Manually updating the ESP server with a Controlled Pattern Release (CPR)

1. Log on to the ESP/TEM Server and create the following folder paths:

   C:\update
   C:\update\pattern

2. Obtain a copy of "Enterprise Pattern - CPR" from Technical Support or in this link.

   Sample CPR Version:
   Filename: lpt888.zip
   Pattern Version: 9.888.04
   Size: 45295843 bytes (NOT "Size on disk")

3. Rename lpt888.zip to vsapi888.zip and move it to C:\update\pattern.
4. Open the notepad (notepad.exe) and type the following information:

   For example:

   [PATTERN]
   Version=888
   P.4=pattern/vsapi888.zip,988804,45295843
   MergeCount=0

   where:

   888 = short pattern version number
   988804 = long pattern version number (9.888.04)
   45295843 = File Size (NOT "Size on disk")

5. Save notepad as server.ini file to C:\update.

1. Log on to the ESP/TEM Console.
2. Go to Endpoint Protection > All Endpoint Protection > Dashboards > ActiveUpdate Server Settings Wizard.
3. Under the Internet location containing a copy of the current file field, type in the ActiveUpdate Source UNC Path you created.

   For example:

   \\au_source\c$\update

4. Click the Create Server Configuration Action... button to open the Take Action dialog box.
5. In the Take Action dialog box, select the ESP/TEM Server as the target.
6. Click OK to proceed and wait until action is complete.

1. Log on to the ESP/TEM console and search for Fixlet ID:25 "Core Protection Module - Set ActiveUpdate Server Pattern Update Interval" and deploy it as one time action to the ESP/TEM server.
2. When action completes, go to Endpoint Protection > All Endpoint Protection > Dashboards > Create Pattern Update/Rollback Task and verify that the new "Virus Pattern" is available.
3. Click the Deploy button to open deployment type dialog box. Select either Deploy a one time action or Create an update Fixlet.
   • Selecting Deploy a one time action opens the Take Action window to select target computers and instantly deploy CPR Component.
   • Selecting Create an update Fixlet opens Create Fixlet window to create a fixlet for use in deploying CPR Component to target computers at a later time.
4. Deploy CPR Component to CPM Endpoints based on the type of deployment selected in step 3.

After deploying CPR to selected endpoints:

1. Change the ESP/TEM Server's ActiveUpdate Source back to "Trend Micro's ActiveUpdate Server" by performing similar steps in "II. Configure temporary ActiveUpdate Source".
2. When action completes, delete all files/folders in "...\Trend Micro\Core Protection Module Server\download" directory and redeploy fixlet ID: 25 "Core Protection Module - Set ActiveUpdate Server Pattern Update Interval".
3. Restart "Core Protection Module - Apply Automatic Updates" policies that were temporarily STOPPED.

This should switch all CPM Endpoints back to regular and normal pattern updates and those endpoints that received CPR/BPR will be updated again with regular patterns in the next Official Pattern Release (OPR) which happens the following day.