Transcription

1

2 Trend Micro Incorporated reserves the right to make changes to this document and to the product/service described herein without notice. Before installing and using the product/service, review the readme files, release notes, and/or the latest version of the applicable documentation, which are available from the Trend Micro website at: Trend Micro, the Trend Micro t-ball logo, and Worry-Free are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners Trend Micro Incorporated. All Rights Reserved. Document Part No.: APEM36510/ Release Date: July 2014 Protected by U.S. Patent No.: Patents pending.

3 This documentation introduces the main features of the product/service and/or provides installation instructions for a production environment. Read through the documentation before installing or using the product/service. Detailed information about how to use specific features within the product/service may be available at the Trend Micro Online Help Center and/or the Trend Micro Knowledge Base. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at [email protected]. Evaluate this documentation on the following site:

4

5 Table of Contents Preface Preface... vii About Trend Micro... viii Audience... viii Document Conventions... viii Chapter 1: Introduction Trend Micro Remote Manager Features Integrated Platform Dashboard Widgets Customizable Settings for New Accounts Threat Status System Status License Status Network Management Reporting Integration with Third-Party Tools Feedback Submission Supported Products Worry-Free Business Security Suite Hosted Security Cloud Edge Third-Party Tools What's New Overall Infrastructure Key Terminology i

6 Trend Micro Remote Manager User's Guide Chapter 2: Getting Started Browser Requirements Adding the Trend Micro Remote Manager Web Console URL to Trusted Sites Using Internet Explorer 9 to Obtain the SSL Certificate Accessing the Platform Coordinating with the Customer Chapter 3: Understanding the Web Console The Web Console Banner Main Menu Understanding the Dashboard Dashboard Status Screens Tabs and Widgets Product/Service Information Chapter 4: Preparing the Infrastructure Infrastructure Installation Overview Worry-Free Business Security Standard and Advanced Hosted Security and Worry-Free Business Security Services ConnectWise Kaseya Autotask Adding Products Adding Customers Registering Trend Micro Products to Trend Micro Remote Manager Integrating Third-party Products with Trend Micro Remote Manager Chapter 5: Managing Customers Customers Adding New Customers ii

7 Table of Contents Associating Accounts Checking Product License Adding Products/Services Contacts Deleting Customers Filtering the Customer List Chapter 6: Managing Agents Managing Agents from the Remote Manager Web Console Checking the Connection Between the Agent and Server Agent Status Submitting Agent Commands Viewing Agent Details Managing Agents from the Managed Server Agent Status Messages Changing the Agent GUID on the Managed Server Using the Agent Configuration Tool Agent Configuration Backing Up and Restoring Agent Settings Backing Up Settings Restoring Settings Finding the Agent Build Number From the Remote Manager Web Console On the Agent Location of Agent Logs and Configuration Files Enabling the Agent Debug Log Removing Agents Removing Agents Locally Chapter 7: Managing Licenses Adding Seat Allocations Renewing Licenses iii

8 Trend Micro Remote Manager User's Guide Chapter 8: Managing Settings Configuring Notifications Configuring Console Settings Configuring Default Setting Templates Chapter 9: Managing Events Managing Events Viewing Events Event Types Outbreak Defense Status Detail Chapter 10: Reports Antivirus Status Detail Anti-Spyware Status Detail Anti-spam Status Detail Network Virus Status Detail Web Reputation Status Detail Behavior Monitoring Status Detail URL Filtering Status Detail Device Control Status Detail Smart Scan Component Update Disk Usage Reports Overview Creating Reports Creating Report Templates Viewing Reports Editing Reports Downloading and Sending Reports Subscribing to Reports iv

9 Table of Contents Chapter 11: Troubleshooting and Known Issues Troubleshooting the Trend Micro Remote Manager Web Console Access Issues Domain Tree not Visible after Installing the Agent Node on Tree Cannot Be Expanded Page Cannot be Displayed Incorrect Information on the Dashboard Unable to Deploy Commands Agent Status Is Abnormal Agent working abnormally using an existing GUID after Troubleshooting the Agent Agent Issues Unable to Connect to the Server Unable to Register with the Remote Server Connection Issues with Hosted Security Known Server Issues Inconsistent Status Icons Spam Data Inconsistent with Worry-Free Business Security Standard or Advanced Incorrect User Name on the Worry-Free Business Security Services Console Inconsistent License Info on the Worry-Free Business Security Services Console Simultaneous Sign In From Two Tabs/Windows of the Same Browser are Not Permitted Historical Reports are Automatically Deleted An Expired Worry-Free Business Security Services Account Cannot be Managed Broken ConnectWise Connection Known Agent Issues Reinstalled Agents Provide Overlapping Data Scan Command Results Cannot be Verified Agent Configuration Tool is Not Visible After Upgrading the Agent FAQs Web Console FAQs v

10 Trend Micro Remote Manager User's Guide Hosted Security FAQs Report FAQs Chapter 12: Getting Help Contacting Trend Micro Speeding Up the Support Call Using the Support Portal Threat Encyclopedia About Trend Micro TrendLabs vi

11 Preface Preface The Remote Manager User's Guide provides details on how to use the platform and perform basic tasks. Topics include: About Trend Micro on page viii Audience on page viii Document Conventions on page viii vii

12 Trend Micro Remote Manager User's Guide About Trend Micro As a global leader in cloud security, Trend Micro develops Internet content security and threat management solutions that make the world safe for businesses and consumers to exchange digital information. With over 20 years of experience, Trend Micro provides top-ranked client, server, and cloud-based solutions that stop threats faster and protect data in physical, virtualized, and cloud environments. As new threats and vulnerabilities emerge, Trend Micro remains committed to helping customers secure data, ensure compliance, reduce costs, and safeguard business integrity. For more information, visit: Trend Micro and the Trend Micro t-ball logo are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other marks are the trademarks or registered trademarks of their respective companies. Audience The Trend Micro Remote Manager User's Guide is written for partners and Managed Service Providers (MSPs) that use the platform to oversee and manage a partner s entire Trend Micro SMB product portfolio for all of their customers from anywhere, anytime. Document Conventions The Remote Manager User's Guide uses the following conventions. TABLE 1. Document Conventions CONVENTION ALL CAPITALS DESCRIPTION Acronyms, abbreviations, and names of certain commands and keys on the keyboard viii

13 Preface CONVENTION DESCRIPTION Bold Navigation > Path Note Menus and menu commands, command buttons, tabs, and options The navigation path to reach a particular screen For example, File > Save means, click File and then click Save on the interface Configuration notes Tip Recommendations or suggestions WARNING! Critical actions and configuration options ix

14

15 Chapter 1 Introduction This section contains the following topics: Trend Micro Remote Manager on page 1-2 Features on page 1-4 Supported Products on page 1-8 What's New on page 1-15 Overall Infrastructure on page 1-17 Key Terminology on page

16 Trend Micro Remote Manager User's Guide Trend Micro Remote Manager Trend Micro Remote Manager is a robust console that works in parallel with Trend Micro Licensing Management Platform to provide managed security services to small and medium businesses. Remote Manager enables you to monitor the health of multiple managed networks through multiple, managed products and services. Trend Micro Remote Manager allows reseller administrators to issue commands to manage critical aspects of network security. Remote Manager is hosted on regional Trend Micro Data Center servers where resellers obtain an account. Resellers can use Remote Manager to establish customer accounts, monitor customer networks, and manage security using the Remote Manager web console. Remote Manager monitors the following products: Worry-Free Business Security Standard (formerly Client Server Suite) versions 6.x, 7.x, 8.x, 9.0 Worry-Free Business Security Advanced (formerly Client Server Messaging Suite) versions 6.x, 7.x, 8.x, 9.0 Worry-Free Business Security Services version 5.0, 5.1, 5.2, 5.3, 5.3 SP1, 5.6 Note Worry-Free Business Security Standard and Advanced, and Worry-Free Business Security Services are collectively referred to as Worry-Free Business Security (all) where appropriate. Trend Micro Hosted Security version 1.x Note Worry-Free Business Security Standard and Advanced, Worry-Free Business Security Services, and Hosted Security are collectively referred to as "managed products" and/or "managed services" in this document. Remote Manager has a monitoring dashboard that allows resellers to look into the following aspects of network security: 1-2

17 Introduction Worry-Free Business Security (all): Virus, network virus, and spyware/grayware incidents Spam and phishing incidents Unauthorized computer changes Outbreak situations License and update status of security products Disk usage on desktops, servers, and Exchange servers (Worry-Free Business Security Standard and Advanced only) Key security indicators Hosted Security: message traffic Accepted message size Threat summary Top spam recipients Top virus recipients Note For detailed information on Hosted Security and Worry-Free Business Security (all), see the documentation for those products available at: Remote Manager offers a structured view of customer networks and allows resellers to issue commands and manage the following aspects of network security: Component updates and updates to the managed server Vulnerability assessment Damage cleanup Automatic outbreak response 1-3

18 Trend Micro Remote Manager User's Guide Firewall and Real-time Scan settings Manual scans Remote Manager also supports comprehensive reporting features and allows resellers to subscribe individuals to automatically generated reports. Features Trend Micro Remote Manager offers the following features. Integrated Platform Remote Manager works in parallel with Trend Micro Licensing Management Platform, but with a more robust interface. You can do the following from the Remote Manager portal: Create new accounts Renew licenses for individual accounts Add more seats Remote Manager also monitors and manages multiple protected networks from a single console by communicating with a Remote Manager Agent that runs on the managed servers. In addition, Remote Manager also offers event monitoring based on key security indicators. Dashboard Widgets Customize the widgets on the dashboard page. These widgets can let you know if you need to renew licenses, add more allocated seats, or even let you know which customers experience the most threats. 1-4

19 Introduction Customizable Settings for New Accounts When creating accounts, you can customize the basic default settings that new accounts will use by default or select the settings from templates you have configured and saved. Threat Status The Remote Manager Events screen provides the status of the following aspects of network security: Worry-Free Business Security Standard and Advanced Outbreak Defense Antivirus Anti-spyware Web Reputation Behavior Monitoring Network Viruses Anti-spam URL Filtering (versions 6.x and up only) Device Control (versions 7.x, 8.x and 9.0 only) Worry-Free Business Security Services Outbreak Defense Antivirus Anti-spyware Web Reputation Behavior Monitoring Network Viruses 1-5

20 Trend Micro Remote Manager User's Guide URL Filtering Hosted Security Total Message Traffic Accepted Message Size Threat Summary Top Spam Recipients Top Virus Recipients Remote Manager provides details about these aspects including statistical data such as the number of infected computers and virus/malware incidents. Reseller administrators can also check detailed information including the names of affected computers or the threats. System Status Reseller administrators can check the following system-related aspects of network security through the Remote Manager Events screen: Smart Protection Services Component updates Disk Shortage Device/agent offline Device/agent offline (Last 24 hours) Device malfunction Device malfunction (Last 24 hours) License Status Reseller administrators can view the following license-related details: 1-6

21 Introduction Total seats purchased Number of seats in use Expired licenses, including date of expiry Expiring licenses, including number of days before expiration Network Management Remote Manager offers a structured view of managed networks and allows reseller administrators to issue commands and manage the following critical aspects of network security: Component updates and updates to the managed server Vulnerability assessment Automatic outbreak response Damage cleanup Firewall and Real-time Scan settings Manual scans Reporting In addition to notifications for security events, Remote Manager can automatically generate and send reports at regular intervals. You can create the reports according to customer, product, frequency, and content and saved in various formats. Integration with Third-Party Tools Enable log monitoring using third-party tools, including Autotask, Kaseya, or ConnectWise to standardize the tasks and processes you monitor. 1-7

22 Trend Micro Remote Manager User's Guide Feedback Submission Trend Micro would like to provide the best and most useful platform for the users. However, Trend Micro does not know what services or features are important to you. And to this end, Remote Manager welcomes your feedback and suggestions through the Submit Feedback button, which is accessible and visible from the banner. Trend Micro can then process and determine which features would help the most number of users. Supported Products Worry-Free Business Security Standard Worry-Free Business Security Advanced Worry-Free Business Security Services Hosted Security Cloud Edge Note Worry-Free Business Security Standard and Advanced, and Worry-Free Business Security Services are collectively referred to as Worry-Free Business Security (all) where appropriate. Third-party tools Autotask Kaseya ConnectWise Worry-Free Business Security Suite Trend Micro Worry-Free Business Security Standard, Worry-Free Business Security Advanced, and Worry-Free Business Security Services are comprehensive, centrallymanaged solutions for small- and medium-sized business. 1-8

23 Introduction Worry-Free Business Security Standard provides client-side antivirus and firewall protection for desktops and servers. Worry-Free Business Security Advanced includes the same features as Worry-Free Business Security Standard, but provides an anti-spam and threat solution for mail servers running Microsoft Exchange Server. Worry- Free Business Security Standard and Advanced include a server-side component for monitoring and managing client protection from a central location. Worry-Free Business Security Services provides most of the advantages of Worry-Free Business Security Standard. And because Worry-Free Business Security Services is a hosted service, you can centrally manage security from anywhere without the need to add, install, configure, or maintain a server. Trend Micro security experts host and constantly update the service for you. Note For information about Worry-Free Business Security Standard and Advanced and Worry- Free Business Security Services, refer to the documentation at: Trend Micro Remote Manager monitors and manages Worry-Free Business Security Standard and Advanced protected networks by communicating with an Agent that runs on Worry-Free Business Security Standard and Advanced servers or Worry-Free Business Security Services servers located at Trend Micro data centers. Hosted Security Trend Micro Hosted Security blocks spam, viruses, phishing, and other threats before they reach your network. As a hosted solution, it requires no hardware or software to install and maintain and helps you reclaim IT staff time, user productivity, bandwidth, mail server storage and CPU capacity. In addition, Trend Micro s worldwide team of experts manages hot fixes, patches, updates and application tuning so that solution performance is continuously optimized. Note For information about Hosted Security, refer to the documentation at: 1-9

24 Trend Micro Remote Manager User's Guide Trend Micro Remote Manager monitors and manages Hosted Security-protected networks by communicating with the Hosted Security server located at Trend Micro data centers. Cloud Edge Cloud Edge brings together the benefits of a next-generation on-premises firewall and the convenience of security as a service for managed service providers. By deeply scanning and filtering network packets on-premises or through the cloud, Cloud Edge stops threats at the gateway. Cloud Edge intelligently combines application control with user and port identification, zero-day exploit detection, anti-malware scanning, web reputation security, and URL filtering to protect your customers against network breaches and business disruptions. VPN support also secures connections from mobile devices, corporate sites, and remote employees. Deploy the Cloud Edge on-premises appliance to customer offices anywhere in the world and then centrally control user access and security policies through an intuitive cloud console, or through Trend Micro Remote Manager. Remote Manager works with Cloud Edge by providing a single point of entry to access graphical reports and summarized dashboard data for supported appliances and Trend Micro products. You can also use Remote Manager to manage licensing and billing of multiple customers. Third-Party Tools Trend Micro Remote Manager integrates with third-party tools to ensure a more secure network environment. These tools are: Autotask Remote Manager can send the following event notifications to the Autotask system: Worry-Free Business Security Standard and Advanced Agent Abnormal Outbreak Defense 1-10

25 Introduction Antivirus Anti-spyware Web Reputation Behavior Monitoring Network Virus Anti-Spam Outdated Managed Servers Unusual System Events License Expiration URL Filtering Device Control Worry-Free Business Security Standard and Advanced Server Shutdown Exchange Server Shutdown Worry-Free Business Security Services Agent Abnormal Outbreak Defense Antivirus Anti-spyware Web Reputation Behavior Monitoring Network Virus Outdated Managed Servers Unusual System Events License Expiration 1-11

26 Trend Micro Remote Manager User's Guide URL Filtering Exchange Server Shutdown These events are sent to Autotask in the form of messages that are transformed into an Autotask ticket. For this to occur, you must add notification recipients to the Remote Manager web console and several fields to Autotask's ticketing system. For more information, refer to Integrating Autotask on page Kaseya Remote Manager and Worry-Free Business Security Services can send event notifications to the Kaseya system. The following events can be sent to Kaseya: Worry-Free Business Security Standard and Advanced Agent Abnormal Outbreak Defense Antivirus Anti-spyware Web Reputation Behavior Monitoring Network Virus Anti-Spam Outdated Managed Servers Unusual System Events License Expiration URL Filtering Device Control Client Server Messaging/Worry-Free Business Security Standard and Advanced Server Shutdown 1-12

27 Introduction Exchange Server Shutdown Worry-Free Business Security Services Agent Abnormal Outbreak Defense Antivirus Anti-spyware Web Reputation Behavior Monitoring Network Virus Outdated Managed Servers Unusual System Events License Expiration URL Filtering Exchange Server Shutdown These events are sent to Kaseya in the form of messages which are transformed into a Kaseya ticket. For this to occur, notification recipients need to be added to the Remote Manager web console and several fields need to be made to Kaseya s ticketing system. For more information, refer to Integrating Kaseya on page ConnectWise Remote Manager and Worry-Free Business Security Services can send event notifications to the ConnectWise system. The following events can be sent to ConnectWise: Worry-Free Business Security Standard and Advanced Agent Abnormal Outbreak Defense 1-13

