Trend Micro, Inc.

September 2017

Trend Micro™ Worry-Free Business Security Services™

Version 6.2

This readme file is current as of the date above. However, all customers are advised to check Trend Micro's website for documentation updates at http://docs.trendmicro.com/en-us/smb/worry-free-business-security-services.aspx.

Trend Micro always seeks to improve its documentation. Your feedback is always welcome. Please evaluate this documentation on the following site: http://docsstg.trendmicro.com/en-us/survey.aspx.

Contents

1. About Worry-Free Business Security Services

2. What's New

3. Document Set
4. System Requirements
5. Known Issues
6. Contact Information
7. About Trend Micro
8. License Agreement

1. About Worry-Free Business Security Services

Trend Micro™ Worry-Free Business Security Services™ for small offices protects multiple Windows computers, Macs, and Android devices located in or out of the office from viruses and other threats from the web. Unique Web Threat Protection stops threats before they reach devices and inflict damage or steal data. This safer, smarter, simpler protection from web threats will not cause devices to slow down. You can centrally manage security from anywhere without the need to add a server, install server software, configure settings, or maintain updates. Trend Micro security experts host and constantly update the service for you. Trend Micro™ Worry-Free Business Security Services™ is:

• Safer: Powered by XGen™ security, Worry-Free Business Security Services uses a blend of threat protection techniques to eliminate security gaps - in any activity, on any endpoint, anywhere. XGen security:

  • Goes beyond next-generation technologies and protects against the full range of threats. Progressively filters out threats using the most efficient technique for maximum detection without false positives.

  • Blends signatureless techniques, including machine learning, behavioral analysis, variant protection, census check, application control, and good-file check with file and web reputation.

• Smarter: Stop viruses and other threats without configuring settings or maintaining updates.

• Simpler: Centrally manage and check the status of protected devices anywhere (no server required).

Back to top

2. What's New

Worry-Free Business Security Services includes the following new features and enhancements:

Full Disk Encryption Enhancements

• BitLocker recovery keys: In the event that a user forgets the BitLocker password and the endpoint is locked, administrators can obtain the BitLocker recovery key from the Worry-Free Business Security Services web console. This feature can also be password protected to restrict this functionality to a specific account within the Worry-Free Business Security Services web console.
• Platform support: Worry-Free Business Security Services supports managing BitLocker full disk encryption on endpoints running Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
• System partition format support: Worry-Free Business Security Services supports managing BitLocker full disk encryption on endpoints using Unified Extensible Firmware Interface (UEFI) mode.

Security Risk Detection Enhancements

• Enhanced protection from ransomware on cloud file sync and share drives: Ransomware and other threats detected on file sync and share drives like Microsoft OneDrive and Box will now be remediated properly in the cloud drive and will no longer continually resynchronize.
• Rapid proliferation: Worry-Free Business Security Services enhances the Behavior Monitoring and Predictive Machine Learning features to better detect and prevent ransomware infections from files, and improves the protection against ransomware threats during outbreak situations.

Back to top

3. Document Set

The document set for the Worry-Free Business Security Services includes:

• Help: HTML files compiled in WebHelp format that provide "how to's", usage advice, and field-specific information. The Help is accessible from the Worry-Free Business Security Services console.
• Readme file: Contains a list of known issues and basic installation steps. It may also contain late-breaking product information not found in the Help or printed documentation.
• Knowledge Base: An online database of problem-solving and troubleshooting information. It provides the latest information about known product issues. To access the Knowledge Base, go to the following website: http://esupport.trendmicro.com

Download the latest versions of the PDF documents and readme at http://docs.trendmicro.com/en-us/smb/worry-free-business-security-services.aspx.

Back to top

4. Security Agent System Requirements

The Worry-Free Business Security Services Security Agent can be installed on Microsoft Windows, Mac OS, iOS, or Android platforms. The Security Agent is also compatible with various third-party products.

Visit the following website for a complete list of system requirements and compatible third-party products:

http://docs.trendmicro.com/en-us/smb/worry-free-business-security-services-62-agent-help/about/wfbs-svc-system-requ.aspx

Back to top

5. Known Issues

• Windows Security Agent Known Issues
• Mac Security Agent Known Issues
• Android Security Agent Known Issues
• iOS Security Profile Known Issues

Windows Security Agent Known Issues

Security Agent Deployment and Upgrade

1. When the following conditions apply, the proxy server information needs to be added to the firewall exception list in the Worry-Free Business Security Services web console.

   • Endpoints are installed on Windows 8, Windows Server 2012, or later and use a proxy server.

   • The firewall security level is set to High in the advanced mode in the Worry-Free Business Security Services web console.

