Log Collection
- Permission issue is indicated in the C:\TMSM_Install.log:
InstallShield 15:45:11: Invoking script function ChangeClientFoldrACL 1: ServerInfoTool.exe --dir-acl "C:\Program Files (x86)\Trend Micro\Apex One\Addon\TMSM\TMSM_HTML\ActiveUpdate\ClientInstall" S-1-5-32-546 1: Warning: Unable to set client package folder ACL:2 InstallShield 15:45:11: Setup aborted InstallShield 15:45:11: CallScriptFunctionFromMsiCA() ends, result 0x642 CustomAction ChangeClientFoldrACL returned actual error code 1602 (note this may not be 100% accurate if translation happened inside sandbox) Action ended 15:45:11: ChangeClientFoldrACL. Return value 2. Action ended 15:45:11: INSTALL. Return value 2.
- During the Installation, our installation scripts need to modify the ClientInstall folder's ACL, but the operation failed.
2022-10-07 15:45:11.8705 INFO [1] ServerInfoTool - ========================== 2022-10-07 15:45:11.8861 INFO [1] ServerInfoTool - = ServerInfoTool Started = 2022-10-07 15:45:11.8861 INFO [1] ServerInfoTool - ========================== 2022-10-07 15:45:11.8861 INFO [1] ServerInfoTool - Called to set update directory ACL 2022-10-07 15:45:11.8861 DEBUG [1] ServerInfoTool - Directory: C:\Program Files (x86)\Trend Micro\Apex One\Addon\TMSM\TMSM_HTML\ActiveUpdate\ClientInstall 2022-10-07 15:45:11.8861 DEBUG [1] ServerInfoTool - SID : S-1-5-32-546 2022-10-07 15:45:11.8861 ERROR [1] ServerInfoTool - System.InvalidOperationException: This access control list is not in canonical form and therefore cannot be modified. at System.Security.AccessControl.CommonAcl.ThrowIfNotCanonical() at System.Security.AccessControl.CommonAcl.SetQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType) at System.Security.AccessControl.DiscretionaryAcl.SetAccess(AccessControlType accessType, SecurityIdentifier sid, Int32 accessMask, InheritanceFlags inheritanceFlags, PropagationFlags propagationFlags) at System.Security.AccessControl.CommonObjectSecurity.ModifyAccess(AccessControlModification modification, AccessRule rule, Boolean& modified) at System.Security.AccessControl.CommonObjectSecurity.SetAccessRule(AccessRule rule) at TMSM.Setup.ServerInfoTool.addReadExecPermission(String dir, String sid) at TMSM.Setup.ServerInfoTool.Main(String[] args)
The issue can happens because of one of the scenarios:
- The user credentials of the current user are not sufficient to perform the action needed by the Apex One Mac installation.
- There is a process blocking this operation, or the system is configured to block change folder authority.
Resolution
Follow the steps below to resolve the issue:
- Contact Trend Micro Technical Support to obtain the TMSM Removal tool.
- Extract the TMSM Removal Tool
- Start a Command Prompt as Administrator, then change the path to the location of the TMSM Removal tool.
- Run the command PsExec.exe -s -i cmd.exe
- In the new pop-out cmd.exe window (PsExec change the priority of this new cmd.exe to the system to be able to remove software installation information in the system registry)
- Run removeTMSM.bat
- Change the path to C:\Program Files (x86)\Trend Micro\Apex One\ in cmd.exe and then execute this command:
ICACLS Addon /T /C /RESETThis changes the Addon folder to default inherited ACL authority. - After all these steps, try to re-login to the Apex One Server and go to the Plugin Manager
- The console should be able to show the latest Apex One (Mac) download button. Download and install the plugin.
Checking TMSM_ServerInfoTool.log, found the following error logs.
2023-10-17 14:09:17.1406 ERROR [1] ServerInfoTool - [updateServerInfoPackages] C:\Program Files (x86)\Trend Micro\Apex One\Addon\TMSM\endpoint_basecamp.conf.plist not exist, skip to add it into ServerInfoHttps.zip 2023-10-17 14:09:17.1596 ERROR [1] ServerInfoTool - System.InvalidOperationException: Diese Implementation ist nicht Teil der FIPS-überprüften kryptographischen Algorithmen für die Windows-Plattform. bei System.Security.Cryptography.MD5CryptoServiceProvider..ctor() bei TMSMMainService.Util.Utility.encryptCertificate(String plainFilePath, String cipherFilePath) bei TMSM.ServerInfo.updateServerInfoPackages(String zipPath, String httpsZipPath, String localZipPath, String tmsmHomeDir) bei TMSM.ServerInfo.createServerInfoZipPackages(String configPath, String configHttpsPath, String configHttpsLocalPath, String tmsmHomeDir) bei TMSM.Setup.ServerInfoTool.writeServerInfoToClientPkg(String[] args) bei TMSM.Setup.ServerInfoTool.Main(String[] args) System.InvalidOperationException: Diese Implementation ist nicht Teil der FIPS-überprüften kryptographischen Algorithmen für die Windows-Plattform. bei System.Security.Cryptography.MD5CryptoServiceProvider..ctor() bei TMSMMainService.Util.Utility.encryptCertificate(String plainFilePath, String cipherFilePath) bei TMSM.ServerInfo.updateServerInfoPackages(String zipPath, String httpsZipPath, String localZipPath, String tmsmHomeDir) bei TMSM.ServerInfo.createServerInfoZipPackages(String configPath, String configHttpsPath, String configHttpsLocalPath, String tmsmHomeDir) bei TMSM.Setup.ServerInfoTool.writeServerInfoToClientPkg(String[] args) bei TMSM.Setup.ServerInfoTool.Main(String[] args) 2023-10-17 14:09:17.4278 INFO [1] ServerInfoTool -
The issue happen because the policy "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is enabled.
Resolution
Follow the steps below to resolve the issue:
- Open Control Panel
- Click Administrative Tools, and then double-click Local Security Policy.
- In Security Settings, expand Local Policies, and then click Security Options.
- Under Policy in the right pane, double-click System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing, and then click Disabled.