Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Troubleshooting the Client/Server Security Agent (CSA) or Security Agent (SA) that appears offline/disconnected or is missing in Worry-Free Business Security (WFBS)

    • Updated:
    • 4 Jul 2016
    • Product/Version:
    • Worry-Free Business Security Standard/Advanced 7.0
    • Worry-Free Business Security Standard/Advanced 8.0
    • Worry-Free Business Security Standard/Advanced 9.0
    • Platform:
    • Windows 2000 Advanced Server
    • Windows 2000 Professional
    • Windows 2000 Server
    • Windows 2000 Small Business Server
    • Windows 2003 Enterprise Server
    • Windows 2003 Small Business Server
    • Windows 2003 Standard Server Edition
    • Windows 2008 Essential Business Server
    • Windows 2008 Small Business Server
    • Windows 7 32-bit
    • Windows Vista 32-bit
    • Windows XP Professional
Summary

Know the troubleshooting steps when you encounter the following issues with the CSA/SA of WFBS:

  • Agent appears as offline in the WFBS management console
  • Agent's status in the System Tray shows the disconnected icon
  • Clients incorrectly appear as "Offline" on the console or do not appear at all
  • Clients do not show the correct pattern file or scan engine on the console
  • Clients do not report/appear to the new Security Server
  • Security Agents are not showing in the WFBS console
  • Clients do not update properly
  • Clients deployment problem from the console
  • Reconnecting offline clients after migrating to a new WFBS server
Details
Public

To resolve any of the issues listed, do one of the following options:

 
Troubleshooting the Security Server should be done if all or majority of the CSAs are not appearing. On the other hand, troubleshooting the CSA should be done when a client or some clients are not appearing, but majority of the clients are appearing online. This is to avoid unnecessary actions on the Security Server and prevent further damage on the WFBS client.
  1. Log in to the WFBS console.
  2. Go to Preferences > Product License.
  3. Make sure that you have not exceeded the seats for your license. Otherwise, the extra clients will not appear in the management console.
    You can contact your reseller or the Trend Micro Sales department to purchase additional seats.

To check the server-agent communication:

  1. From the Security Server, ping the IP address of the disconnected/offline agent.
    1. From the disconnected/offline Client/Server Security Agent, ping the IP address of the Security Server.
    2. Return to the Security Server and open the ..\PCCSRV\ofcscan.ini file.
    3. Note the values of the following entries:
      • Master_DomainName
      • Master_DomainPort
      • Client_LocalServer_Port
    4. Open the Registry Editor in the client computer and compare the communication information with the WFBS server.
       
      Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

      The values of the following registry keys should be the same with the values from Step 1d.

      • For WFBS 7.0: Go to HKEY_LOCAL_MACHINE\Software\Trend Micro\UniClient\1600.
      • For WFBS 6.0/8.0/9.0:
        • 32-bit Operating System (OS): Go to HKEY_LOCAL_MACHINE\Software\Trend Micro\PC-CillinNTtCorp\CurrentVersion
        • 64-bit OS: Go to HKEY_LOCAL_MACHINE\Software\WOW6432Node\Trend Micro\PC-CillinNTtCorp\CurrentVersion
      • Server
      • ServerPort
      • LocalServerPort

      If the values are not the same, use the Client Mover Tool (IPXfer.exe) to restore the communication between the WFBS server and Security Agent. Follow the IpXfer.exe procedure in the article: Migrating clients of Worry-Free Business Security (WFBS) to another server.

    5. Open a command prompt and run this command:

      telnet<space><agent's IP address><space><value of the Client_LocalServer_Port>

      If telnet is unsuccessful, check if a firewall is turned on or is blocking the Client_LocalServer_Port. Ask your network administrator for assistance.

    6. Open a command prompt from the CSA/SA and run this command:

      telnet<space><value of the Master_DomainName><space><value of the Master_DomainPort>

      If telnet is unsuccessful, check if a firewall is turned on or is blocking the Master_DomainPort. Ask your network administrator for assistance.

