Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Restart notification in OfficeScan does not reset

    • Updated:
    • 6 Nov 2019
    • Product/Version:
    • Apex One 2019
    • OfficeScan XG
    • Platform:
    • N/A N/A
Summary

The OfficeScan agent keeps prompting the restart notification even after rebooting the machine.

Details
Public

During OfficeScan agent deployment, it will try to disable Windows Defender to avoid conflict. If the OfficeScan agent cannot disable Windows Defender successfully, it will keep prompting for a restart.

Based on current research, the following keys may force Windows Defender to load since Windows 10 build 1809 (i.e. Window 10 October 2018 Update). It can be disabled via GPO:

  1. Open Group Policy Object editor via Start > Run > gpedit.msc.
  2. Navigate to Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\.
  3. Disable "Allow antimalware service to remain running always".

    Once deployed to agent side, it should have the following registry:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
    "ServiceKeepAlive"=dword:00000000

     
    Deploying this setting without installing Antivirus products (e.g. Apex One/OfficeScan) on the endpoints may introduce security concerns.
 
Since Windows 10 1903 (i.e. Windows 10 May 2019 Update), the feature “Tamper Protection” was enabled by default to prevent Windows Defender settings from being changed. If your agent is Windows 10 Build 1903 or later, please turn off Tamper Protection before deploying the ServiceKeepAlive setting.

You may refer to the following Microsoft articles:

Premium
Internal
Rating:
Category:
Deploy; Install
Solution Id:
1123730
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.