Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Preventing performance issues with Worry-Free Business Security (WFBS) in a Citrix or Terminal Server environment

    • Updated:
    • 14 Oct 2015
    • Product/Version:
    • Worry-Free Business Security Services 5.7
    • Worry-Free Business Security Standard/Advanced 7.0
    • Worry-Free Business Security Standard/Advanced 8.0
    • Worry-Free Business Security Standard/Advanced 9.0
    • Platform:
    • Windows 2003 Enterprise
    • Windows 2003 Small Business Server
    • Windows 2003 Standard
    • Windows 2008 Enterprise
    • Windows 2008 Small Business Server
    • Windows 2008 Standard
    • Windows 2011 Small Business Server Essentials
    • Windows 2011 Small Business Server Standard
Summary

Prevent performance issues for WFBS installed on a Citrix or Terminal Server.

 
It is not recommended to install the Security Server (SS) on a Citrix or Terminal Server.
Details
Public

WFBS supports the following:

  • Remote Desktop
  • Remote Web Workplace
  • Citrix server terminal application

In a Terminal Services environment, you can decide whether to show or hide the Security Agent (SA) icon in the Windows task bar. This setting applies to all or none of the active user sessions. It is not possible to apply the setting to individual user sessions. If the icon shows on all active user sessions, memory usage may increase.

To avoid this issue, do the following:

  1. On the SA host, open the registry editor.
     
    Always create a backup before modifying the registry. Incorrect registry changes may cause serious issues. Should this occur, restore it by referring to the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.
  2. Create/modify the following REG name/value pair:

    Key: HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc (for 32-bit)
    HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc (for 64-bit)
    Name: RCS
    Type: DWORD
    Value: 202 (in decimal format)

     
    There will be no PccNTMon instances created when its value is set to 202.
  3. Set the TmPreFilter to run in MiniFilter-Mode:

    1. Look for the HKLM\SYSTEM\CurrentControlSet\Services\TmPreFilter\Parameters registry hive.
    2. Change the value of the "EnableMiniFilter" registry key to "1".
    3. Restart the computer.
  4. Change the memory usage of the PagedPool.
    The following steps only works on Windows Server 2003 and below. Skip this step if using Windows Server 2008.
    1. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry hive.
    2. Change the value of the "PagedPoolSize" registry key to "FFFFFFFF".
    3. Restart the computer. Memory management will be set.
  5. Exclude the following file extensions from scanning on a Citrix and Terminal Server:
    • .LOG
    • .DAT
    • .TMP
    • .POLB
    • .PF
  6. Exclude the roaming profiles from the RealTime scan on the fileserver.
  7. Create a daily/weekly scheduled scan of the roaming profiles in off-peak hours on the fileserver.

By default, there are multiple UiSeAgnt.exe processes on the Terminal Server for each RDP connection. These processes consume memory resource. To reduce the memory usage on memory critical computers, you can manually set the maximum number of visible UiSeAgent from the registry.

To do this:

  1. Open the Registry Editor (regedit).
     
    Always create a backup before modifying the registry. Incorrect registry changes may cause serious issues. Should this occur, restore it by referring to the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.
  2. Look for this registry hive:

    For 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\UniClient\0\Install
    For 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\UniClient\0\Install

  3. Add the registry key "SeAgntMaxNum" (REG_DWORD) and add the value "1".
  4. Restart the Security Agent.
  5. Change the memory usage of the PagedPool.
    The following steps only works on Windows Server 2003 and below. Skip this step if using Windows Server 2008.
    1. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry hive.
    2. Change the value of the "PagedPoolSize" registry key to "FFFFFFFF".
    3. Restart the computer. Memory management will be set.
  6. Exclude the following file extensions from scanning on a Citrix and Terminal Server:
    • .LOG
    • .DAT
    • .TMP
    • .POL
    • .PF
  7. Exclude the roaming profiles from the RealTime scan on the fileserver.
  8. Create a daily/weekly scheduled scan of the roaming profiles in off-peak hours on the fileserver.

Many instances of the PccNTMon process will be created in the memory where the agent is installed. This happens when users access the computer from a terminal session.

To avoid this issue, do the following:

  1. Open the Registry Editor (regedit).
     
    Always create a backup before modifying the registry. Incorrect registry changes may cause serious issues. Should this occur, restore it by referring to the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.
  2. Look for this registry hive:

    For 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.
    For 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.

  3. Change the value of the registry key "RCS" (REG_DWORD) to decimal "202". The default value is "101".
  4. Set the TmPreFilter to run in MiniFilter-Mode:
    1. Look for the HKLM\SYSTEM\CurrentControlSet\Services\TmPreFilter\Parameters registry hive.
    2. Change the value of the "EnableMiniFilter" registry key to "1".
    3. Restart the computer.
  5. Change the memory usage of the PagedPool.
    The following steps only works on Windows Server 2003 and below. Skip this step if using Windows Server 2008.
    1. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management registry hive.
    2. Change the value of the "PagedPoolSize" registry key to "FFFFFFFF".
    3. Restart the computer. Memory management will be set.
  6. Exclude the following file extensions from scanning on a Citrix and Terminal Server:
    • .LOG
    • .DAT
    • .TMP
    • .POLb
    • .PF
  7. Exclude the roaming profiles from the RealTime scan on the fileserver.
  8. Create a daily/weekly scheduled scan of the roaming profiles in off-peak hours on the fileserver.
Premium
Internal
Rating:
Category:
Configure
Solution Id:
1059023
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.