OfficeScan TM

Client/Server Edition8
for Enterprise and Medium Business

Installation and Deployment Guide

es
Endpoint Security
Trend Micro Incorporated reserves the right to make changes to this document
and to the products described herein without notice. Before installing and
using the software, please review the readme files, release notes, and the latest
version of the applicable user documentation, which are available from the
Trend Micro Web site at:
http://www.trendmicro.com/download
Trend Micro, the Trend Micro t-ball logo, OfficeScan, Control Manager,
Damage Cleanup Services, ScanMail, ServerProtect, and TrendLabs are
trademarks or registered trademarks of Trend Micro, Incorporated. All other
product or company names may be trademarks or registered trademarks of
their owners.
Copyright © 1998-2008 Trend Micro Incorporated. All rights reserved.
Document Part No. OSEM83054/70130
Release Date: October 2008
Protected by U.S. Patent No. 5,623,600; 5,889,943; 5,951,698; 6.119,165
The user documentation for Trend Micro OfficeScan introduces the main
features of the software and installation instructions for your production
environment. Read through it before installing or using the software.
Detailed information about how to use specific features within the software are
available in the online help file and the online Knowledge Base at Trend
Micro’s Web site.
Trend Micro always seeks to improve its documentation. If you have questions,
comments, or suggestions about this or any Trend Micro document, please
contact us at [email protected].
Please evaluate this documentation on the following site:
http://www.trendmicro.com/download/documentation/rating.asp
 Contents

Contents
Chapter 1: Planning Server Installation
Installation Requirements .............................................................................. 1-1
OfficeScan Server Requirements ........................................................ 1-2
Web Console Requirements ................................................................ 1-3
Product Versions and Keys ........................................................................... 1-3
Full Version and Evaluation Version ................................................. 1-3
The Registration Key and Activation Codes .................................... 1-4
Installation Considerations ............................................................................ 1-5
Location of the OfficeScan Server ..................................................... 1-5
Remote Installation ............................................................................... 1-5
Server Performance .............................................................................. 1-6
Dedicated Server ................................................................................... 1-6
Unsupported Client Platforms ............................................................ 1-6
Number of Domains ............................................................................ 1-7
Number of Clients ................................................................................ 1-7
Network Traffic .................................................................................... 1-8
Placement of the Program Files .......................................................... 1-9
Third Party Antivirus Applications .................................................... 1-9
Required Installation Information .............................................................. 1-10
OfficeScan Ports ........................................................................................... 1-10
Other Installation Notes .............................................................................. 1-11
Computer Restart not Required ........................................................ 1-11
Other OfficeScan Programs .............................................................. 1-11
Client Settings ...................................................................................... 1-12
Apache Web Server ............................................................................ 1-12
Planning a Pilot Deployment ...................................................................... 1-12
Choosing a Pilot Site .......................................................................... 1-12
Creating a Rollback Plan .................................................................... 1-12
Deploying Your Pilot ......................................................................... 1-13
Evaluating Your Pilot Deployment .................................................. 1-13
Known Compatibility Issues ....................................................................... 1-13
Microsoft Small Business Server ...................................................... 1-13
Microsoft Lockdown Tools and URLScan ..................................... 1-13

i
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Microsoft Exchange Server ................................................................1-14

SQL Server ...........................................................................................1-14
Internet Connection Firewall (ICF) ..................................................1-14

Chapter 2: Installing and Upgrading the OfficeScan Server

Installing or Upgrading the OfficeScan Server ........................................... 2-2
Pre-installation ....................................................................................... 2-2
Installation and Upgrade ...................................................................... 2-7
Performing Silent Installation ......................................................................2-14
Upgrading from an Evaluation Version ....................................................2-15
Post-installation Tasks ..................................................................................2-16
Verifying the Server Installation or Upgrade ..................................2-16
Updating OfficeScan Components ...................................................2-17
Checking Default Settings ..................................................................2-17
Using Client Mover for Legacy Platforms .......................................2-18
Registering OfficeScan to Control Manager ...................................2-21
Installing Plug-in Manager .................................................................2-21
Performing Server Uninstallation and Rollback .......................................2-22

Chapter 3: Planning Client Installation

Client Installation Requirements ................................................................... 3-2
Update Agent Requirements ......................................................................... 3-8
Installation Methods ....................................................................................... 3-8
Summary ...............................................................................................3-10

Chapter 4: Installing and Upgrading the OfficeScan Client

Performing Fresh Installation ....................................................................... 4-1
Installing from the Web Install Page .................................................. 4-2
Installing with Login Script Setup ....................................................... 4-3
Installing with Client Packager ............................................................ 4-5
Installing from the OfficeScan Web Console .................................4-12
Installing from a Client Disk Image .................................................4-14
Installing with Vulnerability Scanner ................................................4-15
Upgrading the OfficeScan Client ................................................................4-16
Migrating from Third-party Antivirus Applications ................................4-16
Automatic Client Migration ...............................................................4-17
Migrating from ServerProtect Normal Servers .........................................4-17

ii
 Contents

System Requirements ......................................................................... 4-18

Installing Server Protect Normal Server Migration Tool ............. 4-18
Post-installation Tasks .................................................................................. 4-20
Verifying the Client Installation, Upgrade, or Migration .............. 4-20
Initiating Component Update ........................................................... 4-23
Testing OfficeScan Using the EICAR Test Script ........................ 4-23
Uninstalling the Client .................................................................................. 4-24
Uninstalling from the Web Console ................................................ 4-25
Running the Client Uninstallation Program ................................... 4-25

Chapter 5: FAQs and Troubleshooting

Frequently Asked Questions (FAQs) .......................................................... 5-1
Troubleshooting Resources ........................................................................... 5-2
Case Diagnostic Tool ........................................................................... 5-2
Installation Logs .................................................................................... 5-3
Server Debug Logs ............................................................................... 5-4
Client Debug Logs ................................................................................ 5-5
Knowledge Base .................................................................................... 5-5
Troubleshooting Installation Issues ............................................................. 5-6
Client Installation .................................................................................. 5-6
Migration from Third-party Antivirus Software .............................. 5-8
Client Uninstallation ........................................................................... 5-10
Server Uninstallation .......................................................................... 5-12
Apache Web Server ............................................................................ 5-13

Chapter 6: Contacting Trend Micro

Technical Support ........................................................................................... 6-1
Speeding Up Your Support Call ......................................................... 6-2
The Trend Micro Knowledge Base .............................................................. 6-2
TrendLabs ........................................................................................................ 6-3
Security Information Center ......................................................................... 6-3
Sending Suspicious Files to Trend Micro .................................................... 6-4
Documentation Feedback ............................................................................. 6-4

Appendix A: Sample Deployment

Basic Network ................................................................................................ A-1
Multiple Site Network ................................................................................... A-2

iii
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Head Office Deployment .................................................................... A-5

Remote Site 1 Deployment ................................................................. A-5
Remote Site 2 Deployment ................................................................. A-5

Index

iv
 Chapter 1

Planning Server Installation

Topics in this chapter:
• Installation Requirements on page 1-1
• Product Versions and Keys on page 1-3
• Installation Considerations on page 1-5
• Required Installation Information on page 1-10
• OfficeScan Ports on page 1-10
• Other Installation Notes on page 1-11
• Planning a Pilot Deployment on page 1-12
• Known Compatibility Issues on page 1-13

Installation Requirements
The following are the requirements for the OfficeScan server and Web console.

1-1
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

OfficeScan Server Requirements

TABLE 1-1. OfficeScan server requirements

R ESOURCE R EQUIREMENT

Operating Sys- • Microsoft™ Windows™ 2000 Server with Service Pack 3 or 4

tem
• Microsoft Windows 2000 Advanced Server with Service Pack 3 or 4
• Microsoft Windows Server 2003 32-bit Edition with or without Service
Pack 1 or 2
• Microsoft Windows Server 2003 64-bit Edition with or without Service
Pack 1 or 2
• Microsoft Windows Server 2003 R2 32-bit Edition with or without
Service Pack 1 or 2
• Microsoft Windows Server 2003 R2 64-bit Edition with or without
Service Pack 1 or 2
• Microsoft Windows Storage Server 2003 32-bit Edition
• Microsoft Windows Storage Server 2003 64-bit Edition
• Microsoft Cluster Server 2000
• Microsoft Cluster Server 2003

Hardware • 800MHz Intel™ Pentium™ processor or equivalent

• 512MB of RAM
• 1GB of disk space
• Network Interface Card (NIC)
• Monitor that supports 800 x 600 resolution at 256 colors or higher

Web server • Microsoft Internet Information Server (IIS)

on Windows 2000: version 5.0 (Service Pack 3 or 4)
on Windows Server 2003: version 6.0
• Apache™ Web server 2.0 or later (for Windows 2000/Server 2003
only)

1-2
 Planning Server Installation

TABLE 1-1. OfficeScan server requirements

R ESOURCE R EQUIREMENT

Others • Administrator or Domain Administrator access on the server computer

• File and printer sharing for Microsoft Networks installed on the server
computer

Note: If you plan to install the Cisco™ Trust Agent (CTA) on the same computer as the
OfficeScan server, do not install OfficeScan server on Windows Server 2003 x64
Edition. See the Administrator’s Guide for more information on CTA requirements.

Web Console Requirements

TABLE 1-2. Web console requirements

R ESOURCE R EQUIREMENT

Hardware • 300MHz Intel Pentium processor or equivalent

• 128MB of RAM
• 30MB of available disk space
• Monitor that supports 800 x 600 resolution at 256 colors or higher

Browser Microsoft Internet Explorer™ 5.5 Service Pack 1 or later

Product Versions and Keys

Full Version and Evaluation Version
Install either a full version of OfficeScan or a free, evaluation (trial) version.
• Full version: Includes all the product features and technical support, and provides a
grace period (usually 30 days) after the license expires. If you do not renew the
license after the grace period expires, you will not be able to obtain technical
support and perform component update. The scan engines will still scan computers
using out-of-date components. These out-of-date components may not be able to

1-3
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

protect you completely from the latest security risks. You can renew the license
before or after it expires by purchasing a maintenance renewal.
• Evaluation (Trial) version: Includes all the product features. You can upgrade an
evaluation version to a full version at any time. If not upgraded at the end of the
evaluation period, OfficeScan disables component update, scanning, and all client
features.

Note: Both versions require a different type of Activation Code. Register your product if you
do not have an Activation Code.

The Registration Key and Activation Codes

During installation, OfficeScan prompts you to enter the Activation Codes for the
Antivirus, Damage Cleanup Services™ (optional) and Web Threat Protection services.
If you do not have the Activation Code(s), use the Registration Key that came with your
product to register on the Trend Micro Web site and receive the Activation Code(s). The
OfficeScan master installer automatically redirects you to the Trend Micro Web site:
http://www.trendmicro.com/support/registration.asp
If you do not have either the Registration Key or Activation Code, contact your Trend
Micro sales representative (see Contacting Trend Micro on page 6-1).

Note: For questions about registration, refer to

http://esupport.trendmicro.com/support/viewxml.do?ContentID=en-116326.

1-4
 Planning Server Installation

Installation Considerations
Take the following factors into consideration when planning to install the OfficeScan
server:
• Location of the OfficeScan Server on page 1-5
• Remote Installation on page 1-5
• Server Performance on page 1-6
• Dedicated Server on page 1-6
• Unsupported Client Platforms on page 1-6
• Number of Domains on page 1-7
• Number of Clients on page 1-7
• Network Traffic on page 1-8
• Placement of the Program Files on page 1-9
• Third Party Antivirus Applications on page 1-9

Location of the OfficeScan Server

OfficeScan can accommodate a variety of network environments. For example, you can
position a firewall between the OfficeScan server and its clients, or position both the
server and all clients behind a single network firewall. If there is a firewall between the
server and its clients, configure the firewall to allow traffic between the client and server
listening ports (see OfficeScan Ports on page 1-10 for more information).

Note: For information on resolving potential problems you may encounter when managing
OfficeScan clients on a network that uses Network Address Translation, see the
Administrator’s Guide and the OfficeScan server online help).

Remote Installation
Remote installation allows you to launch the installation on one computer but install
OfficeScan to another computer. If you perform remote installation, the Setup program
will analyze if the target computer meets the requirements for server installation.
To ensure that installation can proceed:
• Ensure that you have administrator rights to the target computer.

1-5
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

• Take note of the computer's host name and logon credentials (user name and
password).
• Make sure the computer meets the OfficeScan server system requirements. Refer to
Installation Requirements on page 1-1 for more information.
• If using Microsoft IIS server as the Web server, make sure the version is 5.0 or
higher. If you choose to use Apache Web server, Setup will automatically install this
server if not present on the target computer.

Server Performance
Enterprise networks require servers with higher specifications than those required for
small and medium-sized businesses. Ideally, the OfficeScan server computer would have
at least 2GHz dual processors and over 1GB of memory.
The number of networked computer clients that a single OfficeScan server can manage
depends on several factors, such as available server resources and your network
topology. Contact your Trend Micro representative for help in determining the number
of clients your server can manage.
OfficeScan servers with 2GHz dual processor and 2GB of RAM can usually manage
3000 to 5000 clients.

Dedicated Server
When selecting a computer that will host the OfficeScan server, consider the following:
• How much CPU load will the computer handle?
• What other functions does the computer perform?
If the target computer has other uses (for example, a computer that functions as an
application server), Trend Micro recommends choosing a computer that does not run
critical or resource-intensive applications.

Unsupported Client Platforms

OfficeScan no longer supports Windows 95, 98, Me, NT and IA64 architecture. If you
plan to upgrade to this version of OfficeScan and clients run these operating systems:
• Do not upgrade all OfficeScan servers to this OfficeScan version.
• Designate an un-upgraded OfficeScan server to manage these clients.

1-6
 Planning Server Installation

• Before upgrading, open the Web console and move the clients to the designated
server. In OfficeScan 7.3, you can access the Move Clients screen by clicking
Clients > Move.
If you already upgraded OfficeScan but did not move unsupported clients to an
un-upgraded server, see Using Client Mover for Legacy Platforms on page 2-18 for
instructions.

Number of Domains
A domain in OfficeScan is a group of clients that share the same configuration and run
the same tasks. By grouping your clients into domains, you can simultaneously
configure, manage, and apply the same configuration to all domain members.
An OfficeScan domain is different from a Windows domain. There can be several
OfficeScan domains in one Windows domain.
For ease of management, plan how many OfficeScan domains to create. You can group
client computers based on the departments they belong to or the functions they
perform. Alternatively, group clients that may be at a greater risk of infection and apply
a more secure configuration to all of them.

Number of Clients
If your networked computers run different Windows operating systems, check the
number of computers running a specific Windows version. Use this information to
decide which client deployment method will work best in your environment.

1-7
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Number of clients a single OfficeScan server can manage:

• OfficeScan server with 2GHz dual processor with 2GB of RAM: 3000 to 5000
• OfficeScan server with 3GHz dual processor with 4GB of RAM: 5000 to 8000

Network Traffic
When planning for deployment, consider the network traffic that OfficeScan generates.
The server generates traffic when it does the following:
• Connects to the Trend Micro ActiveUpdate server to check for and download
updated components
• Notifies clients to download updated components
• Notifies clients about configuration changes
The client generates traffic when it does the following:
• Starts up
• Updates components manually or based on a schedule
• Updates settings and installs a hot fix
• Switches between roaming mode and normal mode

Network traffic during component updates

OfficeScan generates significant network traffic when it updates a component. To
reduce network traffic generated during component updates, OfficeScan performs
component duplication. Instead of downloading an updated full pattern file, OfficeScan
only downloads the "incremental" patterns (smaller versions of the full pattern file) and
merges them with the old pattern file after the download.
Clients updated regularly only download the incremental pattern, which is approximately
500KB to 900KB. Otherwise, they may have to download the full pattern file, which is
more than 20MB.
Trend Micro releases new pattern files regularly. However, Trend Micro releases a new
pattern file as soon as the detection routine of a damaging and actively circulating
virus/malware is available.

1-8
 Planning Server Installation

Update Agents and network traffic

If there are "low-bandwidth or "heavy traffic" sections of your network between clients
and the OfficeScan server, you can designate selected OfficeScan clients as update
source for other clients. This helps distribute the burden of deploying components to all
clients.
For example, if you have a remote office with 20 or more computers, designate an
Update Agent to replicate updates from the OfficeScan server and act as a Local
Distribution point for other client computers on the local LAN. See the Administrator’s
Guide for more information on update agents.

