The Endpoint Sensor server refers to an expiration value to determine how often it resends the investigation command to offline or unreachable agents. It may be necessary to edit this value to ensure that endpoints are given sufficient time to respond. To change how often these commands are sent, perform the following procedure:
C:\>sc stop TrendMicroEndpointSensorService
For example, to convert 24 hours, specify 86400 as the new expiration value (which is 60 seconds * 60 minutes * 24 hours), and send the following command:
Declare @varcharField varchar(max); SET @varcharField = '86400' SELECT CONVERT(varbinary(max),@varcharField)
The command returns 0x3836343030.
Ensure that the expiration value is greater than 1 hour (3600 = 60 seconds * 60 minutes). If the expiration value is too small, the Endpoint Sensor server does not send an investigation command.
(Optional) To verify if the converted value is correct, convert the varbinary value back to the original format by sending the following command:
DECLARE @varbinaryField varbinary(max); SET @varbinaryField = 0x3836343030; SELECT CONVERT(varchar(max),@varbinaryField)
Using the example above, to set 0x3836343030 as the new expiration value, send the following command:
UPDATE [SmartSensor].[dbo].[Setting] SET [Value] = CONVERT(VARBINARY(max), '0x3836343030', 1) WHERE [Key] = 'Expiration' AND [Category] = 'Task'
C:\>sc start TrendMicroEndpointSensorService