28 Trend Micro Remote Manager User's Guide Antivirus Anti-spyware Web Reputation Behavior Monitoring Network Virus Anti-Spam Outdated Managed Servers Unusual System Events License Expiration URL Filtering Device Control Client Server Messaging/Worry-Free Business Security Standard and Advanced Server Shutdown Exchange Server Shutdown Worry-Free Business Security Services Agent Abnormal Outbreak Defense Antivirus Anti-spyware Web Reputation Behavior Monitoring Network Virus Outdated Managed Servers Unusual System Events 1-14

29 Introduction License Expiration URL Filtering Exchange Server Shutdown These events are sent to ConnectWise in the form of messages which are logged into ConnectWise. For this to occur, notification recipients need to be added to the Remote Manager web console and several fields need to be made to ConnectWise s ticketing system. For more information, refer to Integrating ConnectWise on page What's New Trend Micro Remote Manager includes the following new features and enhancements: TABLE 1-1. New for the July 2014 Release FEATURE Cloud Edge Integration Agent version Reports DESCRIPTION Trend Micro Remote Manager works with Cloud Edge by providing a single point of entry to access graphical reports and summarized dashboard data for Cloud Edge appliances. You can also use Trend Micro Remote Manager to manage licensing and billing of Cloud Edge customers. You can now see the Worry-Free Business Security Services agent version from the product console. Improved the way the system displays the data generated from HTML to PDF. Widget Enhancements Provided new features and enhancements. Fixed some performance issues. Fixed some overlap issues. 1-15

30 Trend Micro Remote Manager User's Guide TABLE 1-2. New for the June 2014 Release FEATURE/ENHANCEMENT Actionable Notification Customize Your Reports Set Up New Customers in 3 Easy Steps Note This feature is only for Trend Micro Licensing Management Platform users. Contact your Managed Service Provider or Trend Micro representative for more information. Customize the Default Setting Templates Note This feature is only for Trend Micro Licensing Management Platform users. Contact your Managed Service Provider or Trend Micro representative for more information. DETAILS Click the links on the widgets or notification to see, and do something about the licenses that need an action now, or very soon. Clicking the event occurrences can also open the web console of certain products. Refer to Single Sign On. Partners and customers have different needs when it comes to the reports that they receive. You can use the new contents and templates to make sure that they get the right information. Set up and deploy default policies to new customers in three (3) steps. Afterward, these customers will have the same level of protection and monitoring from Trend Micro Remote Manager. Preconfigure different templates for the Worry- Free Business Security Services settings. This gives you flexibility to fit different service models for your customers. 1-16

31 Introduction FEATURE/ENHANCEMENT Single Sign On DETAILS Click the Open Console link from the Customer page to open the web console of the following services: Worry-Free Business Security Services Hosted Security Cloud Edge Additional Help Trend Micro Remote Manager provides easy access to the documentation from the Help button, which also includes video tutorials that you can watch directly from the console. Trend Micro Remote Manager also provided a quick link to the Trend Micro Remote Manager Best Practice Guide. Overall Infrastructure Trend Micro Remote Manager consists of three basic parts: The reseller The Trend Micro data center The customer network 1-17

32 Trend Micro Remote Manager User's Guide FIGURE 1-1. Remote Manager Overall Architecture The reseller accesses a Trend Micro Data Center (currently on different continents) through the Remote Manager web console through the Internet. The reseller does not need to install anything to be able to use the product. The reseller must add and configure each customer on the Remote Manager web console before the reseller can manage customer accounts. Each Worry-Free Business Security Standard and Advanced managed server has a Remote Manager Agent installed which allows communication to and from the Remote Manager servers. Since Worry-Free Business Security Services is hosted at the Trend Micro Data Center, no Agents have to be installed. Instead, Worry-Free Business Security Services have to be registered on the Remote Manager web console for each customer. 1-18

33 Introduction The Remote Manager Agent, which can be installed from the Remote Manager web console, runs on the Worry-Free Business Security Standard and Advanced managed server inside the customer s network. The Remote Manager Agent sends information to the Remote Manager server where you can access the data from your console 24/7 using an Internet connection. Key Terminology Knowing the following terms can help you work with Remote Manager more efficiently: TERM DEFINITION Agent Assessment Assessment indexes Client Security Agent (CSA) Dashboard Detection Installed on Worry-Free Business Security Standard and Advanced servers, this program allows Remote Manager to monitor and manage Worry-Free Business Security Standard and Advanced. Regular checks done on data collected from customer networks to determine the health of monitored networks. These checks use key indicators called assessment indexes. The basis for security assessments; reseller administrators can customize these indexes individually to control assessment intervals, ranges, and notifications. The Agent that reports to the Worry-Free Business Security server. The CSA sends event status information in real time. Agents report events such as threat detection, Agent startup, agent shutdown, start of a scan, and completion of an update. The CSA provides three methods of scanning: real-time scan, scheduled scan, manual scan. You can configure scan settings on Agents from the web console. The dashboard in Remote Manager is the main screen (Home tab) that displays the web console and the widgets. The discovery of a threat; a detection does not constitute a system infection, but simply indicates that malware has reached the computer. The detection of the same threat on different computers can constitute an outbreak. 1-19

34 Trend Micro Remote Manager User's Guide TERM DEFINITION Event Globally Unique Identifier (GUID) or Authorization Key Infection Messaging Security Agent (MSA) Reseller Reseller administrators Trend Micro Data Center Security Server Virus alert Virus outbreak The occurrence of a condition in a monitored domain. A unique reference number used as an identifier in computer software. The condition in which a threat is able to run its payloads in a computer; Remote Manager considers an infection to have occurred whenever the antivirus scanner detects a virus/ malware and is unable to clean, delete, or quarantine the threat. A spyware/grayware infection occurs when the computer cannot be completely cleaned unless it is restarted. The Agent that resides on Microsoft Exchange Servers and reports to Client Server Messaging and Worry-Free Business Security Advanced servers. This Agent protects against virus/ malware, Trojans, worms and other born threats. It also provides spam blocking, content filtering, and attachment blocking. Generic term to refer to organizations that directly provide security monitoring and management services to customers in Remote Manager. Administrators in the reseller side that perform service-related tasks using Remote Manager. The Trend Micro monitoring and management center that hosts Remote Manager (and Hosted Security) servers and provides support to reseller administrators. The Worry-Free Business Security Standard and Advanced server computer. A state of vigilance that is declared by TrendLabs to prepare customer networks for a virus outbreak; TrendLabs alerts different Trend Micro products and delivers preventive solutions that IT administrators can implement as a first line of defense before a pattern becomes available. The rapid propagation of a virus threat to different computers and networks; depending on the prevalence of the threat, an outbreak can be internal, regional, or global. 1-20

35 Chapter 2 Getting Started This section contains the following topics: Browser Requirements on page 2-2 Accessing the Platform on page 2-3 Coordinating with the Customer on page

36 Trend Micro Remote Manager User's Guide Browser Requirements Connection to the Internet Remote Manager account information from Trend Micro Supported browsers: Latest Firefox version (Recommended) Latest Google Chrome version (Recommended) Internet Explorer 9.0 Adding the Trend Micro Remote Manager Web Console URL to Trusted Sites Add the Remote Manager web console URL to your list of trusted sites in Internet Explorer to ensure that you can access all the console screens and features properly. Procedure 1. Open Internet Explorer. 2. Click Tools > Internet Options > Security (tab). 3. Select the Trusted sites zone. 4. Click Sites. 5. In Add this website to the zone, type the console URL. 6. Click Add. 7. Click OK. 2-2

37 Getting Started Using Internet Explorer 9 to Obtain the SSL Certificate To use the Agent, add the SSL certificate from Trend Micro to the browser on the managed server. Procedure 1. Open Internet Explorer and go to the Trend Micro Remote Manager site, dependent on your region. 2. Double-click the padlock icon to the right of the address bar. The website identification menu opens. 3. Click View Certificates. This opens the Certificate window showing the certificate issued to *.trendmicro.com. 4. Go to Certification Path (tab) > Geotrust or Equifax Secure Certificate Authority > View Certificate. 5. When the Certificate window showing Certificate Information Authority opens, click the Details tab. 6. Go to Copy to File > Next and then select DER encoded binary X.509 (.CER). 7. Click Next, and then type the path and filename of the certificate. For example, wfrmcert.cer. 8. Click Next > Finish. Accessing the Platform Everyone, regardless of their account type and permissions, signs in through the same page. Just type your credentials and click Sign In. You should get the sign in URL and your credentials from the user with the parent account. 2-3

38 Trend Micro Remote Manager User's Guide Users will not be able to view settings and options that they do not have privileges to see. Coordinating with the Customer Monitoring and managing your customer s network through Trend Micro Remote Manager provides many benefits for your customer. However, just like other remote management activities, actions made on the console can drastically affect the managed network. Before you start providing services, make sure that you have your customer s consent to do the following remote management and monitoring activities: View the list of computers on their network Renew or add seats to your licenses View the following security information: Virus/malware, spyware/grayware, and network virus detections Names and the number of infected computers File names of infected files addresses that have received infected files Patch information for known vulnerabilities License and system information on Worry-Free Business Security (all) and Hosted Security Send notifications to individuals within the customer organization Run the following actions: Deploy security components Start Vulnerability Assessment scans Start Damage Cleanup Services Start or stop manual scans 2-4

39 Getting Started Update the Worry-Free Business Security Standard and Advanced server Start or stop Outbreak Defense Configure the following settings: Automatic deployment of Outbreak Defense Real-time Scan settings Firewall settings Location Awareness Behavior Monitoring Web Reputation URL Filtering Device Control (Worry-Free Business Security 7.0 and above) 2-5

40

41 Chapter 3 Understanding the Web Console The web console is the central point for monitoring and managing products and customers. This section contains the following topics: The Web Console Banner on page 3-2 Main Menu on page 3-3 Understanding the Dashboard on page

42 Trend Micro Remote Manager User's Guide The Web Console Banner The banner area provides the following options: <account name>: Shows the account currently signed in. Sign out: Signs you out of the web console. Licensing Management Platform: This link will only appear if you have integrated this with the License Management Platform site. Notifications: Indicates how many events need an action. New Customer: Click this button to add a new customer. Search bar: Specify customer information to quickly find a specific customer. Export Usage: Click this button to export a document showing your license usage. Feedback: Click this button to send valuable feedback to Trend Micro regarding how you use the product and what other features you think would be added or how to make current features more useful to you. Help: How-to Videos and Best Practices: Opens the page where you can watch the How-to videos and provides a link to the best practices guide. Contents and Index: Opens the Trend Micro Remote Manager Online Help. User s Guide: Downloads and shows the User s Guide, in PDF format. 3-2

43 Understanding the Web Console Support: Displays the Trend Micro Support web page, where you can submit questions and find answers to common questions about Trend Micro products. About: Provides an overview of the product and instructions to check component version details. What's New: Links to the page that lets you know what the new features are. Main Menu The main menu shows buttons that you can use to navigate to features and options. You can use the navigation bar to click the following: Home: This will bring you to the homepage, which shows the dashboard and widgets on the right panel. Customers: This shows the list of customers, wherein you can add customers, or make changes to customer settings or configurations. 3-3

44 Trend Micro Remote Manager User's Guide Reports: This shows the reports and new reports that can be added. Administration: This is the page where you can change the notification or web console settings, the default setting templates, or configure integration with thirdparty tools. My Account: This will show only if you have not integrated your account with Licensing Management Platform. Understanding the Dashboard This section contains information on the tabs, widgets, and dashboard. Dashboard Status Screens The Dashboard is the central screen for reviewing the status of monitored networks. The Dashboard lists only the products whose statuses are not normal. For example, if a customer's Worry-Free Business Security Services license is expiring or if a customer has too many threats, those customers would be listed here. To access the Dashboard, open a compatible browser and sign into the Trend Micro Remote Manager site for your region. FIGURE 3-1. Dashboard Threat Status Tab 3-4

45 Understanding the Web Console Most items on the Dashboard are linked to help you resolve an issue. Click an item (graph, link, number) to resolve the issue. See Product/Service Information on page 3-20 for details on what you can do. Tabs and Widgets Tabs provide a container for widgets. Each tab on the Summary screen can hold up to 20 widgets. The Summary screen itself supports up to 30 tabs. Widgets are the core components of the dashboard. Widgets provide specific information about various security or license-related events. Some widgets allow you to perform certain tasks. The information that a widget displays comes from: Worry-Free Business Security server and clients Worry-Free Business Security Services server Hosted Security services Cloud Edge servers and clients Tab Tasks The following table lists all the tab-related tasks: TASK STEPS Add a tab Click the plus icon ( ) on top of the Summary screen. The New Tab window displays. Edit tab settings Play tab slide show Move tab Click Tab Settings. A window similar to the New Tab window opens, where you can edit settings. Click Play Tab Slide Show. The information in the selected tabs will change similar to a slide show. Use drag-and-drop to change a tab s position. 3-5

46 Trend Micro Remote Manager User's Guide TASK STEPS Delete tab Click the delete icon ( ) next to the tab title. Deleting a tab also deletes all the widgets in the tab. New Tab Window The New Tab window opens when you add a new tab in the Summary screen. This window includes the following options: OPTION STEPS Title Layout Type the name of the tab. Choose from the available layouts. 3-6

47 Understanding the Web Console OPTION Slide Show Auto-fit STEPS The information in the selected tabs will change similar to a slide show. If you enable this option, you can select which tabs you want to appear in your slide show, and you can also control the speed at which your slide show plays. Auto-fit adjusts a widget to fit the size of a box. Widget Tasks The following table lists widget-related tasks: TASK Add a widget STEPS Open a tab and then click Add Widgets at the top right corner of the tab. The Add Widgets screen displays. Refresh widget data Click the refresh icon ( ). View help Click the Help ( ). Delete a widget Click the Close Widget ( ). This action removes the widget from the tab that contains it, but not from the other tabs that contain it or from the widget list in the Add Widgets screen. Move a widget Use drag-and-drop to move a widget to a different location within the tab. 3-7

48 Trend Micro Remote Manager User's Guide TASK Resize a widget STEPS To resize a widget, point the cursor to the right edge of the widget. When you see a thick vertical line and an arrow (as shown in the following image), hold and then move the cursor to the left or right. Only widgets on multi-column tabs can be resized. These tabs have any of the following layouts and the highlighted sections contain widgets that can be resized. Available Widgets The dashboard shows the following widgets. Notifications Widget Shows events that need an action. These can be threat-related, or license-related events. 3-8

49 Understanding the Web Console Note This is a permanent widget and cannot be added or deleted. Customers Needing the Most Attention Widget Shows the most recent number of customers with the highest number of events that need an immediate action or response. Data displays in a table and pie chart. You can switch between the table and pie chart by clicking the display icons ( ). If the number of clients for a particular status is 1 or more, you can click the number to view the events in the product tree. Click the customer name to view all the events for this customer or expand the customer name to see the events for certain categories. The number of events under Action Required are events that should be handled as soon as possible. The number of events under Warning are events that are not as urgent as the events under Action Required but will also need to be handled soon. 3-9

50 Trend Micro Remote Manager User's Guide Threat Management Widget Shows the threat event count for all the registered products. You can change the time range for the data shown by selecting from: Last 24 hours (default) Last 7 days Last 30 days If the number of events for a particular category is 1 or more, you can click the number to view the event logs. 3-10

51 Understanding the Web Console System Management Widget Shows the current number of all system events for the registered products. You can use this to determine hardware issues or events for the server or agent. If the number of events for a particular category is 1 or more, you can click the number to view the event logs. 3-11

52 Trend Micro Remote Manager User's Guide Managed Customers and Products/Services Widget Shows the number of managed customers for each product within a specified time period. You can change the time range for the data shown by selecting from: Last month (default) Last 3 months Last 6 months Last year You can click the names of the registered products on the right side to add or remove the data from the graph. 3-12

53 Understanding the Web Console Each bar chart represents a week or month. The bar chart shows the total number of products/services. Worry-Free Business Security Services Customers with the Most Threats Widget Shows the Worry-Free Business Security Services customers with the highest number of threat events. Data displays in a table and pie chart. You can switch between the table and pie chart by clicking the display icons ( ). You can change the threat type for the data shown by selecting from: Antivirus Anti-spyware Web Reputation URL Filtering Behavior Monitoring Network Virus Device Control Click the customer name to view the customer information. 3-13

54 Trend Micro Remote Manager User's Guide If the number of threats is 1 or more, you can click the number to view the event logs. Cloud Edge Customers with the Most Threats Widget Shows the Cloud Edge customers with the highest number of threat events. Data displays in a table and pie chart. You can switch between the table and pie chart by clicking the display icons ( ). You can change the time range for the data shown by selecting from: Last hour Last 24 hours (default) Last 7 days 3-14

