSP) [Standard] (64bit) - Windows Storage Server 2016 (64bit) - Windows Server 2003 for Embedded Systems (SP1/SP2) (32bit) - Windows Server 2003 R2 for Embedded Systems (NoSP/SP2) (32bit) - Windows Server 2008 for Embedded Systems (SP1/SP2) (32/64bit) - Windows Server 2008 R2 for Embedded Systems (NoSP/SP1) (64bit) - Windows Server 2012 for Embedded Systems (NoSP) (64bit) - Windows Server 2012 R2 for Embedded Systems (NoSP) (64bit) 5. Installation ======================================================================== For information, see the Installation Guide. 6. Post-Installation Configuration ======================================================================== 6.1 Setting-Up the Approved List ===================================================================== You must set up the Approved List before using the Safe Lock Application Lockdown feature for the first time. For information on setting up the Approved List, see the Installation Guide. 7. Known Issues ======================================================================== Known issues in this release: 7.1 Installation and Uninstallation ===================================================================== a. Safe Lock cannot be installed on endpoints with other Trend Micro products already installed. b. When installed on English versions of Windows, the Japanese version of Safe Lock may not correctly display all characters. c. Safe Lock does not support changing language versions during Safe Lock upgrades. d. If Safe Lock is installed silently and the endpoint must be restarted, it must be restarted manually. e. After installing the Safe Lock agent on an endpoint running Windows Server 2008 without SP2, applications using IIS 7.0 may not work as expected. f. Safe Lock agents installed on tablets may be unable to resume from suspend mode using the quick start button due to an internal error. Contact Trend Micro support for further assistance. g. The Windows Event Log may contain garbled characters after uninstallation of Safe Lock. h. After uninstallation, the following files are not removed by Setup, but can be removed manually: - Temp files - C:\Windows\Temp\INST_WKMsi.log - C:\Windows\Temp\tmdbg.ini - C:\Windows\Temp\TmDbg32.dll - C:\Windows\Temp\TmDbg64.dll - C:\Windows\Temp\wksptl.ini - Log files - C:\Documents and Settings\\Local Settings\ Application Data\Trend Micro\Safe Lock\*.log - C:\Users\\AppData\LocalLow\Trend Micro\Safe Lock\*.log - Installation folder If the Safe Lock service was stopped before uninstallation, you must manually remove the Safe Lock installation folder. i. OneDrive integration in Windows 10 Fall Creators Update and April 2018 Update is not supported. Ensure that OneDrive integration is disabled before installing Safe Lock. 7.2 General ===================================================================== a. Universal Windows Platform is not supported. b. Safe Lock does not support virtualized applications or applications encrypted at the file-system level. c. Windows 2000 SP4 (without Update Rollup), Windows XP SP1, and Windows Server 2003 (no SP) do not support the following features: DLL/Driver Lockdown, Script Lockdown, Integrity Monitoring, USB Malware Protection, Storage Device Blocking, Trusted Updater and Predefined Trusted Updater. d. All Safe Lock features require Windows Administrator privileges. e. Safe Lock displays incorrectly at DPI settings other than the Windows default. f. Safe Lock only supports configuration files using UTF-8 encoding. g. Safe Lock has the following maximum path lengths. Maximum path length limitation: - Installation directory path: 180 - File path in the Approved List: 238 - File path of the Trusted Updater: 238 - File path to export the Approved List: 251 - File path to import the Approved List: 259 - File path to export settings: 259 - File path to import settings: 259 Note: The maximum length may be shorter if the path contains double-byte characters. h. If the system tray icon is enabled, local and remote users cannot open the Safe Lock console at the same time. i. The Safe Lock console and command line interface cannot be used at the same time by the logged on user or by simultaneously logged on Windows accounts. j. When the computer is restarted, the Service Stopped event (Event ID 1001) is not logged. k. Default value of Windows Event Log size is 10,240 KB for new installations. Upgrading the Safe Lock agent does not change any user-defined WEL_SIZE values set in the previous installation. l. Secure Boot is not supported in Windows 8 and 8.1. m. In Windows 10 April 2018 Update (Redstone 4) and later, Safe Lock has the following limitations when working with folders where the case sensitive attribute has been enabled: - Enabling the case sensitive attribute for a folder may prevent Safe Lock from performing certain actions (eg. prescan, quick scan, custom actions) on that folder. Folders that do not have the attribute enabled are not affected. - Safe Lock blocks all processes started from folders where the case sensitive attribute is