Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Uninstalling clients or agents in OfficeScan or Apex One

    • Updated:
    • 24 Feb 2021
    • Product/Version:
    • Apex One All
    • Apex One as a Service
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan 11.0
    • OfficeScan XG
    • Platform:
    • Windows 2003 Enterprise Server
    • Windows 2003 Standard Server Edition
    • Windows 2008 Enterprise Server
    • Windows 2008 Standard Server Edition
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows Vista 32-bit
    • Windows XP Professional

Use the procedures in this article to:

  • Uninstall the OfficeScan /Apex One clients/agents
  • Remove OfficeScan /Apex One components from the computer
  • Troubleshoot problems encountered while removing the OfficeScan /Apex One clients/agents

Below are the options for uninstalling the OfficeScan or Apex One program from clients/agents:
Uninstalling the client/agent removes security risk protection.


The following files will remain in the computer when you apply this procedure while Internet Explorer is open on the target PC. The files will be automatically removed after rebooting:

  • TmIEplg.dll/TmIEplg32
  • TmProxy.dll/TmProxy32.dll

To uninstall the client/agent using the web console:

  1. Log on to the OfficeScan web console or Apex One web console.
    Refer to the following KB article if you have forgotten your password: Resetting the console password in OfficeScan.
  2. Go to either:
    • Networked Computers > Client Management (v10.x)
    • Agents > Agent Management (v11.0/XG/Apex One)
    • Directories> Product Servers> Select the link for Apex One as a Service
  3. In the client tree, select the clients/agents that you want to uninstall OfficeScan from and then click either:
Client Installation
Tasks > Agent Uninstallation (v11.0/XG)
Agent Installation
Product Servers> Select the link for Apex One as a Service> (Apex One SaaS)
Then Go to Agents > Agent Management> Task> Agent Uninstallation (Apex One SaaS)
  1. On the Client/Agent Uninstallation screen, click Initiate Uninstallation. The server then sends a notification to the clients/agents.
  2. Check the notification status and verify if there are clients/agents that did not receive the notification.
    • Click Select Un-notified Computers and then Initiate Uninstallation to immediately resend the notification to the clients/agents.
    • Click Stop Uninstallation to prompt OfficeScan to stop notifying clients/agents. Clients/agents which are already notified and performing uninstallation will ignore this command.

If you granted users the privilege to uninstall the client program, ask them to run the client uninstallation program from their computers.

This procedure requires users to specify the uninstallation password. Make sure that you share the password only to users who will run the uninstallation program and change it immediately has it been divulged to other users. You can also disable the password on computers where the client will be uninstalled.

Follow the steps in the following link to set up the installation password: Granting the OfficeScan Agent Uninstallation Privilege.

Do the following:

  1. On the Windows Start menu, perform any of the two options:
    • Go to Programs > Trend Micro OfficeScan Client > Uninstall OfficeScan Client (v10.x) or Trend Micro OfficeScan Agent > Uninstall OfficeScan Agent (v11.0/XG).

      Uninstall OfficeScan Agent

    • Click Control Panel > Add or Remove Programs, look for Trend Micro OfficeScan Client (v10.x) or Agent (v11.0/XG), and then click Change. Follow the on-screen instruction to finish the uninstallation.

      Uninstall or Change a Program

  2. If prompted, type the uninstallation password. OfficeScan will notify you of the progress and completion. In Officescan 11.0/XG, a prompt “Please manually delete the Trend Micro OfficeScan folder to complete the uninstallation.” will be shown. You do not need to restart the client computer to complete the uninstallation.

    Request the OfficeScan client/agent uninstallation password from the OfficeScan Administrator.  In case the password had been changed or is not documented at all, proceed to the manual removal method written below.

Perform manual uninstallation only if you encountered issues when uninstalling from the web console or after running the uninstallation program. If so, do the following:

  1. Log on to the client/agent computer using an account with Administrator privileges.
  2. Right-click on the OfficeScan client icon on the system tray and then select Unload Officescan. If prompted for a password, specify the unload password and then click OK.

    You can disable the password on computers where the client will be unloaded. For details, see Client Privileges and Other Settings on pages 4-9 of the Administrator's Guide. In OfficeScan 11.0/XG:

    1. Open the web console.
    2. Go to Agents > Agent Management.
    3. Select the OfficeScan agent.
    4. Navigate to Settings > Privileges and Other Settings > Privileges tab.
    5. Select “Does not require a password” under Unload and Unlock.
    6. Click Apply.

