Modifying the Expiration value

The Endpoint Sensor server refers to an expiration value to determine how often it resends the investigation command to offline or unreachable agents. It may be necessary to edit this value to ensure that endpoints are given sufficient time to respond. To change how often these commands are sent, perform the following procedure:

  1. Open a command prompt as an administrator, and stop the Endpoint Sensor service by sending the following command:

    C:\>sc stop TrendMicroEndpointSensorService

  2. Open an application that can send a query statement to the SQL server.
  3. Connect to the Endpoint Sensor SQL database.
  4. Convert the preferred time to varbinary format.

    For example, to convert 24 hours, specify 86400 as the new expiration value (which is 60 seconds * 60 minutes * 24 hours), and send the following command:

    Declare @varcharField varchar(max);
    SET @varcharField = '86400'
    SELECT CONVERT(varbinary(max),@varcharField)

    The command returns 0x3836343030.

    Note:

    Ensure that the expiration value is greater than 1 hour (3600 = 60 seconds * 60 minutes). If the expiration value is too small, the Endpoint Sensor server does not send an investigation command.

    (Optional) To verify if the converted value is correct, convert the varbinary value back to the original format by sending the following command:

    DECLARE @varbinaryField varbinary(max);
    SET @varbinaryField = 0x3836343030;
    SELECT CONVERT(varchar(max),@varbinaryField)
  5. Update the database value using the varbinary value of the preferred time.

    Using the example above, to set 0x3836343030 as the new expiration value, send the following command:

    UPDATE [SmartSensor].[dbo].[Setting]
    SET [Value] = CONVERT(VARBINARY(max), '0x3836343030', 1)
    WHERE [Key] = 'Expiration' AND [Category] = 'Task'
  6. Open a command prompt as an administrator, and restart the Endpoint Sensor service by sending the following command:

    C:\>sc start TrendMicroEndpointSensorService