enabled. Additionally, Safe Lock is unable to provide any information for the blocked processes, except for file path. - The Safe Lock agent cannot verify file signatures of files saved in folders where the case sensitive attribute is enabled. As a result, DAC exceptions related to signatures cannot work. 7.3 Application Lockdown ===================================================================== a. Application Lockdown must be turned off to configure Windows screen saver. b. When a script is blocked, two messages are recorded in the Windows Event log. For example, *.bat will be blocked twice by Trend Micro Safe Lock and will therefore create two block events. c. If an EXE file is moved from one folder to another and the file is blocked, the old path is displayed in the Windows Event log and the Blocked Applications logs. d. Files to be added to the Approved List must have read access enabled when they are added. e. Safe Lock always resolves mapped drives to their UNC paths. For example, selecting a mapped drive Z: will actually select the UNC \\\ path. f. The message "The event log is full" may appear when creating or importing the Approved List for the first time. This message may not be accurate. g. Pop-up notifications do not support guest accounts on systems running Windows XP. h. The recycle bin may not function properly if it is protected by Write Protection settings. i. After upgrading Safe Lock agents, old blocking events without hash information may display as Hash: %6 in the Windows Event Viewer. j. On Windows Vista SP0 x86, Safe Lock can perform process chain checks only, but is unable to perform cmdline argument checks. Endpoints running Windows XP, Vista SP1, and above does not have this issue. k. When the path length of an executable file is longer than 260 characters, the executable file is blocked, but the blocked event (Event ID 2509) is not logged. 7.4 Custom Action ===================================================================== a. The Custom Action of "Quarantine" is not supported on Windows XP and Windows Server 2003. b. If the Custom Action of "Ask Server" is specified, Safe Lock is unable to send files on mapped drives or UNC paths to Trend Micro Safe Lock Intelligent Manager. c. Safe Lock is unable to restore quarantined files to encrypted folders. 7.5 USB Malware Protection ===================================================================== a. USB Malware Protection prevents Trend Micro Portable Security from running automatically. Run launcher.exe manually to scan the computer. 7.6 Network Virus Protection ===================================================================== a. Network Virus Protection can only be installed during the initial Safe Lock installation. To enable Network Virus Protection after installation, Safe Lock must be reinstalled. 7.7 Memory Randomization ===================================================================== a. Memory Randomization, API Hooking Prevention and DLL Injection Prevention are not supported on 64-bit platforms. b. The endpoint must be restarted for Memory Randomization to be enabled or disabled. c. Memory Randomization is not supported on systems running the latest version of Windows 10. 7.8 Trusted Updater and Predefined Trusted Updater ===================================================================== a. Safe Lock Trusted Updater or Predefined Trusted Updater do not support the installation of Trend Micro Safe Lock Intelligent Manager. Remove Safe Lock from the endpoint before installing Safe Lock Intelligent Manager. Safe Lock can be installed after installation of Safe Lock Intelligent Manager is complete. b. Using the Trusted Updater with an MSI file located on a network will result in high CPU usage. Copy MSI files to a local drive before using them with the Trusted Updater. c. The Trusted Updater is used to trace descendant processes of an installer. The Trusted Updater ensures that all files created/updated by the installer process and all files created/updated by the descendant processes of the installer are added to the Approved List. However, the Trusted Updater does not support an installer which delegates the installation to another process which is not the descendant process, and all files resulting from this installation are not added to the Approved List. 7.9 Windows Update Support ===================================================================== a. Known issues related to Windows Update Support: - Windows Update Support does not support OS upgrades. - Windows Update Support does not support major updates for systems running Windows 10. For example, updating Windows 10 from Anniversary Update to Creators Update is not supported. - Windows Update Support is not applicable to Trend Micro Safe Lock installed on endpoints running systems older than Windows Vista. - Windows Update Support may not work properly if Microsoft KB2862330, KB3110329, or a part of .NET Framework is applied. - Windows Update Support may not work properly if a Windows Service Pack is applied. We recommend installing Trend Micro Safe Lock after the Windows Service Pack is installed. - Windows application updates may be blocked on systems running Windows 10. b. Files added by Windows Update may not be added to the Approved List and may remain blocked on the managed endpoints. Manually add these files to the Approved List or contact Trend Micro support for further assistance. c. The Trend Micro Safe Lock agent encounters issues if Windows Defender receives updates. 