55 Understanding the Web Console Last 30 days You can change the threat type for the data shown by selecting from: All Botnet Intrusion Prevention System (IPS) Web Reputation Virus Click the customer name to view the customer information. Click the threat count to open the threat information from the Cloud Edge console. Cloud Edge Devices with the Most Threats Widget Shows the Cloud Edge devices with the highest number of threat events. You can change the time range for the data shown by selecting from: Last hour 3-15

56 Trend Micro Remote Manager User's Guide Last 24 hours (default) Last 7 days Last 30 days You can change the threat type for the data shown by selecting from: All Botnet Intrusion Prevention System (IPS) Web Reputation Virus Click the customer name to view the customer information. Click the threat count to open the threat information from the Cloud Edge console. License Management Widget Displays the current status of the licenses being used by customers. Shows the following license-related details for customers and products: Expiring soon: These are the number of licenses that have not yet expired, but will expire soon. 3-16

57 Understanding the Web Console Expired: These are licenses that have already expired. Note Trend Micro suggests renewing these licenses as soon as possible. Seats Used: These are the number of seats that are currently being used. Provisioned: These are the number of seats that the customer provisioned. 3-17

58 Trend Micro Remote Manager User's Guide Trial and Full License Usage Widget Shows how many trial or full licenses were used for the registered products. You can change the time range for the data shown by selecting from: Last month (default) 3-18

59 Understanding the Web Console Last 3 months Last 6 months Last year You can change the product/service by selecting from: All Hosted Security Worry-Free Business Security Worry-Free Business Security Services Cloud Edge License Usage Widget Displays a graphical analysis of seats that were allocated and those that were actually purchased, for the year. These can help determine whether you should increase or decrease your seat allocation. You can change the product/service by selecting from: 3-19

60 Trend Micro Remote Manager User's Guide All Hosted Security Worry-Free Business Security Worry-Free Business Security Services Product/Service Information The dashboard lists only customers that need attention. To get details for any product, including those that are not listed on the dashboard, go to the Customers tab and access the product on the customer tree. Click Customers > {customer} > {product} to display additional information. Note The displayed options differ for each product/service. Worry-Free Business Security Services Groups: Lists the configured groups and the types. License Info: Displays all the details of the license. Endpoints: Lists the name, IP Address, online/offline status, and details of the scan engine, pattern file, and the platform. Security Settings: Configure the security settings of Worry-Free Business Security Services. Refer to the Trend Micro Worry-Free Business Security Services documentation for detailed information. Note To make more detailed changes, access the Worry-Free Business Security Services console. Worry-Free Business Security 3-20

61 Understanding the Web Console Groups: Lists the different groups configured on the server. You can request to start or stop a scan from here. Endpoints: Lists the name, IP Address, online/offline status, and details of the scan engine, pattern file, and the platform. License Info: Displays all the details of the license. Domain Settings: Configure settings for the entire domain. Refer to the Trend Micro Worry-Free Business Security documentation for detailed information. Note Security settings of individual groups cannot be configured from here. You will need to access the Worry-Free Business Security console to make these changes. Managed Server: Displays all the details of the server. You can request to update the server and update agents from here. TMRM Agent: Contains general information about the Trend Micro Remote Manager agent including the availability, the Globally Unique Identifier (GUID) or Authorization Key, and the IP address. Security Settings: Configure the security settings of a particular group (applicable only for Worry-Free Business Security 6.0 and above). Refer to the Trend Micro Worry-Free Business Security documentation for detailed information. Hosted Security Live Status: Displays the latest Hosted Security information Policy Settings: Lists all the available policies. Approved Senders: Lists all the approved senders. License Info: Displays all the details of the license. Note To make more detailed changes, access the Hosted Security console. 3-21

62 Trend Micro Remote Manager User's Guide Viewing Managed Products To view managed products, click Customers > {customer name} > Products (tab). This tab displays a tree view of the customer's managed products on the right pane and detailed information, settings, and control possibilities on the right pane. For detailed information on Hosted Security and Worry-Free Business Security (all), see the documentation for those products. Customers The Customers page provides a representation of the customers and their products that you manage. By default, the tab displays a table view of all customers. Click the company name to show a tree view with their products in the left pane and detailed information, settings, and control possibilities in the right pane. Note For detailed information on Hosted Security and Worry-Free Business Security (all), see the documentation for those products. To view a product on the customer list, click Customers > {customer name} > {product}. You can do the following: Type the name of a customer or account Filter the displayed list by customer, products, threats, systems, or license events Note When filtering events, you can choose one, two, or all the events or products at once. Browse through all the customers using the pagination arrows. Some other tasks that can be done: Add new customers on page 5-2 Renew licenses for customers with expiring or expired licenses on page 7-2 Export reports for specific customers on page

63 Understanding the Web Console You can also add new customers here and right click on most nodes of the tree to perform specific commands. FIGURE 3-2. List of Customers FIGURE 3-3. Customer Tree Network Tree On the left side of the Customers tab, the screen displays a tree representation of your customers networks. You can search for a customer, view all products at once or only Worry-Free Business Security (all), Hosted Security, or Cloud Edge under the View by drop down list, or browse through all the customers using the pagination arrows. You can also add a customer here and right click on most nodes of the tree to perform specific commands. The table below describes the objects in the network tree. TABLE 3-1. Network tree objects ICON NETWORK OBJECT DESCRIPTION Product/service This product/service is not connected to Remote Manager. 3-23

64 Trend Micro Remote Manager User's Guide ICON NETWORK OBJECT DESCRIPTION Product/service Group Group Server Exchange server Desktop This product/service is connected to Remote Manager. Server Group; this group manages several Client Security Agents (CSAs). Desktop Group A server computer; this computer runs the Client Security Agent (CSA). Exchange Server computer; this computer runs the Messaging Security Agent (MSA). A desktop computer; this computer runs the Client Security Agent (CSA). Right Pane This right pane displays the following: Products The Products tab on the right pane lists all products of a customers and allows you to delete those products. To view Products, click Customers > {customers name} > Products (tab). To delete a product, check the icon to the left of the product and click Delete. Interface items in the Products tab follow: Product Name Product Type Category Incidents Details Status 3-24

65 Understanding the Web Console Note New Hosted Security data can take as long as three hours before it updates on the Remote Manager web console. Hosted Security Customer information is updated once a day. See Hosted Security Settings and Data Updates on page Licenses The Licenses tab of a customer lists all the licenses associated with a customer. Interface items in the Licenses tab follow: Product name Service Plan/Version Used Seats Provisioned Seats Expiration Date Auto-renew status 3-25

66 Trend Micro Remote Manager User's Guide Security Settings Status Real-time Security Settings Status can be viewed by clicking Customers > {customer name} > {product} in the network tree > {group} > Security Settings (right pane). FIGURE 3-4. Real-time Security settings status Both In Office and Out Of Office settings are viewable (applies to Worry-Free Business Security Standard and Advanced only). Settings are controlled through the Settings drop down menu. Out of Office settings are relevant only when Location Awareness is turned on. For more information, refer to see Menu Bar on page 3-27 and Worry-Free Business Security Commands on page Location Awareness With Location Awareness (applies to Worry-Free Business Security Standard and Advanced only), administrators can control security settings depending on how the 3-26

67 Understanding the Web Console Client is connected to the network. Worry-Free Business Security Standard and Advanced automatically identifies the location of the client and controls the web sites users can access. The restrictions differ based on the user's location. Worry-Free Business Security classifies Clients as: Normal Clients: computers that are stationary and maintain a continuous network connection with the Security Server. Roaming Clients: computers that do not always maintain a constant network connection with the Security Server, such as portable computers. These Clients' Client/Server Security Agents continue to provide virus protection, but have delays in sending their status to the Security Server. Note Location Awareness controls the In Office/Out of Office connection settings. Menu Bar The menu bar on the right pane only displays when Worry-Free or Hosted Security is selected on the network tree. These commands enable you to manage critical aspects of network security including real-time scan settings and the deployment of component updates. For a list of the network commands on the menu bar and instructions on how to use these commands, see Worry-Free Business Security Commands on page FIGURE 3-5. Menu Bar 3-27

68 Trend Micro Remote Manager User's Guide Note Items in the menu bar are disabled and will not respond to mouse clicks if the selected network object cannot receive commands. Endpoints If you select a server or desktop computer on the network tree, Trend Micro Remote Manager displays information about the endpoint. The information it displays varies depending on whether the endpoint is a server/desktop or an Exchange server. To see this information, go to Customers > {customer name} > {product} > {group} > Devices (right pane). Remote Manager displays the following information: FIGURE 3-6. Endpoint status Name IP Address Status Virus Engine Virus Pattern Platform Version 3-28

69 Understanding the Web Console Worry-Free Business Security Commands Worry-Free Business Security (Standard and Advanced) commands let you manage critical aspects of security including deploying security components, scanning computers for viruses and known vulnerabilities, and upgrading managed servers. Note The commands in this section are only available for Worry-Free Business Security (Standard and Advanced). For Worry-Free Business Security Services and Hosted Security, you need to sign into the web console of those products. The table below lists the commands of the Worry-Free Business Security (Standard and Advanced) Settings menu. TABLE 3-2. Commands on the Settings Menu COMMAND ACTION EFFECTS Manual Scan Update Now Real-time Antivirus/ Anti-spyware Real-time Scan for POP3 Mail Start or stop a scan for an entire domain or group. Deploy the latest security components, including the scan engine and pattern files. Enable/Disable the realtime Antivirus and Antispyware scanners on all computers in the domain. Enable/Disable Real-time Scan for POP3 Mail for the entire domain. Allows for an on-demand, manual scan. Allows on-demand component updates. Real-time Scan automatically scans accessed files. Disabling Real-time Scan will leave the domain at risk. POP3 Mail Scan (using the Trend Micro Anti-Spam toolbar plug-in) protects computers in real-time against security risks and spam transmitted through POP3 messages. 3-29

70 Trend Micro Remote Manager User's Guide COMMAND ACTION EFFECTS Enable Behavior Monitoring Location Awareness Firewall Web Reputation Enable/Disable Behavior Monitoring for the entire domain. Enable/Disable Location Awareness for the entire domain. Enable/Disable the personal firewall for the entire domain. Configure Web Reputation for the entire domain. Behavior Monitoring protects computers from unauthorized changes to the operating system, registry entries, other software, or files and folders. With Location Awareness, administrators can control security settings depending on how the Client is connected to the network. This affects "In Office/Out of Office" settings of the Firewall, Web Reputation and TrendSecure toolbars: Anti-Key Loggers, Keystroke Encryption, Page Ratings. In Office Settings work as the default settings if Location Awareness is disabled. Out of Office Settings are available only if Location Awareness is enabled. Depending on existing firewall rules, enabling the firewall can limit the ability of computers to communicate with the network. Disabling can expose computers to unwanted network traffic. Web Reputation helps prevent access to URLs that pose potential security risks by checking any requested URL against the Trend Micro Web Security database. 3-30

71 Understanding the Web Console COMMAND ACTION EFFECTS URL Filtering Device Control Start Vulnerability Assessment Start Damage Cleanup Service Update Managed Server Update Client Server Security Agent Enable/Disable URL Filtering for the entire domain. Enable/Disable Device Control for the entire domain. Initiate Vulnerability Assessment (VA) to scan computers in the domain for known vulnerabilities. Deploy Damage Cleanup Services (DCS) to clean infected computers. Deploy the latest security components, including the scan engine and pattern files, only to the Managed Server. Deploy the latest security components, including the scan engine and pattern files, to all Client Server Security Agents (CSA) in the domain. Enabling URL Filtering will monitor attempts to access unauthorized websites. This is only available for Worry-Free Business Security Services and Worry-Free Business Security Advanced 6.0 and above. Enabling Device Control will monitor unauthorized attempts to access devices. This is only available for Worry-Free Business Security Advanced 7.x and 8.0. Consumes some resources on computers and slightly increases traffic between the managed server and the computers. Consumes some resources on computers and can add some traffic between the managed server and the computers. Ensures that computers are running the latest security components. The deployment can increase traffic between computers and the managed server. Ensures that computers are running the latest security components. The deployment can increase traffic between computers and the managed server. Hosted Security Settings and Data Updates To view Hosted Security settings and data including Live Status, Global Settings, and About, click Customers (tab) > {customer} > Hosted Security. 3-31

72 Trend Micro Remote Manager User's Guide The following details are listed for all the domains and are updated once a day: All the information under the Live Status tab. Policy Settings Approved Senders All the information under the License Info tab. Note New Hosted Security data can take as long as three hours before it updates on the Remote Manager web console. Notifications Customer notifications can be sent by or seen from the Notifications widget or a third-party software. The Configure Notifications screen will appear. In this page, you can set the following: Events that will trigger notifications: License related events: Expiring soon: Sends a notification if there are licenses that will be expiring soon. You can also set how often the system will send a notification. Monthly: The system will send an notification every 30 days, starting from 60 days before expiration. Bi-weekly: The system will send an notification every 14 days, starting from 28 days before expiration. Weekly: The system will send an notification every 7 days, starting from 14 days before expiration. 3-32

73 Understanding the Web Console Note Although you have set the notification to send an only every week, every two weeks, or every month, you may get an notification everyday, because the notification is dependent on the expiration date of a company. However, to ensure that you do not get several notifications on the same day, Trend Micro also includes the company names and dates of other products that will expire soon in the same . Expired: Sends a notification if there are licenses that have already expired. Exceeded allocation: Send a notification if the percentage of used seats exceeds the provisioned number of seats. You can specify the percentage of seats used that exceeded the seats the customer provisioned. This can be any value between 100 to 120. Product-related events: Worry-Free Business Security and Worry-Free Business Security Services events: Threats: Sends a notification if the number of threat events exceed the specified threshold. System: Sends a notification if the number of system or device events exceed the specified threshold. Cloud Edge events: Notification recipients: Web threats detected exceeds: Sends a notification if the number of web threats detected exceed the specific threshold. Kaseya (Only Worry-Free Business Security and Worry-Free Business Security Services events) Autotask (Only Worry-Free Business Security and Worry-Free Business Security Services events) ConnectWise Me: This is the address that will receive the notification. 3-33

74 Trend Micro Remote Manager User's Guide Note If the address is incorrect, click the Licensing Management Platform link or the My Account button to go to the profile setting page and change the settings for the profile. Additional recipients: You can specify additional recipients for customer-specific events. For more information on how you configure notification, refer to Configuring Notifications on page 8-2. Worry-Free Business Security Services Status and Data Updates To view Worry-Free Business Security Services settings and data including the status, click Customers > {customer name} > {product} > WFBS-SVC. Worry-Free Business Security Services information is updated once a day. This includes: All the information under the Security Settings. The Expiration Date under the License Info tab (this is the Expiration Date for the Worry-Free Business Security Services activation code). Note New Worry-Free Business Security Services data can take as long as three hours before it updates on the Remote Manager web console. Depending on your license mechanism, the options displayed could be different. 3-34

75 Chapter 4 Preparing the Infrastructure This section contains the following topics: Infrastructure Installation Overview on page 4-2 Adding Products on page

76 Trend Micro Remote Manager User's Guide Infrastructure Installation Overview In general, preparing the service infrastructure involves the following steps for each type of product/service. Worry-Free Business Security Standard and Advanced 1. Add a new customer on the Remote Manager web console. 2. Add the main customer contact. 3. Add at least one product to that customer. 4. Install the Agent on the customer s server. 5. Enter the GUID or Authorization Key on the Agent. Hosted Security and Worry-Free Business Security Services 1. Add a new customer on the Remote Manager web console. 2. Add the main customer contact. 3. Add at least one service to that customer. 4. Enter the Authorization Key on the customer s service console. ConnectWise 1. Link ConnectWise and add the ConnectWise logon credentials on the Administration > Configure third-party integration (screen) on the Remote Manager web console. 2. Specify the global ConnectWise notification settings. 3. Add the notification recipient to the recipient list on the Customers > {customer} > Notification (tab) on the Remote Manager web console. 4-2

77 Preparing the Infrastructure 4. Add the required fields to the ConnectWise console. 5. (Optional) Configure the ConnectWise settings and notification for each customer. Kaseya 1. Link Kaseya and add the Kaseya user on the Administration > Configure third-party integration (screen) on the Remote Manager web console. 2. Add the notification recipient to the recipient list on the Customers > {customer} > Notification (tab) on the Remote Manager web console. 3. Add the required fields to the Kaseya console. Autotask 1. Link Autotask and add the Autotask logon credentials on the Administration > Configure third-party integration (screen) on the Remote Manager web console. 2. Add the notification recipient to the recipient list on the Customers > {customer} > Notification (tab) on the Remote Manager web console. 3. Add the required fields to the Autotask console. Adding Products Adding Customers You should identify basic customer information before you create the customer account. Fields to note include First and Last Name (as it will appear on reports and notifications), Time zone (of the customer), and Language (in which the customer will receive reports and notifications). Before you add a customer and install the Agent on the managed server, make sure you have written approval to perform tasks to access, monitor, and manage the customer's resources. 4-3

