Troubleshooting guide for clients/agents appearing as "Offline" in the management console of OfficeScan

  • Updated:
    • 14 Jul 2016
  • Product/Version:
    • OfficeScan 10.6
    • OfficeScan 11.0
  • Platform:
    • Windows 10 32-bit
    • Windows 10 64-bit
    • Windows 2003 Datacenter 64-bit
    • Windows 2003 Enterprise
    • Windows 2003 Enterprise 64-bit
    • Windows 2003 Server R2
    • Windows 2003 Standard
    • Windows 2003 Standard 64-bit
    • Windows 2008 Datacenter
    • Windows 2008 Datacenter 64-bit
    • Windows 2008 Enterprise
    • Windows 2008 Enterprise 64-bit
    • Windows 2008 Server Core
    • Windows 2008 Server R2 Enterprise
    • Windows 2008 Standard
    • Windows 2008 Standard 64-bit
    • Windows 2008 Web Server Edition
    • Windows 2008 Web Server Edition 64-bit
    • Windows 2012 Datacenter R2
    • Windows 2012 Enterprise
    • Windows 2012 Enterprise R2
    • Windows 2012 Server Essential R2
    • Windows 2012 Server Essentials
    • Windows 2012 Standard
    • Windows 2012 Standard R2
    • Windows 2012 Web Server Edition
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows 8 32-bit
    • Windows 8 64-bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Home
    • Windows XP Professional
    • Windows XP Professional 64-bit
Summary

Clients/Agents appear offline in the OfficeScan management console because of several reasons:

  • The OfficeScan client/agent cannot communicate with the OfficeScan server.
  • The configuration of the individual OfficeScan clients/agents differs from that of the server.
  • After migrating or upgrading to the latest version, the OfficeScan clients/agents could either not be viewed on the management console or could not connect to the OfficeScan server (client/agent appears offline after an upgrade).
Details
Public

Depending on your case, do any of the following:

  1. Verify if the server can ping the client/agent, and vice versa.
  2. Check if the server can telnet to the client using the client/agent communication port.
  3. Check if the client/agent can telnet to the server using the server communication port (default is 8080 for OfficeScan, 8059 for CSM).
  4. Verify if the client/agent can resolve the server's hostname:
    1. Open the client/agent console then click Help > About.
    2. Note the information in the "Server name/port" field.
    3. Open a browser then type the following address:
      • For OfficeScan: http://<servername>:<port>/officescan
      • For CSM: http://<servername>:<port>/SMB/console
 
You may get a message saying you need to view the web console over a secure channel. This indicates that the connection was successful.
  • On the server machine, open the ..\PCCSRV\ofcscan.ini file in a text editor.
  • Note the values of the following parameters:

    Master_DomainName
    Master_DomainPort
    Client_LocalServer_Port

  • Open the Registry Editor (regedit.exe) on the client/agent computer.

     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  • Open either of the following registry hives:

    For 32Bit machine:

    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfficeScanCorp\CurrentVersion

    For 64Bit machine:

    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\OfficeScanCorp\CurrentVersion
  • Check the values of the following registry keys and modify as necessary:
    • LocalServerPort - must have the same value as Client_LocalServer_Port
    • Server - must have the same value as Master_DomainName
    • ServerPort - must have the same value as Master_DomainPort
  1. Do one of the following:
    • For OfficeScan 11.0, from the OSCE web console, go to Administration > Settings > Product License.

      Product License of OfficeScan

    • For OfficeScan 10.5 and 10.6, open the management console and go to the Summary page.
  2. Check if "Desktop/Server Antivirus" appears in the Activated services field.

    If only "Desktop Antivirus" or "Server Antivirus" appears, you can only manage the corresponding system type, i.e. only computers with desktop operating systems or server operating systems.

For CSM/OfficeScan 10.5/10.6/11.0:

  1. On the Security Server/OfficeScan Server, open a command prompt window.
  2. Go to the PCCSRV directory.
  3. Run the following commands:

    svrsvcsetup -setvirdir
    svrsvcsetup -setprivilege

  4. If you are using SSL, run the following command:

    svrsvcsetup -enablessl

  1. Open the IIS Manager then expand [server name] > Web Sites > OfficeScan.
  2. Right-click the officescan virtual directory, then select Properties.
  3. Click the Directory Security tab, then click Edit under "Authentication and access control".
  4. Make sure that Enable anonymous access and Integrated Windows authentication are enabled.
  5. Make sure that the user name used is IUSR_and that Enable automatic password synchronization is selected.