2. The WFBS-SVC_Downloader.exe file can only be run on the endpoint on which the user downloads the file. If a user copies the file to another endpoint and runs the file there, an error occurs.

3. Endpoints may lose network connection temporarily during installation.

4. Users cannot deploy the Security Agent program when Internet Explorer 10 or later is running in Metro mode on Windows 8 or later.

5. Security Agents running on Windows 7, 8, or 8.1 endpoints will be uninstalled when users upgrade an endpoint to Windows 10. Users must upgrade Security Agents to Worry-Free Business Security Services 5.7 Service Pack 1 before upgrading to Windows 10. After Windows 10 is successfully installed, a toast notification will appear to initiate the Security Agent reinstallation on the new operating system.

6. The email installation link does not work properly when users try to re-activate the Security Agent using Microsoft Edge. However, Microsoft intends to resolve this issue in a later release.

7. After users install the Security Agent and then open Firefox, sometimes the Firefox extension installation process does not start. Users need to manually enable the extension in Add-ons Manager.

8. Issue: When users try to download and install the Security Agent through Microsoft Edge on endpoints with the Windows 10 Creators Update installed, an error occurs during the process.

   Workaround: Use another supported browser to install the Security Agent.

Security Agent

1. If the Security Agent is enabled and a malware program resides in the Security Agent folder before Real-time Scan starts, the Security Agent cannot restrict that malware from updating the registry.

2. On Windows 10 endpoints, Worry-Free Business Security Services alerts may be hidden behind the Microsoft Edge browser window. Users must check for any unauthorized event or threat alerts that may appear.

3. If the Security Agent is installed on a Windows endpoint running Enhanced Mitigation Experience Toolkit (EMET), there might be some performance and conflict issues. Trend Micro recommends not installing the Security Agent and Microsoft EMET on the same endpoint.

4. Issue: If users have installed Windows Update KB3076895 (MS15-084), the Msxml6.dll 6.20.5008.0 file included in the update might cause issues in the TmListen.exe service and policy setting deployments.

   Workaround: Install Windows Update KB3092627 or later to update the Msxml6.dll file.

5. The Security Agent does not support IPv6.

6. When multiple logon sessions exist on an endpoint, some agent process files might crash after an agent upgrade. Users might need to manually start the Security Agent.

Firewall

1. During Security Agent installation or firewall driver uninstallation, the endpoint may temporarily lose its network connection. Some applications, such as Secure Shell (SSH), Terminal Services Client, or Remote Desktop could be affected by the disconnection. If the network connection is lost, restart the application after installing the Security Agent or after disabling the firewall.

2. The Security Agent firewall may conflict with other firewall applications. Trend Micro recommends uninstalling or disabling other firewall applications.

3. On VMware clients, the Security Agent firewall may block all incoming packets.

   To address this issue, add the following value to the VMware client registry:

   • Key: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\PFW

   • Name: EnableBypassRule

   • Type: REG_DWORD

   • Data: 1

Web Reputation and URL Filtering

1. When running Internet Explorer 9 or later with Internet Explorer Enhanced Security Configuration, the Web Reputation plug-in module (TmIEPlugInBHO Class) cannot be automatically applied. Risky URLs using SSL cannot be blocked.

2. Web Reputation Services and URL Filtering are not supported when Internet Explorer 10 or later is running in Metro mode on Windows 8 or later.

3. Issue: If users open Chrome before the Security Agent has fully started, Web Reputation Services and URL Filtering cannot block HTTPS websites.

   Workaround: Restart Chrome to resolve the issue.

4. On endpoints running Windows 10 Creators Update, Web Reputation Services and URL Filtering currently cannot block HTTPS websites in Microsoft Edge.

5. The HTTPS Web Threat Protection and URL Filtering features do not support checking websites that use HTTP/2 protocol.

   For a list of unsupported websites, see the Knowledge Base.

6. HTTPS Web Threat Protection does not support Mac Security Agents.

Windows Small Business Server Dashboard Add-In Tool

1. When Internet Explorer 9 is installed under Windows Small Business Server 2011 Essentials, a popup window concerning unused windows appears when closing the Dashboard console.

2. Dashboard Add-in is not compatible with Internet Explorer Enhanced Security Configuration. Ensure this option is disabled before opening the Dashboard.

Login Script Setup Tool

1. Endpoints installed on Windows Vista or later and have User Account Control (UAC) enabled cannot run automatic installation.

Device Control

1. Multiple log entries appear when a user tries to access or copy files to a USB device. Device Control detects each instance as a single policy violation but includes multiple entries in the logs to differentiate the OS versions.

2. Device Control supports all 32-bit operating systems and only the following 64-bit platforms: Windows Vista SP1 x64 and later.