Trend Micro Control Manager and network traffic

Trend Micro Control Manager™ manages Trend Micro products and services, and
third-party antivirus and content security products at the gateway, mail server, file server
and corporate desktop levels. The Control Manager Web-based management console
provides a single monitoring point for antivirus and content security products and
services throughout the network.
Use Control Manager to manage several OfficeScan servers from a single location. A
Control Manager server with fast, reliable Internet connection can download
components from the Trend Micro ActiveUpdate server and deploy the components to
one or more OfficeScan servers with unreliable or no Internet connection.
See the Administrator’s Guide for more information on Control Manager.

Placement of the Program Files

During the OfficeScan server installation, specify where to install the program files on
the clients. Either accept the default client installation path or modify it. Trend Micro
recommends using the default settings unless you have a compelling reason (such as
insufficient disk space) to change them.
The default client installation path is C:\Program Files\Trend Micro\OfficeScan Client.

Third Party Antivirus Applications

Trend Micro highly recommends removing third party antivirus and anti-spyware applications
from the computer on which you will install OfficeScan server because these applications may
prevent successful OfficeScan server installation or affect its performance.

1-9
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Note: OfficeScan cannot uninstall the server component of any third-party antivirus
product, but can uninstall the client component (see Migrating from Third-party
Antivirus Applications on page 4-16 for details).

Required Installation Information

The master installer prompts you for the following information during installation:
• Proxy server details: If a proxy server handles Internet traffic on your network,
specify proxy server information the OfficeScan server will use when downloading
the latest components from the Trend Micro ActiveUpdate server.
• Console password: Prevent unauthorized access to the OfficeScan Web console by
specifying a password.
• Client software installation path: Specify the location where the master installer
will copy the OfficeScan program files.

OfficeScan Ports
OfficeScan uses two types of ports:
• Server listening port (HTTP port): The port used for the OfficeScan server Web
console. By default, OfficeScan uses one of the following:
• IIS server default Web site: The same port number as your HTTP server’s
TCP port
• IIS server virtual Web site: 8080 (HTTP) and 4343 (HTTPS)
• Apache server: 8080
• Client listening port: A randomly generated port number through which the client
receives commands from the server.

1-10
 Planning Server Installation

You can modify the server listening port during installation or on the OfficeScan server
Web console after installation. You cannot modify the client listening port.

WARNING! Many hacker and virus/malware attacks delivered over HTTP use ports
80 and/or 8080 because most organizations use these port numbers as the
default Transmission Control Protocol (TCP) ports for HTTP communi-
cations. Trend Micro recommends using other port numbers if you cur-
rently use the default port numbers.

Other Installation Notes

Computer Restart not Required
OfficeScan server installation does not require a computer restart. After completing the
installation, immediately configure the server and install clients to networked computers.
If using an IIS Web server, the Setup program automatically stops and restarts the IIS
service during Web server installation.

WARNING! Installing the Web server on a computer running IIS-locking applications

may prevent successful installation. See your IIS documentation for more
information.

Other OfficeScan Programs

You can enable the OfficeScan firewall and install Policy Server for Cisco NAC during
or after OfficeScan server installation.

Tip: Trend Micro highly recommends installing OfficeScan during non-peak hours to
minimize the effect on your network.

1-11
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Client Settings
You can preserve client settings when you upgrade to this version of OfficeScan and use them if
you reinstall the OfficeScan server. See Backing up and restoring the OfficeScan database and
configuration files on page 2-22 for instructions.

Apache Web Server

You can install Apache Web server when you install the OfficeScan server. By default, the
administrator account is the only account created on the Apache Web server. Trend Micro
recommends creating another account from which to run the Web server to prevent
compromising the OfficeScan server if a hacker takes control of the Apache Web server.
Refer to http://www.apache.org for the latest information on Apache Web server
upgrades, patches, and security issues.

Planning a Pilot Deployment

Before performing a full-scale deployment, Trend Micro recommends conducting a
pilot deployment in a controlled environment. A pilot deployment provides an
opportunity to determine how features work and the level of support you may need
after full deployment. It also gives your installation team a chance to rehearse and refine
the deployment process, and test if your deployment plan meets your organization’s
antivirus and anti-spyware initiative.
For a sample OfficeScan deployment, see Sample Deployment on page A-1.

Choosing a Pilot Site

Choose a pilot site that matches your production environment. Try to simulate the type
of network topology that would serve as an adequate representation of your production
environment.

Creating a Rollback Plan

Trend Micro recommends creating a disaster recovery or rollback plan in case there are
issues with the installation or upgrade process.
This process should take into account local corporate policies and technical specifics.

1-12
 Planning Server Installation

Deploying Your Pilot

Check the deployment method suitable for your particular environment. See Installing
and Upgrading the OfficeScan Server on page 2-1 for details.

Evaluating Your Pilot Deployment

Create a list of successes and failures encountered throughout the pilot process. Identify
potential pitfalls and plan accordingly. Include this pilot evaluation plan in the overall
product deployment plan.

Known Compatibility Issues

This section explains compatibility issues if you install OfficeScan server on the same
computer with certain third-party applications. Refer to the documentation of
third-party applications installed on the same computer on which you will install
OfficeScan server.

Microsoft Small Business Server

Write down the server port used by ISA before installing OfficeScan on a computer
running Microsoft Small Business Server™ that is also running Microsoft Internet
Security Acceleration server (ISA). By default, both the OfficeScan server and ISA use
port 8080.
Choose another server listening port when installing OfficeScan server.

Microsoft Lockdown Tools and URLScan

If you use the Microsoft IIS Lockdown Tool or URLScan, the lockdown of OfficeScan
configuration (.ini), data (.dat), dynamic link library (.dll), and executable (.exe) files may
block OfficeScan client and server communication.
To prevent URLScan from interfering with client-server communication, stop the World
Wide Web Publishing service on the OfficeScan server, modify the URLScan
configuration file to allow the file types specified above, and restart the service. See your
lockdown tool documentation for additional information.

1-13
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Microsoft Exchange Server

If you choose to install the OfficeScan client during server installation, OfficeScan needs
access to all files the client will scan. Since Microsoft Exchange Server queues messages
in local directories, these directories need to be excluded from scanning to allow the
Exchange Server to process email messages.
OfficeScan automatically excludes all Microsoft Exchange 2000/2003 directories from
scanning. This setting is set in the Web console (Networked Computers > Global
Client Settings > Virus/Malware Scan Settings).
For Microsoft Exchange 2007, refer to
http://technet.microsoft.com/en-us/library/bb332342.aspx for scan exclusion details.
Trend Micro™ ScanMail™ for Microsoft Exchange can protect your Exchange server
from viruses/malware and other potential threats. See the Trend Micro Web site
(http://www.trendmicro.com) or your sales contact for information about ScanMail for
Microsoft Exchange.

SQL Server
You can scan SQL Server databases. However, this may decrease the performance of
applications that access the databases. Trend Micro recommends excluding SQL Server
databases and their backup folders from Real-time Scan. If you need to scan a database,
perform a Manual Scan during off-peak hours to minimize the impact of the scan.

Internet Connection Firewall (ICF)

Windows Server 2003 provides a built-in firewall called Internet Connection Firewall
(ICF). Trend Micro highly recommends removing any third-party firewall applications if
you enable the OfficeScan firewall. However, if you want to run ICF or any other
third-party firewall, add the OfficeScan listening ports to the firewall exception list (see
OfficeScan Ports on page 1-10 for information on listening ports and see your firewall
documentation for details on how to configure exception lists).

1-14
 Chapter 2

Installing and Upgrading the

OfficeScan Server
Installation/Upgrade scenarios:
• Installing or Upgrading the OfficeScan Server on page 2-2
• Performing Silent Installation on page 2-14
• Upgrading from an Evaluation Version on page 2-15

Note: For more information on the differences between the full and evaluation
versions, see Product Versions and Keys on page 1-3.

• Post-installation Tasks on page 2-16

Recommended post-installation tasks:
• Verifying the Server Installation or Upgrade on page 2-16
• Updating OfficeScan Components on page 2-17
• Checking Default Settings on page 2-17

2-1
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

• Using Client Mover for Legacy Platforms on page 2-18

Note: Perform this task only if you have clients running unsupported platforms, which
include Windows 95, 98, Me, NT and IA64 architecture.

• Registering OfficeScan to Control Manager on page 2-21

Note: Control Manager registration only applies to newly installed OfficeScan servers.

• Installing Plug-in Manager on page 2-21

Other task:
• Performing Server Uninstallation and Rollback on page 2-22

Installing or Upgrading the OfficeScan Server

You can perform fresh installation or upgrade a previous OfficeScan version either
locally or remotely. This version of OfficeScan supports upgrade from versions 7.3, 7.0,
6.5, and 5.58 but not from Trend Micro Client/Server Suite or Client/Server/Messaging Suite.
You can preserve your client settings when you reinstall or upgrade to this version of
OfficeScan. See Backing up and restoring the OfficeScan database and configuration
files on page 2-22 for more information.

Pre-installation
If you are performing fresh installation/upgrade of the OfficeScan server to multiple
computers, take note of the following:
1. Ensure you have the logon credentials for an administrator account with "logon as a
service" privilege on the target computers. OfficeScan will prompt you for these
credentials before analyzing each computer.
2. On each target computer, the Remote Registry service should be started using an
administrator account and not a Local System account. Remote Registry service is
managed from the Microsoft Management Console (Click Start > Run, and type
services.msc).

2-2
 Installing and Upgrading the OfficeScan Server

If you are upgrading one or several OfficeScan servers to this version, take note of the
following:
1. Obtain two free Activation Codes by going to
https://olr.trendmicro.com/redirect/osupgrade.htm.
2. After OfficeScan 8.0 has been installed to the server, the server may immediately
deploy OfficeScan 8.0 to clients before Service Pack 1 installation is finished,
resulting in potential installation conflicts and failure. Perform the following steps to
prevent the server from immediately deploying version 8.0 to clients:
If you are using OfficeScan 7.x:
a. Open the Web console, go to Updates > Client Deployment > Automatic
Deployment, and disable the following options under Event-triggered
Deployment:
• Deploy to clients immediately after the OfficeScan server downloads a
new component.
• Deploy to clients for OfficeScan clients only and excluding roaming clients
when they are restarted.
b. Click Clients on the main menu.
c. Select the root domain to select all clients and then click Client
Privileges/Settings.
d. Under Update Settings, enable Forbid program upgrade and hot fix
deployment.
e. Click Apply to All. It may take a while to deploy the settings to online clients if
you have a complex network environment and a large number of clients.
Before the upgrade, allocate sufficient time for settings to get deployed to all
clients. Clients that do not receive the settings and triggered Update Now,
Schedule Update, or clicked AutoPcc.exe will automatically be upgraded.
f. Upgrade the OfficeScan server (see Installation and Upgrade on page 2-7 for
details.

Note: You can configure the OfficeScan server settings using the Web console
immediately after completing the installation and before upgrading clients.
For detailed instructions on how to configure OfficeScan, refer to the
Administrator's Guide and server online help.

2-3
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

g. Open the OfficeScan 8.0 Service Pack 1 Web console, go to Updates >
Networked Computers > Automatic Update, and enable Event-triggered
Update settings.
h. Go to Networked Computers > Client Management. From the client tree,
select the root domain to select all clients.
i. Click Settings > Privileges and Other Settings and go to the Other
Settings tab.
j. Disable the setting Clients can update components but not upgrade the
client program or deploy hot fixes.
k. Click Apply to All Clients.
l. Go to Updates > Networked Computers > Manual Update.
m. Click Manually select clients, and then click Select.
n. From the client tree, select the root domain and then click Initiate
Component Update. The clients begin to upgrade.

If you are using OfficeScan 6.5:

a. Open the Web console, go to Updates > Client Deployment > Automatic
Deployment, and disable the following options under Event-triggered
Deployment:
• Deploy to clients immediately after the OfficeScan server downloads a
new component.
• Deploy to clients for OfficeScan clients only and excluding roaming clients
when they are restarted.
It may take a while to deploy the settings to online clients if you have a
complex network environment and a large number of clients. Before the
upgrade, allocate sufficient time for settings to get deployed to all clients.
Clients that do not receive the settings and triggered Update Now, Schedule
Update, or clicked AutoPcc.exe will automatically be upgraded.
b. Upgrade the OfficeScan server (see Installation and Upgrade on page 2-7 for
details.

2-4
 Installing and Upgrading the OfficeScan Server

Note: You can configure the OfficeScan server settings using the Web console
immediately after completing the installation and before upgrading clients.
For detailed instructions on how to configure OfficeScan, refer to the
Administrator's Guide and server online help.

c. Open the OfficeScan 8.0 Service Pack 1 Web console, go to Updates >
Networked Computers > Manual Update.
d. Click Manually select clients, and then click Select.
e. From the client tree, select the root domain and then click Initiate
Component Update. The clients begin to upgrade.
f. Go to Updates > Networked Computers > Automatic Update and enable
Event-triggered Update settings.

If you are using OfficeScan 5.58:

a. Open the Web console, go to Update & Upgrade > Client Update >
Automated Deployment, and disable the following options under
Deployment Schedule:
• Deploy immediately (inclding hot fix)
• Deploy to clients (excluding roaming clients) when they are restarted.
It may take a while to deploy the settings to online clients if you have a
complex network environment and a large number of clients. Before the
upgrade, allocate sufficient time for settings to get deployed to all clients.
Clients that do not receive the settings and triggered Update Now, Schedule
Update, or clicked AutoPcc.exe will automatically be upgraded.
b. Upgrade the OfficeScan server (see Installation and Upgrade on page 2-7 for
details.

Note: You can configure the OfficeScan server settings using the Web console
immediately after completing the installation and before upgrading clients.
For detailed instructions on how to configure OfficeScan, refer to the
Administrator's Guide and server online help.

2-5
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

c. Open the OfficeScan 8.0 Service Pack 1 Web console, go to Updates >
Networked Computers > Manual Update.
d. Click Manually select clients, and then click Select.
e. From the client tree, select the root domain and then click Initiate
Component Update. The clients begin to upgrade.
f. Go to Updates > Networked Computers > Automatic Update and enable
Event-triggered Update settings.
3. The service pack included in this release includes updates to OfficeScan firewall
drivers. If you have enabled the OfficeScan firewall in your current OfficeScan
version, the following client computer disruptions will occur when you proceed to
upgrade:
a. When the service pack is deployed to clients and Common Firewall Driver
update starts, client computers will be temporarily disconnected from the
network. Users are not notified before disconnection.
b. After the service pack is deployed, the OfficeScan TDI driver will not be
loaded until the computer is restarted. Users are likely to encounter problems
with the OfficeScan client if they do not restart immediately.
Inform all users in advance about the computer disconnection and restart.
Additionally, consider installing OfficeScan when the impact of these client
computer disruptions to your organization is minimal.
4. The OfficeScan server cannot install the service pack if a client is running Login
Script (AutoPcc.exe) at the time of installation. Please ensure that no client is
running Login Script before installation.
5. Trend Micro recommends deleting all log files from the OfficeScan server before
upgrading. If you want to preserve the log files, save them to another location first.

2-6
 Installing and Upgrading the OfficeScan Server

Installation and Upgrade

Below is a list of the installation screens (arranged sequentially) and tasks for installing
or upgrading OfficeScan locally or remotely. For screen-specific information and
instructions, click Help in the applicable Setup screens.

TABLE 2-1. Installation screens and tasks

F RESH F RESH
I NSTALLA - I NSTALLA - U PGRADE U PGRADE
S CREENS /TASKS TION TION (L OCAL ) (R EMOTE )
(L OCAL ) (R EMOTE )

Welcome

License Agreement
Task: Agree to the license agreement.

Installation Destination
Task: Select whether to install locally or
remotely.

Prescan
Task: Decide whether to scan the target
computer before installation.
If performing prescan:
• Local installation: Scanning occurs when
you click Next.
• Remote installation: Scanning occurs
during the actual installation.

Setup Status (Computer Analysis)

2-7
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

TABLE 2-1. Installation screens and tasks

F RESH F RESH
I NSTALLA - I NSTALLA - U PGRADE U PGRADE
S CREENS /TASKS
TION TION (L OCAL ) (R EMOTE )
(L OCAL ) (R EMOTE )

Installation Path
This screen displays if you perform remote
fresh installation and upgrade. However, set-
tings you specify here apply only to remote
fresh installation. For remote upgrade,
OfficeScan will use the previous version’s
settings.
Task: Use the default installation path or
specify a new one.

