General troubleshooting guide for clients appearing as "Offline" in the management console
 

Solution ID:

EN-1034943

Product:

Client Server Messaging Security for SMB - 3.0, 3.5; OfficeScan - 7.0, 7.3; OfficeScan Corporate Edition - 5.58; OfficeScan - 8.0
Operating System:
SP 6a; Windows 2000 Server - SP4; Windows NT 4.0; Windows Server 2003 Enterprise Edition - SP1; Windows Server 2003 Standard Edition - SP1; Windows Vista; Windows 2000 Advanced Server - SP4

Published:

9/16/2009 6:58 PM 
 

Problem:

Clients appear offline in the management console because of several reasons.  This solution allows you to verify the cause of this issue and resolve it.

 

Solution:

Public

 

A.

The client may be unable to communicate with the server

   
 

1.

Verify if the server can ping the client, and vice versa.

     
 

2.

Check if the server can telnet to the client using the client communication port.

     
 

3.

Check if the client can telnet to the server using the server communication port (default is 8080 for OfficeScan, 8059 for CSM).

     
 

4.

Verify if the client can resolve the server's hostname:

     
   

a.

Open the client console then click Help > About.

       
   

b.

Note the information in the "Server name/port" field.

       
   

c.

Open a browser then type the following address:

       
     

For OfficeScan: http://<servername>:<port>/officescan

       
     

For CSM: http://<servername>:<port>/SMB/console

     
   

Note: You may get a message saying you need to view the web console over a secure channel. This indicates that the connection was successful.

     

B.

The client's registry settings may be incorrect

     
 

1.

On the server machine, open the \PCCSRV\ofcscan.ini file in a text editor.

     
 

2.

Note the values of the following parameters:

     
     

Master_DomainName
Master_DomainPort
Client_LocalServer_Port

     
 

3.

Open the Registry Editor (regedit.exe) on the client computer.

     
   

Important: Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

     
 

4.

Open either of the following registry hives:

     
   

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion

   

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfficeScanCorp\CurrentVersion

     
 

5.

Check the values of the following registry keys and modify as necessary:

     
   

LocalServerPort – must have the same value as Client_LocalServer_Port

   

Server – must have the same value as Master_DomainName

   

ServerPort – must have the same value as Master_DomainPort

     

C.

You may not have the correct product license (OfficeScan only)

     
 

1.

Open the management console then go to the Summary page.

     
 

2.

Check if "Desktop/Server Antivirus" appears in the Activated services field.

     
   

If only "Desktop Antivirus" or "Server Antivirus" appears, you can only manage the corresponding system type, i.e. only computers with desktop operating systems or server operating systems.

     

D.

The client may not have sufficient privileges to communicate with the server

     
 

For OfficeScan 6.5/7.x/8.0:

 

1.

On the OfficeScan server, open a command prompt window.

     
 

2.

Go to the PCCSRV directory.

     
 

3.

Run the following commands:

     
     

svrinst –setprivilege
svrinst –setvirdir

     
 

4.

If you are using SSL, run the following command:

     
     

svrinst –enablessl

     
 

For CSM:

 

1.

On the Security Server, open a command prompt window.

     
 

2.

Go to the PCCSRV directory.

     
 

3.

Run the following commands:

     
     

svrsvcsetup –setvirdir
svrsvcsetup –setprivilege

     
 

4.

If you are using SSL, run the following command:

     
     

svrsvcsetup –enablessl

     

E.

The Internet Information Services (IIS) settings may be incorrect

     
 

1.

Open the IIS Manager then expand [server name] > Web Sites > OfficeScan.

     
 

2.

Right-click the officescan virtual directory then select Properties.

     
 

3.

Click the Directory Security tab then click Edit under "Authentication and access control".

     
 

4.

Make sure that Enable anonymous access and Integrated Windows authentication are enabled.

     
 

5.

Make sure that the user name used is IUSR_<servername> and that Enable automatic password synchronization is selected.

     
 

If you are using IIS 6.0 on Windows 2003:

     
 

1.

Open the IIS Manager then click [server name] > Application Pools.

     
 

2.

Click Action > New > Application Pool.

     
 

3.

Enter the following information:

     
     

Application pool ID: OSCE
Application pool settings: Use default settings for new application pool

     
 

4.

Click OK.

     
 

5.

Right-click the OSCE application pool then click Properties.

     
 

6.

Click the Identity tab, then select Predefined and Local System.

     
 

7.

Click OK > Yes.

     
 

8.

Expand [server name] > Web Sites.

     
 

9.

Right-click the OfficeScan web site then click Properties.

     
 

10.

Click the Home Directory tab.

     
 

11.

Under Application Settings, click Remove to delete the existing settings.

     
 

12.

Click Create.

     
 

13.

Select OSCE for the Application pool, then click OK.

     

F.

Try to re-establish communication using autopcc.exe

     
 

1.

On the client computer, open My Network Places then access the <server name>\ofcscan folder.

     
 

2.

Double-click the autopcc.exe file.

     
 

3.

Open the management console then verify if the client now appears correctly.

     

G.

Try to re-establish communication using IpXfer.exe

     
 

1.

On the server machine, open the \PCCSRV\ofcscan.ini file in a text editor.

     
 

2.

Note the values of the following parameters:

     
     

Master_DomainName
Master_DomainPort
Client_LocalServer_Port

     
 

3.