Application Control

1. When users block an application that consists of .dll files only, Worry-Free Business Security Services will not block the application. Blocking the .dll files might also block other applications that run the same .dll files.

2. When multiple logon sessions exist on an endpoint, the Application Control feature will increase CPU usage for a while.

Full Disk Encryption

1. BitLocker cannot encrypt endpoints that run multiple operating systems when users install Windows 7 first and then install Windows 10. In this scenario, the default system partition size on both operating systems will be 100 MB, but BitLocker requires at least 350 MB of system partition size on Windows 10.

Mac Security Agent Known Issues

1. The Security Agent does not support root accounts.

2. When the operating system is upgraded to Mac OS X 10.8, the Security Agent program cannot start. The Security Agent requires Java and the upgrade to Mac OS X 10.8 automatically removes Java. To resolve this issue, install the latest version of Java and then restart the Mac.

3. When installing the Security Agent on a Mac running on Mac OS X 10.6.7 or earlier, the installation process may be unsuccessful. To resolve this issue, upgrade to Mac OS X 10.6.8, and then download and install the following Apple update:

   http://support.apple.com/kb/DL1512

Android Security Agent Known Issues

1. When Worry-Free Business Security Services is installed on a device running Android 2.x, the system proxy is not updated as this version of the operating system does not support system proxies. This could also prevent the device from connecting to the server to receive updates.

2. Worry-Free Business Security Services cannot be installed on rooted Android devices.

3. On an Android device, if the user goes to Settings > Apps > Worry-Free Security > Storage and taps CLEAR CACHE, the Security Agent might not be able to connect to the server to receive updates. The user would need to re-enroll the device.

4. If other installed apps interfere with the device's network connection, the Security Agent might not be able to connect to the server to receive updates.

5. When using the "Remote Locate" feature to find a mobile device, the language code (for example: en, jp, fr) that displays in the browser for the embedded Google Maps may not be the same as the language used by the web console.

6. Worry-Free Business Security Services uses Google Cloud Messaging (GCM) for Android mobile device management commands. Commands sent to Android devices can take some time to be received, or the commands may be unsuccessful.

7. If multiple device administrators manage a single Android device, some commands may not be successful (for example: reset password). Worry-Free Business Security Services uses the Android Device Administrator for mobile device management commands. When more than one Device Administrator exists for the same Android device, the stricter policy on the device has priority. For example, if two apps both require users to follow a password policy, only the stricter policy is applied.

8. For Android devices that contain multiple user profiles, the Security Agent can only be installed in the owner's profile. An error occurs when users try to install the Security Agent in other user profiles.

9. For Android 7.0 devices that already use a password to unlock the device screen, an error occurs when users try to send the Reset Password command to these devices from the Worry-Free Security Services web console.

iOS Security Profile Known Issues

1. Worry-Free Business Security Services uses the Apple Push Notification service (APNs) for iOS mobile device management commands. Commands sent to iOS devices can take some time to be received, or the commands may be unsuccessful.

2. If the Private Browsing feature in Safari is enabled (https://support.apple.com/en-ph/HT203036), iOS devices may not successfully complete device enrollment.

Back to top

6. Contact Information

A license to the Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, Maintenance must be renewed on an annual basis at Trend Micro's then-current Maintenance fees.

You can contact Trend Micro via fax, phone, and email, or visit us at http://www.trendmicro.com.

Evaluation copies of Trend Micro products can be downloaded from our website.

Global Mailing Address/Telephone numbers

For global contact information in the Asia/Pacific region, Australia and New Zealand, Europe, Latin America, and Canada, refer to http://www.trendmicro.com/us/about-us/contact/index.html.

Note: This information is subject to change without notice.

Back to top

7. About Trend Micro

Trend Micro Incorporated, a global leader in Internet content security and threat management, aims to create a world safe for the exchange of digital information for businesses and consumers. A pioneer in server-based antivirus with over 20 years experience, we deliver top-ranked security that fits our customers' needs, stops new threats faster, and protects data in physical, virtualized and cloud environments. Powered by the Trend Micro™ Smart Protection Network™ infrastructure, our industry-leading cloud-computing security technology and products stop threats where they emerge, on the Internet, and are supported by 1,000+ threat intelligence experts around the globe. For additional information, visit http://www.trendmicro.com.

Copyright 2017, Trend Micro Incorporated. All rights reserved. Trend Micro, the t-ball logo and Worry-Free Business Security Services are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other product or company names may be trademarks or registered trademarks of their owners.

Back to top

8. License Agreement

Information about your license agreement with Trend Micro can be viewed at http://us.trendmicro.com/us/about/company/user_license_agreements/.

License Attributions can be viewed from the Worry-Free Business Security Services web console.

Back to top