Views:

Published by: Trend Micro, Incorporated

Published on: June 2014

This readme file was current as of the date above. All customers are advised to check the Trend Micro Online Help Center for updates (docs.trendmicro.com).

About Trend Micro Client/Server Security Agent

The Trend Micro Client/Server Security Agent (CSA) is the endpoint component for the "Services" edition of the Trend Micro Worry-Free Business Security package. CSA is installed on client devices and protects your Windows, Mac, and Android devices from Internet threats. It is managed through the console. The Agent provides real-time, scheduled, and manual threat scanning capabilities along with other protection.

New in this Release

Worry-Free Business Security Services includes the following new features and enhancements.

Table 1. What's New

Feature

Description

Data Security Enhancements(Android and iOS)

Administrators can make these data security features optional for bring-your-own-device (BYOD) heavy environments:

  • Remote device wipe

  • Password policy enforcement (including password reset for Android and clear passcode for iOS)

  • Remote device lock

  • Location detection (Android only)

Mobile Application Reputation(Android)

  • Better security without relying on large pattern files

  • Potentially Unwanted Program (PUP) detection

Web Reputation(Android)

  • Web Reputation detection of dangerous URLs

  • Reports/logs data

New Platform Support

  • iOS 6, 7, and 8

  • Android 4.4

Version 5.0

Table 2. What's New

Feature

Description

Support for Mac and Mobile

This version of WFBS-SVC now manages Macs and Android devices to provide increased security at work (or at home).

Flexible Device Management

With custom tags, you can use email addresses, employee IDs, or any other unique combination to speed up your workflow.

Improved User Experience

Features that require a lot of parameters in the background have been simplified on the console. The Common Tasks on Live Status gives you quick access to commonly used tasks.

Enhanced Flows

Flows have been changed to reduce the steps taken to complete a task. For example, you can now add a device and the device to a group with ease.

Refreshed Look and Feel

We have refreshed the interface that makes it easier for you to use WFBS-SVC.

Version 3.7

  • A list of protected computers can now be created from the client tree.

  • Option to automatically install agents on clients that log in to the network.

Version 3.6 SP1

  • Improved query functions to generate reports for entire domains.

  • Ability to migrate clients from WFMS.

  • Fix to avoid clients from restarting during updates.

  • Previously. Active Agents supported a maximum of 5 NICs. Now, Active Agents support a maximum of 10 NICs.

Worry-Free Business Security Services Documentation

Worry-Free Business Security Services documentation includes the following:

Table 3. Worry-Free Business Security Services Documentation

Documentation

Description

Help

HTML files compiled in WebHelp or CHM format that provide "how to's", usage advice, and field-specific information

Readme file

Contains a list of known issues and basic installation steps. It may also contain late-breaking product information not found in the Help or printed documentation

Knowledge Base

An online database of problem-solving and troubleshooting information. It provides the latest information about known product issues. To access the Knowledge Base, go to the following website:

http://esupport.trendmicro.com/en-us/business/default.aspx

Download the latest version of the PDF documents and readme at:

http://docs.trendmicro.com/en-us/smb/worry-free-business-security-services.aspx

System Requirements

Table 4. Web Console Minimum Requirements

Web browser

  • Microsoftt™ Internet Explorer™ 7.0, 8.0, 9.0, 10.0, 11 (32 and 64 bit)

  • Mozilla™ Firefox™ 24 (ESR), 28, 29, 30

PDF reader (for reports)

Adobe™ Acrobat™ Reader 4.0 or later

Display

High-color display with resolutions of 1024x768 or higher

Table 5. Windows Agent (CSA) Minimum Requirements

Processor

Intel Pentium x86 or compatible processor

x64 processor supporting AMD64 or Intel EM64T technologies

Clock speed requirements vary depending on the operating system:

  • Windows SBS 2008, SBS 2011: 2GHz

  • Windows Server 2012/2012 R2, Windows Server 2012/2012 R2 Essentials, Home Server 2011: 1.4GHz