Proxy Server Settings

This screen displays if you perform
remote fresh installation and upgrade.
However, settings you specify here apply
only to remote fresh installation. For
remote upgrade, OfficeScan will use the
previous version’s settings.
Task: Specify proxy server settings if you
use a proxy server for client-server com-
munication. Otherwise, skip this step.

Web Server Settings

This screen displays if you perform
remote fresh installation and upgrade.
However, settings you specify here apply
only to remote fresh installation. For
remote upgrade, OfficeScan will use the
previous version’s settings.
This screen also displays if you upgrade
from OfficeScan 5.58 locally.
Task: Choose whether to use an IIS or
Apache Web server and then configure
HTTP port and SSL settings.

2-8
 Installing and Upgrading the OfficeScan Server

TABLE 2-1. Installation screens and tasks

F RESH F RESH
I NSTALLA - I NSTALLA - U PGRADE U PGRADE
S CREENS /TASKS
TION TION (L OCAL ) (R EMOTE )
(L OCAL ) (R EMOTE )

Computer Identification
This screen displays if you perform
remote fresh installation and upgrade.
However, settings you specify here apply
only to remote fresh installation. For
remote upgrade, OfficeScan will use the
previous version’s settings.
Task: Determine whether OfficeScan cli-
ents will identify the server computer by
its domain name or IP address.

Registration
Task: Register OfficeScan using the Reg-
istration Key that came with your product
and then obtain the Activation Codes. If
you already registered and received the
Activation Codes, skip this step.

Activation
Task: Enter the Activation Codes of the
product services.

Remote installation destination

Task: Specify the target computer to
which you will install OfficeScan.

Remote installation computer analysis

Tasks:
• Click Analyze so Setup can determine
whether the target computer meets the
installation requirements.
• To save the selected computers to a text
file, click Export.

2-9
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

TABLE 2-1. Installation screens and tasks

F RESH F RESH
I NSTALLA - I NSTALLA - U PGRADE U PGRADE
S CREENS /TASKS
TION TION (L OCAL ) (R EMOTE )
(L OCAL ) (R EMOTE )

Install Other OfficeScan Programs

• If the OfficeScan client exists on the target
computer, the installer upgrades the client
automatically after server installation.
• If Trend Micro ServerProtect™ exists on
the computer, uninstall it before installing
the OfficeScan client.
• Cisco NAC programs are unavailable if you
do not activate the Antivirus service.
• You can skip installing the OfficeScan client
and Cisco NAC programs and install them
after server installation. For OfficeScan
client installation, refer to Installing and
Upgrading the OfficeScan Client on page
4-1. For CTA installation, open the Web
console and go to Cisco NAC > Agent
Deployment. For Policy Server installation,
run the installer from your OfficeScan
installation package.
• Refer to the Administrator’s Guide for more
information about Cisco NAC.
Tasks:
• Select the programs to install.
• If installing Cisco Trust Agent (CTA),
specify the location of the agent certificate
file (if the certificate is available to you; if
not, contact your Trend Micro
representative).

2-10
 Installing and Upgrading the OfficeScan Server

TABLE 2-1. Installation screens and tasks

F RESH F RESH
I NSTALLA - I NSTALLA - U PGRADE U PGRADE
S CREENS /TASKS
TION TION (L OCAL ) (R EMOTE )
(L OCAL ) (R EMOTE )

Cisco Trust Agent Installation/Upgrade

• If you perform fresh installation, this screen
displays only if you choose to install Cisco
Trust Agent in the previous screen. Select
the CTA package to install to clients.
• If you upgrade, this screen displays only if
you have previously installed CTA. Choose
whether to upgrade CTA to the current
version (2.1). If upgrading, select the CTA
upgrade package.
• If you did not select to install CTA during
server installation, you can still install it
using the Web console.

Cisco Trust Agent License

Task: Agree to the license agreement.

World Virus Tracking

Task: Decide whether to join the Trend
Micro World Virus Tracking program.

Administrator Account Password

Task: Specify passwords to perform the
following:
• Access the Web console
• Unload and uninstall the OfficeScan client

2-11
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

TABLE 2-1. Installation screens and tasks

F RESH F RESH
I NSTALLA - I NSTALLA - U PGRADE U PGRADE
S CREENS /TASKS
TION TION (L OCAL ) (R EMOTE )
(L OCAL ) (R EMOTE )

Client Installation Path

Task: Accept the default client installation
settings or specify a different
• Client installation path
• Port number the OfficeScan server will use
to communicate with clients
• Client security level

Enable Firewall
This screen displays only if you activate
the Antivirus service.

Enable Assessment Mode

This screen displays only if you activate
the Web Threat Protection service.

Program Folder Shortcut

Task: Accept the default folder name or
specify a new one. You can also select an
existing folder to which Setup will add
program shortcuts.

Installation Information
Tasks:
• Check if installation information is correct.
• Click Back to modify settings.

OfficeScan Server Installation

2-12
 Installing and Upgrading the OfficeScan Server

TABLE 2-1. Installation screens and tasks

F RESH F RESH
I NSTALLA - I NSTALLA - U PGRADE U PGRADE
S CREENS /TASKS
TION TION (L OCAL ) (R EMOTE )
(L OCAL ) (R EMOTE )

Policy Server Installation

This screen displays if you chose to
install Policy Server for Cisco NAC. The
succeeding Policy Server installation
screens that display include:
• Welcome
• License Agreement
• Installation Destination
• Web Server Selection
• Web Server Settings
• Policy Server Console Password
• ACS Server Authentication Password
• Policy Server Installation
• Installation Complete

OfficeScan Server Installation Com-

plete
Tasks:
• View the readme file.
• Open the Web console to start configuring
OfficeScan settings. See Updating
OfficeScan Components on page 2-17 for
more information.

2-13
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Performing Silent Installation

Install multiple OfficeScan servers silently if the servers will use identical installation
settings. Silent installation involves two procedures:
1. Create a response file by running the Setup wizard and recording the installation
settings to an .iss file. All servers installed silently using the response file will use the
settings.
Important:
• The Setup wizard only shows screens for local installation (fresh installation or
upgrade). See Installation and Upgrade on page 2-7 for the relevant screens
that will display.
• If you plan to upgrade OfficeScan servers to this version, make sure to create
the response file from a computer with an OfficeScan server installed. Similarly,
if you plan to perform fresh installation, create a response file from a computer
without an OfficeScan server installed.
2. Run Setup from a command prompt and point Setup to the location of the response
file to use for silent installation. You can use the silent installation process to
upgrade an OfficeScan server from an earlier version. The process is similar to fresh
installation.
To record the server Setup configuration to a response file:

Note: This procedure does not install OfficeScan. It only records the server Setup
configuration to a response file.

1. Open a command prompt and type the directory of the OfficeScan Setup.exe file.
For example, "CD C:\OfficeScan installer".
2. Enter setup.exe -r. The -r switch commands the program to record the installation
details to a response file.
3. In the Setup wizard, follow the installation steps. After completing these steps,
check the response file (setup.iss) in %windir%.

2-14
 Installing and Upgrading the OfficeScan Server

To run silent installation:

1. Copy the installation package (includes all installation files and folders, and the
setup.exe file) and setup.iss to the target computer.
2. In the target computer, open a command prompt and type the directory of the
setup.exe file.
3. Type setup.exe -s -f1{path}setup.iss -f2{path}setup.log.
For example: C:\setup.exe -s -f1C:\setup.iss -f2C:\setup.log
Where:
• -s: Commands the Setup program to perform silent installation
• -f1{path}setup.iss: Location of the response file. If the path contains spaces,
enclose the path with quotes ("). For example, -f1"C:\osce script\setup.iss".
• -f2{path}setup.log: Location of the log file that Setup will create after
installation. If the path contains spaces, enclose the path with quotes ("). For
example, -f2"C:\osce log\setup.log".
4. Press Enter. Setup.exe silently installs the server to the computer.
5. To determine if installation is successful, check the OfficeScan program shortcuts
on the target computer. If the shortcuts are not available, retry the installation.

Upgrading from an Evaluation Version

When your evaluation (trial) version is about to expire, OfficeScan displays a notification
message on the Summary screen. You can upgrade from an evaluation version to the full
version of OfficeScan through the Web console without losing any of your
configuration settings. When you have a full version license, you will receive a
Registration Key or an Activation Code.
To upgrade from an evaluation version:
1. Open the OfficeScan Web console.
2. Click Administration > Product License. The Product License screen appears.
3. If you have an Activation Code, type it in the New Activation Code field and click
Save.
If you do not have an Activation Code, click Register Online and use the
Registration Key to obtain an Activation Code.

2-15
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Post-installation Tasks
Trend Micro recommends performing the following post-installation tasks:
• Verifying the Server Installation or Upgrade on page 2-16
• Updating OfficeScan Components on page 2-17
• Checking Default Settings on page 2-17
• Using Client Mover for Legacy Platforms on page 2-18

Note: Perform this task only if you have clients running unsupported platforms, which
include Windows 95, 98, Me, NT and IA64 architecture.

• Registering OfficeScan to Control Manager on page 2-21

Note: Control Manager registration only applies to newly installed OfficeScan servers.

• Installing Plug-in Manager on page 2-21

Verifying the Server Installation or Upgrade

After completing the installation or upgrade, verify the following:
• OfficeScan program shortcuts on the Windows Start menu
• List of currently installed programs in the Add/Remove Programs screen, which
should include "Trend Micro OfficeScan Server"
• Web console connection:
• http://{OfficeScan server name}:{port number}/OfficeScan
• or if using SSL: https://{OfficeScan server name}:{port number}/OfficeScan
Where {OfficeScan server name} is the name or IP address of the OfficeScan server.
• OfficeScan services included in Windows services:
• OfficeScan Master Service (should be running)
• Trend Micro Policy Server for Cisco NAC (if installed)
• Running OfficeScan processes:
• OfcService.exe
• DBServer.exe

2-16
 Installing and Upgrading the OfficeScan Server

• Installation log: OFCMAS.LOG in %windir%

• Registry keys: HKEY_LOCAL_MACHINE\Software\TrendMicro\OfficeScan
• Program folder: {Installation Drive and folder}\Trend Micro\OfficeScan

Updating OfficeScan Components

After installation or upgrade, update the server immediately with the latest OfficeScan
components.

Note: This section shows you how to perform manual update. For information on
scheduled update and update configurations, see the OfficeScan server online help.

To update the OfficeScan server:

1. Open the OfficeScan Web console.
2. On the main menu, click Updates > Server > Manual Update. The Manual
Update screen appears, showing the current components, their version numbers,
and the most recent update dates.
3. Select the components to update.
4. Click Update. The server checks the update server for updated components. The
update progress and status display.

Checking Default Settings

OfficeScan installs with default settings. If these settings do not conform to your
security requirements, modify and then save the settings on the Web console before
installing OfficeScan clients. Refer to the online help and Administrator’s Guide for
details on the settings available on the Web console.

Scan settings
OfficeScan provides several types of scans to protect your clients from security risks.
You can modify the scan settings from the Web console by going to Networked
Computers > Client Management > Settings > {Scan Type}.
• Real-time Scan: OfficeScan scans files in real time. If OfficeScan detects no
security risk, users can proceed to open or save the file. If OfficeScan detects a

2-17
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

security risk, it displays a notification message, showing the name of the file and the
specific security risk.
• Manual Scan: Manual Scan for virus/malware starts immediately after a user
launches it in the client console. The length of the scan depends on the number of
files to scan and the client computer’s hardware resources. The scan time and
coverage for spyware/grayware depends on the scan method you or client users
(with Manual Scan configuration privilege) specify. You can select the scan method
to use in the Manual Scan Settings page in the Web console.
• Scheduled Scan: Scheduled Scan has similar scan behavior as Manual Scan. The
only difference is that Scheduled Scan runs automatically on the scheduled date and
time. Use Scheduled Scan to automate routine scans on the client and improve scan
management efficiency.
• Scan Now: Scan Now and Manual Scan are the same type of scan. The only
difference is that you initiate Scan Now remotely using the Web console, while users
run Manual Scan locally on their client computers.

Global client settings

OfficeScan provides several types of settings that apply to all clients registered to the
server or to all clients with a certain privilege. You can modify global client settings from
the Web console by going to Networked Computers > Global Client Settings.

Client privileges
Default client privileges include displaying the Mail Scan and Toolbox tabs on the
client console. Modify default client privileges from the Web console by going to
Networked Computers > Client Management > Settings > Privileges and Other
Settings.

Using Client Mover for Legacy Platforms

The OfficeScan client no longer supports Windows 95, 98, Me, NT and IA64
architecture. If OfficeScan clients (version 5.58, 6.5, 7.0, or 7.3) run any of these
platforms and you upgraded the server that manages them to version 8.0 SP1:
• The OfficeScan clients will not be upgraded.
• The OfficeScan 8.0 SP1 server stops managing the clients. The clients' status becomes
"Disconnected".

2-18
 Installing and Upgrading the OfficeScan Server

• The OfficeScan 8.0 SP1 server saves the clients’ information to a file named
unsupCln.txt. You will use this file to "move" clients to a server with the same version.
Move means designating a new server to manage the clients.
• On the OfficeScan 8.0 SP1 server computer, you need to run a tool called Client
Mover for Legacy Platforms. This tool notifies clients that they will be managed by a
new server and verifies if client movement succeeds. When clients receive the
notification, they register to their new parent server.
To move clients:
1. Prepare a new parent server. This server’s version should be the same as the version
of the clients to be moved.
2. Take note of the server’s computer name/IP address and server listening port. You
will need these details when you move the clients.
You can obtain the server listening port from the server’s Web console.
• For OfficeScan 5.58, go to Server Administration > Web Server .
• For OfficeScan 6.5, 7.0, or 7.3, go to Administration > Web Server.
3. On the OfficeScan 8.0 SP1 server computer, navigate to \PCCSRV\Admin\
Utility\ClientMover and run clientmover.exe.

Note: \PCCSRV is under the OfficeScan installation folder, typically, C:\Program

Files\Trend Micro\OfficeScan.

4. In the command window, type the following command:

ClientMover /P:{"ExportDataPath"} /S:{ServerIP:port} /N
Where:
• ExportDataPath: The path and file name of the file (unsupCln.txt) containing
client information.
• ServerIP:port: The IP address and server listening port number of the new
parent server.
• /N: A command that notifies and then moves the clients to the new parent
server. This command is used in conjunction with the /V command.
For example:

2-19
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

ClientMover /P:"C:\Program Files\TrendMicro\OfficeScan\PCCSRV\

Private\unsupcln.txt" /S:123.12.12.123:23456 /N
5. Use the /V command to verify if the tool successfully moved the clients. This
command compares the IP addresses of the OfficeScan 8.0 SP1 server and the new
parent server. If the IP addresses are the same, the tool was unable to move the
clients.
For example:
ClientMover /P:"C:\Program Files\Trend Micro\OfficeScan\PCCSRV\Private\
unsupcln.txt" /S:123.12.12.123:23456 /V
6. To check the result:
a. Access the resulting log in \PCCSRV\Private\. The log’s file name is
unsupcln.txt.log.{date_time}.
For example: unsupcln.txt.log.20080101_123202
b. Also in the same folder, verify if OfficeScan updated and backed up the
unsupcln.txt file. The backup file’s name is unsupcln.txt.bak.
Sample entry in the updated unsupcln.txt file:
------------------------------------------------------------
x12xx345-6xxx-78xx-xx91-234x567x8x91 1234567891 23456 0
------------------------------------------------------------
Where:
• "x12xx345-6xxx-78xx-xx91-234x567x8x91" is the client’s GUID.
• "1234567891" is the client's IP address in decimal notation.
• "23456" is the client listening port.
• "0" is the result and it means notification was completed.
Other possible results:
• 1 = Client notification successful
• 2 = Client notification unsuccessful
• 3 = Verification successful
• 4 = Verification unsuccessful

2-20
 Installing and Upgrading the OfficeScan Server

Sample entry in the unsupcln.txt.log.{date_time} file:

------------------------------------------------------------
x12xx345-6xxx-78xx-xx91-234x567x8x91 123.12.12.123:23456
Unable to send the notification. Please check the network or
client status.
------------------------------------------------------------
Where:
• "x12xx345-6xxx-78xx-xx91-234x567x8x91" is the client’s GUID.
• "123.12.12.123:23456" is the client's IP address and listening port.
• Result is "Unable to send the notification. Please check the network or client
status".
7. Use the /F command to force the notification or verification without checking the
current client status.

