Based on the troubleshooting done, the Apex One agent real-time scan engine scans for locked files. It waits for the Oplock break of SMB to be able to scan the locked files. For cases that have encountered possible oplock issues, it is recommended to enable CheckRtPCWOplock=1 in order to skip locked files and improve scanning performance.
Enabling CheckRtPCWOplock=1 on the agent does not pose any security risk as based on the design of the Realtime Scan engine, the options are related to scanning performance only.
- Access the Apex One Server console and go to <drive>\Program Files (x86)\Trend Micro\Apex One\PCCSRV.
- Look for the file ofcscan.ini and under [Global Setting], add the entry CheckRtPCWOplock=1. Save the file afterward.
- Login to Apex One Server Console and go to Agents> Global Agent Settings. Click Save to update all agent machines with the added entry.
- Verify if the issue still persists.
Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
- Login to Apex One Server console, go to Agent Management and select the target agent.
- On the settings, disable the agent self-protection, and click Save.
- On the target agent, go to the registry hive using the registry editor and add the entry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TmFilter\Parameters] br"CheckRtPCWOplock"=dword:00000001 - Verify if the issue persists on the agent. Then re-enable the agent self-protection on the server console.