  • Windows 8/8.1, Server 2008, EBS 2008, Home Server: 1GHz

  • Windows Vista, Windows 7: 800MHz

  • Windows XP, Server 2003, SBS 2003, Home Server: 450MHz

Memory

  • Windows SBS 2008, EBS 2008, SBS 2011: 4GB

  • Windows Server 2012 R2 Essentials: 2GB minimum, 16GB recommended

  • Windows Server 2012 Essentials, Home Server 2011: 2GB minimum; 8GB recommended

  • Windows 8/8.1, Server 2008, SBS 2003: 1GB minimum; 2GB recommended

  • Windows Server 2012/2012 R2, Server 2003, Home Server, Windows Vista, Windows 7: 512MB minimum; 1GB recommended

  • Windows XP: 256MB minimum; 512MB recommended

Disk space

750MB

Note:

This is the minimum disk space required for installing the Agent. The actual requirements depend on the number of quarantined files, the retained logs, and other changes made to the default configuration.

Operating system

  • Windows XP: SP3

  • Windows Server 2003 R2 (with Storage Server 2003): SP1 or SP2

  • Windows Server 2003 (with Storage Server 2003): SP1 or SP2

  • Windows SBS 2003 R2: SP1 or SP2

  • Windows SBS 2003: SP1 or SP2

  • Windows Vista: SP1 or SP2

  • Windows Home Server: Power Pack 2 or 3

  • Windows Home Server 2011: No service pack

  • Windows Server 2008 R2: None or SP1

  • Windows Server 2008: SP1 or SP2

  • Windows SBS 2008: SP1 or SP2

  • Windows 2008 Foundation: SP1 or SP2

  • Windows Essential Business Server (EBS) 2008: SP1 or SP2

  • Windows 7: None or SP1

  • Windows SBS 2011: No service pack

  • Windows 8: No service pack

  • Windows 8.1: No service pack or update

  • Windows Server 2012: No service pack

  • Windows Server 2012 R2: No service pack or update

  • Windows Server 2012 Essentials: No service pack

  • Windows Server 2012 R2 Essentials: No service pack

Note:

All major editions and 64-bit versions of these operating systems are sup­ported unless noted otherwise.

Web browser (for downloading Agent Installer)

  • Internet Explorer 7.0, 8.0, 9.0, 10.0, 11 (32 and 64 bit)

  • Firefox 24 (ESR), 28, 29, 30

Display

256-color display or higher with resolutions of 800x600 or higher

Notes

  • The Agent supports Citrix Presentation Server™ 4.0/4.5/5.0 and Remote Desktop.

  • The Agent supports VMware™ ESX™ 3.0/3.5/4.0, VMware vSphere Hypervisor™ (ESXi) 4.0/5.0, VMware Workstation 6.0/7.0/8.0/9.0, and Microsoft Hyper-V™ Server 2008/2012.

Table 6. Mac Agent Minimum Requirements

Processor

  • OS X 10.9, 10.8: 64-Bit Intel Core 2 Duo processor or better required

  • OS X 10.7: Mac with an Intel Core 2 Duo, Core i3, Core i5, Core i7, or Xeon processor

  • OSX 10.6: Mac with an Intel core processor

Memory

  • OS X 10.9, 10.8, 10.7: 2 GB of memory

  • OS X 10.6: 1 GB of memory

Disk space

30MB

Operating system

  • Mac OS X v10.9 (Mavericks)

  • Mac OS X v10.8 (Mountain Lion)

  • Mac OS X v10.7 (Lion) or later

  • Mac OS X v10.6 (Snow Leopard) or later

Web browser (for downloading Agent Installer)

Safari 4.0, 5.0, 5.1, 6.0, 7.0

Table 7. Android Agent Minimum Requirements

Version

  • Android 2.3 (Gingerbread) or newer

  • Android 3.0 (Honeycomb) or newer

  • Android 4.0 (Ice Cream Sandwich) or newer

  • Android 4.1, 4.2, 4.3 (Jelly Bean)

  • Android 4.4 (KitKat)

Web browser (for downloading Agent Installer)

  • Google Chrome (only available for Android 4.0 or newer)

  • Default web browser on the device

Table 8. iOS Profile Minimum Requirements

Version

  • iOS 6.0 or newer

  • iOS 7.0 or newer

  • iOS 8.0 or newer

Web browser (for downloading the profile)

  • Default web browser on the device

Installation

Refer to the latest Online Help (http://docs.trendmicro.com/en-us/smb/worry-free-business-security-services.aspx) for information about deploying clients.