Registering OfficeScan to Control Manager

If you want a Control Manager server to manage newly installed OfficeScan servers,
register OfficeScan to Control Manager after installation. You can do so from the
OfficeScan Web console by going to Administration > Control Manager Settings.
See the online help for the procedure.

Installing Plug-in Manager

With Plug-in Manager, you can start using plug-in programs developed outside of a
product release as soon as they are available. Plug-in Manager displays the plug-in
programs for both the OfficeScan server and client on the OfficeScan Web console.
Install and manage the programs from the Web console, including deploying the client
plug-in programs to clients.
Download and install Plug-in Manager by clicking Plug-in Manager on the main menu
of the Web console. Follow the Setup screens to complete the installation. After
successfully installing Plug-in Manager, check for available plug-in programs.

Note: Refer to the available documentation for Plug-in Manager for installation
requirements and instructions.

2-21
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Performing Server Uninstallation and Rollback

If you experience problems with OfficeScan, you can:
• Use the uninstallation program to safely remove the OfficeScan server from your
computer and then reinstall OfficeScan. Remove all clients before removing the
server.
• Roll back to version 8.0 instead of uninstalling the OfficeScan server.

Note: There is no rollback tool available, which means you need to perform manual
rollback. You cannot roll back from OfficeScan 8.0 Service Pack 1 server directly
because Service Pack 1 includes some kernel drivers that cannot be rolled back
automatically. You need to prepare another computer with OfficeScan 8.0 server
installed.

Backing up and restoring the OfficeScan database and configuration

files
Trend Micro recommends backing up the OfficeScan database and important
configuration files before uninstallation or rollback.
To back up and restore the database and configuration files:
1. Back up the OfficeScan server database to a location outside of the OfficeScan
program directory.
Perform database backup through the OfficeScan Web console (Administration >
Database Backup). See the Administrator’s Guide or the OfficeScan server online
help for instructions.

WARNING! Do not use any other type of backup tool or application.

2. Manually back up the following files and folders from the \Program Files\Trend
Micro\OfficeScan\PCCSRV folder:
• ofcscan.ini: Contains global client settings
• ous.ini: Contains the update source table for antivirus component deployment
• Private folder: Contains firewall and update source settings
• Web\tmOPP folder: Contains Outbreak Prevention settings

2-22
 Installing and Upgrading the OfficeScan Server

• Pccnt\Common\OfcPfw.dat: Contains firewall settings

• Download\OfcPfw.dat: Contains firewall deployment settings
• Log folder: Contains system events and the connection verification logs
• Virus folder: Contains quarantined files
• HTTDB folder: Contains the OfficeScan database
3. Perform uninstallation or rollback (See Uninstalling the OfficeScan server on page
2-23 or Rolling back to version 8.0 on page 2-24 for details).
If you performed server uninstallation:
After uninstallation, perform fresh installation (See Installing or Upgrading the
OfficeScan Server on page 2-2 for details). After the master installer finishes, stop
the OfficeScan service on the target computer.
a. Open the Microsoft Management Console (click Start > Run and type
services.msc).
b. Select OfficeScan Master Service from the list, right-click and then select
Stop.
4. Copy the backup files to the \PCCSRV folder on the target computer. This
overwrites the OfficeScan server database and the relevant files and folders.
5. Restart the OfficeScan service.

Uninstalling the OfficeScan server

To uninstall the OfficeScan server:
1. If you performed fresh installation on the server computer, skip this step.
If you upgraded the server from an earlier version to this version:
a. If Plug-in Manager is currently installed, uninstall Plug-in Manager.
b. If Plug-in Manager is not installed, delete the AOS registry key found in
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfficeScan\servic
e\.
2. On the OfficeScan server computer, click Start > Programs > Trend Micro
OfficeScan Server > Uninstall OfficeScan.
A confirmation screen appears.

2-23
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

3. Click Yes. The server uninstallation program prompts you for the administrator
password.
4. Type the administrator password and click OK. The server uninstallation program
starts removing the server files. A confirmation message appears.
5. Click OK to close the uninstallation program.

Rolling back to version 8.0

To roll back to version 8.0:
Part 1: Rollback preparation
1. Prepare a computer with OfficeScan 8.0 server installed.
2. Apply hot fixes and patches released after version 8.0 to this server.
3. Duplicate or reconfigure settings on the OfficeScan 8.0 server.
Consider the following settings:
a. Client settings
• Scan
• Update Agents
• Privileges
• Spyware/Grayware Approved List
b. Global client settings
c. Web Reputation settings
• Computer location
• Policies
• Proxy
d. OfficeScan Firewall settings
• Policy
• Profiles
e. Connection verification schedule
f. Update settings
• Server scheduled update

2-24
 Installing and Upgrading the OfficeScan Server

• Server update source

• Client scheduled update
• Client update source
g. Log maintenance settings
h. Notifications - all notification messages
i. Administration settings
• Quarantine Manager
• Control Manager Agent
• Database backup
4. Run Client Packager on the OfficeScan 8.0 server to create a client installation
package.
Settings on Client Packager screen:
a. Package type: Setup
b. Output file: \InstNTPkg.exe
5. Prepare an update source (another computer that will act as update source) that has
components similar to or newer than the components on the current OfficeScan 8.0
Service Pack 1 server.

Tip: You can copy all component files directly from the OfficeScan 8.0 server's
"PCCSRV\Download" folder to the update source.

Note: If you have older components on the update source, you cannot perform
rollback from the server's Web console.

6. Package the following files:

• RollbackAgent.dll (under \PCCSRV\Admin)
• ClientRollback.exe (under \PCCSRV\Admin)
• InstNTPkg.exe (for x86 computers)
• InstNTPkg.exe (for x64 computers)
a. Compress RollbackAgent.dll as RollbackAgent.zip.

2-25
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

b. Create two folders: RollBackNTPkg and RollBackNTpkgx64.

c. Copy ClientRollback.exe and NT Client Packager (InstNTPkg.exe) to the
RollbackNTPkg folder.
d. Copy the ClientRollback.exe and NT x64 Client Packager (InstNTPkg.exe)
to the RollbackNTPkgx64 folder..
e. Compress the RollbackNTPkg folder as RollbackNTPkg.zip and the
RollbackNTPkgx64 folder as RollbackNTpkgx64.zip.
f. Modify the update source' download file and server.ini file.
• Copy RollbackAgent.zip, RollbackNTPkg.zip and RollbackNTPkgx64.zip
to the computer acting as update source, under the folder
Download\Product\.
• Add the server.ini file and modify as follows:

Note: Modify only the following lines. Please do not change any other setting.

----------------------------------------------
[All_Product]
MaxProductID=109
Product.109=OfficeScan Rollback, 3.5, 8.0

[Info_109_35000_1_1]
Version=8.0
Update_Path=product/RollbackAgent.zip, 90517
Path=product/RollBackNTPkg.zip, xx

[Info_109_35000_1_5633]
Version=8.0
Update_Path=product/RollbackAgent.zip, 90517
Path=product/RollBackNTPkg x64.zip, yy
----------------------------------------------
Where:
xx - File size of "RollBackNTPkg.zip". For example, 32058256.
yy - File size of RollBackNTPkg x64.zip. For example, 36930773.
To get the file size, right-click the zip file and click Properties. Take note
of the size, not the size on disk.

2-26
 Installing and Upgrading the OfficeScan Server

Part 2: Rollback
1. On the OfficeScan 8.0 Service Pack 1 Web console, configure all clients to update
from the update source configured in Part 1.
a. Go to Updates > Networked Computers > Update Source.
b. Select Customized Update Source.
c. On the Customized Update Source List, add the update source, which
should contain the patch agent and client packages.
d. Click Notify All Clients.
Clients will use the patch agent to uninstall and then reinstall the OfficeScan
8.0 client during client update.
2. After the client has been reinstalled, inform users to restart their client computers.
After client computers are restarted, all clients will report to the OfficeScan 8.0
server prepared in Part 1.

2-27
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

2-28
 Chapter 3

Planning Client Installation

Topics in this chapter:
• Client Installation Requirements on page 3-2
• Update Agent Requirements on page 3-8
• Installation Methods on page 3-8

3-1
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Client Installation Requirements

The following are the requirements for installing the OfficeScan client on computers
running Windows 2000, XP, Server 2003, Vista, and 2008.

TABLE 3-1. Client system requirements - Windows 2000

R ESOURCE R EQUIREMENT

Operating sys- • Windows 2000 with Service Pack 3 or 4

tem
• Windows Cluster Server 2000
• OfficeScan supports client installation on guest Windows 2000
operating systems hosted on the following virtualization applications:
• Microsoft Virtual Server 2005 R2 with Service Pack 1
• VMware ESX Server 3.0 (ESX Server Edition)
• VMware Server 1.0.3 (Server Edition)
• VMware Workstation and Workstation ACE Edition 6.0

Hardware • 300MHz Intel Pentium processor or equivalent

• RAM: 256MB minimum, 512MB recommended
• 350MB of available disk space
• Monitor that supports 800 x 600 resolution at 256 colors or higher

Others Windows Internet Explorer 5.0 or later if performing Web setup

3-2
 Planning Client Installation

TABLE 3-2. Client system requirements - Windows XP/2003, 32-bit version

R ESOURCE R EQUIREMENT

Operating sys- • Windows XP Professional with Service Pack 1 or 2

tem
• Windows XP Home with Service Pack 3
• Windows Server 2003 with or without Service Pack 1 or 2
• Windows 2003 Web Edition with or without Service Pack 1 or 2
• Windows Server 2003 R2 with or without Service Pack 1 or 2
• Windows Storage Server 2003
• Windows Cluster Server 2003
• OfficeScan supports client installation on guest Windows XP/2003
operating systems hosted on the following virtualization applications:
• Microsoft Virtual Server 2005 R2 with Service Pack 1
• VMware ESX Server 3.0 (ESX Server Edition)
• VMware Server 1.0.3 (Server Edition)
• VMware Workstation and Workstation ACE Edition 6.0

Hardware • 300MHz Intel Pentium processor or equivalent; AMD(TM) x64 or Intel

64 processor architectures also supported
• RAM: 256MB minimum, 512MB recommended
• 350MB of available disk space
• Monitor that supports 800 x 600 resolution at 256 colors

Others • Windows Internet Explorer 6.0 or later if performing Web setup

• Disable Simple File Sharing on Windows XP computers so users can
successfully install the OfficeScan client program (see your Windows
documentation for instructions).

3-3
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

TABLE 3-3. Client system requirements - Windows XP/2003, 64-bit version

R ESOURCE R EQUIREMENT

Operating sys- • Windows XP Professional with Service Pack 1 or 2

tem
• Windows Server 2003 with or without Service Pack 1 or 2
• Windows 2003 Web Edition with or without Service Pack 1 or 2
• Windows Server 2003 R2 with or without Service Pack 1 or 2
• Windows Storage Server 2003
• Windows Cluster Server 2003
• OfficeScan supports client installation on guest Windows XP/2003
operating systems hosted on the following virtualization applications:
• VMware ESX Server 3.0 (ESX Server Edition)
• VMware Server 1.0.3 (Server Edition)
• VMware Workstation and Workstation ACE Edition 6.0

Hardware • Intel x64 processor, AMD x64 processor

• RAM: 256MB minimum, 512MB recommended
• 350MB of available disk space
• Monitor that supports 800 x 600 resolution at 256 colors

Others • Windows Internet Explorer 6.0 or later if performing Web setup

• Disable Simple File Sharing on Windows XP computers so users can
successfully install the OfficeScan client program (see your Windows
documentation for instructions).

3-4
 Planning Client Installation

TABLE 3-4. Client system requirements - Windows Vista, 32-bit and 64-bit versions

R ESOURCE R EQUIREMENT

Operating sys- • Windows Vista Business Edition with Service Pack 1

tem
• Windows Vista Enterprise Edition with Service Pack 1
• Windows Vista Ultimate Edition with Service Pack 1
• Windows Vista Home Premium Edition with Service Pack 1
• Windows Vista Home Basic Edition with Service Pack 1
• OfficeScan supports client installation on guest Windows Vista
operating systems hosted on the following virtualization applications:
• Microsoft Virtual Server 2005 R2 with Service Pack 1
• VMware ESX Server 3.0 (ESX Server Edition)
• VMware Server 1.0.3 (Server Edition)
• VMware Workstation and Workstation ACE Edition 6.0

Hardware • 800MHz Intel Pentium processor or equivalent; AMD x64 or Intel 64

processor architectures also supported
• 1GB of RAM
• 350MB of available disk space
• Monitor that supports 800 x 600 resolution at 256 colors

Others Windows Internet Explorer 7.0 or later if performing Web setup

3-5
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

TABLE 3-5. Client system requirements - Windows 2008, 32-bit version

R ESOURCE R EQUIREMENT

Operating sys- • Windows Server 2008 Standard Edition

tem
• Windows Server 2008 Enterprise Edition
• Windows Server 2008 Datacenter Edition
• Windows Web Server 2008
• OfficeScan also supports client installation on guest Windows 2008
operating systems hosted on the following virtualization applications:
• Microsoft Virtual Server 2005 R2, with Service Pack 1
• VMware ESX Server 3.0 (ESX Server Edition)
• VMware Server 1.0.3 (Server Edition)
• VMware Workstation and Workstation ACE Edition 6.0
Note: OfficeScan cannot be installed if Windows 2008 runs on the
Server Core environment.

Hardware • At least 1GHz Intel Pentium processor or equivalent; 2GHz

recommended; AMD x64 and Intel 64 processor architectures
• 1GB of RAM
• 350MB of available disk space
• Monitor that supports 800 x 600 resolution at 256 colors

Others Windows Internet Explorer 7.0 or later if performing Web setup

3-6
 Planning Client Installation

TABLE 3-6. Client system requirements - Windows 2008, 64-bit version

R ESOURCE R EQUIREMENT

Operating sys- • Windows Server 2008 Standard Edition

tem
• Windows Server 2008 Enterprise Edition
• Windows Server 2008 Datacenter Edition
• Windows Web Server 2008
• OfficeScan also supports client installation on guest Windows 2008
operating systems hosted on the following virtualization applications:
• Microsoft Virtual Server 2005 R2, with Service Pack 1
• VMware ESX Server 3.0 (ESX Server Edition)
• VMware Server 1.0.3 (Server Edition)
• VMware Workstation and Workstation ACE Edition 6.0
Note: OfficeScan cannot be installed if Windows 2008 runs on the
Server Core environment.

Hardware • At least 1.4GHz Intel Pentium processor or equivalent; 2GHz

recommended; AMD x64 and Intel 64 processor architectures
• 1GB of RAM
• 350MB of available disk space
• Monitor that supports 800 x 600 resolution at 256 colors

Others Windows Internet Explorer 7.0 or later if performing Web setup

3-7
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Update Agent Requirements

The following are the requirements for OfficeScan clients that will act as Update
Agents:

TABLE 3-7. Update Agent requirements

R ESOURCE R EQUIREMENT

Operating sys- Windows 2000, XP, Server 2003, Vista

tem

Hardware Processor: 800MHz Intel Pentium or equivalent

RAM:
• 512MB (Windows 2000, XP, Server 2003)
• 1GB (Windows Vista)
Available disk space: 700MB
Others: Monitor that supports 800 x 600 resolution at 256 colors
or higher

Update Dependent on the computer's hardware specifications

request capac-
ity

Installation Methods
This section provides a summary of the different client installation methods to help you
decide which method is most suitable for your network environment. All installation
methods require local administrator rights on the target computers.