7.10 Managed Mode ===================================================================== a. If the Internet Explorer proxy setting is modified, import the Managed Mode configuration to apply that proxy setting (under Managed Mode). 7.11 Diagnostic Toolkit ===================================================================== a. By default, no troubleshooting logs are collected. To collect diagnostic information, enable debug logging in the Diagnostic Toolkit. b. Troubleshooting logs cannot be stored using mapped drive paths or UNC paths. c. Extracting the log archive located in the installation folder requires a password. To access the archive's contents, copy the ZIP file to another folder, extract it, and leave the password field blank. d. The endpoint must be restarted after uninstalling Safe Lock to remove the Diagnostic Toolkit. e. Windows 2000 SP4 does not support debug log collection using the Diagnostic Toolkit. To solve this issue, apply Update Rollup to the managed endpoint or disable Self Protection of the Safe Lock agent while collecting debug logs. f. Windows 10 environments where Windows Defender real-time protection is enabled may experience performance issues if agent debug mode is enabled. To avoid this issue, add the agent modules below to Windows Defender's exception process before enabling debug mode: C:\Program Files\Trend Micro\Safe Lock\WKSrv.exe C:\Program Files\Trend Micro\Safe Lock\SLCmd.exe NOTE: The module path may vary depending on the environment. 8. Release History ======================================================================== For more information about updates to this product, go to: http://www.trendmicro.com/download Previous releases include the following: Trend Micro Safe Lock 2.0 - December 15, 2014 Trend Micro Safe Lock 2.0 Patch 1 - May 12, 2015 Trend Micro Safe Lock 2.0 Service Pack 1 - April 21, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 - July 26, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 - October 7, 2016 Trend Micro Safe Lock 2.0 Service Pack 1 Patch 1 - April 27, 2017 Trend Micro Safe Lock 2.0 Service Pack 1 Patch 2 - December 27, 2017 Trend Micro Safe Lock 2.0 Service Pack 1 Patch 3 - July 6, 2018 Trend Micro Safe Lock 2.0 Service Pack 1 Patch 4 - January 21, 2019 9. Contact Information ======================================================================== A license to the Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, Maintenance must be renewed on an annual basis at Trend Micro's then-current Maintenance fees. You can contact Trend Micro via fax, phone, and email, or visit us at: http://www.trendmicro.com Evaluation copies of Trend Micro products can be downloaded from our web site. Global Mailing Address/Telephone Numbers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ For global contact information in the Asia/Pacific region, Australia and New Zealand, Europe, Latin America, and Canada, refer to: http://www.trendmicro.com/en/about/overview.htm The Trend Micro "About Us" screen displays. Click the appropriate link in the "Contact Us" section of the screen. Note: This information is subject to change without notice. 10. About Trend Micro ======================================================================== Trend Micro Incorporated, a global leader in Internet content security and threat management, aims to create a world safe for the exchange of digital information for businesses and consumers. A pioneer in server-based antivirus with over 20 years of experience, we deliver top-ranked security that fits our customers' needs, stops new threats faster, and protects data in physical, virtualized and cloud environments. Powered by the Trend Micro(TM) Smart Protection Network(TM) infrastructure, our industry-leading cloud-computing security technology and products stop threats where they emerge, on the Internet, and are supported by 1,000+ threat intelligence experts around the globe. For additional information, visit www.trendmicro.com. Copyright 2019, Trend Micro Incorporated. All rights reserved. Trend Micro, the t-ball logo and Safe Lock are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other product or company names may be trademarks or registered trademarks of their owners. 11. License Agreement ======================================================================== Information about your license agreement with Trend Micro can be viewed at: http://us.trendmicro.com/us/about/company/user_license_agreements/ Third-party licensing agreements can be viewed by selecting the "About" option in the application user interface.