78 Trend Micro Remote Manager User's Guide Procedure 1. From the Remote Manager web console banner, click New Customer. Note You can click New Customer from the Banner, or from the Customers tab. 2. Provide the customer information. FIGURE 4-1. Customer Info Screen 3. Click Next >. 4. Assign a service plan, license start date, and the number of units per license. 4-4

79 Preparing the Infrastructure 5. Set up the product default settings for this account. These are: Note This feature is only for Worry-Free Business Security Services. Basic product settings: Configure only the settings on this screen that new customer accounts will use. FIGURE 4-2. Basic product settings Templates: Use this option to select a default setting template. Configure the settings from Admin > Configure default settings template. 6. Verify all the information and then click Done. Note After adding the customer, profile changes can only be made from the Trend Micro Licensing Management Platform. 4-5

80 Trend Micro Remote Manager User's Guide Registering Trend Micro Products to Trend Micro Remote Manager You can register Trend Micro products to Trend Micro Remote Manager. For thirdparty products, refer to Integrating Third-party Products with Trend Micro Remote Manager on page Registering Worry-Free Business Security This section helps you understand how to connect or disconnect Worry-Free Business Security from Trend Micro Remote Manager. Agent GUID or Authorization Key To distinguish between products and services, Remote Manager assigns a globally unique identifier (GUID) or Authorization Key to each product and service. Every time you add a product or service to the Remote Manager web console, Remote Manager generates a new GUID or Authorization Key. The person who installs the Agent on the managed server or adds the service to the Remote Manager web console must input the GUID or Authorization Key during installation to allow the product to register to Remote Manager. 4-6

81 Preparing the Infrastructure The GUID or Authorization Key for a customer's products/services are always available from: Customers > All Customers (on the tree) > {customer} > TMRM Agent (tab). FIGURE 4-3. The Agent GUID or Authorization Key is always available (Worry-Free Business Security Standard and Advanced) Remote Manager Agent GUID 1A2B3C4567D8-E1FGHI23-J456-78K9-1L23 Agent Installation for Worry-Free Business Security 6.0 and Above There are several ways to install the Trend Micro Remote Manager Agent to the Worry- Free Business Security Standard or Advanced 6.0 and above server. The installation procedures depend on whether the customer is new or already has an existing account on the Remote Manager web console. Before You Begin Remote Manager Agent GUID Agent installer (WFRMAgentforWFBS.exe) 4-7

82 Trend Micro Remote Manager User's Guide Active Internet connection 50MB available hard disk space Customers Without Remote Manager Accounts Procedure Option 1: From the Remote Manager web console 1. From the Remote Manager web console, add the customer and provide an optional description. 2. Add Worry-Free Business Security Standard or Advanced to the Remote Manager web console, generating a GUID in the process. 3. Install the Remote Manager Agent on the Worry-Free Business Security Standard or Advanced server using the console-generated GUID. Option 2: Install the Agent on the Worry-Free Business Security server Use the Remote Manager Agent installer on the Worry-Free Business Security server (without first adding the customer to the Remote Manager web console) to install the agent. Customers With Remote Manager Accounts Procedure 1. Add Worry-Free Business Security Standard or Advanced to the Remote Manager web console, generating a GUID in the process. 2. Install the Remote Manager Agent on the Worry-Free Business Security Standard or Advanced server using the console-generated GUID. Verifying Trend Micro Remote Manager Agent Installation Verify that the Agent has been installed successfully. 4-8

83 Preparing the Infrastructure Checking the Agent Service Status On the computer where the Remote Manager Agent is installed, check if Trend Micro Information Center for CSM has started. Procedure 1. Click Start > Settings > Control Panel > Administrative Tools > Services. 2. Look for Trend Micro Remote Manager Agent. 3. Check if the Status has Started. Checking the Start Menu Shortcuts On the computer where the Trend Micro Remote Manager Agent is installed, check the Program Group in the Start Menu. Procedure 1. Click Start > Programs > Trend Micro Remote Manager Agent. 2. Verify that the Program Group contains the following items: Agent Configuration Tool Readme Checking the System Tray Icon On the computer where the Trend Micro Remote Manager Agent is installed, check for the Trend Micro Remote Manager Agent icon in the system tray. If for any reason the icon is not visible, you can start it by clicking Start > Programs > Trend Micro Remote Manager Agent > Agent Configuration Tool. Exiting the tool does not stop the Trend Micro Remote Manager service. It only closes the Configuration Tool and removes the icon from the task bar. The tool can be restarted at any time. Suspend the mouse over the icon for status information. 4-9

84 Trend Micro Remote Manager User's Guide TABLE 4-1. System Tray Icons ICON DESCRIPTION A green icon indicates that the Agent is connected to the Trend Micro Remote Manager communication server. The Agent is working normally. A red icon indicates that the Agent is not connected to the Trend Micro Remote Manager communication server or the version of the Agent is mismatched with the server and needs to be updated. An icon with a red arrow indicates that the Agent has signed out from Trend Micro Remote Manager. An icon with a red "X" means that the Agent has been disabled. Checking the Connection Between the Agent and Server To ensure that the Trend Micro Remote Manager service is running smoothly, make sure that Agents have a status of "connected" or "online" on the Remote Manager web console. Go to Customers > {customer} > Products (tab). The tree lists the status of each Agent in the Status column. For details on each status, see Agent Status on page 6-2. In addition to the current section, refer to Troubleshooting and Known Issues on page 11-1 for more issues dealing with Server/Agent connectivity. Viewing Installation Errors The Agent installation logs cover Agent installation activities. Collect these logs and send them to your support provider if you encounter problems during installation. The Agent installation logs can be obtained from the following location on the managed server: C:\WFRMAgentForCSM_Install.log 4-10

85 Preparing the Infrastructure Registering Worry-Free Business Security Services This section lets you know how to connect or disconnect Worry-Free Business Security Services from Trend Micro Remote Manager. Connecting a Worry-Free Business Security Services Customer to the Remote Manager Web Console To manage Worry-Free Business Security Services from the Trend Micro Remote Manager web console, a customer s Worry-Free Business Security Services account must register with Remote Manager by carrying out the following: Note If the reseller added the product to your account from Licensing Management Platform, you do not need to do the following steps. Procedure 1. Add the product to the Remote Manager web console and save the GUID or Authorization Key. For more information, refer to Adding Products/Services on page Sign into the customer s Worry-Free Business Security Services account. 3. Go to Administration > Trend Micro Remote Manager. 4. Type the Authorization Key and click Connect. Disconnecting a Worry-Free Business Security Services Customer from the Remote Manager Web Console To disconnect Worry-Free Business Security Services from the Remote Manager web console: If the account has been integrated with Licensing Management Platform, the reseller can delete the service plan from the Licensing Management Platform web 4-11

86 Trend Micro Remote Manager User's Guide console. Once the service plan has been deleted, the customer will be disconnected from the Remote Manager web console. For other accounts, the customer can open the Remote Manager screen on the Worry-Free Business Security Services web console and click Disconnect. The customer will then be notified on the Worry-Free Business Security Services console. Registering Hosted Security This section lets you know how to connect or disconnect Hosted Security from Trend Micro Remote Manager. Connecting a Hosted Security Customer to the Remote Manager Web Console To manage Hosted Security from the Trend Micro Remote Manager web console, a customer s Hosted Security account must register with Remote Manager. Note If the reseller added the product to your account from Licensing Management Platform, you do not need to do the following steps. Procedure 1. Add the product to the Remote Manager web console and save the GUID or Authorization Key. 2. Sign into the customer s Hosted Security account. 3. Go to Administration > Remote Manager. 4. Type the GUID or Authorization Key and click Connect. After entering the GUID or Authorization Key and clicking Connect, it can take as long as ten minutesfor Hosted Security to complete the connection to the Remote Manager web console. 4-12

87 Preparing the Infrastructure 5. Review the connection status. New Hosted Security data can take as long as three hours before it updates on the Remote Manager web console. Hosted Security Customer information is updated once a day. See Hosted Security Settings and Data Updates on page Disconnecting a Hosted Security Customer from the Remote Manager Web Console To disconnect Hosted Security from the Remote Manager web console: If the account has been integrated with Licensing Management Platform, the reseller can delete the service plan from the Licensing Management Platform web console. Once the service plan has been deleted, the customer will be disconnected from the Remote Manager web console. For other accounts, the customer can open the Remote Manager screen on the Hosted Security web console and click Discontinue. The customer is then notified on the Hosted Security console and clicks OK. Integrating Third-party Products with Trend Micro Remote Manager You can register third-party products to Trend Micro Remote Manager. For Trend Micro products, refer to Registering Trend Micro Products to Trend Micro Remote Manager on page 4-6. Integrating Autotask Configure the following settings to integrate Autotask with Remote Manager: 4-13

88 Trend Micro Remote Manager User's Guide Configuring Autotask Settings in Remote Manager Procedure 1. Click Administration > Configure 3rd-party Integration. The Third-party Integration window opens. FIGURE 4-4. Account Information Notifications Group Box 2. Click Enable Integration. 3. Specify the sign in credentials. You can check the Autotask credentials in Admin > AutotaskExtend > Tools > Incoming Processing > Add Ticket E- mail Service (ATES) > Edit > General. 4-14

89 Preparing the Infrastructure 4. Select the preferred language. 5. Click Save. 6. Click Customers > All Customers (on the tree) > {customer} > Notifications (tab). FIGURE 4-5. Select the required notifications 7. Select the notifications that should be sent to Autotask for Worry-Free Business Security Services. 4-15

90 Trend Micro Remote Manager User's Guide 8. Select Autotask as one of the recipients. 9. Repeat steps 5, 6, and 7 for each customer. Configuring Settings in Autotask Procedure 1. In Autotask, go to Admin > Service Desk > Issue and Sub-Issue Types > Managed Services Alert to add the following fields to the ticketing system. This will enable Autotask to show Trend Micro Remote Manager notifications. Choose from the following managed service alerts: Trend Micro Threat Events Trend Micro System Events Trend Micro License Events 4-16

91 Preparing the Infrastructure FIGURE 4-6. Trend Micro Sub-issue Types 2. Go to Admin > AutotaskExtend > Tools > Incoming Processing > Add Ticket Service (ATES) > Edit > Ticket and ensure that the setting is correct: 4-17

92 Trend Micro Remote Manager User's Guide 3. Go to Admin > Site Setup > User-Defined Fields and create the Trend Micro Site ID field: 4-18

93 Preparing the Infrastructure FIGURE 4-7. Trend Micro Site ID Definition 4. Go to CRM > New Account and input the Remote Manager unique ID in the new Trend Micro Site ID field. This is the unique ID exported from Remote Manager. 4-19

94 Trend Micro Remote Manager User's Guide Integrating Kaseya Configure the following settings to integrate Kaseya with Remote Manager: Configuring Kaseya Settings in Remote Manager Procedure 1. Click Administration > Configure 3rd-party Integration. The Third-party Integration window opens. FIGURE 4-8. Account Information Notifications Group Box 2. Click Enable integration. 4-20

95 Preparing the Infrastructure 3. Add the Kaseya address. 4. Click Save. 5. Go to Customers > All Customers (on the tree) > {customer} > Notifications (tab). 4-21

96 Trend Micro Remote Manager User's Guide FIGURE 4-9. Select the required notifications 6. Select the product notification settings that should be sent to Kaseya. 4-22

97 Preparing the Infrastructure Note You select the default real-time notification settings that is applicable to all products and customers, or specify the settings for this customer. 7. Select Kaseya as one of the recipients. 8. Repeat steps 5, 6, and 7 for each customer. Configuring Settings in Kaseya Procedure 1. In Kaseya, add the following fields to the ticketing system to show Trend Micro Remote Manager notifications. Worry-Free Business Security FIELD NAME TM_CreateTime TM_ProductName TM_AgentGUID TM_CustomerName TM_EventName TM_ServerName TM_MASClientName (optional) PURPOSE Event generation time Product name Remote Manager agent GUID Customer/Company name Event name Client Server Messaging/Worry-Free Business Security server name Exchange server name (only affects the Exchange Server Shutdown event) 4-23

98 Trend Micro Remote Manager User's Guide FIGURE Kaseya Ticketing Fields Worry-Free Business Security Services FIELD NAME TM_CreateTime TM_ProductName TM_CustomerName TM_EventName PURPOSE Event generation time Product name Customer/Company name Event name 4-24

99 Preparing the Infrastructure FIGURE Kaseya Ticketing Fields 2. Ensure that the setting is correct as shown on the following screen: 4-25

100 Trend Micro Remote Manager User's Guide FIGURE Kaseya Settings 4-26

101 Preparing the Infrastructure When an event is triggered, Kaseya will receive the ticket: FIGURE Kaseya Event Ticket Integrating ConnectWise Configure the following settings to integrate ConnectWise with Remote Manager: Configuring General ConnectWise Settings in Remote Manager Procedure 1. Go to Administration > Configure 3rd-party Integration. 4-27

102 Trend Micro Remote Manager User's Guide The Third-party Integration window opens. FIGURE Account Information Notifications Group Box 2. Update the following: Enable ConnectWise Integration: Select the checkbox to enable integration between Trend Micro Remote Manager and ConnectWise. ConnectWise URL: Type the URL of the service. Company ID Logon ID: The account used to sign into ConnectWise. Logon password: The password associated with the account. Select how frequently Remote Manager should send billing information. Select how frequently Remote Manager should send spam statistics. 3. Click Save. Configuring Customer-specific ConnectWise Settings in Remote Manager Configure the ConnectWise settings for each customer. These settings are optional. However, if you also want to receive customer-specific notification, you have to enable this feature. 4-28

103 Preparing the Infrastructure Procedure 1. Go to Customers (tab) > {customer} > ConnectWise (tab, right pane). 2. Select Enable integration. 3. Specify a valid Company ID that exists in ConnectWise. Note You can click Test Validity to verify the company ID if you are unsure of the spelling. 4. Select the integration settings. Use the default settings under Administration. Specify your own options for billing and executive summaries. 5. Click Save. 6. Go to Customers (tab) > {customer} > Notification (tab, right pane). 7. Configure the notification settings for this customer. 8. Select ConnectWise as one of the recipients. 9. Click Save. 4-29

104 Trend Micro Remote Manager User's Guide Configuring Settings in ConnectWise Procedure 1. Log on to ConnectWise using the Professional services automation (PSA) tool. 2. Build a new service board. This is an optional step. But completing this step will help you filter results from Trend Micro Remote Manager efficiently. a. Go to Setup > Setup Table > Search and type Service Board. b. Click Service Board. A list of service boards appear. c. Click the new icon to create a new service board. The new service board screen appears. d. Update Board Name, Location, Business Unit, and Sign Off Template. All other fields are optional. 4-30

105 Preparing the Infrastructure e. Click Save. f. Click the Statuses tab. g. Click the new icon to create a new status service. h. Update Status to Description, Sort Order, and check Display on Board. i. Click Save. 3. Assign rights to the user. a. Go to Setup > Setup Table > Search and type Integrator Login. b. Click the required Integrator Login and click the new icon to create a new login account. The General screen opens. c. From Access Levels, select All records. 4-31

106 Trend Micro Remote Manager User's Guide d. Check the following options: Service Ticket API, Management Services API, Company API, System API, and Configuration API. e. Select the service board you previously created, update the Ticket Callback URL to or any other arbitrary URL, and click Save. f. Click Save. 4. Build a new management solution. a. Go to Setup > Setup Table > Search and type Management IT. b. Click Management IT. c. Click the new icon to create a management solution. d. Update Name to TMRM Management Setup, Management IT Solution to Custom, and Custom Solution Name to TMRM Management Solution. Using other values might break the connection. e. Click Save. 5. Change the default status of the company to Active. a. Go to Setup > Setup Table > Search and type Company Status. b. Click Company Status. c. Click Active. d. Select Default Flag. e. Click Save. 6. Build a new service for every Remote Manager managed product/service. a. Go to Setup > Products > New. b. Update Product ID to a managed product/service. Choose from HES/ WFBS-SVC/WFBS-S/WFBS-A. c. Update the pricing as required. d. Click Save. 4-32

107 Preparing the Infrastructure Repeat these steps for every managed product/service. 7. Build cross references for each Remote Manager managed product/service. a. Go to Setup > Setup Table > Search and type Managed Devices Integration. b. Click Managed Devices Integration. c. Select the Management Solution named "Remote Manager Management Solution". d. Go to Cross Reference (tab) > New. e. Update the fields as required. Settings for Remote Manager managed products/services. PRODUCT/SERVICE Worry-Free Business Security Standard SETTINGS Type: T-WFBS-S Level: Standard Agreement Type: Managed Service Product: WFBS-S Configuration Type: Spam Stats Worry-Free Business Security Advanced Type: T-WFBS-A Level: Advanced Agreement Type: Managed Service Product: WFBS-A Configuration Type: Spam Stats 4-33

