Trend Micro, Inc.

November 2017

 

Trend Micro™ OfficeScan™ as a Service

 

This readme file is current as of the date above. However, all customers are advised to check Trend Micro's website for documentation updates at http://docs.trendmicro.com/en-us/enterprise/officescan-as-a-service.aspx.

Register online with Trend Micro within 30 days of installation to continue downloading new pattern files and product updates from the Trend Micro website. Register during installation, or online at http://olr.trendmicro.com.

Trend Micro always seeks to improve its documentation. Your feedback is always welcome. Please evaluate this documentation on the following site: http://docs.trendmicro.com/en-us/survey.aspx.

 

Contents

  1. About OfficeScan as a Service
  2. Document Set
  3. System Requirements
  4. Installation
  5. Known Issues
  6. Contact Information
  7. About Trend Micro
  8. License Agreement

 

1. About OfficeScan as a Service

Trend Micro OfficeScan as a Service protects endpoints, on or off the corporate network, against malware, Trojans, worms, spyware, and ransomware with protection that adapts against new unknown variants as they emerge.

OfficeScan as a Service provides the following full-featured product benefits:

 

Back to top

 

2. Document Set

The document set includes:

Download the latest versions of the PDF documents and readme at http://docs.trendmicro.com/en-us/enterprise/officescan-as-a-service.aspx.

 

Back to top

 

3. System Requirements

  1. OfficeScan as a Service supports the following web browsers:

  2. The OfficeScan server and agent can be installed on endpoints running Microsoft Windows platforms. The OfficeScan agent is also compatible with various third-party products.

    Visit the following website for a complete list of system requirements and compatible third-party products:

    http://docs.trendmicro.com/en-us/enterprise/officescan.aspx

    Size of Deployment Package

    Note: All of the following deployment package sizes are for packages that do not include any additional plug-in features. The size of the deployment package may vary if additional plug-in features are included in the package.

    For the fully-functional OfficeScan agent MSI Setup Package:

    For the coexist OfficeScan agent MSI Setup Package:

  3. The Trend Micro Security (for Mac) agent can be install on endpoints running supported Mac platforms.

    Visit the following website for a complete list of system requirements:

    http://docs.trendmicro.com/en-us/enterprise/trend-micro-security-(for-mac)-as-a-service/agentinstall_ch_intr/trend-micro-security.aspx

    Size of Deployment Package

    For the Trend Micro Security (for Mac) agent ZIP Setup Package: 90.6 MB

 

Back to top

 

4. Installation

For OfficeScan agent installation instructions, refer to the Administrator's Guide.

 

Back to top

 

5. Known Issues

OfficeScan as a Service (featuring Control Manager) Known Issues

  1. When more than 12 pattern components are deployed at the same time for the "Detailed deployment rate summary" reports, only 12 pattern components display in the generated report.
  2. When the Time range on the Users/Endpoints Directory screen is set to "Today" and users click a red dot to view additional information, the number of threats displayed in tooltip on the Users/Endpoints Directory screen may not match the number of threats on the Security Details screen.

  3. When using Microsoft Edge to print the Security Threat Details screen, the background of the threat icon does not print.

    To resolve this issue:

  4. On the Manual Update or Scheduled Update screens:

  5. The Active Directory agent synchronization tool does not support IPv6 proxy servers.
  6. When migrating from a trial version of OfficeScan as a Service to a full version, the country of the full license Registration Key must match the country for which the trial version was provisioned. If the country assigned to your trial version license key in the Trend Micro Customer Licensing Portal does not match the country for the full version license key, contact Support for further assistance.

  7. During the provisioning process, confirmation email messages may be blocked by your spam filter. To resolve this issue:

 

Back to top

 

OfficeScan SaaS Server and OfficeScan Agent Known Issues

The following are the known issues related to the OfficeScan XG SaaS server and OfficeScan agents in this release:

Agent Installation

  1. When an application that locks the Windows Service Control Manager (SCM) is launched, the OfficeScan agent cannot be installed or upgraded. Before upgrading or installing OfficeScan, ensure that no SCM-locking application is running.
  2. The OfficeScan agent (operating in fully-featured mode) may not install correctly if Norton SystemWorks™ antivirus is installed on the endpoint. Uninstall it before installing OfficeScan agent.
  3. If the OfficeScan agent is installed using the "per-user" method, the OfficeScan agent shortcut will still show on all the users' Windows Start menu.
  4. After an OfficeScan agent in a VPN environment is uninstalled successfully, the agent is not removed on the web console's agent tree and its status is offline.
  5. Installing OfficeScan agents to Windows 7 or Windows Server 2008 R2 using a GUEST OS running on VMware Workstation 6.x and below may cause the system to stop responding. This is because of compatibility issues with the Intel™ Network Adapter Driver.
  6. If you add the OfficeScan agent program to the Microsoft Software Restriction Policy list using the user interface, you may need to restart the endpoint before subsequent additions to the list take effect.

