Deploying Trend Micro through C. Remote

[ImAMacGuy]

So recently we've had problems with our Trend Micro installs, we used to push (C. Remote or policy) and it worked fine. Now it installs but it can't connect to the server. If I manually install it, it connects fine. Apparently it's not sending a certificate and a server plist file... any reason why it wouldn't come through when pushed through casper anymore?

[jhalvorson · Accepted solution]

Are you talking about Trend Micro Security 2.0.3036/2.0.3037 that works with Trend Office Scan?

I've discovered that the mpkg file they provide for multi deployment via tools like ARD and JAMF, installs a version that won't always reach the server and self update. It actually contains a pkg that is older than 2.0.3036 and it doesn't work right on 10.9 and 10.10.

The pkg file that they offer for direct install will install 2.0.3036, contact the Office Scan, and update to 2.0.3037.

I've created a package that includes a script that curl's the current pkg (single/direct) installer from the console and then installs. Here is the script and many thanks goes to @Aaron

#!/bin/bash

#Reference:  Aaron's post on https://jamfnation.jamfsoftware.com/discussion.html?id=7347#responseChild38774

#Download the latest installer from the Trend Console
curl -s -k -o /tmp/tmsminstall.zip https://yourOfficeScanConsoleAddress.edu:4343/officescan/console/html/TMSM_HTML/ActiveUpdate/ClientInstall/tmsminstall.zip

#Unzip the file
unzip -qq /tmp/tmsminstall.zip -d /tmp

#Install the application
installer -pkg /tmp/tmsminstall/tmsminstall.pkg -target /

exit 0

[pblake]

Are you installing on Yosemite? For us using Trend. I don't thought it wasn't working. Hen I realized if I leave it for 30 mins or so it updates and works.

[jhalvorson · Accepted solution]

Are you talking about Trend Micro Security 2.0.3036/2.0.3037 that works with Trend Office Scan?

I've discovered that the mpkg file they provide for multi deployment via tools like ARD and JAMF, installs a version that won't always reach the server and self update. It actually contains a pkg that is older than 2.0.3036 and it doesn't work right on 10.9 and 10.10.

The pkg file that they offer for direct install will install 2.0.3036, contact the Office Scan, and update to 2.0.3037.

I've created a package that includes a script that curl's the current pkg (single/direct) installer from the console and then installs. Here is the script and many thanks goes to @Aaron

#!/bin/bash

#Reference:  Aaron's post on https://jamfnation.jamfsoftware.com/discussion.html?id=7347#responseChild38774

#Download the latest installer from the Trend Console
curl -s -k -o /tmp/tmsminstall.zip https://yourOfficeScanConsoleAddress.edu:4343/officescan/console/html/TMSM_HTML/ActiveUpdate/ClientInstall/tmsminstall.zip

#Unzip the file
unzip -qq /tmp/tmsminstall.zip -d /tmp

#Install the application
installer -pkg /tmp/tmsminstall/tmsminstall.pkg -target /

exit 0

[jhbush · Accepted solution]

This has been working for me.

#!/bin/bash

#Switch to the /tmp directory
cd /tmp

#Download the Trend installer
curl -O -k https://yourserver.here.com:4343/officescan/console/html/TMSM_HTML/ActiveUpdate/ClientInstall/tmsminstall.zip

#Unzip the installer
unzip tmsminstall.zip

#Install the Trend Software
installer -pkg /tmp/tmsminstall/tmsminstall.pkg -target /

#Clean up the folder
rm tmsminstall.zip
rm -rf /tmp/tmsminstall

exit 0

[Aaron]

+1 for @jhbush1973's script, it's basically identical to mine. I scope this out via policy - the upside is that it will always be the most up-to-date version.

[ImAMacGuy]

thank you guys! wish I had come here first rather than waiting 2 weeks for Trend to chase their own tails.

[jhalvorson]

One issue I have open with Trend is that the Trend menu bar app will fail to open which then leads to the TMS app won't open. If I manually open the Trend Micro Security Quick Menu.app, then the Trend Micro Security application will open. Reinstall fixes it, but sometimes it begins to fail again. Has anyone else witnessed that?

[ImAMacGuy]

@jhalvorson sounds similar to what I had. occasionally it would just need about 30min to activate as @pblake mentioned. Are you on the latest and greatest version on your server/clients?

[jhalvorson]

The clients work correctly for days and weeks. But once the menu bar stops loading then the client GUI app isn't able to open. But it appears the live protection and web rep continue to work, it's just the application won't open. I'll have to check with the Office Scan admin to see if everything is current. Is there a Trend Micro Security forum for Mac?

(Update: Since the time of this post, the client agent has been updated to version 3.0.3039 and appears to resolve the application unresponsive issue and menu bar app not appearing.)

[pblake]

@jhalvorson - I have found that there are times where Trend is doing a self update. If during that time the end user put the machine to sleep or shuts it down, the install becomes corrupt. When that happens, I usually have to uninstall and re-install the software. It also creates a non-stop error log that eats the battery life of laptops.