108 Trend Micro Remote Manager User's Guide PRODUCT/SERVICE Worry-Free Business Security Services SETTINGS Type: T-WFBSS Level: Standard Agreement Type: Managed Service Product: WFBSS Configuration Type: Spam Stats Hosted Security Type: T-HES Level: Standard Agreement Type: Managed Service Product: HES Configuration Type: Spam Stats f. Click Save. 8. Build a new company for every customer you want to integrate with ConnectWise. a. Go to Contacts > Company > New. b. Update Company ID. Trend Micro recommends using the Remote Manager Customer Name as the ConnectWise Company ID. c. Click Save. Repeat these steps to build a company for each customer. 9. Build a new management for each company a. Click Management (tab). b. Click Save. c. Click New Item. d. Update Solution to Remote Manager Management Solution. e. Update Managed ID to the company ID specified in the previous step. 4-34

109 Preparing the Infrastructure f. Click Save. 10. Build configurations for each company. a. Click Configuration (tab). b. Build a new configuration with Configuration Type set to Spam Stats and the Name set to use the company ID. c. Click Save. 11. Build a new agreement for each customer you want to integrate with ConnectWise. a. Go to Agreements (tab) > New. b. Select Managed Service as the Agreement Type and update the other details as required. c. Click Save. 12. Include additions for the agreement. a. Go to Agreements > Additions. 4-35

110 Trend Micro Remote Manager User's Guide b. Update the fields as required. For example, update the price and the serial number. Important The serial number must use the SerialNumber: Serial_Company ID format. c. Click Save. Repeat these steps for every managed product/service. 4-36

111 Chapter 5 Managing Customers This section contains the following topic: Customers on page

112 Trend Micro Remote Manager User's Guide Customers Check your customer details and license information through the Customers page. You can also do the following: Click each customer s name to see more details of the customer information Filter the customer list Export customers information to a csv file Add new customers Renew licenses Manage products Adding New Customers Procedure For Licensing Management Platform accounts: 1. Go to Customers > {customer name} > Products (tab) > Add. 2. Select the service plan, the start date, and the number of units per license. 3. Click Next. 4. Configure the default settings for the product. You can choose one of the following: 5-2

113 Managing Customers Note This feature will show only if you selected Worry-Free Business Security Services. 5-3

114 Trend Micro Remote Manager User's Guide Basic: Configure only the settings shown. 5-4

115 Managing Customers Approved List for Web Reputation and URL Filtering Note If you are adding a URL to the Approved list, make sure it has not been added to the Blocked List, and vice versa. Blocked List for URL Filtering Scheduled Scan for the Server and device Templates: Go to Administration > Configure default setting templates to set up more settings, using a console similar to Worry-Free Business Security. 5. Click Done. The product/service is added and the details of the addition appear. Note Make note of the GUID or Authorization Key. 6. Click Connect to get information on how to connect the product/service to the console. For other accounts: 1. Click New Customer from the banner or go to Customers > New Customer. A New Customer page will open. 5-5

116 Trend Micro Remote Manager User's Guide 2. Provide the necessary information. 3. Click Next >. 4. Select the product type and provide a product description. 5. Click Done. 5-6

117 Managing Customers Associating Accounts If you manage other Trend Micro Remote Manager accounts that have not migrated to the new Licensing Management Platform, you can merge those accounts with the current one. Procedure 1. Sign into a Remote Manager account that has been migrated to Licensing Management Platform. The Dashboard screen opens. 2. Click the arrow next to the sign in name and click Merge Another Account > Continue. WARNING! If you merge an account to the current one, all data from the other account will be moved. For example, if you are currently signed in as admin1 and you merge admin2 to the admin1 account, all the data from the admin2 account will be deleted from the admin2 account. This data has been merged with the admin1 account. You will still be able to open the admin2 account but all the data will be in the admin1 account. 3. Enter the user name and password of the account you want to merge with the current one. 4. Click Merge. Wait a couple of minutes for the data to be merged. 5-7

118 Trend Micro Remote Manager User's Guide What to do next After migrating the account, you will always see the following when adding a new customer: With an active Licensing Management Platform account: If the new customer already has an account in Licensing Management Platform. With existing product servers that need to be connected to this account: If the new customer has a product/service but the account has not been integrated into Licensing Management Platform. Checking Product License Check your customers' managed server product licenses regularly to ensure continuous protection. Procedure 1. Click Customers > {customer} > {product} > License (tab). 2. Check the product license information. 5-8

119 Managing Customers Adding Products/Services Procedure 1. Go to Customers > {customer name} > Products (tab) > Add. For Licensing Management Platform accounts: a. Select the service plan, the start date, and the number of units per license. b. Add the product or service. The product/service is added and the details of the addition appear. c. Click Done. If you are using an account that has been integrated with the Trend Micro Licensing Management Platform: a. Select the product type and add a product description. b. Click Done. 5-9

120 Trend Micro Remote Manager User's Guide c. Make note of the GUID or Authorization Key. You will need this when you are registering your products on page 4-6. Contacts If your account is associated with Licensing Management Platform, you can add contacts, modify customer information, or delete contacts from the Licensing Management Platform. Click the Licensing Management Platform link above Sign Out to do so. If you do not see that link, you can only view contact information from the Remote Manager web console. Adding Contacts To subscribe to event notifications and reports, users in your customer s organization first need to be added as contacts. Note If your account is associated with Licensing Management Platform, click the Licensing Management Platform link above Sign Out to add contacts. If you do not see that link, you can only view contact information from the Remote Manager web console. Procedure 1. Go to Customers > {customer} > Contact Information (tab). 2. Click Add. 3. In Add Contact, provide the following information: Contact name Phone number ZIP/Postal code Remote Manager will send event notifications and reports to this address. 5-10

121 Managing Customers Other 4. Click Save. Modifying Customer Information The Company Profile and Contact Information tab lets you edit a customer's information. Note If your account is associated with Licensing Management Platform, click the Licensing Management Platform link above Sign Out to modify the contact information. If you do not see that link, you can only view contact information from the Remote Manager web console. Procedure 1. Go to Customers > {customer} > Company Profile (tab). 2. Update the company information. Note You can also change the logo that customers will see when they sign into the Remote Manager web console. 3. Go to Customers > {customer} > Contact Information (tab). 4. Update the contact details. 5. Click Save. Deleting Contacts Customers can subscribe to notifications and reports as contacts. However, there are times when the contacts change and some contacts have to be removed from the list of recipients. 5-11

122 Trend Micro Remote Manager User's Guide Note If your account is associated with Licensing Management Platform, click the Licensing Management Platform link above Sign Out to modify the contact information. If you do not see that link, you can only view contact information from the Remote Manager web console. Procedure 1. Go to Customers > {customer} > Contact Information (tab). 2. Select the contact to delete. 3. Click Delete. Deleting Customers If you delete a product or service, all the records for this product or service will be deleted. If you wish to re-register the product or service to the Trend Micro Remote Manager server, you have to create a GUID for this customer. You also need to reinstall the Remote Manager Agent on the managed product and use the new GUID. Note This feature is only applicable on accounts that have not integrated with Licensing Management Platform. Procedure 1. Delete all associated products/services from the customer. a. Click Customers > {customer}. b. Select all the products/services in the Product tab. c. Click Delete. 2. Delete one or more customers. a. Click Customers. 5-12

123 Managing Customers b. Select the customers in the list. Note c. Click Delete. Select only customers that do not have products or services. Filtering the Customer List The Customer list can show a short or long list, depending on how many customers you have. To get to the information you need, you can narrow down the customers and find only the customers that fit the profile you set. Procedure 1. From the Remote Manager web console, click Customers. All your customers will show on this page. 2. On the right-hand side, select one or more fields. Note If you select more than one (1) field, you might get the specific information you need, and that is a good thing. However, you might also have filtered out the information you need, so be careful what you select. 3. (Optional) Click Export to generate a CSV file of your filtered customers. 5-13

124

125 Chapter 6 Managing Agents This section contains the following topics: Managing Agents from the Remote Manager Web Console on page 6-2 Managing Agents from the Managed Server on page 6-6 Removing Agents on page

126 Trend Micro Remote Manager User's Guide Managing Agents from the Remote Manager Web Console This section contains information on how to manage agents from the Trend Micro Remote Manager web console. Checking the Connection Between the Agent and Server To ensure that the Trend Micro Remote Manager service is running smoothly, make sure that Agents have a status of "connected" or "online" on the Remote Manager web console. Go to Customers > {customer} > Products (tab). The tree lists the status of each Agent in the Status column. For details on each status, see Agent Status on page 6-2. In addition to the current section, refer to Troubleshooting and Known Issues on page 11-1 for more issues dealing with Server/Agent connectivity. Agent Status The status of a Remote Manager Agent indicates whether the Agent is able to collect data and receive commands from the Remote Manager server. The status also indicates the reason why the Agent cannot function properly and how you can handle the situation. The table below describes the different Agent status types and ways to handle the situation. TABLE 6-1. Agent status types STATUS DESCRIPTION RESOLUTION Online The Agent is running normally. NA 6-2

127 Managing Agents STATUS DESCRIPTION RESOLUTION Abnormal Disabled Offline The Agent appears offline and is not responding to the Remote Manager server, but has not sent a logoff request. This status is set manually from the console. When an Agent in disabled status, the Agent queries commands from the server every 10 minutes. The Agent closed normally after having sent a logoff request to the Remote Manager server. Typically, an Agent is in this status if a user has shut down the Agent service or the managed server has shut down. This status can occur if the managed server did not shut down properly. Ensure that the managed server administrator is aware of this situation. Contact the administrator if necessary. Submit a command to enable the Agent (See Submitting Agent Commands on page 6-4). Ensure that the managed server administrator is aware that the server has shut down. Contact the managed server administrator if necessary. Unknown The Agent is not working normally. Remove the Agent and have the managed server administrator reinstall the Agent. Contact your support provider if this issue persists. Plug-in errors Unregistered The console has detected errors in the Agent's service plug-in component. The Agent has not registered to the Remote Manager server. Remove the Agent and ask the managed server administrator to re-install the Agent. Contact your support provider if this issue persists. The Agent may have not been installed or has not been able to communicate successfully with the Remote Manager server. Contact the managed server administrator. 6-3

128 Trend Micro Remote Manager User's Guide STATUS DESCRIPTION RESOLUTION Version mismatch Incompatibility between the versions of any of the following components has been detected: Agent Remote Manager Worry-Free Business Security (Standard and Advanced) Upgrade the Agent and the managed server. If this does not work, report this problem to the Trend Micro Data Center administrator. Submitting Agent Commands Agent commands allow you to remotely resolve issues affecting the Worry-Free Business Security (Standard and Advanced) Agent. If an Agent is in abnormal or unregistered status, you cannot submit a command to it. Procedure 1. Go to Customers > {customers} > {product} > Groups (tab). Select one of the following commands: Scan Now: Initiates a scan of the endpoint. Stop Scan: Stops the scanning process. 2. Go to Customers > {customers} > {product} > Domain Settings (tab). Select one of the following commands: Enable: Restores the Agent from disabled status to normal functionality. Disable: Agent stops collecting information but continues to query the server for commands every 10 minutes. Start Vulnerability Assessment: Performs a vulnerability assessment scan. Start Damage Cleanup Services: Scans and cleans computer of file-based and network viruses, and virus and worm remnants. 6-4

129 Managing Agents 3. Go to Customers > {customers} > {product} > Managed Server (tab). Select one of the following commands: Update Managed Server: Downloads and installs managed server updates. Update Security Agent: Downloads and installs agent updates. Viewing Agent Details Procedure 1. Go to Customers > {customer} > Products (tab) > WFBS-S/WFBS-A > Endpoint. The following information is displayed: Status Name GUID: Globally unique identifier; Remote Manager generates this string automatically. Provide the GUID to the administrator who will install the Agent program. IP address: IP address of the server where the Agent is installed. Registered on Last update: Date and time the Agent was last updated Agent version Managed product: Product managed through the Agent Managed product version: Version of the product managed through the Agent 6-5

130 Trend Micro Remote Manager User's Guide Managing Agents from the Managed Server This section contains information on how to manage agents from the managed server. Agent Status Messages On the managed server, the Agent displays one of the following system tray icons: TABLE 6-2. System tray icons ICON DESCRIPTION A green icon indicates that the Agent is connected to the Remote Manager communication server. The Agent is working normally. A red icon indicates that the Agent isn t connected to the Remote Manager communication server or the version of the Agent is mismatched with the server and needs to be updated. An icon with a red arrow indicates that the Agent has logged off from Remote Manager. An icon with a red "X" means that the Agent has been disabled. Changing the Agent GUID on the Managed Server If you entered an incorrect Globally Unique Identifier (GUID) during Remote Manager Agent installation, delete the agent and install it again using the correct GUID. If you are unable to do this procedure, you can do the following: Procedure 1. Go to C:\Program Files\Trend Micro\TMRMAgentForCSM. 2. Open the AgentSysConfig.xml file using a text editor. 3. Look for the GUID between the parameters <AgentGUID> and </AgentGUID>. 4. Edit the GUID and then save the file. 6-6

131 Managing Agents 5. In the same folder, open the csmsysconfig.xml file using a text editor. 6. Look for the GUID between the parameters <ProductGUID> and </ ProductGUID>. 7. Edit the GUID and then save the file. 8. Right-click the Trend Micro Remote Manager Agent icon on the task bar and then click Restart Service. Using the Agent Configuration Tool The Agent Configuration Tool allows changes to be made to Remote Manager Agent configuration settings. Go to Start > Programs > Trend Micro Remote Manager Agent > Agent Configuration Tool or right-click the tray icon and click Configure. See Agent Configuration on page 6-7 for more information. Agent Configuration Agent Configuration Menu To configure the Agent, right click on the tray icon to open the following menu: FIGURE 6-1. Agent Configuration Tool pop-up menu The following items appear: 6-7

132 Trend Micro Remote Manager User's Guide Configure: Opens the Agent configuration screen. Select Language: In addition to other possible languages, the "English" language always exists. Service: Start, Stop, Restart. Exit: Exiting the tool does not stop the Remote Manager service. It only closes the Configuration Tool and removes the icon from the task bar. The tool can be restarted at any time. 6-8

133 Managing Agents Configuration Tool Main Dialog Right-click on the tray icon and click Configure on the Agent configuration menu to open the Agent configuration tool General tab. FIGURE 6-2. Agent Configuration Tool "General" tab 6-9

134 Trend Micro Remote Manager User's Guide The following sections of the Agent configuration screen are the only presently relevant sections of this tool. Server Settings: Configure server communication by setting the following: Server address: The fully qualified domain name (FQDN) of the Remote Manager communication server. The FQDN varies in each region as follows: Asia Pacific: rm-apaca.trendmicro.com Europe and the Middle East: rm-emea.trendmicro.com Japan: rm-jpa.trendmicro.com Latin America: rm-lara.trendmicro.com North America: rm-usa.trendmicro.com Port: The port that the Remote Manager server uses to communicate with the Agent. This should be 80 for HTTP and 443 for HTTPS. Protocol: The protocol used for communication between the server and the Agent. Proxy Server Settings: Enable this area by clicking the Proxy server settings checkbox if the user s network requires a proxy to communicate with the Remote Manager server. Address: The IP address of the proxy server Port: The port or the proxy server Protocol Test Connection button: The Test Connection button is used to test communication between the Agent and the Remote Manager server. Use this function to test if the basic connection to the communication server works well. If it fails (a popup dialog box will appear if the tool cannot connect to the server), there may be a basic issue such as the address of the communication server and its port, or the Proxy server address and its port. 6-10

135 Managing Agents Backing Up and Restoring Agent Settings If you need to uninstall and then reinstall the Agent using the same GUID within a span of three days, keep the Agent settings to avoid any overlapping data. To do this, back up the configuration files manually and then replace the configuration files with the backup after reinstalling the Agent. Backing Up Settings Procedure 1. On the managed server, right click the Agent system tray icon and click Stop Service to stop the Agent service. 2. Copy all the.xml,.dat, and.ini files from the installation folder C:\Program Files\ Trend Micro\WFRMAgentforCSM..xml files csmsysconfig.xml csmlocalconfig.xml csmlogdef.xml AgentWorkConfig.xml AgentSysConfig.xml AgentStatus.xml AgentLocalConfig.xml.dat files MSA.dat logbuf.dat group.dat CSA.dat 6-11

136 Trend Micro Remote Manager User's Guide CriticalVA.dat.ini files csmstatusdata.ini 3. Copy all the files from the \Cache folder. 4. Restart the Agent service. Restoring Settings Procedure 1. Remove the Agent locally if you haven t already. For detailed instructions, see Removing Agents Locally on page Note When removing the Agent locally, the Agent will unregister from Remote Manager which automatically deletes all data associated with the Agent. To prevent the Agent from unregistering, modify the Server address value in Agent interface before removing the Agent. 2. Reinstall the Agent. Ensure that you use the same GUID which can be obtained from agentsysconfig.xml. 3. On the managed server, right click the Agent system tray icon and click Stop Service to stop the Agent service. 4. Replace the configuration files with the backup files. 5. Right-click the Agent system tray icon and click Start Service to restart the Agent service. 6-12

