Knowledge Base

Support

Troubleshooting guide for OfficeScan clients incorrectly appearing "Offine" or not showing updated pattern file or scan engine

Solution IDLast Updated
0123889Date : 2012/04/2 Time: 12:56 AM (PST)


Product/VersionPlatform
OfficeScan - 10.0, 10.5, 8.0
Windows - 2000 Advanced Server, 2000 Server, 2003 Enterprise Server, 2003 Standard Server Edition, 2008 Enterprise, 2008 Standard

Problem Description

Identify the causes of the following issues and resolve them using the troubleshooting guide:
  • OfficeScan clients that incorrectly appears offline on the management console
  • OfficeScan clients that does not show updated pattern file/scan engine on the management console
You can also find the logs and files needed for further troubleshooting if the issues persists are also included in this solution.

Solution

To troubleshoot and resolve the issues, follow the steps below:
[ Expand All ]

 

 

STEP 1: Verify the Permissions

    • The PCCSRV folder on the OfficeScan server is shared. In the permissions setting on the Sharing tab, everyone must have Full Control. On the Security tab, everyone should have at least Read and Execute permissions.
    • The Administrator should have Full Control on the PCCSRV folder, including its sub-directories.
    • The IUSR_<server name> should have everything but Full Control on the PCCSRV folder, including its sub-directories.
    • The server and clients should be able to ping each other via FQDN and IP address.
    • The IUSR_<server name> should be on the Allowed Anonymous Access list on the Internet Services Manager or IIS.

 

STEP 2: Create Application Pool if you are using Windows 2003 (IIS 6.0)

    1. Go to Administrative Tools > Internet Information Services (IIS) Manager.
    2. Expand the Server Name directory and then click Application Pools.
    3. Click Action > New > Application Pool.
    4. Create a new Application Pool with the following characteristics:
      • Application Pool ID: OSCE
      • Application Pool Settings: Use default settings for new application pool
    5. Right-click the new Application Pool and select Properties.
    6. Click the Identity tab. Under the Predefined option, select Local System.
    7. Click Yes > Apply > OK.
    8. Set the website to use the new Application Pool:
      1. Right-click the created website and click Properties.
      2. Under the Home Directory tab, look for Application Settings.
      3. Click the Remove button to remove the existing application settings.
      4. Click the Create button to recreate the application settings.
      5. Locate the Application Pool dropdown list and select OSCE.
      6. Click Apply > OK.

 

STEP 3: Choose one of the options and follow the steps

Option A: Access the server and execute autopcc.exe.
  1. From the client machine, open Network Neighborhood and access the OfficeScan server.
  2. Go to the ofcscan folder or the PCCSRV shared folder.
  3. Execute autopcc.exe.
  4. Refresh the management console.
Option B: Use the Ipxfer command to re-establish communication between the OfficeScan server and client.
  1. On the server machine, go to the PCCSRV folder.
  2. Open the ofcscan.ini file using a text editor, like Notepad.
  3. Note the values of the following parameters:
    • master_domainport
    • client_localserver_port
  4. On the client machine, open the command prompt.
  5. Execute the following command:
    \\aaaaa\bbbbb\Admin\Utility\IpXfer\ipxfer.exe -s aaaaa -m 1 -p ccccc -c ddddd

    where:
    aaaaa is the OfficeScan server name
    bbbbb is the PCSRV shared folder
    ccccc is the master_domainport value
    ddddd is the client_localserver_port value
  6. Refresh the management console and check the clients.

    Note: The OfficeScan Server name can be changed using the IP address of the OfficeScan Server that the OfficeScan clients can see or ping.
Option C: Check if the OfficeScan server database is corrupted.
  1. Stop the OfficeScan Master Service.
  2. Go to the PCCSRV folder and move the contents of the HTTPDB folder to another location.
  3. Start the OfficeScan master service.

    Note: No client will appear when you restart the Master Service. However, when the clients reboot or when the OfficeScanNT listener is restarted, OfficeScan will automatically repopulate the database.
Option D: Check if the OfficeScan client has enabled the Windows XP Service Pack 2 built-in firewall.
  1. On the server machine, open the ofcscan.ini file using a text editor, like Notepad.
  2. Note the values of the following:
    • master_domainport
    • client_localserver_port
  3. Make sure that the server's client_localserver_port value is the same as the one found in the OfficeScan client's registry.
  4. Go to Control Panel > Windows Firewall and open the Windows XP Service Pack 2 Firewall Settings.
  5. Add the domain port and client listening port to the Exclusion List.
  6. The direction is incoming and outgoing, and the protocol is TCP.
  7. Restart the OfficeScanNT Listener service.
  8. Clear Internet Explorer's history, cookies, and all offline contents.
  9. Refresh the management console and check if the client is displayed.
Option E: Compare the Ofcscan.ini file of the server with that of the client's
  1. Using a text editor, like Notepad, open the ofcscan.ini file in the server machine.
  2. Note the values of the following:
    • master_domainname
    • masterdirectory
    • master_domainport
    • client_localserver_port
  3. Open the registry editor (regedit.exe) on the client machine.
    Important: Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  4. Go to one of the following and verify if the client has the same values as the server:
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\Software\TrendMicro\OfficescanCorp\CurrentVersion
      KeyValue
      LocalServerPort Must have the same value as the client_localserver_port
      Server Must have the same value as the OfficeScan Server Name or IP address
      ServerPort Must have the same value as the master_domainport

 

STEP 4: Change the Domain

    If Steps 1 to 3 do not resolve the issue, do the following:
    1. On the OfficeScan management console, click Clients.
    2. On the OfficeScan client tree, click Add or Add a new domain.
    3. Drag the OfficeScan client, that has an offline or disconnected status, to the new domain.
    4. On the OfficeScan client machine, restart tbe OfficeScanNT Listener service.
    5. Perform Update Now! even if the OfficeScan client is already updated.
    6. Refresh the management console and check the status of the OfficeScan client.

 

STEP 5: Verify the client's connection to the OfficeScan server.

    If Step 4 did not work, then follow the following steps:
    1. Open Internet Explorer from the client machine.
    2. Type one of these URLs in the address bar:Note: The master_domainname value can be found in the ofcscan.ini file on the server.
      • For OfficeScan with SSL:
        https://officescan server name:port/officescan/cgi/cgionstart.exe
      • For OfficeScan without SSL:
        http://officescan server name/officescan/cgi/cgionstart.exe
      • For OfficeScan installed on a different port:
        http://master_domainname:master_domainport/officescan/cgi/cgionstart.exe
    3. If "-2" is displayed, send the following items to Trend Micro Technical Support:
      • IIS logs
      • ofcscan.ini file of the server
      • ofcscan.ini file of the client
      • One of the following registry:
        HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion
        HKEY_LOCAL_MACHINE\Software\TrendMicro\OfficescanCorp\CurrentVersion
      • IP address of the OfficeScan client that experienced the issue.
        Note: Rename this file to ofcscan-client.ini.


Rate this Solution
Did this article help you?  
 
 Please provide your comments to help us improve this solution.

 
  *This form is an automated system. General questions, technical, sales and product-related issues submitted through this form will not be answered.
 
 

Connect with us on