Configure the following under Policies > Global Security Agent Settings.

Security Settings tab

1. Under General Scan, enable the following:

   • Enable deferred scanning on file operations

      

     Enabling this feature significantly improves performance, but may introduce a slight security risk
   • Exclude the Microsoft Exchange Server 2003 folders
   • Exclude the Microsoft domain controller folders (Not applicable to manual and scheduled spyware/grayware scans)
   • Exclude Shadow Copy sections
   • Resume a missed scheduled scan at the same time next day

2. Under Virus Scan, enable the following:

   • Configure Scan Settings for large compressed files (Keep the default settings for compressed files)
   • Clean compressed files
   • Scan up to ____¬OLE layer(s) (Keep the default settings)
   • Add Manual Scan to the Windows shortcut menu on clients

3. Under Spyware/Grayware Scan, enable the following:

   • Scan for cookies
   • Add cookie detections to the Spyware log

4. Under Behavior Monitoring, enable the following:

   • Enable warning messages for low-risk changes or other monitored actions
   • Prompt users before executing newly encountered programs downloaded through HTTP or email applications (Server platforms excluded)

5. Under HTTPS Web Threat Protection, enable the following:

   • Enable HTTPS checking for Web Reputation and URL Filtering on Chrome and Microsoft Edge
   • Display a notification above the Security Agent icon when an update to the feature requires users to restart Chrome

Agent Control tab

1. Under Watchdog, tick the Enable the Security Agent Watchdog service and keep the default agent status checking time interval.

2. Under Uninstallation, make sure to select Require users to provide a password to uninstall the Security Agent.

   

3. Under Exit / Unlock, enable Require a password to exit the Security Agent or unlock advanced settings to prevent end users from disabling the security agent in the workstations.

   

Under Security Agents, select Manual Groups > Server (Default) group and then configure policy.

Scan Method

The recommended scan method is Smart Scan, to lessen the bandwidth consumption, storage consumption, and network traffic.

Scan Settings

1. Under Real-Time Scan, toggle the slide to enable it.
2. Click Configure Settings.

3. Under Target tab, choose File types scanned by IntelliScan.

   

4. Under Advanced Settings, tick the following:

   • Enable IntelliTrap
   • Scan compressed files (keep the default value of two (2) Maximum Layers)

   

    

   Enabling other settings may cause performance issues on servers.

Behavior Monitoring

1. Toggle the slide to enable Behavior Monitoring.
2. Configure Behavior Monitoring using the procedure in this article: Enabling ransomware protection for Worry-Free Business Security Services (WFBS-SVC).

Predictive Machine Learning

Enabling Predictive Machine Learning for Servers is not recommended especially for file servers as it may result in false positive detections specifically for internally developed application.

Web Reputation

1. Toggle the slide to enable Web Reputation.
2. Under Security Level, choose Medium, which is recommended for Web Reputation Service.

3. Under Browser Exploit Prevention, enable Block websites containing malicious script.

   

Device Control

It is recommended to enable the Block the autorun function on USB storage devices option.

URL Filtering

1. Toggle the slide to enable URL Filtering.

2. Set the Filter Strength to Medium.

   

3. For Servers, click All days (24x7) under Business Hours.

   

Agent Privileges

1. Navigate to Privileges and Other Settings > Other Settings.

2. Enable Prevent users or other processes from modifying Trend Micro program files, registries and processes.

   

Under Security Agents, select Manual Groups > Device (Default) group and then configure policy.

Scan Method

The recommended scan method is Smart Scan, to lessen the bandwidth consumption, storage consumption, and network traffic.

Scan Settings

1. Under Real-Time Scan, toggle the slide to enable it.
2. Click Configure Settings.

3. Under Target tab, choose File types scanned by IntelliScan.

   

4. Under Advanced Settings, tick the following:

   • Enable IntelliTrap
   • Scan compressed files (keep the default value of two (2) Maximum Layers)

   

    

   Enabling other settings may cause performance issues on servers.

Behavior Monitoring

1. Toggle the slide to enable Behavior Monitoring.
2. Configure Behavior Monitoring using the procedure in this article: Enabling ransomware protection for Worry-Free Business Security Services (WFBS-SVC).

Predictive Machine Learning

Toggle the slide to enable Predictive Machine Learning. For detailed instruction on how to configure Predictive Machine Learning, refer to this article: Enabling ransomware protection for Worry-Free Business Security Services (WFBS-SVC).

Web Reputation

1. Toggle the slide to enable Web Reputation.
2. Under Security Level, choose Medium, which is recommended for Web Reputation Service.
3. Under Browser Exploit Prevention, enable Block pages websites containing malicious script.

Device Control

1. Toggle the slide to enable Device Control.
2. Set the device control permission depending on your IT environment need.
3. Enable Block the autorun function on USB storage devices option.

URL Filtering

1. Toggle the slide to enable URL Filtering.

2. Set the Filter Strength to Medium.

   

3. All days (24x7) under Business Hours.

   

Application Control

Enable Application to block applications/path that is restricted on each group that you create (i.e. per department on your company). For the complete procedure in configuring the Application Control, refer to the article: Configuring Application Control in Worry-Free Business Security Services (WFBS-SVC).

Agent Privileges

1. Navigate to Privileges and Other Settings > Other Settings.

2. Enable Prevent users or other processes from modifying Trend Micro program files, registries and processes.

   

Currently, the known Microsoft vulnerability that attackers, specifically ransomware authors, are using is the MS17-010 vulnerability. Here are the update links from Microsoft to patch the said vulnerability:

• MS17-010 Update for Windows 8.1
• MS17-010 Update for Windows 10
• MS17-010 for Windows 7 and Server 2008

For Windows OS users, Microsoft also provides Security Bulletin for documentation and download links for critical information such as patch availability, new vulnerabilities, and critical updates. You can find the lists of those vulnerabilities and updates on the following websites:

• Microsoft Security Bulletin website
• Additional technical blogs about the Microsoft vulnerabilities exploits