Business Impact

• No functionality impact. NCIE functions are not enabled for the Windows platform.
• The registry key is used for files that need to be rebooted to clean. Customers may have monitoring tools to monitor this registry key.
• The folder “C:\Program Files\Trend Micro\Net Filter” should not exist. This can be removed but duplicated registry key data values will remain in the registry.

Root Cause

The Trend Vision One sensor (cloud endpoint) continuously checks whether NCIE is opted-in and enabled. If the user has not opted-in to NCIE, the endpoint service triggers the uninstall command and adds the registry value data each time the uninstall is triggered for tm_netsrv.

Mitigation

If customers urgently need to resolve this issue, notify the cloud endpoint team to upgrade to a fixed build or wait for December release update.