Web install page

Instruct the users in your organization to go to the Web install page and download the
client Setup files (see Installing from the Web Install Page on page 4-2).
Supported operating systems: All operating systems

3-8
 Planning Client Installation

Login Script Setup

Automate the installation of the OfficeScan client to unprotected computers when they
log on to the network (see Installing with Login Script Setup on page 4-3).
Supported operating systems: All operating systems

Client Packager
Create and send the client Setup or update files to client users (see Installing with Client
Packager on page 4-5). If creating an MSI package using Client Packager, you can deploy
the package using Active Directory™ or Microsoft SMS.
For details, see the following topics:
• Deploying an MSI package using Active Directory on page 4-9
• Deploying an MSI package using Microsoft SMS on page 4-9
Supported operating systems: All operating systems

Remote installation
From the Web console, install the client program on computers running supported
platforms (see Installing from the OfficeScan Web Console on page 4-12).
Supported operating systems: All operating systems except:
• Windows Vista Home Basic and Home Premium Editions (32-bit and 64-bit
versions)
• Windows XP Home Edition

From a client disk image

Create and clone an image of an OfficeScan client, and then deploy to other computers
on your network (see Installing from a Client Disk Image on page 4-14).
Supported operating systems: All operating systems except:
• Windows Vista
• Windows 2008
• 64-bit platforms

3-9
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Trend Micro Vulnerability Scanner (TMVS)

Install the client program on unprotected computers by running the Trend Micro™
Vulnerability Scanner (Installing with Vulnerability Scanner on page 4-15).
Supported operating systems: All operating systems except:
• Windows Vista Home Basic and Home Premium Editions (32-bit and 64-bit
versions)
• Windows XP Home Edition

Summary
TABLE 3-8. OfficeScan client installation methods

C LIENT C LIENT
P ACKAGE P ACKAGE
W EB L OGIN C LIENT D EPLOYED D EPLOYED R EMOTE C LIENT
I NSTALL S CRIPT I NSTALLA - TMVS
P ACKAGE U SING U SING D ISK I MAGE
P AGE S ETUP TION
M ICROSOFT A CTIVE
SMS D IRECTORY

Suitable for No No No Yes Yes No No No

deployment
across the
WAN

Suitable for No No No Yes Yes Yes No Yes

centralized
administra-
tion and
management

Requires Yes Yes Yes Yes/No Yes/No No No No

client user
intervention

Requires IT No Yes Yes Yes Yes Yes Yes Yes

resource

Suitable for No No No Yes Yes No No No

mass deploy-
ment

3-10
 Planning Client Installation

TABLE 3-8. OfficeScan client installation methods

C LIENT C LIENT
P ACKAGE P ACKAGE
W EB L OGIN D EPLOYED R EMOTE
C LIENT D EPLOYED C LIENT
I NSTALL S CRIPT I NSTALLA - TMVS
P ACKAGE U SING U SING D ISK I MAGE
P AGE S ETUP TION
M ICROSOFT A CTIVE
SMS D IRECTORY

Bandwidth High High, if Low, if Low, if High, if High Low High

consumption clients sched- sched- clients
start at uled uled start at
the same the same
time time

3-11
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

3-12
 Chapter 4

Installing and Upgrading the

OfficeScan Client
Installation/Upgrade scenarios:
• Performing Fresh Installation on page 4-1
• Upgrading the OfficeScan Client on page 4-16
• Migrating from Third-party Antivirus Applications on page 4-16
• Migrating from ServerProtect Normal Servers on page 4-17
Recommended post-installation tasks:
• Verifying the Client Installation, Upgrade, or Migration on page 4-20
• Initiating Component Update on page 4-23
• Testing OfficeScan Using the EICAR Test Script on page 4-23
Other task:
• Uninstalling the Client on page 4-24

Performing Fresh Installation

Close any running applications on client computers before installing the client program.
Otherwise, the installation process may take longer to complete.

4-1
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Installing from the Web Install Page

If you installed the OfficeScan server to a computer running Windows 2000 Server or
Windows Server 2003 with Internet Information Server (IIS) 5.0 or later or Apache 2.0,
your client users can install the client program from the Web install page created during
server installation. Instruct users to go to the Web install page and download the client
Setup files.

Tip: You can use Vulnerability Scanner to determine the users that did not follow the
instructions to install from the Web install page (see Using Vulnerability Scanner to
verify the client installation on page 4-21 for more information).

Requirements:
• At least Microsoft Internet Explorer 5.0 (Windows 2000), 6.0 (Windows XP/Server
2003) or 7.0 (Windows Vista/2008) with the security level set to allow ActiveX™
controls
• Administrator privileges on the computer
Send the following instructions to your users to install the OfficeScan client from the
Web install page.
To install from the Web install page:
1. If installing to a computer running Windows 2000 and 2003, skip this step.
If installing to a computer running Windows XP, Vista, and 2008, perform the
following steps:
a. Log on to the computer using a built-in administrator account.
b. Launch Internet Explorer and add the OfficeScan server URL (such as
https://computername:4343/officescan) to the list of trusted sites. In
Windows XP Home, the list can be accessed by going to Tools > Internet
Options > Security tab, selecting the Trusted Sites icon, and clicking Sites.
c. Modify the Internet Explorer security setting to enable Automatic prompting
for ActiveX controls. On Windows XP, this can be done by going to Tools >
Internet Options > Security tab, and clicking Custom level.

4-2
 Installing and Upgrading the OfficeScan Client

2. Open an Internet Explorer window and type one of the following:

• OfficeScan server with SSL:
https://{OfficeScan_server_name}:{port}/officescan
• OfficeScan server without SSL:
http://{OfficeScan_server_name}:{port}/officescan
3. Click the link under For Networked Computers.
4. In the new screen that displays, click Install Now to start installing the OfficeScan
client. The client installation starts. Allow ActiveX control installation when
prompted.
The OfficeScan client icon appears in the Windows system tray after installation.

Installing with Login Script Setup

Login Script Setup automates the installation of the OfficeScan client to unprotected
computers when they log on to the network. Login Script Setup adds a program called
AutoPcc.exe to the server login script.
AutoPcc.exe performs the following functions:
• Determines the operating system of the unprotected computer and installs the
appropriate version of the OfficeScan client
• Updates the program files and the antivirus, anti-spyware and Damage Cleanup
Services components

Note: Client computers must be part of the domain to be able to use AutoPcc through login
script.

To add AutoPcc.exe to the login script using Login Script Setup:

1. On the computer you used to run the server installation, click Programs > Trend
Micro OfficeScan Server {Server Name} > Login Script Setup from the
Windows Start menu.
The Login Script Setup utility loads. The console displays a tree showing all
domains on your network.

4-3
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

2. Locate the server whose login script you want to modify, select it, and then click
Select. The server must be a primary domain controller and you must have
administrator access. Login Script Setup prompts you for a user name and password.
3. Type your user name and password. Click OK to continue.
The User Selection screen appears. The Users list shows the profiles of users that
log on to the server. The Selected users list shows the user profiles whose login
script you want to modify.
• To modify the login script of a single or multiple user profiles, select them from
the Users list, and then click Add.
• To modify the login script of all users, click Add All.
• To exclude a user profile that you previously selected, click the name from the
Selected users list, and click Delete.
• To reset your choices, click Remove All.
4. Click Apply when all target user profiles are in the Selected users list.
A message informs you that you have modified the server login scripts successfully.
5. Click OK. Login Script Setup returns to its initial screen.
• To modify the login scripts of other servers, repeat steps 2 to 4.
• To close Login Script Setup, click Exit.

Note: AutoPcc.exe automatically installs the OfficeScan client to an unprotected

Windows 2000/Server 2003 computer when it logs on to the server whose login
scripts you modified.

However, AutoPcc.exe does not automatically install the client to Windows

XP/Vista/2008 computers. Users need to connect to the server computer,
navigate to \\{server computer name}\ofcscan), right-click AutoPcc.exe, and
select Run as administrator.

For remote desktop installation using AutoPcc.exe:

- The computer must be run in Mstsc.exe /console mode. This forces the
AutoPcc.exe installation to run in session 0.

- Map a drive to the ofcscan share and execute AutoPcc.exe from that point.

4-4
 Installing and Upgrading the OfficeScan Client

The Windows 2000/Server 2003 scripts

If you already have an existing login script, Login Script Setup will append a command
that executes AutoPcc.exe. Otherwise, OfficeScan creates a batch file called ofcscan.bat
that contains the command to run AutoPcc.exe.
Login Script Setup appends the following at the end of the script:
\\{Server_name}\ofcscan\autopcc
Where:
• {Server_name} is the computer name or IP address of the OfficeScan server
computer
• "ofcscan" is the OfficeScan directory on the server
• "autopcc" is the link to the autopcc executable file that will install the OfficeScan
client
Login script location (through a net logon shared directory):
• Windows 2000 server: \\Windows 2000 server\system
drive\WINNT\SYSVOL\domain\scripts\ofcscan.bat
• Windows Server 2003 server: \\Windows 2003 server\system
drive\windir\sysvol\domain\scripts\ofcscan.bat

Installing with Client Packager

Client Packager can compress Setup and update files into a self-extracting file, which you
can then send to users using conventional media such as CD-ROM. When users receive
the package, all they have to do is run the Setup program in the client computer.
Client Packager is especially useful when deploying the client Setup or update files to
clients in low-bandwidth remote offices. OfficeScan clients you install using Client
Packager report to the server where Client Packager created the Setup package.

Self-extracting files created by Client Packager

• Executable: This common file type has an .exe extension.
• Microsoft Installer (MSI) Package Format: This file type conforms to
Microsoft's Windows Installer package specifications. You can send the MSI package
through conventional media or use Active Directory and Microsoft SMS. See Deploying
an MSI package using Active Directory on page 4-9 and Deploying an MSI package

4-5
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

using Microsoft SMS on page 4-9 for details. For more information on MSI, see the
Microsoft Web site.

Client computer requirements

• Minimum of 160MB free disk space
• Windows Installer 2.0 (to run an MSI package)
To create a package using Client Packager:
1. On the OfficeScan server computer, browse to \PCCSRV\Admin\Utility\
ClientPackager.
2. Double-click ClnPack.exe to run the tool. The Client Packager console opens.
3. Select the type of package you want to create:
• Setup: Select if installing the OfficeScan client program. This will create an
executable file.
• Update: Select if updating OfficeScan client components only. This will also
create an executable file.
• MSI Package: Select if creating a package that conforms to the Microsoft
Installer Package format
4. If creating an executable file, select the operating system for which you want to
create the package.
5. Select from among the following installation options:
• Silent Mode: Creates a package that installs on the client computer in the
background, unnoticeable to the client and without showing an installation
status window

4-6
 Installing and Upgrading the OfficeScan Client

• Update Agent: Gives the client the ability to act as an update agent (Update
Agents are alternative servers that help the OfficeScan server deploy
components to clients.). If you install the OfficeScan client program using
Client Packager and you enable the Update Agent option, you must use the
Scheduled Update Configuration Tool to enable and configure scheduled
updates (see Using the Scheduled Update Configuration Tool on page 4-8).

Tip: If you install the OfficeScan client program using Client Packager and you
enable the Update Agent option, any OfficeScan server that registers with
the client will not be able to synchronize or modify the following settings:
the Update Agent privilege, client scheduled update, update from Trend
Micro ActiveUpdate server, and updates from other update sources.

Trend Micro recommends installing only on client computers not

registered with any OfficeScan server and configuring the Update Agent to
get its updates from an update source other than an OfficeScan server. If
you want to modify the Update Agent settings mentioned above, use a
client program installation method other than Client Packager.

• Force overwrite with latest version: Overwrites old versions with the latest
version; applicable only when you select Update as the package type.
• Disable prescan (only for fresh install): Disables the file scanning that
OfficeScan performs before installation
6. Select the OfficeScan client utilities to include in the package.
• Outlook Mail Scan: Scans Microsoft Outlook™ mailboxes for security risks
• Check Point SecureClient Support: Support for Check Point™
SecureClient™ for Windows 2000/XP/Server 2003
7. Select the components to include in the installation package.
8. Next to Source file, ensure that the location of the ofcscan.ini file is correct. To
modify the path, click to browse for the ofcscan.ini file. By default, this file is in
the \PCCSRV folder of the OfficeScan server.
9. In Output file, click to specify the location where you want to create the client
package and the file name (for example, ClientSetup.exe).
10. Click Create. When Client Packager finishes creating the package, the message
"Package created successfully" appears. To verify successful package creation, check
the output directory you specified.

4-7
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

11. Deploy the package.

• Send the package to your users and ask them to run the client package on their
computers by double-clicking the .exe or .msi file.

WARNING! Send the package only to users whose OfficeScan client will
report to the server where the package was created.

• If you have users who will install the .exe package on computers running
Windows Vista and 2008, instruct them to right-click the .exe file and select
Run as administrator.
• If you created an .msi file, you can:
• Use Active Directory or Microsoft SMS. See Deploying an MSI package
using Active Directory on page 4-9 or Deploying an MSI package using
Microsoft SMS on page 4-9.
• Launch the MSI package (on the command prompt) and silently install the
OfficeScan client to a remote computer running Windows XP, Vista, and
2008.

Using the Scheduled Update Configuration Tool

Use the Scheduled Update Configuration Tool to enable and configure scheduled
updates on OfficeScan clients acting as Update Agents that you installed using Client
Packager. This tool is available only on Update Agents that Client Packager installs.
To use the Scheduled Update Configuration Tool:
1. On the Update Agent that Client Packager installed, open Windows Explorer.
2. Go to the OfficeScan client folder.
3. Double-click SUCTool.exe to run the tool. The Schedule Update Configuration
Tool console opens.
4. Select Enable Scheduled Update.
5. Specify the update frequency and time.
6. Click Apply.

4-8
 Installing and Upgrading the OfficeScan Client

Deploying an MSI package using Active Directory

You can take advantage of Active Directory features to deploy the MSI package
simultaneously to multiple client computers. For instructions on creating an MSI file, see
Installing with Client Packager on page 4-5.
To deploy an MSI package using Active Directory:
1. Open the Active Directory console.
2. Right-click the Organizational Unit (OU) where you want to deploy the MSI
package and click Properties.
3. In the Group Policy tab, click New.
4. Choose between Computer Configuration and User Configuration, and open
Software Settings below it.

Tip: Trend Micro recommends using Computer Configuration instead of User

Configuration to ensure successful MSI package installation regardless which
user logs on to the computer.

5. Below Software Settings, right-click Software installation, and then select New
and Package.
6. Locate and select the MSI package.
7. Select a deployment method and then click OK.
• Assigned: The MSI package is automatically deployed the next time users log
on to the computer (if you select User Configuration) or when the computer
restarts (if you select Computer Configuration). This method does not require
any user intervention.
• Published: To run the MSI package, inform users to go to Control Panel, open
the Add/Remove Programs screen, and select the option to add/install
programs on the network. When the OfficeScan client MSI package displays,
users can proceed to install the client.

Deploying an MSI package using Microsoft SMS

You can deploy the MSI package using Microsoft System Management Server (SMS).
However, you must have Microsoft BackOffice SMS installed on the server.

4-9
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

For instructions on creating an MSI file, see Installing with Client Packager on page 4-5.

Note: The following instructions are applicable if you use Microsoft SMS 2.0 and 2003.

The SMS server needs to obtain the MSI file from the OfficeScan server before it can
deploy the package to target computers.
• Local: The SMS server and the OfficeScan server are on the same computer
• Remote: The SMS server and the OfficeScan server are on different computers
To obtain the package locally:
1. Open the SMS Administrator console.
2. On the Tree tab, click Packages.
3. On the Action menu, click New > Package From Definition. The Welcome
screen of the Create Package From Definition Wizard appears.
4. Click Next. The Package Definition screen appears.
5. Click Browse. The Open screen appears.
6. Browse and select the MSI package file created by Client Packager, and then click
Open. The MSI package name appears on the Package Definition screen. The
package shows "Trend Micro OfficeScan Client" and the program version.
7. Click Next. The Source Files screen appears.
8. Click Always obtain files from a source directory, and then click Next.
The Source Directory screen appears, displaying the name of the package you want
to create and the source directory.
9. Click Local drive on site server.
10. Click Browse and select the source directory containing the MSI file.
11. Click Next. The wizard creates the package. When it completes the process, the
name of the package appears on the SMS Administrator console.
To obtain the package remotely:
1. On the OfficeScan server, use Client Packager to create a Setup package with an .exe
extension (you cannot create an .msi package). See Installing with Client Packager
on page 4-5 for details.
2. On the computer where you want to store the source, create a shared folder.
3. Open the SMS Administrator console.

4-10
 Installing and Upgrading the OfficeScan Client

4. On the Tree tab, click Packages.

5. On the Action menu, click New > Package From Definition. The Welcome
screen of the Create Package From Definition Wizard appears.
6. Click Next. The Package Definition screen appears.
7. Click Browse. The Open screen appears.
8. Browse for the MSI package file. The file is on the shared folder you created.
9. Click Next. The Source Files screen appears.
10. Click Always obtain files from a source directory, and then click Next. The
Source Directory screen appears.
11. Click Network path (UNC name).
12. Click Browse and select the source directory containing the MSI file (the shared
folder you created).
13. Click Next. The wizard creates the package. When it completes the process, the
name of the package appears on the SMS Administrator console.
To distribute the package to target computers:
1. On the Tree tab, click Advertisements.
2. On the Action menu, click All Tasks > Distribute Software. The Welcome screen
of the Distribute Software Wizard appears.
3. Click Next. The Package screen appears.
4. Click Distribute an existing package, and then click the name of the Setup
package you created.
5. Click Next. The Distribution Points screen appears.
6. Select a distribution point to which you want to copy the package, and then click
Next. The Advertise a Program screen appears.
7. Click Yes to advertise the client Setup package, and then click Next. The
Advertisement Target screen appears.
8. Click Browse to select the target computers. The Browse Collection screen appears.
9. Click All Windows NT Systems.
10. Click OK. The Advertisement Target screen appears again.
11. Click Next. The Advertisement Name screen appears.
12. In the text boxes, type a name and your comments for the advertisement, and then
click Next. The Advertise to Subcollections screen appears.