Scanning

  1. When specifying the scan target for Scheduled Scan, Scan Now and Real-time Scan, spyware/grayware scan can be disabled. However, for Manual Scan, there is no option for disabling spyware/grayware scan, which means that during Manual Scan, OfficeScan will always scan for spyware/grayware.
  2. When OfficeScan is configured to scan mapped drives during Manual Scan, the mapped drive may not get scanned when scanning is initiated through Terminal Service client.
  3. When an email containing an attachment with spyware/grayware is retrieved through Eudora email client and POP3 Mail Scan is disabled, OfficeScan's Real-time Scan denies access to the email even if the scan action is "clean". The email does not appear on the inbox and the Eudora client displays a message informing the user that access to the email is denied.
  4. After the Damage Cleanup Engine cleans a malicious file, the infection channel always displays as "Local or network drive" regardless of the actual source of the infection.

Server Update

  1. When updating OfficeScan patterns and engines from Control Manager, administrators are not notified of the update status even if notifications are enabled. The update status can be viewed from the Control Manager console.

Agent Update

  1. OfficeScan agents can only download settings from the OfficeScan server, not Update Agents.
  2. An Update Agent running a 64-bit platform is unable to generate incremental patterns. Therefore, the Update Agent always downloads all incremental patterns available in the ActiveUpdate server, regardless of how many of these patterns it has previously downloaded.
  3. When the server and agent endpoints are located on geographical locations with different time zones, the agent cannot be configured to update based on the server's time zone.

Server Management

  1. When the endpoint's date/time format is changed, the date/time format on the OfficeScan console does not automatically change.

Agent Management

  1. Agent names in the OfficeScan agent tree supports only 15 characters and truncates the succeeding characters.
  2. Double-byte characters (characters typically used in East Asian languages) cannot be used when specifying the notification message for virus/malware infection source (Administration > Notifications > Agents > Virus/Malware tab).
  3. Select the Show icon and notifications option to display the OfficeScan icon in the Windows 7 and 8 system tray. The default option for Windows 7 and 8 is Only show notification.
  4. Some agent console screens include a Help button, which, when clicked, opens context-sensitive, HTML-based Help. Because Windows Server Core 2008 lacks a browser, the Help will not be available to the user. To view the Help, the user must install a browser.
  5. The Prompt users before executing newly encountered programs downloaded through web or email application channels (Server platforms excluded) feature only monitors ports 80, 81, and 8080 on certain Windows platforms that require the TmProxy.exe service.

Device Control

  1. If the Device Control permission for USB storage devices is changed from "Allow" to "Block" when USB storage device files are already opened on the agent endpoint, access to the opened files is still permitted. The Block permission is updated the next time that the USB device is plugged in, or the agent endpoint is restarted.
  2. Device management applications (such as iTunes, HTCSync, and SamSung Kies) for devices blocked by Device Control are also blocked from user access.

Data Loss Prevention

  1. Data transmitted through Instant Messaging applications are not detected if the applications use a non-transparent proxy server.
  2. Data Loss Prevention logs can only display the first 1000 bytes of characters in the Source and Destination columns due to a buffer overflow issue with long file names.

OfficeScan Firewall

  1. The Firewall rule for outgoing traffic will not work as expected if a machine has several IP addresses with different Firewall policies.

  2. When the security level on a Citrix server is medium or high, perform the following steps:

    1. On the OfficeScan server web console, create a new firewall policy.
    2. Add the following port numbers to the policy's exclusion list: 1494, 2598
    3. Go to Agents > Firewall > Profiles and click Assign Profile to Agents.
  3. The OfficeScan firewall service and driver cannot be installed if a previous version of the firewall driver exists and is running but there is no Trend Micro Common Firewall in the network protocol.

Smart Scan

  1. Only Internet Explorer is supported for configuring proxy settings used by agents to connect to the Global Smart Protection Server. If proxy settings are configured in other browsers, agents will not be able to connect to the Global Smart Protection Server.

Web Reputation

  1. If you enable the option Check HTTPS URLs in a Web Reputation policy:

    1. Select the option Enable third-party browser extensions in Internet Explorer. If this option is disabled, agents will not be able to check the reputation of HTTPS websites.
    2. For agents running Windows Server 2008 (32-bit), disable Internet Explorer Enhanced Security Configuration (IE ESC) from Windows Server Manager. If IE ESC is enabled, the Web Reputation blocking page displays in source code mode.