Copy the \PCCSRV\Admin\Utility\IpXfer\IpXfer.exe file to the OfficeScan Client folder on the client machine.

     
 

4.

On the client machine, open a command prompt window.

     
 

5.

Go the OfficeScan Client directory.

     
 

6.

Run the following command:

     
     

IpXfer.exe -s servername -m 1 -p serverport -c clientport

     
   

where:
servername
is the Master_DomainName value
serverport
is the Master_DomainPort value
clientport
is the Client_LocalServer_Port value

     
 

7.

Open the management console then verify if the client now appears correctly.

     

H.

The Windows Firewall on the client may be blocking the communication ports

     
 

1.

On the server machine, open the \PCCSRV\ofcscan.ini file in a text editor.

     
 

2.

Note the values of the following parameters:

     
     

Master_DomainPort
Client_LocalServer_Port

     
 

3.

On the client machine, click Start > Settings > Control Panel.

     
 

4.

Double-click Windows Firewall.

     
 

5.

Click the Exceptions tab then click Add Port.

     
 

6.

Enter the values of the Master_DomainPort and Client_LocalServer_Port using the TCP protocol.

     
 

7.

Restart the OfficeScanNT Listener service.

     
 

8.

Clear the Internet Explorer temporary internet files, offline content, and cookies.

     
 

9.

Open the management console then verify if the client now appears correctly.

     

I.

Change the client's domain

     
 

1.

Open the OfficeScan management console then click Clients.

     
 

2.

On the client tree, click Add.

     
 

3.

Type a name for the domain then click OK.

     
 

4.

Drag the client that has an offline or disconnected status to the new domain.

     
 

5.

On the client machine, restart the OfficeScanNT Listener service.

     
 

6.

Right-click the OfficeScan icon on the system tray then click Update Now.

     
 

7.

Refresh the management console then verify if the client now appears correctly.

     

J.

Verify if the client can resolve the server's hostname

     
 

1.

On the server machine, open the \PCCSRV\ofcscan.ini file in a text editor.

     
 

2.

Note the values of the following parameters:

     
     

Master_DomainName
Master_DomainPort
Master_SSLPort

     
 

3.

On the client machine, open a browser then type the following address:

     
   

For OfficeScan with SSL:
https://<servername>:<sslport>/officescan/cgi/cgionstart.exe

     
   

For OfficeScan without SSL:
http://<servername>:<port>/officescan/cgi/cgionstart.exe

     
   

where:
servername
is the Master_DomainName value
port
is the Master_DomainPort value
sslport
is the Master_SSLPort value

     
 

4.

If the page displays "-2", the client can communicate with the server.

     

K.

The server's database may be corrupted

     
 

1.

On the OfficeScan server, stop the OfficeScan Master Service.

     
 

2.

Open the \PCCSRV\HTTPDB folder then move its contents to a temporary folder.

     
 

3.

Start the OfficeScan Master Service

     
 

4.

Restart the OfficeScanNT Listener service on the client, or restart the computer.

     
 

5.

Open the management console then verify if the client now appears correctly.

     

L.

The CGI folder may be missing after upgrading to OfficeScan 7.x

     
 

1.

On the OfficeScan server, open the \PCCSRV\Web folder then verify if the CGI folder exists.

     
 

2.

If it does not exist, do the following:

     
   

a.

Download the OfficeScan installer file then extracts its contents to a temporary folder.

       
   

b.

Copy the \output\_wgroup\Web\CGI folder from the extracted files to the \PCCSRV\Web folder on the OfficeScan server.

       
   

c.

Restart the OfficeScan Master Service.

       
   

d.

Open the management console then verify if the client now appears correctly.

     

If the issue persists after following the procedures above, do the following:

1.

Note down the following:

   
 

a.

When did the issue first occur? Was it working properly before?

 

b.

How many clients are managed by your server?

 

c.

How many clients and what operating systems are affected? Do some clients show up properly in the management console?

 

d.

Are the clients on the same local area network as the server? Are there any proxies/firewalls/NATs between them?

   

2.

Use the Case Diagnostic Tool to collect debugging information. Run it once on both the server and the affected client

   

3.

Collect IIS logs from the server:

   
 

a.

Open the IIS Manager then expand [server name] > Web Sites > OfficeScan.

     
 

b.

Right-click the OfficeScan web site then click Properties.

     
 

c.

On the Web Site tab, select Enable logging then click Properties.

     
 

d.

Configure the log settings as necessary then click OK.

     
 

e.

Copy the log files in the location you selected (the default location is %WinDir%\System32\LogFiles\W3SVC1).

   

4.

Collect the ofcscan.ini files from both the server and client machines. Rename the ofcscan.ini from the client to ofcscan-client.ini.

   

5.

Export either of the following registry hives in the client:

   
 

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion

 

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfficeScanCorp\CurrentVersion

   

6.

Send all the information above to Trend Micro Technical Support. For Premium Support customers, log a case in Premium Support Online, or contact your Technical Account Manager.

   
   

Related solutions:

Troubleshooting guide for clients incorrectly appearing as “Offline,” or not showing the correct pattern file or scan engine on the management console

The OfficeScan 7.0 client appears offline when the Microsoft Personal Firewall is running

Clients with more than one Network Interface Card (NIC) show up as offline and do not update


  
Rate this Solution
Did this article help you?
   Yes       No
Comments:
This form uses an automated system and does not provide feedback.