4-11
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

13. Choose whether to advertise the package to subcollections. You can choose to
advertise the program only to members of the specified collection or to members of
subcollections.
14. Click Next. The Advertisement Schedule screen appears.
15. Specify when to advertise the client Setup package by typing or selecting the date
and time.
If you want Microsoft SMS to stop advertising the package on a specific date, click
Yes. This advertisement should expire, and then specify the date and time in the
Expiration date and time list boxes.
16. Click Next. The Assign Program screen appears.
17. Click Yes, assign the program, and then click Next.
Microsoft SMS creates the advertisement and displays it on the SMS Administrator
console.
When Microsoft SMS distributes the advertised program (that is, the OfficeScan client
program) to target computers, a screen will display on each target computer. Instruct
users to click Yes and follow the instructions provided by the wizard to install the
OfficeScan client to their computers.
Known Issues when Installing with Microsoft SMS
• "Unknown" appears in the Run Time column of the SMS console.
• If the installation is unsuccessful, the installation status may still show that the
installation is complete on the SMS program monitor. For instructions on how to
verify if the installation was successful, see Using Vulnerability Scanner to verify the
client installation on page 4-21.

Installing from the OfficeScan Web Console

You can remotely install the OfficeScan client to one or several computers connected to
the network. Ensure you have administrator rights to the target computers to perform
remote installation. Remote installation will not install the OfficeScan client on a
computer already running the OfficeScan server.

Note: This installation method cannot be used on computers running Windows XP

Home, and Windows Vista Home Basic and Home Premium Editions (32-bit
and 64-bit versions).

4-12
 Installing and Upgrading the OfficeScan Client

To install from the OfficeScan Web console:

1. If the computer does not run Windows Vista, skip this step. If running Windows
Vista Business, Enterprise, or Ultimate Edition, perform the following steps:
a. Enable a built-in administrator account and set the password for the account.
b. Disable the Windows firewall.
i. Click Start > Programs > Administrative Tools > Windows Firewall
with Advanced Security.
ii. For Domain Profile, Private Profile, and Public Profile, set the firewall
state to "Off".
c. Open the Microsoft Management Console (click Start > Run and type
services.msc) and start the Remote Registry service. When installing the
OfficeScan client, use the built-in administrator account and password.
2. In the Web console, click Networked Computers > Client Installation >
Remote.
3. Select the target computers.
• The Domains and Computers list displays all the Windows domains on your
network. To display computers under a domain, double-click the domain name.
Select a computer, and then click Add.
• If you have a specific computer name in mind, type the computer name in the
field on top of the page and click Search.
OfficeScan will prompt you for the target computer’s user name and password.
Make sure to use an administrator account user name and password to continue.
4. Type your user name and password, and then click Log in. The target computer
appears in the Selected Computers table.
5. Repeat Step 3 and Step 4 to add more computers.
6. Click Install when you are ready to install the client to your target computers. A
confirmation box appears.
7. Click Yes to confirm that you want to install the client to the target computers. A
progress screen appears as the program files copy to each target computer.
When OfficeScan completes the installation to a target computer, the computer
name disappears in the Selected Computers list and appears in the Domains and
Computers list with a red check mark.

4-13
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

When all target computers appear with red check marks in the Domains and
Computers list, you have completed remote installation.

Note: If you install to multiple computers, OfficeScan will record any unsuccessful
installation in the logs, but it will not postpone the other installations. You do
not have to supervise the installation after you click Install. Check the logs later
on to see the installation results.

Installing from a Client Disk Image

Disk imaging technology allows you to create an image of an OfficeScan client using
disk imaging software and make clones of it to other computers on your network.
Each client installation needs a Globally Unique Identifier (GUID) so that the server
can identify your clients individually. Use an OfficeScan program called ImgSetup.exe to
create a different GUID for each of the clones.

Note: This installation method cannot be used on computers running Windows Vista, 2008,
and 64-bit platforms.

To create a disk image of an OfficeScan client:

1. Install the OfficeScan client to a computer. You will use this client as the source of
the disk image.
2. Copy ImgSetup.exe from the OfficeScan server’s \PCCSRV\Admin\
Utility\ImgSetup folder to this computer.
3. Run ImgSetup.exe on this computer. This creates a RUN registry key under
HKEY_LOCAL_MACHINE.
4. Create a disk image of the OfficeScan client using your disk imaging software.
5. Restart the clone. ImgSetup.exe will automatically start and create one new GUID
value. The client will report this new GUID to the server and the server will create a
new record for the new client.

4-14
 Installing and Upgrading the OfficeScan Client

WARNING! To avoid having two computers with the same name in the OfficeScan
database, remember to manually change the computer name or domain
name of the cloned OfficeScan client.

Installing with Vulnerability Scanner

Use Vulnerability Scanner to detect installed antivirus solutions, search for unprotected
computers on your network, and install OfficeScan client to them. To determine if
computers need protection, Vulnerability Scanner pings ports that antivirus solutions
normally use.
This section explains how to install the OfficeScan client program with Vulnerability
Scanner. For instructions on how to use Vulnerability Scanner to detect antivirus
solutions, see the Administrative Tools section of the Administrator’s Guide and the
OfficeScan server online help.

Note: This installation method cannot be used on computers running Windows XP Home,
and Windows Vista Home Basic and Home Premium Editions (32-bit and 64-bit
versions).

You cannot install OfficeScan clients with Vulnerability Scanner to a computer with
the OfficeScan server installed.

To install OfficeScan client with Vulnerability Scanner:

1. If the computer does not run Windows Vista, skip this step. If running Windows
Vista Business, Enterprise, or Ultimate Edition, perform the following steps:
a. Enable a built-in administrator account and set the password for the account.
b. Disable the Windows firewall.
i. Click Start > Programs > Administrative Tools > Windows Firewall
with Advanced Security.
ii. For Domain Profile, Private Profile, and Public Profile, set the firewall
state to "Off".

4-15
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

c. Open the Microsoft Management Console (click Start > Run and type
services.msc) and start the Remote Registry service. When installing the
OfficeScan client, use the built-in administrator account and password.
2. In the computer where you installed OfficeScan server, open
\OfficeScan\PCCSRV\Admin\Utility\TMVS. Double-click TMVS.exe. The Trend
Micro Vulnerability Scanner console appears.
3. Click Settings.
4. Under OfficeScan server settings, type the OfficeScan server name and port
number.
5. Select Auto-Install OfficeScan client on unprotected computers.
6. Click OK to begin checking the computers on your network and begin OfficeScan
client installation.

Upgrading the OfficeScan Client

You can upgrade to a full version of OfficeScan from a previous version or from an
evaluation version. When you upgrade the OfficeScan server, clients automatically
upgrade when you perform client installation with any of the installation methods
available (see Installation Methods on page 3-8 for information on installation methods).
You can also use the Client Mover tool. See the Administrator’s Guide and OfficeScan
server online help for details.

Migrating from Third-party Antivirus

Applications
Migrating from third-party antivirus software to OfficeScan is a two-step process: the
installation of the OfficeScan server, followed by the automatic migration of the clients.

Note: If using Client Mover to move an un-upgraded OfficeScan client to a server already
upgraded to this version, the client upgrades automatically. For more information on
Client Mover, see the Administrator’s Guide and the OfficeScan server online help.

4-16
 Installing and Upgrading the OfficeScan Client

Automatic Client Migration

Automatic client migration refers to replacing existing client antivirus software with the
OfficeScan client. The client Setup program automatically uninstalls the existing
software and replaces it with the OfficeScan client.

Note: OfficeScan only uninstalls clients, not servers.

To check the applications that OfficeScan automatically uninstalls, open the following
files in \Trend Micro\OfficeScan\PCCSRV\Admin: tmuninst.ptn, tmuninst_as.ptn.
Client migration issues:
• If automatic client migration is successful but a user encounters problems with the
OfficeScan client right after installation, restart the computer.
• If the client Setup program prompts you that it cannot automatically uninstall an
existing client antivirus software on a user’s computer, perform the following tasks:
• Manually uninstall the existing client antivirus software. Depending on the
uninstallation process of the software, the computer may or may not need to
restart after uninstallation.
• Install the OfficeScan client using any of the installation methods discussed in
Performing Fresh Installation on page 4-1.
• If the client Setup program proceeded to install the OfficeScan client but did not
uninstall any existing client antivirus software, there may be conflicts between the
two client software installed on the same computer. In this case, uninstall both
software, and then install the OfficeScan client using any of the installation methods
discussed in Performing Fresh Installation on page 4-1.

Migrating from ServerProtect Normal Servers

The ServerProtect Normal Server Migration Tool is a Windows-based tool that helps
migrate computers running ServerProtect Normal Server to OfficeScan client.

4-17
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

System Requirements
The ServerProtect Normal Server Migration Tool shares the same hardware and
software specification as the OfficeScan server. Run the tool on Windows
2000/XP/Vista/Server 2003 computers.
When uninstallation of the ServerProtect Normal server is successful, it installs the
OfficeScan client. However, it does not preserve and migrate the ServerProtect Normal
server's settings to OfficeScan client settings.

Installing Server Protect Normal Server Migration Tool

On the OfficeScan server computer, open \OfficeScan\PCCSRV\
Admin\Utility\SPNSXfr and copy the files SPNSXfr.exe and SPNSX.ini to
\PCCSRV\Admin.
Use the local/domain administrator account to access the client computer. If you log on
the remote computers with insufficient privileges, such as "Guest" or "Normal user",
you will not be able to perform installation.
To use the Server Protect Normal Server Migration Tool:
1. Double click the SPNSXfr.exe file to open the tool. The Server Protect Normal
Server Migration Tool console opens.
2. Select the OfficeScan server. The path of the OfficeScan server appears under
OfficeScan server path. If it is incorrect, click Browse and select the PCCSRV
folder in the directory where you installed OfficeScan.
To enable the tool to automatically find the OfficeScan server again the next time
you open the tool, select the Auto find OfficeScan server check box (selected by
default).
3. Select the computers running ServerProtect Normal Server on which to perform
the migration by clicking one of the following under Target computer:
• Windows network tree: Displays a tree of domains on your network. To select
computers by this method, click the domains on which to search for client
computers.
• Information Server name: Search by Information Server name. To select
computers by this method, type the name of an Information Server on your
network in the text box. To search for multiple Information Servers, enter a
semicolon ";" between server names.

4-18
 Installing and Upgrading the OfficeScan Client

• Certain Normal Server name: Search by Normal Server name. To select

computers by this method, type the name of a Normal Server on your network
in the text box. To search for multiple Normal Servers, enter a semicolon ";"
between server names.
• IP range search: Search by a range of IP addresses. To select computers by
this method, type a range of class B IP addresses under IP range.

Note: If a DNS server on your network does not respond when searching for clients,
the search will hang. Wait for the search to time out.

4. Select to include computers running Windows Server 2003 in the search.

5. Select to restart computers running Windows Server 2003. For the migration to
complete successfully on Windows 2003 computers, the computer must reboot.
Selecting this check box ensures that it automatically reboots. If you do not select
the Restart Windows Server 2003 computers check box, you must restart the
computer manually after migration.
6. Click Search. The search results appear under ServerProtect Normal Servers.
7. Click the computers on which to perform the migration:
• To select all computers, click Select All.
• To deselect all computers, click Unselect All.
• To export the list as a .CSV file, click Export to CSV.
If logging on the target computers requires a user name and password, do the
following:
a. Select the Use group account/password check box.
b. Click Set User Logon Account. The Enter Administration Information
window appears.
c. Type the user name and password.
d. Click Ok.
e. Click Ask again if logon is unsuccessful to be able to type the user name
and password again during the migration process if you are unable to log on.

4-19
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

8. Click Migrate.

Note: The ServerProtect Normal Server Migration Tool does not uninstall the Control
Manager agent for ServerProtect. For instructions on how to uninstall the agent, refer
to your ServerProtect and/or Control Manager documentation.

While installing the OfficeScan client, the migration tool client installer may time out
and the result may be shown as failed. However, the client may have been installed
successfully. Verify the installation on the client computer from the OfficeScan Web
console.

Migration fails under the following circumstances:

- If the remote client cannot use the NetBIOS protocol, or ports 455,337~339 are
blocked
- If the remote client cannot use the RPC protocol
- If the Remote Registry Service stops

Post-installation Tasks
Trend Micro recommends performing the following post-installation tasks:
• Verifying the Client Installation, Upgrade, or Migration on page 4-20
• Initiating Component Update on page 4-23
• Testing OfficeScan Using the EICAR Test Script on page 4-23

Verifying the Client Installation, Upgrade, or Migration

After completing the installation or upgrade, verify the following:
• The Trend Micro OfficeScan Client shortcuts on the Windows Start menu of the
client computer
• If "Trend Micro OfficeScan Client" is in the Add/Remove Programs list of the
client computer’s Control Panel

4-20
 Installing and Upgrading the OfficeScan Client

• OfficeScan client services included in Windows services:

• OfficeScan NT Listener
• OfficeScan NT Firewall (if firewall was enabled during installation)
• OfficeScan NT Proxy Service
• OfficeScanNT RealTime Scan
• Installation log: OFCNT.LOG in the following locations:
• %windir% for all installation methods except MSI package
• %temp% for the MSI package installation method
• Installation status using Vulnerability Scanner (see the next section)

Using Vulnerability Scanner to verify the client installation

You can also automate Vulnerability Scanner by creating scheduled tasks. For
information on how to automate Vulnerability Scanner, see the OfficeScan online help.

Note: You cannot use Vulnerability Scanner on computers running Windows XP

Home, and Windows Vista Home Basic and Home Premium Editions (32-bit
and 64-bit versions).

To verify client installation using Vulnerability Scanner:

1. On the OfficeScan server computer, open \OfficeScan\PCCSRV \Admin\Utility\
TMVS. Double-click TMVS.exe. The Trend Micro Vulnerability Scanner console
appears.
2. Click Settings.
3. Under Product query, select the OfficeScan Corporate Edition/Security Server
check box and specify the port that the server uses to communicate with clients.
4. Select whether to use Normal or Quick retrieval. Normal retrieval is more accurate,
but it takes longer to complete.
If you click Normal retrieval, you can set Vulnerability Scanner to try to retrieve
computer descriptions, if available, by selecting Retrieve computer descriptions
when available.
5. To automatically send the results to yourself or to other administrators in your
organization, select Email results to the system administrator. Then, click
Configure to specify your email settings.

4-21
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

• In To, type the email address of the recipient.

• In From, type your email address. This will let the recipients know who sent
the message.
• In SMTP server, type the address of your SMTP server. For example, type
smtp.company.com. This is a required information.
• In Subject, type a new subject for the message or accept the default subject.
6. Click OK to save your settings.
7. To display an alert on unprotected computers, click the Display notification on
unprotected computers. Then, click Customize to set the alert message. The
Alert Message screen appears. Type a new alert message in the text box or accept the
default message, and then click OK.
8. To save the results as a comma-separated value (CSV) data file, select
Automatically save the results to a CSV file. By default, Vulnerability Scanner
saves CSV data files to the TMVS folder. If you want to change the default CSV
folder, click Browse, select a target folder on your computer or on the network, and
then click OK.
9. Under Ping settings, specify how Vulnerability Scanner will send packets to the
computers and wait for replies. Accept the default settings or type new values in the
Packet size and Timeout fields.
10. Click OK. The Vulnerability Scanner console appears.
11. To run a manual vulnerability scan on a range of IP addresses, do the following:

Note: Vulnerability Scanner only supports a class B subnet IP address range.

a. In Manual Scan, type the IP address range of computers that you want to
check for installed antivirus solutions.
b. Click Start to begin checking the computers on your network.
12. To run a manual vulnerability scan on computers requesting IP addresses from a
DHCP server, do the following:
a. Click the DHCP Scan tab in the Results box. The Start button appears.
b. Click Start. Vulnerability scanner begins listening for DHCP requests and
performing vulnerability checks on computers as they log on to the network.

