Forensic files for the e-mail client channel not being sent to the Officescan server is a known issue in OfficeScan XG. Hence, Control Manager is unable to get the file when downloading it from the incident details.
As a workaround, disable the multi-part scan feature on the Officescan server:
- Open the ofcscan.ini file in the \PCCSRV\ folder of the OfficeScan server.
- Under the Global Setting section, manually add the following key and set its value to "0":
[Global Setting]
EnableDlpMPScan=0To enable the setting again, set it as "EnableDlpMPScan=1". - Save the changes and close the file.
- Open the OfficeScan server management console and click Agents > Global Agent Settings on the main menu to access the Global Agent Settings page.
- Click Save to deploy the setting to agents.
The OfficeScan server deploys the command to agents and adds the following registry entry on all agent computers:
Path: HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\DlpLite
Key: EnableMPScan
Type: dword
Value: 0
- The agent should be at least Officescan XG Build 1717.
- For Apex One as a Service, kindly contact Trend Micro Technical Support to disable the multi-part scan feature.