    7. Check for limited network bandwidth. If this condition exists, run these commands to determine if the limited bandwidth causes connection timeout:
      • From the Security Server, type "ping<space>-t<space><agent's IP address>"
      • From the CSA/SA, type "ping<space>-t<space><server's IP address>
  2. Set the CSA/SA's permission in the ..\Security Server\PCCSRV folder.
    1. From the Security Server, open a command prompt and go to the ..\PCCSRV folder.
    2. Run "svrsvcsetup<space>-setprivilege" and then close the command prompt.
    3. Restart the Trend Micro Client/Server Security Agent Listener service on one of the clients that is disconnected or offline.
    4. Open the WFBS console and go to Security Settings.
    5. Refresh the page after 30 seconds and verify if the agent is still disconnected or appears offline.
  3. Verify the client’s connection to the Security Server:
    1. On the client computer, open Internet Explorer.
    2. Type the following URL in the address bar then press Enter:

      http://<Server name>:<serverport>/SMB/cgi/cgionstart.exe

      If the next screen shows -2, this means the client can communicate with the server.

  4. Access the server and execute autopcc.exe.

    The program autopcc.exe performs the following functions:

    • Determines the operating system of the unprotected computer and the CSA/SA.
    • Updates the scan engine, virus pattern file, Damage Cleanup Services components, cleanup file, and program files.

    In order to enforce the use of the login script installation method, client computers must be listed in the Windows Active Directory of the server that is performing the installation.

      1. On the client computer, open Network Neighborhood and access the Security Server.
      2. Go to the PCCSRV folder or the ofcscan shared folder.
      3. Execute autopcc.exe.
      4. Refresh the WFBS console.

        If the agent still does not appear on the WFBS console, re-establish the communication between the server and the agent by using the Client Mover Tool (IpXfer).

      5. Return to the WFBS console and check the status of the agent.
  5. Check the server-agent communication using the administrator account for the OfficeScan website.
    1. From the Security Server, click Start > Run and then type "inetmgr".
    2. Expand Servername > Website.
    3. Under Websites, right-click OfficeScan and then select All tasks > Save Configuration to a file.
    4. Use "OfficeScan" as the filename.
    5. Click on the Desktop icon and then click Save.
    6. Go to the Directory Security tab.
    7. Under the Authentication and Access Control section, click Edit.
    8. Tick the Enable Anonymous Access checkbox.
    9. Enter your administrator account and password.
    10. Click Apply > Yes to All > OK.
    11. Open the Services console and restart the following services:
      • World Wide Web Publishing Service
      • Trend Micro Security Server Master Service
    12. Log in to the WFBS console and verify that the computers are now listed under Servers and Desktop groups.

Use the following workaround if the client is offline after migrating to a new WFBS server or if the client can be updated but do not appear in the web console after a fresh install.

This procedure is only applicable if you cannot use IpXfer to move the client to the new server.

For WFBS 8.0/9.0

  1. Go to the offline client machine and unload the agent.
  2. Open Registry Editor.
     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  3. Go to the following registry key:
    • For 64-bit OS:
      HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • For 32-bit OS:
      HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion
  4. Modify the following values:

    The Domain and DomainID value are referencing to the Group in the WFBS console. By default, the values are:

    For Servers group:

    "Domain"="Servers (default)"
    "DomainID"="10000000-0000-0000-0000-000000000000"

    For Desktops group:

    "Domain"="Desktops (default)"
    "DomainID"="20000000-0000-0000-0000-000000000000"

    • ServerPort=dword:00001f7b (default port in hexadecimal)
    • Server="Name of the server"
    • Domain="Desktops (default)"
    • LocalServerPort=listening port (hexadecimal)
    • DomainID="20000000-0000-0000-0000-000000000000"

    For other languages, you must change the Domain value according to what is displayed in the console for the default groups. The DomainID should stay the same.

  5. Reload the agent.

For WFBS 6.0/7.0

  1. Go to the offline client machine and open the Registry Editor.
  2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion.
  3. Modify the following values:

    The Domain and DomainID value are referencing to the Group in the WFBS console. By default, the values are:

    For Servers group:

    "Domain"="Servers (default)"
    "DomainID"="10000000-0000-0000-0000-000000000000"

    For Desktops group:

    "Domain"="Desktops (default)"
    "DomainID"="20000000-0000-0000-0000-000000000000"

    • ServerPort=dword:00001f7b (default port in hexadecimal)
    • Server="Name of the server"
    • Domain="Desktops (default)"
    • LocalServerPort=listening port (hexadecimal)
    • DomainID="20000000-0000-0000-0000-000000000000"

    For other languages, you must change the Domain value according to what is displayed in the console for the default groups. The DomainID should stay the same.

  4. Restart the client machine.

If the issue still occurs, contact Trend Micro Technical Support and provide the Case Diagnostic Tool (CDT) log generated on the WFBS server and the Security agent.

Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1037481
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.