4-22
 Installing and Upgrading the OfficeScan Client

Vulnerability Scanner checks your network and displays the results in the Results table.
Verify that all desktop and notebook computers have the client installed.
If Vulnerability Scanner finds any unprotected desktop and notebook computers, install
the client on them using your preferred client installation method.

Initiating Component Update

Notify your clients to update their components to ensure that they have the most
up-to-date protection from security risks.

Note: This section shows you how to initiate manual update. For information on automatic
update and update configurations, see the OfficeScan server online help.

To deploy the components to the clients:

1. Open the OfficeScan Web console.
2. Click Updates > Networked Computers > Manual Update on the main menu.
The Manual Deployment screen appears showing a summary of components,
versions, and the last update period.
3. Select the target clients. You can update clients with outdated components or
manually select clients.
• Select clients with outdated components: Optionally include roaming
clients with functional connections to the server, and then click Initiate
Update.
• Manually select clients: After selecting this option, click Select to choose
specific clients from the client tree. Select the clients you want to update and
then click Initiate Component Update on top of the client tree.
The server starts notifying each client to download updated components.

Testing OfficeScan Using the EICAR Test Script

Trend Micro recommends testing OfficeScan and confirming that it works by using the
EICAR test script. EICAR, the European Institute for Computer Antivirus Research,
developed the test script as a safe way to confirm proper installation and configuration
of antivirus software. Visit the EICAR Web site for more information:
http://www.eicar.org

4-23
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

The EICAR test script is an inert text file with a .com extension. It is not a virus and
does not contain any fragments of viral code, but most antivirus software react to it as if
it were a virus. Use it to simulate a virus incident and confirm that email notifications
and virus logs work properly.

WARNING! Never use real viruses to test your antivirus product.

To test OfficeScan using the EICAR test script:

1. Enable Real-time Scan on the client.
2. Copy the following string and paste it into Notepad or any plain text editor:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-
FILE!$H+H*
3. Save the file as EICAR.com to a temp directory. OfficeScan immediately detects the
file.
4. To test other computers on your network, attach the EICAR.com file to an email
message and send it to one of the computers.

Note: Trend Micro also recommends testing a zipped version of the EICAR file. Using
compression software, zip the test script and perform the steps above.

Uninstalling the Client

There are two ways to uninstall the OfficeScan program from the clients:
• Uninstalling from the Web Console on page 4-25
• Running the Client Uninstallation Program on page 4-25

Note: If the client also has a Cisco Trust Agent (CTA) installation, uninstalling the
OfficeScan client program may or may not remove the CTA. This depends on the
settings you configured for the client for Cisco Agent Deployment (see the
Administrator’s Guide and the OfficeScan online help for more information).

4-24
 Installing and Upgrading the OfficeScan Client

Uninstalling from the Web Console

You can uninstall the client program from computers on the network using the Web
console. Note that uninstalling the client program also removes security risk protection
on selected clients.
To uninstall the client from the Web console:
1. On the OfficeScan Web console main menu, click Networked Computers >
Client Management. The client tree displays.
2. In the client tree, select the clients to uninstall the OfficeScan client, and then click
Tasks > Client Uninstallation.
3. In the Client Uninstallation screen, click Initiate Uninstallation. The server sends
a notification to the clients.
4. Check the notification status and verify if there are clients that did not receive the
notification.
a. Click Select Un-notified Computers and then Initiate Uninstallation to
immediately resend the notification to un-notified clients.
b. Click Stop Uninstallation to prompt OfficeScan to stop notifying clients
currently being notified. Clients already notified and already performing
uninstallation will ignore this command.

Running the Client Uninstallation Program

If you granted users the privilege to uninstall the client program, instruct them to run
the client uninstallation program from their computers. For more information, see the
Administrator’s Guide and the OfficeScan server online help.
To run the client uninstallation program:
1. On the Windows Start menu, click Programs > Trend Micro OfficeScan Client
> Uninstall OfficeScan Client. The OfficeScan Client Uninstallation screen
appears and prompts for the uninstallation password.
2. Type the uninstallation password, and then click OK. OfficeScan will notify the user
of the uninstallation progress and completion.
The user does not need to restart the client computer to complete the uninstallation.

4-25
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

4-26
 Chapter 5

FAQs and Troubleshooting

Topics in this chapter:
• Frequently Asked Questions (FAQs) on page 5-1
• Troubleshooting Resources on page 5-2
• Troubleshooting Installation Issues on page 5-6

Frequently Asked Questions (FAQs)

I have several questions about OfficeScan registration. Where can I find the
answers?
See the following Web site for frequently asked questions about registration:
http://kb.trendmicro.com/solutions/search/main/search/solutionDetail.asp?solutionI
D=16326
Which OfficeScan versions can upgrade to the current version?
This version of OfficeScan supports upgrade from any of the following versions: 7.3,
7.0, 6.5, and 5.58.
Which operating systems are no longer supported in this version?
This version of OfficeScan no longer supports Windows 95, 98, Me, NT and IA64
architecture.

5-1
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Can I upgrade the OfficeScan client from version 7.3 with patch to 8.0 from
Terminal Service 2000?
No. OfficeScan 7.3 does not support Terminal Service.
Can OfficeScan work in a network environment that utilizes Network Address
Translation?
Yes. You must enable Scheduled Deployment in a NAT environment to ensure your
clients can receive updated components. See the Administrator’s Guide and for more
information.
Can I manually uninstall the OfficeScan server and client?
Yes. However, Trend Micro recommends using the uninstallation program to uninstall
the OfficeScan server and client. For the procedure, see Performing Server
Uninstallation and Rollback on page 2-22 and Uninstalling the Client on page 4-24.
Perform manual uninstallation only if you encounter problems with the uninstallation
program. For the procedure, see Server Uninstallation on page 5-12 and Solution:
Manually uninstall the client. on page 5-10.
What do I need to do if I do not want to use the OfficeScan firewall?
During OfficeScan server installation, do not select Enable firewall in the Antivirus
Features screen.
If you enabled the OfficeScan firewall during installation, you can disable it from the
Web console by doing the following:
1. Go to Administration > Product License > Additional Services.
2. In Firewall for networked computers, click Disable.
3. Log off from the Web console and then log on again.

Troubleshooting Resources
Case Diagnostic Tool
Trend Micro Case Diagnostic Tool (CDT) collects necessary debugging information
from a customer’s product whenever problems occur. It automatically turns the
product's debug status on and off and collects necessary files according to problem

5-2
 FAQs and Troubleshooting

categories. Trend Micro uses this information to troubleshoot problems related to the
product.
To obtain this tool and relevant documentation, contact your Support provider.

Installation Logs
Use the installation log files OfficeScan automatically generates to troubleshoot
installation problems.

TABLE 5-1. Installation log files

L OG F ILE F ILE N AME L OCATION

Server local installa- OFCMAS.LOG %windir%

tion/upgrade log

Server remote instal- OFCMAS.LOG (On the %windir%

lation/upgrade log computer where you
launched Setup)
OFCMAS.LOG (On the tar-
get computer)

Client installation log OFCNT.LOG %windir% (For all installation

methods except MSI pack-
age)
%temp% (For the MSI pack-
age installation method)

5-3
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Server Debug Logs

You can enable debug logging before performing the following server tasks:
• Uninstall and then install the server again.
• Upgrade OfficeScan 8.0 to a new version.
• Perform remote installation/upgrade (Debug logging is enabled on the computer
where you launched Setup and not on the remote computer.).

WARNING! Debug logs may affect server performance and consume a large amount
of disk space. Enable debug logging only when necessary and promptly
disable it if you no longer need debug data. Remove the log file if the file
size becomes huge.

To enable debug logging on the OfficeScan server computer:

1. Copy the "LogServer" folder located in \PCCSRV\Private to C:\.
2. Create a file named ofcdebug.ini with the following content:
[debug]
DebugLevel=9
DebugLog=C:\LogServer\ofcdebug.log
3. Save ofcdebug.ini to C:\LogServer.
4. Perform the appropriate task (that is, uninstall/reinstall the server, upgrade to a new
server version, or perform remote installation/upgrade).
5. Check ofcdebug.log in C:\LogServer.

5-4
 FAQs and Troubleshooting

Client Debug Logs

You can also enable debug logging before installing the OfficeScan client.

WARNING! Debug logs may affect client performance and consume a large amount of
disk space. Enable debug logging only when necessary and promptly dis-
able it if you no longer need debug data. Remove the log file if the file size
becomes huge.

To enable debug logging on the OfficeScan client computer:

1. Create a file named ofcdebug.ini with the following content:
[Debug]
Debuglog=C:\ofcdebug.log
debuglevel=9
debugLevel_new=D
debugSplitSize=10485760
debugSplitPeriod=12
debugRemoveAfterSplit=1
2. Send ofcdebug.ini to client users, instructing them to save the file to C:\.
3. LogServer.exe automatically runs each time the client computer starts. Instruct users
NOT to close the LogServer.exe command window that opens when the computer
starts as this prompts OfficeScan to stop debug logging. If users close the command
window, they can start debug logging again by running LogServer.exe located in
\OfficeScan Client.
4. For each client computer, you can check ofcdebug.log in C:\.
5. To disable debug logging for the OfficeScan client, delete ofcdebug.ini.

Knowledge Base
Some solutions in this section direct you to the Trend Micro Knowledge Base. Please
make sure you have Internet connection to open the Knowledge Base.

5-5
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Troubleshooting Installation Issues

• Client Installation on page 5-6
• Migration from Third-party Antivirus Software on page 5-8
• Client Uninstallation on page 5-10
• Server Uninstallation on page 5-12
• Apache Web Server on page 5-13

Client Installation
PROBLEM 1:
The OfficeScan client does not install on computers running Windows XP.
Solution:
Disable Simple File Sharing on computers running Windows XP (see your Windows
documentation for instructions).
PROBLEM 2:
After installing Windows 2003 Service Pack 1, the client tree in the Web console’s
Remote Installation screen (Networked Computers > Client Installation > Remote)
does not display the domains and client computers.
Solution:
Option 1: Change the anonymous user account in the Internet Information Services
(IIS) Manager
1. Open the IIS console by clicking Start > Programs > Administrative Tools >
Internet Services Manager.
2. Click the OfficeScan virtual directory, select officescan > console >
remoteinstallcgi, and double-click cgiRemoteInstall.exe.
3. In the File Security tab, then click Edit > Browse > Advanced > Find Now.
4. Select Administrator (if any), then click OK.
5. Double-click cgiGetNTDomain.exe. Repeat steps 3 and 4.
6. Double-click cgiGetNTClient.exe. Repeat steps 3 and 4.
Option 2: Install OfficeScan using any of the following installation methods:
• Login Script Setup. See Installing with Login Script Setup on page 4-3.

5-6
 FAQs and Troubleshooting

• Web Installation. See Installing from the Web Install Page on page 4-2.
• Client Packager. See Installing with Client Packager on page 4-5.
PROBLEM 3:
Some client computers do not appear in the Remote Installation screen (Networked
Computers > Client Installation > Remote) even when they are online. The client
computers and the server computer are on the same subnet and can communicate with
each other (verified using ping).
Explanation:
The computers are not visible on the network.
Solution:
Make the computers visible on the network by enabling File and Print Sharing for
Microsoft Networks in Network Connection.
PROBLEM 4:
The Web install page containing the link for the OfficeScan client installation does not
display.
Explanation:
The settings in the Internet options may have been configured incorrectly.
Solution:
Perform the following steps on the target computers:
1. If the user can download the client Setup files but cannot install the OfficeScan
client, verify the following:
• The user has Administrator rights on the computer.
• The target computer meets the minimum system requirements for OfficeScan
client installation.
• The computer runs a supported Windows operating system.
2. Open Internet Explorer and click Tools > Internet Options.
3. Click the Connections tab and select LAN Settings.
4. Disable Bypass proxy server for local addresses.
5. Click OK to save the changes.
6. Install the OfficeScan client again from the Web install page.

5-7
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

PROBLEM 5:
When using the Login Script Setup to install the OfficeScan client, the following error
message appears:
"Error – Failed to logon. Please make sure the selected server {Server Name} is a
Windows server, and enter the correct user name and password."
Solution:
Use an account with Domain Administrator privileges when installing the OfficeScan
client.
PROBLEM 6:
If you install the Check Point SecureClient Support tool in OfficeScan 7.3 with patch 2
and you upgrade to this version, there will be issues with the tool after the upgrade.
Solutions:
• Use Client Packager to deploy Check Point SecureClient Support.
• Install the tool from the OfficeScan client console.

Migration from Third-party Antivirus Software

PROBLEM 1:
The OfficeScan client Setup program is unable to automatically uninstall third-party
antivirus software installed on the client computer.
Explanation:
The Setup program for the OfficeScan client utilizes the third-party software’s
uninstallation program to automatically remove it from the client computer and replace
it with the OfficeScan client. Automatic uninstallation fails for the following reasons:
• The third-party software’s version number or product key is inconsistent.
• The third-party software’s uninstallation program does not work.
• Certain files for the third-party software are either missing or corrupted.
• Setup cannot clean the registry key for the third-party software.
• The third-party software has no uninstallation program.
Solutions:
• Manually remove the third-party software.

5-8
 FAQs and Troubleshooting

• Stop the service for the third-party software.

• Unload the service or process for the third-party software.
To manually remove the third-party software:
• If the third-party software registers to the Add/Remove Programs
a. Open the Control Panel.
b. Double-click Add/Remove Programs.
c. Select the third-party software from the list of installed programs.
d. Click Remove.
• If the third-party software does not register to the Add/Remove Programs
a. Open the Windows registry.
b. Go to HKEY_LOCAL_MACHINES\Software\Microsoft\Windows\
CurrentVersion\Uninstall.
c. Locate the third-party software and run the uninstall string value.
d. If the third-party software’s Setup program is in MSI format:
• Locate the product number
• Verify the product number
• Run the uninstall string

Note: Some product uninstallation keys are in the Product Key folder.

To modify the service for the third-party software:

1. Restart the computer in Safe mode.
2. Modify the service startup from automatic to manual.
3. Restart the system again.
4. Manually remove the third-party software.

5-9
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

To unload the service or process for the third-party software:

WARNING! This procedure may cause undesirable effects to your computer if per-
formed incorrectly. Trend Micro highly recommends backing up your
system first.

1. Unload the service for the third-party software.

2. Open the Windows registry, then locate and delete the product key.
3. Locate and delete the run or run service key.
Verify that the service registry key in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services has been
removed.

Client Uninstallation
PROBLEM 1:
The client does not uninstall using the client uninstallation program.
Solution: Manually uninstall the client.

WARNING! This procedure requires you to delete registry keys. Before doing so,
make sure you understand how to restore it if a problem occurs. Making
incorrect changes to your registry can cause serious system problems.
Always make a backup copy before making any registry changes. For
more information, refer to the Registry Editor Help.

To manually uninstall the OfficeScan client:

1. Stop the following services:
• OfficeScan NT Firewall (if enabled)
• OfficeScan NT Listener
• OfficeScan NT Proxy Service
• OfficeScanNT RealTime Scan
2. Open Registry Editor. On the Start menu, click Start > Run and type regedit.
3. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and
delete the following keys (if available):

5-10
 FAQs and Troubleshooting

• ntrtscan
• tmcfw
• tmcomm
• TmFilter
• tmlisten
• TmPfw
• TmPreFilter
• TmProxy
• tmtdi
4. Go to HKEY_LOCAL_MACHINE \SOFTWARE\TrendMicro and delete the
following keys (if available):

Note: For 64-bit clients, look for HKEY_LOCAL_MACHINE \SOFTWARE

\Wow6432Node\TrendMicro.

• CFW
• NSC
• OfcWatchDog
• Pc-cillinNTCorp or OfficeScanCorp (depending on the client)
5. Go to HKEY_LOCAL_MACHINE \SOFTWARE
\Microsoft\Windows\CurrentVersion\Run and delete the key OfficeScanNT
Monitor.
6. Delete the OfficeScan client shortcut from the Windows Start menu.
7. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current
Version\Uninstall and delete the OfficeScanNT key.
8. If the OfficeScan firewall is enabled, open Control Panel and select Network
Connections > Local Area Connection. Click Properties and then uninstall
Trend Micro Common Firewall Driver.
9. Restart the computer.
10. Delete the directories that contain the OfficeScan client program files.