Post-Installation Configuration

Trend Micro recommends performing an update immediately after installation.

Known Issues

Windows Agent Known Issues

Client Deployment and Upgrade

  1. To completely reinstall or upgrade the CSA, you will need to restart the computer. A restart will also be necessary when updating some components including the firewall and the proxy drivers.

  2. After installing the CSA on a computer with IIS 7.0, you must restart the IIS service. IIS 7.0 may not work as expected with the CSA, which uses the Windows Filtering Platform, until IIS is restarted. This issue only occurs on Microsoft Windows 2008 without service pack 2.

  3. Real-time scan on CSA can prevent Hyper-V Manager from creating virtual machines. If you encounter this issue, configure real-time scan to exclude the storage folder for your virtual machines from scanning. Hyper-V Manager uses "C:\ProgramData\Microsoft\Windows\Hyper-V" as the default storage folder, but a different folder may be specified during virtual machine creation.

  4. In environments such as distributed file systems, scanning offline files causes unnecessary file recalls and can eventually lead to performance issues. To avoid scanning offline files:

    1. Open the Windows registry and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmfilter\Parameters.

    2. Set the registry keys SkipOffLineFile and SkipSparseFile to1.

      For more information, refer to http://esupport.trendmicro.com/Pages/How-to-skip-offline-files-from-being-scanned.aspx

  5. The WFBS-SVC_Downloader.exe file can only be run on the computer on which the user downloads it. If a user copies the file to another computer and runs it there, an error results.

  6. Computer loses network connection temporarily during installation.

  7. Users cannot successfully uninstall the agent if Dropbox is installed on the same computer.

  8. Users cannot deploy agent program when Internet Explorer 10 running in Metro mode on Windows 8.

Client/Server Security Agent

  1. On Windows Vista/2008/7 guest operating systems running VMware ESX 3.5 servers, PccNTmon cannot render the CSA console correctly. The system hangs and eventually crashes.

    To prevent this issue:

    1. Click Start > Control Panel > Performance Information and Tools > Visual Effects.

    2. Select Adjust for best performance.

  2. CSA self-protection for Process and Registry Keys works only on the following 64-bit platforms: Windows Vista SP1 x64 and Windows Server 2008 SP1 x64 and above.

  3. If Client Security is set to High and a malware program resides in the CSA folder before real-time scan starts, CSA cannot restrict that malware from updating the registry.

  4. If virus pattern or spyware active-monitoring pattern files are not available to the CSA, the CSA will keep its current scan method until the pattern is delivered

Firewall

  1. During CSA installation or firewall driver uninstallation, the computer may temporarily lose its network connection. Some applications, such as Secure Shell (SSH), Terminal Services Client, or Remote Desktop could be affected by the disconnection. If the network connection is lost, restart the application after installing the CSA or after disabling the firewall.

  2. The CSA firewall may conflict with other firewall applications. Trend Micro recommends uninstalling or disabling other firewall applications.

  3. On VMware clients, the CSA firewall may block all incoming packets.

    To address this issue, add the following value to the client's registry:

    • Key:HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\PFW

    • Name:EnableBypassRule

    • Type:REG_DWORD

    • Data:1

  4. The firewall does not support IPV6.

  5. On Windows Vista, Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2 and Windows Server 2012 computers, if the firewall is disabled and then re-enabled, Firewall patterns fail to load sometimes. To fix this problem, restart the affected computer

Behavior Monitoring

  1. Behavior Monitoring supports all 32-bit operating systems and only the following 64-bit platforms: Windows Vista SP1 x64 and Windows Server 2008 SP1 x64 and above.