  2. Agents can browse blocked sites if using Juniper Networks VPN and proxy servers to connect to the Internet. To resolve this issue:

    1. Connect to the network using Juniper Networks VPN.
    2. Open Internet Option > Connection > LAN Settings.
    3. Disable Automatic configuration settings.
    4. Enable Proxy server and specify the IP address and port of your proxy server.
    5. Click Ok.
  3. If users access the Internet using Firefox and a proxy server, be sure that proxy settings in Internet Explorer have been configured. If proxy settings have not been configured in Internet Explorer, Web Reputation will not work, even if proxy settings have been configured in Firefox.
  4. On the OfficeScan agent endpoint, Web Reputation automatic proxy detection in Internet Explorer does not work if the administrator enables the OfficeScan Agent Access Restriction option on the OfficeScan server web console's Privileges and Other Settings screen.
  5. OfficeScan agents running in coexist mode do not support checking HTTPS URLs using Chrome, Microsoft Edge, or Firefox browsers because this feature requires the Unauthorized Change Prevention Service. To resolve this issue, switch the OfficeScan agents to use the full feature set.

Predictive Machine Learning

  1. The logged "User Account" may display inaccurate data. If another user logs onto an endpoint before a Predictive Machine Learning query result completes, OfficeScan logs the newly logged on user as the event owner when the query returns.

Cloud Synchronization Channel Support

  1. OfficeScan does not provide support of the Windows 8.1 pre-installed OneDrive (SkyDrive) synchronization folder. OfficeScan logs malware infections for OneDrive (SkyDrive) as being in the "Local or network drive" channel.
  2. If you disable the Unauthorized Change Prevention Service, the OfficeScan agent may lock files during the sychronization process and prevent the files from synchronizing to the sync folder. To resolve this issue, enable the Unauthorized Change Prevention Service.
  3. OfficeScan logs malicious files that do not include a portable executable extension as being in the "Local or network drive" channel.
  4. OfficeScan logs malicious files synchronized to mounted drives as being in the "Local or network drive" channel.

Control Manager Integration

  1. The Integrated Windows Authentication protocol is not supported when registering OfficeScan to Control Manager and specifying web server authentication credentials for the IIS server. Only basic access authentication is supported.

Online Help

  1. The Online Help system experiences scripting errors when viewed using Internet Explorer 8.0 and earlier. Apply the following Windows fix to solve the problem: http://support.microsoft.com/kb/175500/en-us.

Additional Release Notes

  1. Download the latest components after upgrading to keep your security risk protection current.

 

Back to top

 

Trend Micro Security (for Mac) Known Issues

  1. After enabling the Scan Time Machine option for Manual and Scheduled Scan, Trend Micro Security (for Mac) can only detect malware threats but not take any action (clean, quarantine, or delete) due to a permission limitation in Mac OS. Configured scan actions display as unsuccessful in the product logs.

 

Back to top

 

6. Contact Information

A license to the Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, Maintenance must be renewed on an annual basis at Trend Micro's then-current Maintenance fees.

You can contact Trend Micro via fax, phone, and email, or visit us at http://www.trendmicro.com.

Evaluation copies of Trend Micro products can be downloaded from our website.

 

Global Mailing Address/Telephone numbers

For global contact information in the Asia/Pacific region, Australia and New Zealand, Europe, Latin America, and Canada, refer to http://www.trendmicro.com/en/about/overview.htm.

The Trend Micro "About Us" screen displays. Click the appropriate link in the "Contact Us" section of the screen.

Note: This information is subject to change without notice.

 

Back to top

 

7. About Trend Micro

Trend Micro Incorporated, a global leader in Internet content security and threat management, aims to create a world safe for the exchange of digital information for businesses and consumers. A pioneer in server-based antivirus with over 20 years experience, we deliver top-ranked security that fits our customers' needs, stops new threats faster, and protects data in physical, virtualized and cloud environments. Powered by the Trend Micro™ Smart Protection Network™ infrastructure, our industry-leading cloud-computing security technology and products stop threats where they emerge, on the Internet, and are supported by 1,000+ threat intelligence experts around the globe. For additional information, visit http://www.trendmicro.com.

Copyright 2017, Trend Micro Incorporated. All rights reserved. Trend Micro, the t-ball logo and OfficeScan are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other product or company names may be trademarks or registered trademarks of their owners.

 

Back to top

 

 

8. License Agreement

Information about your license agreement with Trend Micro can be viewed at http://us.trendmicro.com/us/about/company/user_license_agreements/.

License Attributions can be viewed from the OfficeScan web console.

 

Back to top