Backing up and restoring Endpoint Sensor (TMES) 1.6 server using the command line

1. Back up the following files:

   • C:\Program Files\Trend Micro\Trend Micro Endpoint Sensor\config.xml
   • C:\Program Files\Trend Micro\Trend Micro Endpoint Sensor\Web\UI\widget\repository\inc\class\common\crypt\crypt.key

2. Enable Named Pipes for SQL Server.

   1. Open the SQL Server Configuration Manager.
   2. On the left pane, under SQL Server Network Configuration, select Protocols for SMARTSENSOR.
   3. On the right pane, Under the Protocol Name column, find Named Pipes and ensure that the status is set to "Enabled".
   4. Restart the SQL service.

3. Back up the database to a local disk (for example to c:\temp\tmes.bak).

   Open the Command Prompt and execute following command:

   osql.exe -S .\SMARTSENSOR -E -d master -b -c cmd_end -Q "BACKUP DATABASE SmartSensor to disk='c:\temp\tmes.bak'"

    

   Make sure that the SmartSensor database is not being used by another application.

Restoring TMES server 1.6 requires a server with the same environment as the original server. For instance, same hostname, etc.

1. Restore the database using the following commands:

   1. Stop TrendMicroEndpointSensorService
   2. Restart MSSQL$SMARTSENSOR (SQL Server service).
   3. osql.exe -S .\SMARTSENSOR -E -Q "drop database smartsensor"
   4. osql.exe -S .\SMARTSENSOR -E -d master -b -c cmd_end -Q "RESTORE DATABASE SmartSensor from disk='c:\temp\tmes.bak'"

   After restoring the database, you will see either of the following messages:

   If you see the error message, check if you correctly followed the steps then try again.

   ------------ SUCCESSFUL ------------  C:\Users\Administrator>osql.exe -S .\SMARTSENSOR -E -d master -b -c cmd_  end -Q "RESTORE DATABASE SmartSensor from disk='c:\temp\tmes.bak'"  Processed 5952 pages for database 'SmartSensor', file 'SmartSensor' on file 1.  Processed 2 pages for database 'SmartSensor', file 'SmartSensor_log' on file 1.  RESTORE DATABASE successfully processed 5954 pages in 9.195 seconds (5.058  MB/sec).

   --------------- Failed ---------------  C:\Users\Administrator>osql.exe -S .\SMARTSENSOR -E -d master -b -c cmd_  end -Q "RESTORE DATABASE SmartSensor from disk='c:\temp\tmes.bak'"  Msg 3101, Level 16, State 1, Server WIN-97MUGPLBVEO\SMARTSENSOR, Line 1  Exclusive access could not be obtained because the database is in use.  Msg 3013, Level 16, State 1, Server WIN-97MUGPLBVEO\SMARTSENSOR, Line 1  RESTORE DATABASE is terminating abnormally.

2. Replace the following files:

   • C:\Program Files\Trend Micro\Trend Micro Endpoint Sensor\config.xml
   • C:\Program Files\Trend Micro\Trend Micro Endpoint Sensor\Web\UI\widget\repository\inc\class\common\crypt\crypt.key
3. Start TrendMicroEndpointSensorService.
4. Confirm that the agent is online in the server console.
5. Perform a new investigation to confirm if the agent communication is running normally.