The ACS Certificate Integrity Checking Enhancement will be added from:
- Apex One as a Service March 2023 maintenance – (Block New Agent Installation & Block Program Upgrade)*
- Apex One On-Premise March Critical Patch release – (Block New Agent Installation & Block Program Upgrade)*
The non-ACS program upgrade blocking is a best effort implementation to prevent accidental deployment of new build on non-ACS compliant system.
Customers are strongly advised to apply appropriate MS KB immediately to enable ACS support before deploying latest Apex One builds.
Important notice on Non-ACS blocking enhancement:
- On some environment, the ACS compliant detection logic may not work correctly and fail to block program updates on non-ACS compliant systems.
- If current agent build is at Dec 2022 build(11960) or lower, user might experience high network usage due to repeated downloads of program upgrade module.
- Non-ACS supported endpoint may remain unnoticed at an old build missing out on critical security fixes that may increases vulnerability of the system.
Please refer to the summary table for Trend Micro recommendations:
| ACS Compliance Level | Recommendation | Other Info |
|---|---|---|
| All systems are ACS compliant | Can apply latest build without any issues | Can upgrade agents to latest build without issues |
| All systems are not ACS compliant | Disable Agent program upgrade before applying latest hot fix or patch. Please install appropriate Windows KB before applying re-enabling program upgrade. Warning: It is recommended to separate the systems by grouping and to upgrade only ACS compliant systems. | In-place upgrade using EXE or MSI package will also do ACS check and block if not compliant. |
| Systems are partially ACS compliant |
If the target endpoint does not have the required Windows updates, the following messages will be shown:
- Applying Patch on Apex One server (On-Premise)
Click the image to enlarge.
- Fresh Installation of Apex One Security Agent:
- Popout message (Standalone MSI Installer)
Click the image to enlarge.
- Web Console Remote Installation (On-Premise)
Click the image to enlarge.
- Popout message (Standalone MSI Installer)
- Program Update: Application Event Logs will have recorded events below. (Security Agent will stay on current version)
Click the image to enlarge.