137 Managing Agents Finding the Agent Build Number You can check the build number of the Agent either from the console or directly, on the Agent. From the Remote Manager Web Console Procedure 1. Click the Customers tab. 2. Select the target domain from the View by drop-down list in the left pane. 3. Click All Customers > {customer} > {agent} > Server/Agent Details > TMRM Agent Details. 4. Check the agent version in the General Information table. On the Agent Procedure 1. Go to the C:\Program Files\Trend Micro\WFRMAgentForCSM directory. 2. Right-click the csmplugin.dll file and then click Properties > Version (tab) to see the build number. Location of Agent Logs and Configuration Files Agent configuration files are located in: <install path>\trend Micro\WFRMAgentForCSM\*.xml 6-13

138 Trend Micro Remote Manager User's Guide <install path>\trend Micro\WFRMAgentForCSM\*.ini Log files are located in: <install path>\trend Micro\WFRMAgentForCSM\log\ Enabling the Agent Debug Log Normally the Agent will only log warning and error information. If more detail log information is required, enable the Agent's debug log. Resolution 1. Open the file AgentLocalConfig.xml in <install path>\trend Micro \WFRMAgentForCSM\ in a text editor. 2. Change <DebugLogLevel> from LL_FOR_ERROR to LL_FOR_ALL. 3. Restart the Agent service by right-clicking the Remote Manager Agent on the task bar, then clicking Restart Service. 4. The Agent log file is <install path>\trend Micro\WFRMAgentForCSM \log\tmicagent.log. Removing Agents This section contains information on how to remove agents. Removing Agents Locally Before removing an Agent, refer to Backing Up and Restoring Agent Settings on page

139 Managing Agents WARNING! Unregistering an Agent from Remote Manager deletes all data associated with the Remote Manager Agent. To prevent the Agent from unregistering (and deleting its data), modify the server address value on the Remote Manager Agent interface before removing the Remote Manager Agent. There are three ways to remove an Remote Manager Agent locally: Directly uninstall the Remote Manager Agent. Uninstall the Remote Manager Agent via the Control Panel. Uninstall the Remote Manager Agent manually. Directly Uninstall the Remote Manager Agent Procedure 1. Open the Remote Manager Agent installation file (WFRMAgentforCSM.exe or WFRMAgentforWFBS.exe). 2. Click Yes to confirm the Confirm Uninstall dialogue box. Note During removal, you will be prompted to close certain applications. Close these applications and click Retry to continue. 3. Click Finish to close the wizard after the uninstallation is complete. Uninstall the Remote Manager Agent from the Control Panel Procedure 1. Open the Control Panel Add or Remove Programs applet (or Programs and Settings on Windows Vista ). 6-15

140 Trend Micro Remote Manager User's Guide 2. Select Trend Micro Remote Manager Agent and then click the Change/ Remove button. 3. Follow the on-screen instructions. Uninstall the Remote Manager Agent Manually If for any reason an Agent cannot be removed through standard ways, try these steps: Procedure 1. Stop the Remote Manager Agent service. a. Go to Start > Run. b. Type cmd on the command line and then press the Enter key. c. Run the following command: net stop Trend Micro Worry-Free Remote Manager Agent 2. Remove the Remote Manager Agent service: a. On the command line, use the change directory (cd) command to go to the Remote Manager Agent directory. b. Run the following command: TMICAgent -u 3. Remove the program files. Delete {Agent install directory} / WFRMAgentForCSM 4. Open the Registry Editor (regedit.exe) and remove the following registry keys: Note Always create a backup before modifying the registry. Incorrect registry changes may cause serious issues. Should this occur, restore it by referring to the "Restoring the Registry" Help topic in regedit.exe or the "Restoring a Registry Key" Help topic in regedt32.exe. 6-16

141 Managing Agents HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\TMIC4CSM\Agent \HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products \23FC8F347B51DD440AD13A73D13A73D22D58E6 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion\Installer\UserData\S \Products \23FC8F347B51DD440AD13A73D13A73D22D58E6 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion\Uninstall\{43F8CF32-15B7-44DD-A01D- A3372DD2856E} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion\Uninstall\InstallShield Uninstall Information\{43F8CF32-15B7-44DD-A01D-A3372DD2856E} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows \CurrentVersion\Uninstall\InstallShield_ \{43F8CF32-15B7-44DD-A01D-A3372DD2856E} 5. Remove the Remote Manager Agent shortcut from the Start menu. a. On the desktop, click My Computer. b. Change the current directory to..\documents and Settings\All Users\Start Menu\Programs. c. Delete the Remote Manager Agent folder. 6-17

142

143 Chapter 7 Managing Licenses This section contains the following topics: Note This feature is only applicable if you are using an account that has been integrated with the Trend Micro Licensing Management Platform. Adding Seat Allocations on page 7-2 Renewing Licenses on page

144 Trend Micro Remote Manager User's Guide Adding Seat Allocations Each reseller can specify how many seats they can allocate per customer. If they exceed the allocated number of seats, resellers can add more seats per customer. Note This feature is only applicable if you are using an account that has been integrated with the Trend Micro Licensing Management Platform. Procedure 1. There are several ways to see the Add Seats window: From the Trend Micro Remote Manager web console: a. Click Customers. b. Select the customer that exceeded the seat allocation. c. Click Change Seats. From the Notifications widget, click the Add seats now link beside the notification. From the notification message, click the Add seats now button. 2. Specify the number of seats you want to add to your allocation. 3. Click Submit. Renewing Licenses Renew licenses for customers you manage. Note This feature is only applicable if you are using an account that has been integrated with the Trend Micro Licensing Management Platform. 7-2

145 Managing Licenses Procedure 1. There are several ways to see the Renew Licenses window: From the Remote Manager web console: a. Click Customers. b. Select the customer that has the expired license or will be expiring soon. c. Click Renew License. From the Notifications widget, click the Renew now link beside the notification. From the notification message, click the Renew now button. 2. Specify the change to the license terms. 3. Click Submit. 7-3

146

147 Chapter 8 Managing Settings This section contains the following topics: Configuring Notifications on page 8-2 Configuring Console Settings on page 8-3 Configuring Default Setting Templates on page

148 Trend Micro Remote Manager User's Guide Configuring Notifications Set up the notifications if there are events that need your attention. These notifications can either be through , from the Notifications widget, or through your third-party software. Procedure 1. Configure the general notification settings. a. Click Administration > Configure notifications. Note The screen shows which address will receive the notification. If this is incorrect, go to My Account, or the Licensing Management Platform web console, and change the settings for the profile. b. Select the language. c. (Optional) Enable or disable the daily notification summary . This will give you a notification every day to keep you informed of all the events that were triggered and that still need some kind of action. d. Specify the types of notifications that will be sent when the events are triggered: Show in Notifications: You will see notifications for this event on the Notifications widget. You will also see the number of events from the Notifications icon on the banner section of the console. You will receive an notification for this event. You may be able to renew the licenses or add to your allocated seats directly from the links provided in this . e. Click Save. 2. Configure the customer-specific notification settings. a. Go to Customer > {customer name} > Notifications (tab). 8-2

149 Managing Settings b. Select the notification setting. c. Specify additional recipients. Note Make sure the customers have integrated third-party tools before enabling notifications for Kaseya, Autotask, or ConnectWise. Configuring Console Settings Specify the logo that customers will see whenever they sign into the service. Note This is an optional setting. Procedure 1. Click Administration > Console settings. 2. Select an image that you want to use. The logo must be a.png,.jpg,.bmp, or.gif image with a suggested size of 600 (width) by 55 (height). 3. Click Save. Configuring Default Setting Templates Note Default Setting Templates are only available if you integrated Trend Micro Remote Manager with Licensing Management Platform, and only for your Worry-Free Business Security Services product. 8-3

150 Trend Micro Remote Manager User's Guide Default setting templates are templates that already have the preconfigured settings for a customer. This makes it easier to ensure that customers are using the same settings. When creating the templates, you will see a console that looks like Worry-Free Business Security Services. This was done to give you a sense of familiarity when setting the default options that each customer will use. You can create several templates that are specifically for customer types, or groups. For more information on the settings that you can configure from this template, refer to the Worry-Free Business Security Services documentation at: Procedure 1. Go to Administration > Configure default setting templates. 2. Click Create. 3. Specify the template name and some comments or descriptions. This will help you remember what or who this template is for. 4. Click Configure Template. Note A console similar to Worry-Free Business Security Services will open. Any changes you make to this site are saved as a template and do not affect any registered product. 5. Configure the following settings: Policies 8-4

151 Managing Settings a. Go to Devices > Server (Default) > Configure Policies. b. Configure the default server policy settings. c. Go to Scans > Device (Default) > Configure Policies. d. Configure the default device policy settings. e. Click Save. Scan settings a. Go to Scans > Manual Scan (tab). b. Configure the default server and device settings. c. Go to Scans > Scheduled Scan (tab). d. Configure the default server and device settings. e. Click Save. Notification settings a. Go to Administration > Notifications > Events (tab). b. Specify the events and recipients that will trigger an event notification. c. Click Save. Global settings a. Go to Administration > Global Settings > Security Settings (tab). b. Make the necessary changes to the scan, behavior monitoring, or outbreak prevention settings. c. Go to Administration > Global Settings > Approved/Blocked Settings (tab). d. Add or remove sites to the approved or blocked sites. e. Go to Administration > Global Settings > Agent Control (tab). f. Change the agent settings. 8-5

152 Trend Micro Remote Manager User's Guide g. Go to Administration > Global Settings > Device Management (tab). h. Change the user-based device management settings. i. Click Save. 8-6

153 Chapter 9 Managing Events This section contains the following topics: Managing Events on page 9-2 Viewing Events on page 9-4 Event Types on page

154 Trend Micro Remote Manager User's Guide Managing Events In Trend Micro Remote Manager, an event occurs when a product or service at a customer location needs your attention. Use the Incident Logs screen to review and manage events of all your customers. You can look for events that have occurred on Worry-Free Business Security, Worry-Free Business Security Services, and Hosted Security either by type or by customer. You can also filter events by severity and status. FIGURE 9-1. The Incident Logs screen showing antivirus events Events Events are categorized as follows: Threats Outbreak Defense on page 9-5 Antivirus on page 9-7 Anti-spyware on page 9-9 Anti-spam on page 9-10 Network Virus on page 9-11 Web Reputation on page

155 Managing Events Behavior Monitoring on page 9-12 URL Filtering on page 9-13 Device Control on page 9-13 System Smart Protection Service on page 9-14 Component Update on page 9-14 Disk Usage on page 9-15 License Severity License Expired License Expiring Soon Seat Usage Severity is categorized as follows: Action Required: Events that require immediate attention. Warning: Warnings or notifications are only intended for your information. Status Status is categorized as follows: Unsolved: These events need your attention. Resetting/Updating: You have worked on these events and these events are waiting for an update from the product/service. 9-3

156 Trend Micro Remote Manager User's Guide Viewing Events Procedure 1. Go to Home > {dashboard} > {widget} 2. Click one of the incidents. 3. Do any of the following: View incidents by type or by customer using the tree and search window on the left View events of a particular product/service using the tabs on the right Filter events by severity or status using the drop-down lists on the top-right of the screen Drill-down to a particular event by clicking links from widgets or notifications to view more information Select an event and click Reset to reset counts or click Update to update components. Refer to Event Types on page 9-5 for information on each event and what actions need to be taken. 9-4

157 Managing Events Event Types This shows the different event types you can view from Trend Micro Remote Manager. Outbreak Defense Status Detail Note This is only available for Worry-Free Business Security (all). Outbreak Defense provides early warning for Internet threats and other worldwide outbreak conditions. Outbreak Defense automatically responds with preventive measures to keep computers and networks safe, followed by protective measures to identify the problem and repair the damage. While Outbreak Defense protects networks and clients, TrendLabs on page 12-4 creates solutions to the threat. After developing the solution, TrendLabs releases updated components, and Worry-Free Business Security (all) servers download and deploy the updated components to clients. Outbreak Defense then cleans any virus remnants and repairs files and directories damaged by the threat. Outbreak Defense may take the following actions if an outbreak occurs: Block ports Write-protect certain files and directories Block certain attachments To determine the outbreak defense status for managed networks, Trend Micro checks whether TrendLabs has declared a virus alert. An Outbreak Defense event only displays on the dashboard if one or more Outbreak Defense events have occurred. The table below shows the possible outbreak defense status icons. TABLE 9-1. Outbreak Defense status icons STATUS ICON DESCRIPTION TrendLabs has declared a Yellow Alert 9-5

158 Trend Micro Remote Manager User's Guide STATUS ICON DESCRIPTION TrendLabs has declared a Red Alert Alert Status Alert status information displays whenever there is a red or yellow alert. Enable Outbreak Defense to ensure that preventive measures deploy automatically and protect the network before a pattern becomes available. Vulnerable Computers Vulnerable computers have not been patched for known software vulnerabilities. To handle vulnerable computers, contact the administrator of the affected domain and provide the names of the vulnerable computers and the vulnerabilities affecting them. To get this information, click the number of vulnerable computers. To ensure that the list of vulnerable computers is current, run a Vulnerability Assessment (VA) scan. For more information, refer to Worry-Free Business Security Commands on page Computers to Clean Computers to Clean are infected computers with a virus or malware that the security client did not successfully clean, delete, or quarantine upon detection. Typically, an infected computer contains a running copy of the virus or malware that configured the computer to allow the virus or malware to automatically start and stay running. To view a list of the infected computers and the names of the viruses, click the number of computers to clean. To address infected computers, deploy Damage Cleanup Services (DCS) to the domain. For more information, refer to Worry-Free Business Security Commands on page

159 Managing Events Antivirus Status Detail Note This is only available for Worry-Free Business Security (all). The table below shows the possible antivirus status icons and color-coding. TABLE 9-2. Antivirus Status Icons STATUS ICON DESCRIPTION This status icon displays if 15 or more spyware/grayware incidents within 1 hour have been found (Worry-Free Business Security (all), by default). Administrators can modify the threshold on the managed server. The onehour interval is the 60-minute period before the point of assessment. This status icon displays if any of the following conditions occur: The real-time scanner on the Exchange server is disabled. A security client is unable to clean or quarantine a malware. For Worry-Free Business Security Standard or Advanced 5.1 or later: The real-time scanner is disabled in at least one computer. Virus Threat Incidents Virus threat incidents are the number of virus or malware detections in the domain. The console groups this statistical information into the following groups: Desktop/Servers: virus or malware detected during manual scans or when files are accessed on desktop and server computers Exchange servers: virus or malware detected in messages that are processed by an Exchange server Access additional information or actions, if available, by clicking Details. 9-7

160 Trend Micro Remote Manager User's Guide WARNING! Do not click Reset unless you are sure that the incidents have been addressed and contained. Antivirus Action Unsuccessful Antivirus scanners clean, quarantine, or delete files found with malware or viruses. Typically, the scanner performs an initial action. If the scanner cannot perform this action, the scanner performs a secondary action. Unsuccessful actions indicate that a virus or malware has successfully circumvented antivirus defenses and has infected the computer. Remote Manager assumes that computers with an unsuccessfully cleaned, quarantined, or deleted virus or malware are infected. Access additional information or actions, if available, by clicking Details. Computers to Clean Computers to Clean are infected computers with a virus or malware that the security client did not successfully clean, delete, or quarantine upon detection. Typically, an infected computer contains a running copy of the virus or malware that configured the computer to allow the virus or malware to automatically start and stay running. To view a list of the infected computers and the names of the viruses, click the number of computers to clean. To address infected computers, deploy Damage Cleanup Services (DCS) to the domain. For more information, refer to Worry-Free Business Security Commands on page To address computers that were infected due to unsuccessful antivirus actions, deploy Damage Cleanup Services (DCS) to the domain. For more information, refer to Worry- Free Business Security Commands on page Real-time Scan Disabled Computers with Real-time Scan disabled will not be able to scan files as soon as they arrive or are processed. However, these files will still be scanned when scheduled scan 9-8

