Business Impact

• No functionality impact. NCIE functions are not enabled for the Windows platform.
• The registry key is used for files that need to be rebooted to clean. Customers may have monitoring tools to monitor this registry key.
• The folder “C:\Program Files\Trend Micro\Net Filter” should not exist. This can be removed but duplicated registry key data values will remain in the registry.

Root Cause

The Trend Vision One™ sensor (cloud endpoint) continuously checks whether NCIE is opted-in and enabled. If the user has not opted-in to NCIE, the endpoint service triggers the uninstall command and adds the registry value data each time the uninstall is triggered for tm_netsrv.

Mitigation

If customers urgently need to resolve this issue, notify the cloud endpoint team to upgrade to a fixed build or wait for December release update.