    If the unload password was not specified, stop the following services from the Microsoft Management Console:

    • OfficeScan NT Listener
    • OfficeScan NT Firewall
    • OfficeScanNT RealTime Scan
    • OfficeScan NT Proxy Service
    • Trend Micro Unauthorized Change Prevention Service (if the computer runs an x86 type platform)
    • OfficeScan Common Client Solution Framework (v11.0/XG)
    • Trend Micro OfficeScan NT Proxy Service (v11.0/XG)
  3. Go to Start > Programs, right-click on either Trend Micro OfficeScan Client (v10.x) or Agent (v11.0/XG), then click Delete.
  4. Open the Registry Editor.
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  5. Delete the following registry keys:

    Registry Editor

    • If there are no other Trend Micro products installed on the computer:
    • For 64-bit computers:
      • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\TrendMicro
    • If there are other Trend Micro products installed on the computer:
      • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfcWatchDog
    • For 64-bit computers:
      • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\TrendMicro\OfcWatchDog
      • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp
      • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432node\TrendMicro\PC-cillinNTCorp
  6. Delete the following registry keys/values:
    • For 32-bit computers:
      • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT
      • OfficeScanNT Monitor (REG_SZ) under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • For 64-bit computers:
      • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OfficeScanNT
      • OfficeScanNT Monitor (REG_SZ) under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
  7. Delete all instances of the following registry keys in the following locations:
    • Locations:
      • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
      • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services
    • Keys:
      • ntrtscan
      • Perf_iCrcPerfMonMgr
      • tmactmon
      • TMBMServer
      • tmccsf
      • tm_cfw (For Windows XP or older)
      • tmcomm
      • TMEBC
      • tmeevw (For Windows Vista/2008 computers or newer)
      • tmeext (For Windows XP or older)
      • tmel (For Windows 8, Windows Server 2012, or newer)
      • tmevtmgr
      • TmFilter
      • Tmlisten
      • tmlwf (For Windows Vista/2008 computers or newer)
      • tmnciesc
      • tmpfw
      • TmPreFilter
      • tmumh (XG)
      • tmusa (For Windows 7/2008 R2 computer or newer)
      • TmProxy (For Windows XP, Vista/2008 computers or older)
      • tmtdi (For Windows XP, Vista/2008 computers or older)
      • tmwfp (For Windows Vista/2008 computers or later versions)
      • VSApiNt
  8. Close the Registry Editor.
  9. Go to the Control Panel and then double-click on System.
  10. Click the Hardware tab and then click Device Manager > View > Show hidden devices.
  11. Expand Non-Plug and Play Drivers and then uninstall the following devices:
    • tmcomm
    • tmactmon
    • tmevtmgr
    • Trend Micro Filter
    • Trend Micro PreFilter
    • Trend Micro TDI Driver
    • Trend Micro VSAPI NT
    • Trend Micro Unauthorized Change Prevention Service
    • Trend Micro WFP Callout Driver (For Windows Vista/2008 computers)
    • TMEBC
    • tmeevw
    For Windows 8.0, 8.1, 10.0, 2012 or any Operating system using Windows Kernel revisions 6.2, please disregard the step for Non-Plug and Play Drivers. These drivers are still removed via the registry keys.
  12. Uninstall the Common Firewall Driver:

    Wi-Fi Properties

    1. Right-click My Network Places and then click Properties.
    2. Right-click Local Area Connection and then click Properties.
    3. On the General tab, select Trend Micro Common Firewall Driver, and then click Uninstall.

    On Windows Vista computers, do the following:

    1. Right-click Network, and then click Properties > Manage network connections.
    2. Right-click Local Area Connection, and then click Properties.
    3. On the Networking tab, select Trend Micro NDIS 6.0 Filter Driver and then click Uninstall.
  13. Restart the client computer.
  • If there are no other Trend Micro products installed on the computer, delete the Trend Micro installation folder:

    • Default: C:Program Files\Trend Micro
    • 64-bit computers: C:\Program Files (x86)\Trend Micro

    If there are other Trend Micro products installed, delete the following folders:

    • {client installation folder}
    • The BM folder under the Trend Micro installation folder (by default located in
      C:\Program Files\Trend Micro\BM)
This tool was designed to forcibly uninstall a corrupted or password-protected OfficeScan agent. Due to security considerations, please contact Trend Micro Technical Support directly to obtain it or refer to the KB article: Information about the CUT Tool for OfficeScan/Apex One.
Configure; Troubleshoot; Uninstall
Solution Id:
Did this article help you?

Thank you for your feedback!

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.