161 Managing Events starts. These computers are highly susceptible to virus or malware infection. Exchange servers with Real-time Scanners disabled will let all files (even those with malware) in messages pass, leaving the customer network susceptible to mass-mailing worms. Access additional information or actions, if available, by clicking Details. To enable the real-time scanner on all computers and Exchange servers in the domain, select the customer and click Solve. Anti-Spyware Status Detail Note Anti-Spyware is only available for Worry-Free Business Security (all). To show the anti-spyware status, the Customers page displays status icons and colorcoding that indicate a relatively high spyware/grayware incident rate and the presence of computers that are infected with spyware/grayware. The table below shows the possible anti-spyware status icons. TABLE 9-3. Anti-spyware Status Icons STATUS ICON DESCRIPTION Fifteen or more spyware/grayware incidents within an hour have been found (Worry-Free Business Security (all), by default). You can modify the threshold on the managed server. The one-hour interval is the 60-minute period before the point of assessment. Action required. At least one computer needs to be restarted to completely remove a spyware/grayware infection. Computer Restart for Anti-spyware Required Computer restart for anti-spyware required displays the number of computers infected with spyware/grayware that were partially cleaned. These computers remain infected because the spyware/grayware affecting them cannot be removed completely until after 9-9

162 Trend Micro Remote Manager User's Guide restarting the computers. To complete the cleanup process on these computers, contact an administrator on the customer s side to restart the computers manually. Access additional information or actions, if available, by clicking Details. WARNING! Do not click Reset unless you are sure that the incidents have been addressed and contained. Spyware/Grayware Threat Incidents Spyware/Grayware threat incidents are the number of spyware/grayware detections in the domain. To view the list of affected computers and the names of the spyware/ grayware threats, click the number of incidents. To reset the current count, click Reset. Access additional information or actions, if available, by clicking Details. WARNING! Do not click Reset unless you are sure that the incidents have been addressed and contained. Anti-spam Status Detail The Anti-spam Status Detail section warns of the increasing number of spam messages that the Exchange server processes. The screen displays status icons to show whether the percentage of spam messages (out of all messages that the Exchange server processes) has reached a certain threshold. An anti-spam event only displays on the dashboard if one or more anti-spam events occur. The table below shows the possible status icons. 9-10

163 Managing Events TABLE 9-4. Anti-spam Status Icons STATUS ICON DESCRIPTION Warning. Spam messages comprise 10% or more of the total messages processed by the Exchange server (Client Server Messaging/Worry-Free Business Security Advanced, by default). Administrators can modify the threshold on the managed server. This icon is not used to show these details. Network Virus Status Detail The network virus status detail section warns of any significant network virus activity on the network. The Event Management displays status icons and color-coding to indicate whether network virus activity in customer domains has reached a certain threshold. A network virus event only displays on the dashboard if one or more network virus events occur. TABLE 9-5. Network Virus Status Icons STATUS ICON DESCRIPTION This is a warning message. Ten or more network virus incidents within 1 hour have been found (Worry-Free Business Security (all), by default). Administrators can modify the threshold on the managed server. The onehour interval is the 60-minute period before the point of assessment. This icon is not used to show these details. Access additional information or actions, if available, by clicking Details. Web Reputation Status Detail Web Reputation evaluates the potential security risk of requested web pages before displaying them. Depending on the rating that the database returns and the configured security level, the Client/Server Security Agent located on computers managed by Worry-Free Business Security (all) either block or approve the request. The Web Reputation Services section indicates the number of attempts to retrieve web pages 9-11

164 Trend Micro Remote Manager User's Guide evaluated as a security risk. A Web Reputation event only displays on the dashboard if one or more Web Reputation events occur. TABLE 9-6. Web Reputation Status Icons STATUS ICON DESCRIPTION The clients are reporting numerous or frequent URL violations. More than 200 violations have been found within 1 hour (Worry-Free Business Security (all), by default). Administrators can modify the threshold on the managed server. The one-hour interval is the 60-minute period before the point of assessment. This icon is not used to show these details. Behavior Monitoring Status Detail Behavior Monitoring monitors the client for attempts to modify the operating system and other programs. When a Client/Server Security Agent located on computers managed by Worry-Free Business Security (all) detects an attempt, Security Agent notifies the user of the change. The user can allow or block the request. Worry-Free Business Security (all) administrators (or users) can create exception lists that allow certain programs to run while violating a monitored change or completely block certain programs. When the violations count exceeds the threshold, the status icon changes and the number of incidents is listed on the Dashboard and the Event Management screens. TABLE 9-7. Web Reputation Status Icons STATUS ICON DESCRIPTION The clients are reporting numerous or frequent URL violations. More than 200 violations have been found within 1 hour (Worry-Free Business Security (all), by default). Administrators can modify the threshold on the managed server. The one-hour interval is the 60-minute period before the point of assessment. This icon is not used to show these details. 9-12

165 Managing Events URL Filtering Status Detail The URL Filtering module delivers powerful, effective tools to manage employee Internet access and block offensive or non-work-related web sites. URL Filtering filters content through a database with millions of categorized URLs and employs dynamic rating technology to classify new Web pages in real time or in the background. IT managers can set URL policies by group or user, category, file type, time, day, bandwidth, and other variables. Note URL Filtering pertains to Worry-Free Business Security Services and Worry-Free Business Security Standard and Advanced versions 6.0 and up only. TABLE 9-8. URL Filtering Status Icons STATUS ICON DESCRIPTION Warning. URL Filtering events exceed 300 in the last hour. This icon is not used to show these details. Device Control Status Detail The Device Control module delivers powerful, effective tools to regulate access to external storage devices and network resources. Note Device Control pertains to Worry-Free Business Security Standard and Advanced versions versions 7.x and up only. TABLE 9-9. Device Control Status Icons STATUS ICON DESCRIPTION Warning. Unauthorized device access incidents exceed 300 in the last hour. 9-13

166 Trend Micro Remote Manager User's Guide STATUS ICON DESCRIPTION This icon is not used to show these details. Smart Scan Trend Micro Worry-Free Business Security uses a technology called Smart Scan. Previously, Worry-Free Business Security Services clients only used Conventional Scan, which involved each client downloading scan-related components to perform scans. With the Smart Scan process, the client uses the pattern file on the Smart Protection server instead. Only the Smart Protection Server resources are used for scanning files. Note Smart Protection technology is used by Worry-Free Business Security Standard and Advanced versions 6.x and up, and Worry-Free Business Security Services 3.x and up only. TABLE Disk Usage Status Icons STATUS ICON DESCRIPTION The Smart Protection service has been interrupted on a Worry- Free Business Security agent. The Smart protection service has been interrupted on a Worry- Free Business Security agent. If the Smart Protection service is not running, wait 30 minutes to give the Agent time to sync with the global scan server. If the Agent still does not connect to Global scan server, check the Agent s internet connection. Contact your support provider for more help. Component Update The table below shows how the Customer page displays icons to indicate any update problems. 9-14

167 Managing Events TABLE Update Status Icons STATUS ICON DESCRIPTION Warning. This status icon appears if either of the following conditions occurs: The managed product has not updated successfully for more than seven days. The pattern and engine deploy rate on desktop and server computers is less than 90%. Action required. This status icon appears if any of the following conditions occur: The managed product has not updated successfully for more than 14 days. The pattern and engine deploy rate on desktop and server computers is less than 70%. At least one Exchange server is running with outdated security components. To address update problems, go to Customers > {customer} > System > Component Update > {product type}, select the product/service and click Solve. Once you have successfully updated the managed server and have deployed the latest components, Trend Micro recommends running a Manual Scan (under the Actions menu). A scan can find threats that outdated components missed. Disk Usage The Customers page lets you monitor disk usage on computers in the domain by displaying icons to indicate potential and current disk space problems. To understand what these icons mean, see the table below. 9-15

168 Trend Micro Remote Manager User's Guide TABLE Disk Usage Status Icons STATUS ICON DESCRIPTION This icon is not used to show these details. Action required. This status icon appears if more than one computer has less than 1% disk space (1% is the Worry-Free Business Security Standard and Advanced default which can be changed on the Worry-Free Business Security Standard and Advanced console). To address disk usage issues, contact the administrator of the affected domain. 9-16

169 Chapter 10 Reports This section contains the following topics: Reports Overview on page 10-2 Creating Reports on page 10-3 Viewing Reports on page 10-7 Editing Reports on page 10-7 Downloading and Sending Reports on page 10-7 Subscribing to Reports on page

170 Trend Micro Remote Manager User's Guide Reports Overview Trend Micro Remote Manager lets you generate, download, and automatically send out reports. Reports provide an overview of license status, assessment results, threat incidents, major threats, and the most affected computers, files and addresses in your customers networks. Reports include a range of statistics from Worry-Free Business Security (all) and Hosted Security. Remote Manager allows for report profiles, one-time and periodic reports, date ranges, and multiple recipients. Remote Manager saves the 30 most recent daily reports, ten most recent weekly reports, and five most recent monthly reports. General reports are suitable for resellers and customers. Detailed reports are suitable for resellers and partners. FIGURE Reports Page Report profiles enable you to create multiple reports from a single profile. For example, create a one-time report today, generate that report, and tomorrow, change some options and regenerate without having to recreate the entire report. Remote Manager currently supports general and detailed reports. 10-2

171 Reports Creating Reports Trend Micro Remote Manager offers the following ways to create a report template: Click an existing report, modify the report, and click Save at the bottom of the screen. Create a new report template. See Creating a Report Template on page 10-3 for more information. Creating Report Templates Procedure 1. Click Reports > New Report. The New Report screen opens. 10-3

172 Trend Micro Remote Manager User's Guide 2. Update the following as required: Report name Report type: Refer to Reports Overview on page 10-2 for more information. Only Worry-Free Business Security has a detailed report. 3. Select the report date range: One-time report 10-4

173 Reports OPTION DESCRIPTION Today Calculates the report with data received from 12 midnight up until the moment the report is generated (based on the selected time zone). Note The time zone that the report depends on is the one that the reseller selected when creating the profile. It is not determined by the customer's machine. Last 7 days Last 30 days Specific range Calculates the report with the last 7 days data (excluding today s data). Calculates the report with the last 30 days data (excluding today s data). The "From" date must be later than or equal to the first date of the last month (Remote Manager only stores the last and current month's data); the "To" date cannot be later than today. Recurring report OPTION Daily Report DESCRIPTION The end date must be later than today. Then every day in the specified range generates a report based on the previous day s data. For example, if the range is set from Jan to Jan , then: On the 27th, Remote Manager generates a report based on the 26th On the 28th, Remote Manager generates a report based on the 27th On the 29th, Remote Manager generates a report based on the 28th 10-5

174 Trend Micro Remote Manager User's Guide OPTION Weekly Report Monthly Report DESCRIPTION Remote Manager generates the weekly report every Monday using the previous week s data. Therefore, to generate a report for this week, set the end date to at least Monday of the following week. Remote Manager generates the monthly report every second day of the month using the previous month s data. This means that to generate a report for this month, set the end date to at least the second day of the following month. 4. Set the Report Content. This includes the following report format elements: OPTION DESCRIPTION Report format Report language Logo Note PDF or CSV format The language of the report. The logo is optional. Partner logo must be a.png,.jpg,.bmp, or.gif image with a suggested size of 600 (width) and 55 (height) pixels. The note field is for internal use and does not display on the report itself. 5. Click Next. 6. Select data for your report. Select a report template and the data you to be generated. Note 7. Click Next. If the reseller is not connected to the customer s server or there is no data, information does not display for the customer. 8. Select the customers that will generate this report. 10-6

175 Reports Note You can click Done and the reports will be generated for the selected customers. 9. Specify report details. Recipients under to options come from the companies contact list. See Adding Contacts on page You can also add address that will receive the generated reports. Note 10. Click Done. Each selected customer will have different recipients. You can add or delete recipients or a logo depending on the customers. Remote Manager adds the report template to the list of report templates. Viewing Reports A report must have been generated at least once in order to view it. Go to Reports > {report name} > Report Files (tab) > {file under View}. Refer to Reports Overview on page 10-2 for more information. Editing Reports Go to Reports > {report name}. Refer to Creating Report Templates on page 10-3 for more information. Downloading and Sending Reports You can download and send reports to recipients. Although recipients were specified when you defined the report, the recipient list can be modified. 10-7

176 Trend Micro Remote Manager User's Guide Procedure 1. Go to Reports > {item or number of items under Report Files} > {report under View}. 2. Select the reports you want to send or download. 3. Click Send or Download. See Subscribing to Reports on page 10-8 for more information. Subscribing to Reports Procedure 1. Go to Reports > {report name} > Target Audience (tab) > Add Target. 2. Select the customer report. Note The list of recipients when creating reports comes from Contact details. 3. Revise the subject line as required. 4. Click Save. 10-8

177 Chapter 11 Troubleshooting and Known Issues This section contains the following topics: Troubleshooting the Trend Micro Remote Manager Web Console on page 11-2 Troubleshooting the Agent on page 11-6 Known Server Issues on page Known Agent Issues on page FAQs on page

178 Trend Micro Remote Manager User's Guide Troubleshooting the Trend Micro Remote Manager Web Console This section contains the following topics: Access Issues A user cannot sign into Trend Micro Remote Manager. Resolution There are two possible reasons for this issue: JavaScript is disabled on the browser. Remote Manager requires this option to be enabled. Refer to your browser's documentation for instructions. Profile has not been synchronized. If you just registered on Trend Micro Licensing Management Platform and cannot sign in, wait for a few minutes for the information to synchronize. Domain Tree not Visible after Installing the Agent The domain tree does not appear on the console after you install the Remote Manager Agent on the managed server. The Globally Unique Identifier (GUID) is incorrect. The Remote Manager Agent cannot communicate with Remote Manager. Resolution 1. Make sure that the GUID entry is correct. a. On the Security Server, use a text editor like Notepad to open C:\Program Files\Trend Micro\WFRMAgentForCSM\AgentSysConfig.xml. b. Check the GUID right after the parameter. c. If you corrected the GUID, save the file then restart the Trend Micro Remote Manager Agent service. 11-2

179 Troubleshooting and Known Issues d. Check the status of the customer's domain from the Remote Manager after a couple of minutes. 2. Check the Agent-Server connection using the Test Connection feature. a. Go to Start > Programs > Trend Micro Remote Manager Agent > Agent Configuration Tool. b. Click Test Connection. c. If the test connection fails: i. Check if the managed server can connect to the Internet. ii. iii. Check if you entered the Trend Micro Remote Manager Server address correctly. If the Security Server uses a proxy to connect to the Internet, make sure that you also entered the proxy server settings. Node on Tree Cannot Be Expanded If a node on the domain tree (under the Customers tab) does not expand when clicked, group and client information on the Worry-Free Business Security server and the Trend Micro Remote Manager server may be out of sync. Resolution Right-click the node, then click Action > Sync with Managed Server to resend data from the Agent to the Trend Micro Remote Manager server. Page Cannot be Displayed Page cannot be displayed shows up when trying to open the Trend Micro Remote Manager Server URL. This happens if: The URL is incorrect. The Trend Micro Remote Manager Server's URL is not an Internet Explorer Trusted Site. 11-3

180 Trend Micro Remote Manager User's Guide Resolution 1. Make sure that the Trend Micro Remote Manager Server's URL is an Internet Explorer Trusted Site. a. Open Internet Explorer. b. Click Tools > Internet Options > Security > Trusted Site > Sites. c. Check if the Trend Micro Remote Manager Server URL is in the list. If not, type it in and then click OK. Incorrect Information on the Dashboard If the dashboard seems to be giving you incorrect or incomplete information about a particular domain. Resolution Check if the managed server is started. Check if the Agent is started and running correctly. Check the Remote Manager web console at Customers (tab) > All Customers (on the tree) > {customer} > WFBS-S/WFBS-A > Server/ Agent Details (right pane) > TMRM Agent Details (see Agent Status on page 6-2). Check the status of the Agent on the managed server (see Managing Agents from the Managed Server on page 6-6, Agent Status on page 6-2 and, Verifying Agent Installation on page 4-8). Check if the customer re-installed the Agent. Also check if the customer reinstalled the Agent and used a different or duplicate GUID. By default, the Agent should get up to the last three days of data from the managed server. You can try generating a new GUID and re-installing the Agent. Unable to Deploy Commands If you are unable to deploy network commands to an Agent. 11-4

181 Troubleshooting and Known Issues Resolution Worry-Free Business Security Standard or Advanced service is running. Client Agent is running. If not, to start the Agent, see Agent Service on page 4-9 Ports 80 and 443 are open. You can check this by telneting from the Remote Manager server to the Agents on ports 80 and 443 and vice versa. If the ports are not open, the customer administrator must open the ports on their firewall. Agent Status Is Abnormal Several reasons can cause the Agent to be abnormal. Resolution 1. Agent status will be abnormal if the Agent did not send a logoff request to the Remote Manager server before the Agent shut down. To fix this, restart the Agent service (see Agent Service on page 4-9). 2. If this does not resolve the problem, open the Agent configuration tool by rightclicking the Agent icon and clicking Configure. Click the Test Connection button to test the network connection to the Remote Manager server. 3. If you receive an error, check your firewall policy. 4. If the connection is OK, inspect the Agent log (See Agent logs and configuration files location on page 6-13). 5. If the problem is critical and can be reproduced after restarting the Agent service, enable the debug log (See Enabling the Agent debug log on page 6-14) and contact your support provider. Agent working abnormally using an existing GUID after... Why does the Agent not work normally using an existing GUID after reinstalling the operating system, reinstalling the Remote Manager Agent, changing the machine's network card, or installing an Agent on another machine? 11-5