If you are using IIS 6.0 on Windows 2003:

  1. Open the IIS Manager then click [server name] > Application Pools.
  2. Click Action > New > Application Pool.
  3. Enter the following information:

    Application pool ID: OSCE
    Application pool settings: Use default settings for new application pool

  4. Click OK.
  5. Right-click the OSCE application pool then click Properties.
  6. Click the Identity tab, then select Predefined and Local System.
  7. Click OK > Yes.
  8. Expand [server name] > Web Sites.
  9. Right-click the OfficeScan web site then click Properties.
  10. Click the Home Directory tab.
  11. Under Application Settings, click Remove to delete the existing settings.
  12. Click Create.
  13. Select OSCE for the Application pool, then click OK.
  1. On the client/agent computer, open My Network Places then access the\ofcscan folder.
  2. Double-click the autopcc.exe file.
  3. Open the management console then verify if the client now appears correctly.
  1. On the server machine, open the ..\PCCSRV\ofcscan.ini file in a text editor.
  2. Note the values of the following parameters:

    Master_DomainName
    Master_DomainPort
    Client_LocalServer_Port

  3. Copy the ..\PCCSRV\Admin\Utility\IpXfer\IpXfer.exe file to the OfficeScan Client/Agent folder on the client/agent machine.
  4. On the client/agent machine, open a command prompt window.
  5. Go the OfficeScan Client/Agent directory.
  6. Run the following command:

    IpXfer.exe -s servername -m 1 -p serverport -c clientport

    where:
    servername is the Master_DomainName value
    serverport is the Master_DomainPort value
    clientport is the Client_LocalServer_Port value
  7. Open the management console then verify if the client/agent now appears correctly.
  1. On the server machine, open the ..\PCCSRV\ofcscan.ini file in a text editor.
  2. Note the values of the following parameters:

    Master_DomainPort
    Client_LocalServer_Port

  3. On the client machine, click Start > Settings > Control Panel.
  4. Double-click Windows Firewall.
  5. Click the Exceptions tab then click Add Port.
  6. Enter the values of the Master_DomainPort and Client_LocalServer_Port using the TCP protocol.
  7. Restart the OfficeScanNT Listener service.
  8. Clear the Internet Explorer temporary internet files, offline content, and cookies.
  9. Open the management console then verify if the client/agent now appears correctly.
  1. Do one of the following:
    • For OfficeScan 11.0, open the OSCE management console and navigate to Agents > Agent Management.
    • For OfficeScan 10.5 and 10.6, open the OfficeScan management console and click Clients.
  2. On the client tree, click Add.
    For OfficeScan 11.0, click Add Domain on the Manage Agent Tree.
  3. Type a name for the domain, then click OK.
  4. Drag the client/agent that has an offline or disconnected status to the new domain.
  5. On the client/agent machine, restart the OfficeScanNT Listener service.
  6. Right-click the OfficeScan icon on the system tray then click Update Now.
  7. Refresh the management console then verify if the client/agent now appears correctly.
  1. On the server machine, open the ..\PCCSRV\ofcscan.ini file in a text editor.
  2. Note the values of the following parameters:

    Master_DomainName
    Master_DomainPort
    Master_SSLPort

  3. On the client/agent machine, open a browser then type the following address:

    For OfficeScan with SSL:
    https://<servername>:<sslport>/officescan/cgi/cgionstart.exe
    For OfficeScan without SSL:
    http://<servername>:<port>/officescan/cgi/cgionstart.exe

    where:
    servername is the Master_DomainName value
    port is the Master_DomainPort value
    sslport is the Master_SSLPort value
  4. If the page displays "-2", the client can communicate with the server.
  1. On the OfficeScan server, stop the OfficeScan Master Service.
  2. Open the ..\PCCSRV\HTTPDB folder then move its contents to a temporary folder.
  3. Start the OfficeScan Master Service
  4. Restart the OfficeScanNT Listener service on the client/agent, or restart the computer.
  5. Open the management console then verify if the client/agent now appears correctly.
  1. On the OfficeScan server, open the ..\PCCSRV\Web folder then verify if the CGI folder exists.
  2. If it does not exist, do the following:
    1. Download the OfficeScan installer file then extracts its contents to a temporary folder.
    2. Copy the \output\_wgroup\Web\CGI folder from the extracted files to the ..\PCCSRV\Web folder on the OfficeScan server.
    Restart the OfficeScan Master Service.
  3. Open the management console to verify if the client now appears correctly.

If the issue persists after following the procedures above, do the following:

  1. Note down the following:
    1. When did the issue first occur? Was it working properly before?
    2. How many clients/agents are managed by your server?
    3. How many clients/agents and what operating systems are affected? Do some clients/agents show up properly in the management console?
    4. Are the clients/agents on the same local area network as the server? Are there any proxies/firewalls/NATs between them?
  2. Use the Case Diagnostic Tool to collect debugging information. Run it once on both the server and the affected client/agent.
  3. Collect IIS logs from the server:
    1. Open the IIS Manager then expand [server name] > Web Sites > OfficeScan.
    2. Right-click the OfficeScan web site then click Properties.
    3. On the Web Site tab, select Enable logging then click Properties.
    4. Configure the log settings as necessary then click OK.
    5. Copy the log files in the location you selected (the default location is %WinDir%\System32\LogFiles\W3SVC1).
  4. Collect the ofcscan.ini files from both the server and client/agent machines. Rename the ofcscan.ini from the client to ofcscan-client.ini.
  5. Export either of the following registry hives in the client/agent:

    For 32Bit machine:

    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfficeScanCorp\CurrentVersion

    For 64Bit machine:

    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\OfficeScanCorp\CurrentVersion
  6. Send all the information above to Trend Micro Technical Support or contact your Technical Account Manager.
Premium
Internal
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.