Web Reputation and URL Filtering

  1. When running Internet Explorer 9 with IE Enhanced Security Configuration, the Web Reputation plug-in module (TmIEPlugInBHO Class) cannot be automatically applied. Risky URLs using SSL cannot be blocked.

  2. Web Reputation Services and URL Filtering are not supported when Internet Explorer 10 is running in Metro mode on Windows 8.

SBS Dashboard Add-In Tool

  1. When Internet Explorer 9 is installed under Windows Small Business Server 2011 Essentials, a popup window concerning unused windows appears when closing the Dashboard console.  

  2. Dashboard Add-in is not compatible with Internet Explorer Enhanced Security Configuration. Ensure this option is disabled before opening the Dashboard.

Login Script Setup Tool

  1. Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Vista, Windows 7, and Windows 8 computers with UAC enabled prohibit automatic installation.  

Mac Agent Known Issues

  1. The Agent does not support root accounts.

  2. When the operating system is upgraded to Mac OSX 10.8, TMSM does not start. TMSM requires Java and the upgrade to Mac OSX 10.8 automatically removes Java. To fix this, install the latest version of Java and then restart the Mac.

Android Agent Known Issues

  1. When WFBS-SVC is installed on a device running Android 2.x, the system proxy is not updated as this version of the operating system does not support system proxies. This could also prevent the device from connecting to the server to receive updates.

  2. WFBS-SVC will not be installed on rooted Android devices.

  3. If the user goes to Settings > Applications > Manage Applications WFBS-SVC and taps Clear Data, WFBS-SVC might not be able to connect to the server to receive updates. The user would need to re-enroll the device.

  4. If other installed apps interfere with the device's network connection, WFBS-SVC might not be able to connect to the server to receive updates.

  5. When using the Remote Locate feature to find a mobile device, the language code (example: en, jp, fr) that displays in the browser for the embedded Google Map may not be the same as the language used by the web console.

  6. WFBS-SVC uses Google Cloud Messaging (GCM) for Android mobile device management commands. This means that sometimes commands sent to Andriod mobile devices can take some time or be unsuccessful.

  7. If multiple device administrators manage a single Android mobile device some commands may not be successful (example: reset password).This is because WFBS-SVC uses the Android system Device Administrator for mobile device management commands. When more than one Device Administrator exists for the same Android mobile device, the stricter policy on the device has priority. For example, if two apps both require user to follow a password policy, the stricter is used. The laxer policy will never be applied.

iOS Profile Known Issues

  1. Worry-Free Business Security Services uses the Apple Push Notification service (APNs) for iOS mobile device management commands. This means that sometimes commands sent to iOS devices can take some time or be unsuccessful.

  2. If the private browsing feature in Safari (under Bookmarks > Private on iOS 7.1) is enabled, iOS devices may not successfully complete device enrollment.

Release History

Release

Date

WFBS-H v2.5

September 2008

WFBS-H v2.5 SP1

February 2009

WFBS-H v2.5 SP2

April 2009

WFBS-SVC v3.0

December 2009

WFBS-SVC v3.5

September 2010

WFBS-SVC v3.5 SP1

November 2010

WFBS-SVC v3.5 SP2

December 2010

WFBS-SVC v3.5 SP3

April 2011

WFBS-SVC v3.6

September 2011

WFBS-SVC v3.6 SP1

January 2012

WFBS-SVC v3.7

February 2012

WFBS-SVC v5.0

August 2012

WFBS-SVC v5.1

January 2013

WFBS-SVC v5.2

June 2013

WFBS-SVC v5.3

September 2013

WFBS-SVC v5.6

June 2014

Contacting Trend Micro

Trend Micro has sales and corporate offices in many cities around the globe. For global contact information, visit the Trend Micro Worldwide site http://esupport.trendmicro.com/support/srf/questionentry.do.

Note:

The information on this website is subject to change without notice.

About the License Agreement

Information about your license agreement with Trend Micro can be viewed at http://us.trendmicro.com/us/about/company/user_license_agreements.

Third-party licensing agreements can be viewed by selecting the About option in the application user interface.