182 Trend Micro Remote Manager User's Guide Resolution Before performing any of the operations mentioned above, the Agent should first be uninstalled in order to delete existing information on the Remote Manager server. If this is not done, an Agent using an existing GUID will work abnormally. Troubleshooting the Agent Agent Issues Whenever you move your mouse over the system tray icon, it displays a status message that indicates whether the Agent is functioning normally or not. TABLE Status messages displayed by the Agent s system tray icon MESSAGE Unknown error encountered. Check the system or restart the Agent. DESCRIPTION Unknown error encountered. Check the system or restart the Agent. Unexpected errors, typically system errors, are preventing the Agent from functioning properly. Resolution: Check the managed server for low memory or other system problems. 11-6

183 Troubleshooting and Known Issues MESSAGE Unable to register with the remote server. Unable to connect to the remote server. Agent disabled by Remote Manager. Agent does not match the Client Server Messaging Security (CSM). DESCRIPTION The GUID you provided may be incorrect or there may be a network issue. Resolution There are two situations that may cause this: Verify that you have used the correct GUID. See Agent GUID on page 4-6 to find the correct GUID on the Remote Manager web console, and see Unable to Register with the Remote Server on page 11-9 to check (and possibly change) the GUID on the Agent. If the network has an issue, the Agent cannot connect to the server. Check the network connection between Worry-Free Business Security (Standard and Advanced) server and the Trend Micro Remote Manager server. The managed server may be experiencing Internet connectivity problems. Resolution Check Internet connectivity on the managed server. Also, check the Agent s proxy settings and the specified server address and port. The Agent has been temporarily disabled through the Remote Manager web console. Resolution Enable the Agent through the Remote Manager web console. The Client Server or Client Server Messaging Security Suite and Agent versions do not match. Resolution Upgrade the Client Server or Client Server Messaging Security Suite server to the latest version and install the latest Agent. 11-7

184 Trend Micro Remote Manager User's Guide MESSAGE Agent service stopped. Unable to load components. You may need to reinstall the Agent. DESCRIPTION Agent has logged off from Remote Manager. Resolution Start the Agent service by right-clicking the Agent system tray icon and clicking Start Service. The Agent encountered problems while loading some components. Resolution First try restarting the Agent service by right-clicking the Agent system tray icon and clicking Restart Service or Start Service. If this does not work, uninstall and then reinstall the Agent. Make sure you use the same GUID. Unable to Connect to the Server When you click the Test Connection button in the Trend Micro Remote Manager Agent Configuration Tool and Unable to connect to the server. It may be invalid settings. Enter valid settings and try again. appears. Resolution Try one of the following fixes: The managed server cannot connect to the Internet. Make sure Worry-Free Business Security Advanced can access the Internet. The FQDN of the Remote Manager communication server address is incorrect. Use the FQDN that corresponds to your region: Asia Pacific: rm-apaca.trendmicro.com Europe and the Middle East: rm-emeaa.trendmicro.com Japan: rm-jpa.trendmicro.com Latin America: rm-lara.trendmicro.com North America: rm-usa.trendmicro.com 11-8

185 Troubleshooting and Known Issues If the Security Server uses a proxy server to connect to the Internet, make sure the proxy and user authentication settings are correctly configured. Unable to Register with the Remote Server Unable to register with the remote server shows up when the mouse is moved over the Trend Micro Remote Manager Agent icon. Resolution This happens when the Globally Unique Identifier (GUID) is incorrect. To fix this issue, 1. Go to <install path>\trend Micro\WFRMAgentForCSM. 2. Open the AgentSysConfig.xml file using a text editor. 3. Look for the GUID between the parameters "<AgentGUID>" and "</ AgentGUID>". 4. Edit the GUID and then save the file. 5. In the same folder, open the csmsysconfig.xml file using a text editor. 6. Look for the GUID between the parameters "<ProductGUID>" and "</ ProductGUID>". 7. Edit the GUID and then save the file. 8. Right-click the Trend Micro Remote Manager Agent icon on the task bar and then click Restart Service. Connection Issues with Hosted Security If you are unable to connect or disconnect Hosted Security, any of the following may display at the bottom of the page: 11-9

186 Trend Micro Remote Manager User's Guide MESSAGES Unable to connect to Remote Manager server. Please check the network connection and remote manager status. Invalid authorization key Duplicate authorization key Unable to connect to remote managerremote Manager server. Check the network connection and Remote Manager server status. Server internal error RESOLUTION Check the network connection and remote manager status then again. Verify the GUID. If the GUID is incorrect. delete the agent and try to connect again. Verify the GUID. If the GUID is incorrect. delete the agent and try to connect again. Check the network connection and remote manager status then try again. Contact your support provider. Known Server Issues The following are known server issues in this release. Inconsistent Status Icons During the initial stages of data gathering (right after the Agent registers with the server), Remote Manager may display antivirus and anti-spam status icons that are inconsistent with the displayed number of virus and spam incidents. Right after it registers with the server, the Agent transmits the current antivirus and antispam statuses from Worry-Free Business Security (all), but does not transmit the historical data on which these statuses are based. As a result, it may display, for example, a red status symbol but show no incidents. Resolution Remote Manager will display the correct icon and data as soon as Worry-Free Business Security (all) detects an incident

187 Troubleshooting and Known Issues Spam Data Inconsistent with Worry-Free Business Security Standard or Advanced Spam data may differ between Worry-Free Business Security Standard or Advanced and Remote Manager if the servers running both systems are in different time zones. Resolution Spam incidents in the Remote Manager web console and reports may be dated earlier or later, depending on the time difference between the servers. Incorrect User Name on the Worry-Free Business Security Services Console After signing on to Worry-Free Business Security Services through the Remote Manager web console, the reseller name will show on the Worry-Free Business Security Services console instead of the Worry-Free Business Security Services customer name. Resolution There is presently no known resolution for this issue. Inconsistent License Info on the Worry-Free Business Security Services Console When a reseller edits the license information on the Remote Manager web console in response to a license event, the alert will not change until Worry-Free Business Security Services syncs with Remote Manager. Resolution Wait for about five minutes for Worry-Free Business Security Services to sync with Remote Manager

188 Trend Micro Remote Manager User's Guide Simultaneous Sign In From Two Tabs/Windows of the Same Browser are Not Permitted If a reseller attempts to log on more than once from a different tab or window of the same browser, the reseller will be directed automatically to the open tab or window. Resolution Sign out from the initial session before starting a new session. Historical Reports are Automatically Deleted You can only change the maximum number of daily reports that are stored by Remote Manager. After the quota is met, older reports are automatically deleted. Resolution Trend Micro recommends downloading older reports to computers or other storage devices. An Expired Worry-Free Business Security Services Account Cannot be Managed Remote Manager does not display expired Worry-Free Business Security Services account information as Worry-Free Business Security Services purges older account information. Resolution Trend Micro recommends renewing Worry-Free Business Security Services accounts when required. Broken ConnectWise Connection The ConnectWise connection to a customer breaks if the company ID is updated in ConnectWise

189 Troubleshooting and Known Issues Resolution From the Remote Manager Customer screen in ConnectWise, update the new company ID. Known Agent Issues The following are known Agent issues in this release. Reinstalled Agents Provide Overlapping Data Agents automatically transmit three days worth of certain Worry-Free Business Security (all) data upon registration. If an Agent is uninstalled and then reinstalled within a threeday period, the Agent will likely pull data that will overlap with data that it pulled before it was uninstalled. Resolution Back up the Agent configuration files before removing the Agent and restore these files after reinstalling the Agent. For more information, refer to Backing Up and Restoring Agent Settings on page Scan Command Results Cannot be Verified The Agent cannot verify whether Worry-Free Business Security Standard or Advanced successfully deployed the "scan" command to the network. This prevents, Remote Manager from verifying the results of the "scan" command. Resolution You may need to verify the status of the scan command through your customer s IT administrator

190 Trend Micro Remote Manager User's Guide Agent Configuration Tool is Not Visible After Upgrading the Agent The Agent Configuration Tool is not visible after upgrading the Agent on a Windows Vista or Windows Server 2008 operating system. Before the upgrade, the user usually runs the Agent Configuration tool under the user's account. During the upgrade process, the tool is killed, then restarted by LocalSystem instead of the user's account. Therefore, even though it is running, the user cannot see it. Resolution The machine should be restarted in order to restart the Agent Configuration Tool under the user's account. FAQs Web Console FAQs Why does the agent still show version 1.6 on the Remote Manager console when the Remote Manager server is version 3.2? Remote Manager 3.2 still uses the 1.6 agent (on servers prior to WFBS 6.0); only the server is version 3.2. Can a reseller have more than one account on Remote Manager? No. In Remote Manager 3.1, a reseller can have only one account. When selecting Hosted Security in the "View by" list above the customer tree, why is the tree still sorted by the customer name? When selecting Hosted Security, this filters all Hosted Security customers; it does not sort by Hosted Security. In other words, when selecting Hosted Security in the drop-down list, only customers with Hosted Security will display

191 Troubleshooting and Known Issues Note Other products for this Hosted Security customer will also be displayed. Why are some menu items or options grayed out? Certain menu items used to send commands to an Agent may be grey. This can occur when the Agent has not yet registered to the Remote Manager server or relevant data has not yet been communicated due to network time delay or other reasons. Why can't I change my password on Trend Micro Licensing Management Platform? It is possible that Licensing Management Platform is undergoing maintenance. Try changing your password after a while. If the problem persists, contact your support provider. I just updated something on the console. However, the status still remains the same. What could be happening? It takes a few minutes for the data to synchronize across the services. Some examples of a delayed change include updating the license or seats, resetting counters, and so on. I don't see a customer's Worry-Free Business Security Services service on the console. Why? If the service has expired 60 days ago, the service will not be listed. I clicked the link to sign into Worry-Free Business Security Services. I get an error. Why? This happens if Worry-Free Business Security Services is down for maintenance or if there is an issue with Licensing Management Platform. You could try clicking the link after a while. Why isn't the customer I created on Licensing Management Platform not visible in Remote Manager? It takes a few minutes for the data to synchronize across the services

192 Trend Micro Remote Manager User's Guide Why is the "Outdated Managed Servers" light still red even after clicking the Update button? The Update button only sends commands to the Worry-Free Business Security Standard or Advanced server. Any of the following can occur: The Worry-Free Business Security Standard or Advanced server receives the update command, but due to configurations on the Worry-Free Business Security Standard or Advanced server, the update operation cannot be executed. The Worry-Free Business Security Standard or Advanced server has updated itself, but it hasn't updated most the CSAs which belong to it, so it continues to send a Red alert to Remote Manager. It may take some time for most of the CSAs to be updated. Hosted Security FAQs Why is the latest 3 hours data not displayed on Live Status? On the Hosted Security server, data collection takes places over a two-hour period. To be certain that the Remote Manager server will have integrated data from the Hosted Security server, data collection is delayed for 3 hours. Why are Sync with Server and Go to Customer Console grayed out when right-clicking on Hosted Security on the customer tree? There are three possible reasons for Hosted Security is not being active. Hosted Security hasn't yet been connected to Remote Manager. The customer terminated the connection. See Connect a Hosted Security Customer to the Remote Manager Console on page The customer tree may need to be refreshed. Why do I get the error message "Your Hosted Security customer has not connected to Remote Manager or has been disconnected by Hosted Security. Contact your administrator" when I try to 11-16

193 Troubleshooting and Known Issues redirect to the customer's Hosted Security console after the customer connected Hosted Security to Remote Manager? After entering the GUID or Authorization Key and clicking Connect, it can take as long as ten minutes for Hosted Security to complete the connection to the Remote Manager web console. If the problem persists, contact Trend Micro Support. Why does an Hosted Security customer's Activation Code (AC) and Expiration Date show "N/A" on the Remote Manager web console? If a Hosted Security customer has not connected the Hosted Security service to Remote Manager or has disconnected, Remote Manager cannot retrieve data. The other reason is that Hosted Security cannot find a valid Activation Code and Expiration Date for this customer. This is a rare occurrence. Report FAQs Is there a limitation on the number of reports that can be stored? Yes. Remote Manager limits the number of stored reports. After the quota is met, older reports are automatically deleted. The number of reports that are stored is: Daily reports: A maximum of 30 reports are stored. Weekly reports: A maximum of 10 reports are stored. Monthly reports: A maximum of 5 reports are stored. Why aren't reports being generated? Check if the disk is full. Remote Manager currently offers only 512MB of space. Try downloading a few reports to your local disk, delete them from the console, and try generating the reports again. Why is there no new report generated in the report history after creating a one-time report profile? Wait for one or two minutes after creating the report profile. The report will show up in the report history. If the report still cannot be generated, open the report profile and save it again. If the issue persists, contact Trend Micro support

194 Trend Micro Remote Manager User's Guide Why can't I receive daily/weekly/monthly reports via when there are reports in report history? Make sure the customer's address is valid and is in the list of report profile recipients. If both are OK, it may be a network issue. On a generated report, why isn't the data time displayed according to my time zone? The time zone that the report depends on is the one that the reseller selected when creating the profile. It is not determined by the customer's computer. What does the "N/A" means after creating a one-time report? For a one-time report, the status column will always show "N/A". This happens because there is no status for the one-time report (cannot disable, enable, suspend, etc.). Cannot view reports when using SSL (HTTPS) connections. "Do not save encrypted pages to disk" is a security setting for Internet Explorer 7.0/8.0 and comes into play when dealing with SSL (HTTPS) connections. If you check this setting, nothing will be saved to the cache, and you will not be able to open or download reports. In order to fix this, in IE 7.0/8.0, click Tools > Internet Options > Advanced > Securityand uncheck, "Do not save encrypted pages to disk"

195 Chapter 12 Getting Help This sections the following topics: Contacting Trend Micro on page 12-2 Speeding Up the Support Call on page 12-2 Using the Support Portal on page 12-3 Threat Encyclopedia on page 12-3 About Trend Micro on page 12-4 TrendLabs on page

196 Trend Micro Remote Manager User's Guide Contacting Trend Micro In the United States, Trend Micro representatives are available by phone, fax, or Address Trend Micro, Inc North De Anza Blvd., Cupertino, CA Phone Toll free: +1 (800) (sales) Voice: +1 (408) (main) Fax +1 (408) Website address Worldwide support offices: Trend Micro product documentation: Speeding Up the Support Call To improve problem resolution, have the following information available: Steps to reproduce the problem Appliance or network information Computer brand, model, and any additional hardware connected to the endpoint Amount of memory and free hard disk space Operating system and service pack version Endpoint client version Serial number or activation code Detailed description of install environment 12-2

197 Getting Help Exact text of any error message received. Using the Support Portal The Trend Micro Support Portal is a 24x7 online resource that contains the most up-todate information about both common and unusual problems. Procedure 1. Go to 2. Select a product or service from the appropriate drop-down list and specify any other related information. The Technical Support product page appears. 3. Use the Search Support box to search for available solutions. 4. If no solution is found, click Submit a Support Case from the left navigation and add any relevant details, or submit a support case here: A Trend Micro support engineer investigates the case and responds in 24 hours or less. Threat Encyclopedia Most malware today consists of "blended threats" - two or more technologies combined to bypass computer security protocols. Trend Micro combats this complex malware with products that create a custom defense strategy. The Threat Encyclopedia provides a comprehensive list of names and symptoms for various blended threats, including known malware, spam, malicious URLs, and known vulnerabilities. Go to to learn more about: Malware and malicious mobile code currently active or "in the wild" 12-3

198 Trend Micro Remote Manager User's Guide Correlated threat information pages to form a complete web attack story Internet threat advisories about targeted attacks and security threats Web attack and online trend information Weekly malware reports. About Trend Micro As a global leader in cloud security, Trend Micro develops Internet content security and threat management solutions that make the world safe for businesses and consumers to exchange digital information. With over 20 years of experience, Trend Micro provides top-ranked client, server, and cloud-based solutions that stop threats faster and protect data in physical, virtualized, and cloud environments. As new threats and vulnerabilities emerge, Trend Micro remains committed to helping customers secure data, ensure compliance, reduce costs, and safeguard business integrity. For more information, visit: Trend Micro and the Trend Micro t-ball logo are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other marks are the trademarks or registered trademarks of their respective companies. TrendLabs TrendLabs is a global network of research, development, and action centers committed to 24x7 threat surveillance, attack prevention, and timely and seamless solutions delivery. Serving as the backbone of the Trend Micro service infrastructure, TrendLabs is staffed by a team of several hundred engineers and certified support personnel that provide a wide range of product and technical support services. TrendLabs monitors the worldwide threat landscape to deliver effective security measures designed to detect, preempt, and eliminate attacks. The daily culmination of these efforts is shared with customers through frequent virus pattern file updates and scan engine refinements. 12-4

199 Getting Help Learn more about TrendLabs at: index.html#trendlabs 12-5

200