5-11
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

PROBLEM 2:
OfficeScan client cannot be uninstalled using the "per-user" uninstallation method on
Microsoft SMS and Active Directory’s Group Policy Object.
Explanation:
The OfficeScan client needs to check the uninstallation password. For the "per-system"
uninstallation from Microsoft SMS and Active Directory, OfficeScan skips password
checking by account name (SYSTEM and SMSCliToknAcct&). However, for the
"per-user" uninstallation, OfficeScan cannot skip password checking if the privilege
"Allow the user to uninstall the OfficeScan client" is not set.
Solutions:
• Use "per-system" installation and uninstallation to finish the deployment.
• In the Web console, enable the privilege "Allow the user to uninstall the OfficeScan
client".

Server Uninstallation
PROBLEM 1:
The server does not uninstall using the server uninstallation program.
Solution:
Manually uninstall the server.

WARNING! This procedure requires you to delete registry keys. Before doing so,
make sure you understand how to restore it if a problem occurs. Making
incorrect changes to your registry can cause serious system problems.
Always make a backup copy before making any registry changes. For
more information, refer to the Registry Editor Help.

5-12
 FAQs and Troubleshooting

To manually uninstall the OfficeScan server:

1. Stop the OfficeScan Master Service from the Windows Services screen.
2. Delete the OfficeScan program shortcut from the Start menu.
3. Delete the files in the \Trend Micro\OfficeScan directory. This deletes the
DBBackup and PCCSRV folders.
4. Delete the IIS Virtual Directories.
a. Open the Internet Information Services console. You can open the console
from the Windows Start menu (Start > Programs > Administrative Tools >
Internet Services Manager).
b. Search and delete the OfficeScan folder.
5. Delete the OfficeScan registry keys.
a. Open Registry Editor. On the Start menu, click Start > Run and type regedit.
b. Go to HKEY_LOCAL_MACHINE\Software\TrendMicro and delete the
OfficeScan key.
c. Go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVe
rsion Uninstall\ and delete the OfficeScan Management Console key.
d. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
and delete the ofcservice key.

Apache Web Server

Policy Server and Plug-in Manager handle some of the Web requests using Internet
Server Application Programming Interface (ISAPI). ISAPI is not compatible with
Apache Web server versions 2.0.56 to 2.0.59 and versions 2.2.3 to 2.2.4.
You can restore an unsupported Apache Web server version. For example, you can
restore version 2.0.59 to version 2.0.54.
To restore Apache Web server version 2.0.59 to 2.0.54:
1. Upgrade the OfficeScan server or Policy Server to this version.
2. Back up the following files on the Apache2 folder on the OfficeScan installation
folder:
• httpd.conf

5-13
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

• httpd.conf.tmbackup
• httpd.default.conf
3. Uninstall Apache 2.0.59 from the Add/Remove Programs screen.
4. Install Apache 2.0.54.
a. Launch apache.msi from \PCCSRV\Admin\Utility\Apache.
b. In the Server Information screen, enter the required information.
c. In the Destination Folder screen, change the destination folder by clicking
change and browsing to \PCCSRV.
d. Complete the installation.
5. Copy the backup files back to the Apache2 folder.
6. Restart the Apache service.

5-14
 Chapter 6

Contacting Trend Micro

Topics in this chapter:
• Technical Support on page 6-1
• The Trend Micro Knowledge Base on page 6-2
• TrendLabs on page 6-3
• Security Information Center on page 6-3
• Sending Suspicious Files to Trend Micro on page 6-4
• Documentation Feedback on page 6-4

Technical Support
Trend Micro provides technical support, pattern downloads, and program updates for
one year to all registered users, after which you must purchase renewal maintenance. If
you need help or just have a question, please feel free to contact us. We also welcome
your comments.
Trend Micro Incorporated provides worldwide support to all registered users.
• Get a list of the worldwide support offices at http://www.trendmicro.com/support.
• Get the latest Trend Micro product documentation at
http://www.trendmicro.com/download.

6-1
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

In the United States, you can reach the Trend Micro representatives through phone, fax,
or email:
Trend Micro, Inc.
10101 North De Anza Blvd., Cupertino, CA 95014
Toll free: +1 (800) 228-5651 (sales)
Voice: +1 (408) 257-1500 (main)
Fax: +1 (408) 257-2003
Web address: www.trendmicro.com
Email: [email protected]

Speeding Up Your Support Call

When you contact Trend Micro, to speed up your problem resolution, ensure that you
have the following details available:
• Microsoft Windows and Service Pack versions
• Network type
• Computer brand, model, and any additional hardware connected to your computer
• Amount of memory and free hard disk space on your computer
• Detailed description of the install environment
• Exact text of any error message given
• Steps to reproduce the problem

The Trend Micro Knowledge Base

The Trend Micro Knowledge Base, maintained at the Trend Micro Web site, has the
most up-to-date answers to product questions. You can also use Knowledge Base to
submit a question if you cannot find the answer in the product documentation. Access
the Knowledge Base at:
http://esupport.trendmicro.com
Trend Micro updates the contents of the Knowledge Base continuously and adds new
solutions daily. If you are unable to find an answer, however, you can describe the

6-2
 Contacting Trend Micro

problem in an email and send it directly to a Trend Micro support engineer who will
investigate the issue and respond as soon as possible.

TrendLabs
TrendLabsSM is the global antivirus research and support center of Trend Micro.
Located on three continents, TrendLabs has a staff of more than 250 researchers and
engineers who operate around the clock to provide you, and every Trend Micro
customer, with service and support.
You can rely on the following post-sales service:
• Regular virus pattern updates for all known "zoo" and "in-the-wild" computer
viruses and malicious codes
• Emergency virus outbreak support
• Email access to antivirus engineers
• Knowledge Base, the Trend Micro online database of technical support issues
TrendLabs has achieved ISO 9002 quality assurance certification.

Security Information Center

Comprehensive security information is available at the Trend Micro Web site:
http://www.trendmicro.com/vinfo/
Information available:
• List of viruses and malicious mobile code currently "in the wild," or active
• Computer virus hoaxes
• Internet threat advisories

6-3
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

• Virus weekly report

• Virus Encyclopedia, which includes a comprehensive list of names and symptoms
for known viruses and malicious mobile code
• Glossary of terms

Sending Suspicious Files to Trend Micro

If you think you have an infected file but the scan engine does not detect it or cannot
clean it, Trend Micro encourages you to send the suspect file to us. For more
information, refer to the following site:
http://subwiz.trendmicro.com/subwiz
You can also send Trend Micro the URL of any Web site you suspect of being a phish
site, or other so-called "disease vector" (the intentional source of Internet threats such as
spyware and viruses).
• Send an email to: [email protected], and specify "Phish or Disease
Vector" as the Subject.
• Use the Web-based submission form: http://subwiz.trendmicro.com/subwiz.

Documentation Feedback
Trend Micro always seeks to improve its documentation. If you have questions,
comments, or suggestions about this or any Trend Micro document, please go to the
following site:
http://www.trendmicro.com/download/documentation/rating.asp

6-4
 Appendix A

Sample Deployment
This section illustrates how best to deploy OfficeScan based on network topology and
available network resources. You can use this as a reference when planning OfficeScan
deployment in your organization.

Basic Network
Figure A-1 illustrates a basic network with the OfficeScan server and clients connected
directly. Most business networks have this configuration where the LAN (and /or WAN)
access speed is 10Mbps, 100Mbps or 1Gbps. In this scenario, a computer that meets the
OfficeScan system requirements and has adequate resources is a prime candidate for the
installation of the OfficeScan server.

A-1
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Access switch/hub

Client computers

Server

FIGURE A-1 Basic network topology

Multiple Site Network

For a network with multiple access points and multiple remote sites with different
bandwidths, analyze the consolidation points in terms of offices and network
bandwidth, and determine their current bandwidth utilization. This presents a clearer
picture as to how best to deploy OfficeScan.

A-2
 Sample Deployment

Figure A-2 illustrates a multiple site network topology.

Firewall Internet

Access
switch/hub
WAN
link Server 3
35 client comput-
REMOTE SITE 1

Servers 1 and
WAN
50 client comput- link

HEAD OFFICE
REMOTE SITE 2 9 client comput-

FIGURE A-2 Multiple site network topology

Network information:
• Remote Site 1 WAN link averages around 70 percent utilization during business hours.
There are 35 client computers on this site.
• Remote Site 2 WAN link averages around 40 percent utilization during business hours.
There are 9 client computers on this site.
• Server 3 only functions as a file and print server for the group at Remote Site 1. This
computer is a possible candidate for installing an OfficeScan server, but may not be
worth the extra management overhead. All servers run Windows 2000. The network
uses Active Directory, but mainly for network authentication.
• All client computers in Head Office, Remote Site 1, and Remote Site 2 run Windows
2000 or Windows XP.

A-3
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

Tasks:
1. Identify the computer where you will install the OfficeScan server. See Installing or
Upgrading the OfficeScan Server on page 2-2 for the installation procedure.
2. Identify the available installation methods and eliminate methods that do not fit the
requirement. See Installation Methods on page 3-8 for more information.
Possible installation methods:
Login Script Setup
Login Script Setup works well if there is no WAN in place because local traffic does
not matter. However, given that more than 50MB of data transmits to each computer,
this option is not viable.
Remote installation from the Web console
This method is valid for all the LAN-connected computers at the head office. Because
these computers all run Windows 2000, it is simple to deploy the package to the
computers.
Due to the low link speed between the two remote sites, this deployment method may
impact available bandwidth if OfficeScan deployment occurs during business hours.
You can use the whole link capacity to deploy OfficeScan during non-business hours
when most people are no longer at work. However, if users turn off their computers,
OfficeScan deployment to these computers will not be successful.
Client package deployment
Client package deployment seems to be the best option for remote site deployment.
However, at Remote Site 2, there is no local server to facilitate this option properly.
Looking at all options in-depth, this option provides the best coverage for most
computers.

A-4
 Sample Deployment

Head Office Deployment

The easiest client deployment method to implement at the head office is remote
installation from the OfficeScan Web console. See Installing from the OfficeScan Web
Console on page 4-12 for the procedure.

Remote Site 1 Deployment

Deployment to Remote Site 1 requires configuration of the Microsoft Distributed File
System (DFS). For more information about DFS, refer to
http://support.microsoft.com/?kbid=241452. After configuring DFS, Server 3 at
Remote Site 1 needs to enable DFS, replicating the existing DFS environment or
creating a new one.
A suitable deployment method is the creation of a client package in Microsoft Installer
Package (MSI) format and the deployment of the client package to the DFS share. See
Installing with Client Packager on page 4-5 for the procedure. Since the package will be
replicated to Server 3 during the next scheduled update, client package deployment has
minimal bandwidth impact.
You can also use a new Active Directory (AD) Policy. See Deploying an MSI package
using Active Directory on page 4-9 for more information.
To minimize the impact of component updates across the WAN:
• Designate a client to act as an Update Agent for Remote Site 1. To do this, open the
Web console and go to Networked Computers > Client Management. In the
client tree, select the client that will act as the Update Agent and click Settings >
Update Agent Settings.
• After designating an Update Agent, select the clients in Remote Site 1 that will update
components from the Update Agent. To do this, go to Updates > Networked
Computers > Update Source. Select Customized Update Source and click Add.
In the screen that displays, enter the IP address range of the client computers in
Remote Site 1, select the Update source button, and then select the designated
Update Agent from the dropdown list.

Remote Site 2 Deployment

The key issue in Remote Site 2 is low bandwidth. However, 60 percent of the bandwidth
is free during business hours. During business hours when there is 40 percent utilization,
there is approximately 154 Kbits of available bandwidth available.

A-5
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

The best way to install the OfficeScan client is to use the same client package in MSI
format used at Remote Site 1. However, since there is no available server, you cannot
use a Distributed File System (DFS). You can configure a computer running Windows
2000 or XP as a DFS host but this is outside the scope of this document. You need to
explore other options.
One option is to use third-party management tools that will allow administrators to
configure or create shares on remote computers without having physical access to them.
After creating this share on a single computer, copying the client package to the share
requires less overhead than installing the client to nine computers.
You can use another Active Directory policy, but again, not specifying the DFS share as
the source.
These methods keep the installation traffic local to the network, minimizing the traffic
hit across the WAN.
To minimize the impact of component updates across the WAN, you can also designate
a client to act as Update Agent. See the procedure in Remote Site 1 for more
information.

A-6
 Index

Index
A F
activation 2-9 FAQs 5-1
Activation Code 1-4 full version 1-3
Active Directory 4-9, A-5
Apache Web server 1-12, 5-13 I
assessment mode 2-12 installation
computer restart 1-11
C Policy Server 2-13
Case Diagnostic Tool 5-2 post-installation tasks 2-16
Cisco NAC 2-10 prescan 2-7
Cisco Trust Agent 2-10 remote 1-5
client debug logs 5-5 required information 1-10
client disk image 3-9, 4-14 screens and tasks 2-7
client installation silent 2-14
from the Web console 4-12 system requirements 1-1, 3-2
from the Web install page 4-2 verification 2-16
using client disk image 4-14 installation considerations
using Client Packager 4-5 dedicated server 1-6
using Login Setup Script 4-3 firewall 1-5
using Vulnerability Scanner 4-15 network traffic 1-8
client installation path 1-9–1-10, 2-12 number of clients 1-7
Client Mover for Legacy Platforms 2-18 number of domains 1-7
Client Packager 3-9, 4-5, A-4 program file placement 1-9
compatibility issues 1-13 remote installation 1-5
components 2-17, 4-23 server location 1-5
Control Manager 1-9, 2-21 server performance 1-6
third party applications 1-9
D unsupported client platforms 1-6
debug logs installation issues 5-6
client 5-5 client installation 5-6
server 5-4 client uninstallation 5-10
default settings migration from third-party software 5-8
client privileges 2-18 server uninstallation 5-12
global client settings 2-18 installation logs 5-3
scan settings 2-17 installation path
Distributed File System (DFS) A-5 client 2-12
documentation feedback 6-4 server 2-8
installation requirements
E client 3-2
EICAR test virus 4-23 server 1-1
evaluation version 1-4, 2-15 Internet Connection Firewall 1-14

IN–1
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

K uninstallation 4-24
Knowledge Base 5-5, 6-2 OfficeScan server
debug logs 5-4
L default settings 2-17
listening port 1-10 fresh installation 2-2
Login Script Setup 3-9, 4-3, A-4 manage using Control Manager 1-9
register to Control Manager 2-21
M system requirements 1-1
Microsoft Exchange Server 1-14 upgrade 2-2
Microsoft SMS 4-9
migration P
automatic client migration 4-17 pilot deployment 1-12
from ServerProtect Normal Servers 4-17 evaluation 1-13
from third party applications 4-16 pilot site 1-12
troubleshooting 5-8 rollback plan 1-12
MSI package deployment A-5 Plug-in Manager 2-21
Active Directory 4-9 Policy Server 2-13
Microsoft SMS 4-9 proxy server 1-10, 2-8

N R
network traffic registration 2-9
assigning Update Agents 1-9 Registration Key 1-4
during component updates 1-8 remote installation 1-5, A-4
response file
O silent installation 2-14
OfficeScan restore program settings 2-22
assessment mode 2-12
component update 4-23 S
components 2-17 sample deployment A-1
deployment sample A-1 Scheduled Update Configuration Tool 4-8
domain 1-7 Security Information Center 6-3
firewall 2-12 server
fresh installation 2-2 debug logs 5-4
known compatibility issues 1-13 installation considerations 1-5
network traffic generated 1-8 specifications 1-6
Policy Server 2-13 ServerProtect 4-17
ports 1-10 silent installation 2-14
processes 2-16 suspicious files 6-4
programs 1-11 system requirements 1-1, 3-2
registration 2-9
services 2-16 T
upgrade 2-2 Technical Support 6-1
OfficeScan client third party antivirus applications 1-9
debug logs 5-5 TrendLabs 6-3
installation methods 3-8 trial version 1-4
system requirements 3-2 troubleshooting issues 5-6

IN–2
 Index

troubleshooting resources 5-2

U
uninstallation 4-24
unsupported client platforms 1-6, 2-18
Update Agent 1-9
requirements 3-8
upgrade
clients 4-16
from an evaluation version 2-15
verification 2-16

V
verification
client installation or upgrade 4-20
server installation or upgrade 2-16
Vulnerability Scanner 3-10, 4-15, 4-21

W
Web server 1-2, 2-8
Windows Vista
pre-installation tasks 4-2, 4-13, 4-15
World Virus Tracking 2-11

IN–3
Trend Micro™ OfficeScan™ 8.0 and 8.0 SP1 Installation and Deployment Guide

IN–4