[jhalvorson]

@pblake Do you have an Extension Attribute to detect if parts or all of Trend are not working? Is it based on process name(s) or last checkin?

[Aaron]

@jhalvorson I use extension attributes to find when the signatures were last updated, I guess you could knock something up to determine that if it's been > 2 weeks, then it requires attention? These are the ones I use:

#!/bin/sh

# Trend Micro installed version

if [ -f /Library/Application Support/TrendMicro/TmccMac/UIMgmt.app/Contents/Info.plist ]; then
    VERSION=`defaults read /Library/Application Support/TrendMicro/TmccMac/UIMgmt.app/Contents/Info CFBundleShortVersionString`
else
    VERSION="Not Installed"
fi

echo "<result>$VERSION</result>"

#!/bin/sh

# Trend Micro parent server

if [ -f /Library/Application Support/TrendMicro/common/conf/ServerInfo.plist ]; then
    SERVER=`defaults read /Library/Application Support/TrendMicro/common/conf/ServerInfo DisplayName`
else
    SERVER="Not Found"
fi

echo "<result>$SERVER</result>"

#!/bin/sh

# Trend Micro spyware pattern date

if [ -f /Library/Application Support/TrendMicro/common/conf/TmUpdate.conf.plist ]; then
    DATE=`/usr/libexec/PlistBuddy -c "print :ComponentCfg:component_list:3:last_update_time" /Library/Application Support/TrendMicro/common/conf/TmUpdate.conf.plist`
    DATE=`date -r $DATE | awk '{ print $3,$2,$4}'`
else
    DATE="Not Found"
fi

echo "<result>$DATE</result>"

#!/bin/sh

# Trend Micro virus pattern date

if [ -f /Library/Application Support/TrendMicro/common/conf/TmUpdate.conf.plist ]; then
    DATE=`/usr/libexec/PlistBuddy -c "print :ComponentCfg:component_list:0:last_update_time" /Library/Application Support/TrendMicro/common/conf/TmUpdate.conf.plist`
    DATE=`date -r $DATE | awk '{ print $3,$2,$4}'`
else
    DATE="Not Found"
fi

echo "<result>$DATE</result>"

@pblake Thanks for that little tidbt, I think that explains why I've seen a few broken installations. It got to the point where I've created custom policy triggers now to reinstall Trend. I might see if I can come up with some kind of self-healing policy, because while uncommon, it happens often enough to be annoying.

[jhalvorson]

The following is not fully tested, but I think it should help me with reporting if Trend is actually working or not. I'll watch the results come in and compare to the info from the Extension Attributes @Aaron has for both pattern dates.

I might be able to assume if the pattern dates are old and the neither process is running, then the client has gone bad.

#!/bin/sh

#Check to see if the TmLoginMgr is running.  I could be wrong, but I think this process indicates if the Trend icon menu bar is running.
PROCESS=TmLoginMgr
number=$(/bin/ps aux | /usr/bin/grep $PROCESS | /usr/bin/grep -v grep | /usr/bin/wc -l | /usr/bin/awk '{print $1}')

if [ $number -gt 0 ]; then
    /bin/echo "<result>Running</result>"
else
    /bin/echo "<result>Not_Running</result>"
fi

[Updated: Note, if no user is logged in at the time Update Inventory is run, then the check for TmLoginMgr will result in "Not_Running".]

#!/bin/sh

#Check to see if iCoreService is running.  I could be wrong, but I thing this is the live virus protection service.
PROCESS=iCoreService
number=$(/bin/ps aux | /usr/bin/grep $PROCESS | /usr/bin/grep -v grep | /usr/bin/wc -l | /usr/bin/awk '{print $1}')

if [ $number -gt 0 ]; then
    /bin/echo "<result>Running</result>"
else
    /bin/echo "<result>Not_Running</result>"
fi

[jhalvorson]

Trend support provided "tmsmRegisterLoginItem" script that has fixed the icon not appearing in the menu bar and the application unresponsive issue. I've been able to provide it within Self Service and deploy via casper remote.

@jwojda @pblake Ask your rep for the script if your clients have seen the same issue.

[rfadul]

@Aaron do you have the extension attribute to pull the version of:
virus scan engine
virus pattern
spyware active-monitoring pattern

[Aaron]

@rfadul I wrote about this a little while ago over at https://jamfnation.jamfsoftware.com/discussion.html?id=7429

We've had a client update, and a change in parent server since, but it still seems to be reporting the versions correctly.

[rfadul]

@Aaron thanks, I was looking for the attribute that returns the version not date of the following

[cervegnano]

Thanks for your script @jhbush1973 With some small modifications I was able to get the new Trend 2.0.3061 deployed to my population. Much appreciated!
I removed the last rm line, which generated an error for me, but otherwise it saved the day for me.