Troubleshooting guide for clients/agents appearing as "Offline" in the management console

Support
Solution ID Last Updated
1034943 Date : 2014/04/08 Time:2:42 AM , (PST)


Product/Version Platform
OfficeScan - 10.0, 10.5, 10.6, 11.0;
Windows - 2003 Enterprise Server, 2003 Standard Server Edition, 2008 Enterprise, 2008 Standard, 7 32-bit, Vista 32-bit, XP Professional, 2012 Standard, 2012 Standard R2

Problem Description

Clients/Agents appear offline in the OfficeScan management console because of several reasons:
  • The OfficeScan client/agent cannot communicate with the OfficeScan server.
  • The configuration of the individual OfficeScan clients/agents differs from that of the server.
  • After migrating or upgrading to the latest version, the OfficeScan clients/agents could either not be viewed on the management console or could not connect to the OfficeScan server (client/agent appears offline after an upgrade).

Solution

Depending on your case, do any of the following:
[ Expand All ]

 

The client/agent may be unable to communicate with the server

  1. Verify if the server can ping the client/agent, and vice versa.
  2. Check if the server can telnet to the client using the client/agent communication port.
  3. Check if the client/agent can telnet to the server using the server communication port (default is 8080 for OfficeScan, 8059 for CSM).
  4. Verify if the client/agent can resolve the server's hostname:
    1. Open the client/agent console then click Help > About.
    2. Note the information in the "Server name/port" field.
    3. Open a browser then type the following address:
      • For OfficeScan: http://<servername>:<port>/officescan
      • For CSM: http://<servername>:<port>/SMB/console
Note: You may get a message saying you need to view the web console over a secure channel. This indicates that the connection was successful.

 

The client/agent's registry settings may be incorrect

  • On the server machine, open the ..\PCCSRV\ofcscan.ini file in a text editor.
  • Note the values of the following parameters:
    Master_DomainName
    Master_DomainPort
    Client_LocalServer_Port
  • Open the Registry Editor (regedit.exe) on the client/agent computer.
    Important: Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  • Open either of the following registry hives:
    For 32Bit machine:
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfficeScanCorp\CurrentVersion
    For 64Bit machine:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\OfficeScanCorp\CurrentVersion
  • Check the values of the following registry keys and modify as necessary:
    • LocalServerPort - must have the same value as Client_LocalServer_Port
    • Server - must have the same value as Master_DomainName
    • ServerPort - must have the same value as Master_DomainPort

 

You may not have the correct product license

  1. Do one of the following:
    • For OfficeScan 11.0, from the OSCE web console, go to Administration > Settings > Product License.
      Product License of OfficeScan
      Click image to enlarge.
    • For OfficeScan 10.5 and 10.6, open the management console and go to the Summary page.
  2. Check if "Desktop/Server Antivirus" appears in the Activated services field.
    If only "Desktop Antivirus" or "Server Antivirus" appears, you can only manage the corresponding system type, i.e. only computers with desktop operating systems or server operating systems.

 

The client/agent may not have sufficient privileges to communicate with the server

For OfficeScan 6.5/7.x/8.0:
  1. On the OfficeScan server, open a command prompt window.
  2. Go to the PCCSRV directory.
  3. Run the following commands:
    svrinst -setprivilege
    svrinst -setvirdir
  4. If you are using SSL, run the following command:
    svrinst -enablessl
For CSM/OfficeScan 10/10.5/10.6/11.0:
  1. On the Security Server/OfficeScan Server, open a command prompt window.
  2. Go to the PCCSRV directory.
  3. Run the following commands:
    svrsvcsetup -setvirdir
    svrsvcsetup -setprivilege
  4. If you are using SSL, run the following command:
    svrsvcsetup -enablessl

 

The Internet Information Services (IIS) settings may be incorrect

  1. Open the IIS Manager then expand [server name] > Web Sites > OfficeScan.
  2. Right-click the officescan virtual directory, then select Properties.
  3. Click the Directory Security tab, then click Edit under "Authentication and access control".
  4. Make sure that Enable anonymous access and Integrated Windows authentication are enabled.
  5. Make sure that the user name used is IUSR_and that Enable automatic password synchronization is selected.
If you are using IIS 6.0 on Windows 2003:
  1. Open the IIS Manager then click [server name] > Application Pools.
  2. Click Action > New > Application Pool.
  3. Enter the following information:
    Application pool ID: OSCE
    Application pool settings: Use default settings for new application pool
  4. Click OK.
  5. Right-click the OSCE application pool then click Properties.
  6. Click the Identity tab, then select Predefined and Local System.
  7. Click OK > Yes.
  8. Expand [server name] > Web Sites.
  9. Right-click the OfficeScan web site then click Properties.
  10. Click the Home Directory tab.
  11. Under Application Settings, click Remove to delete the existing settings.
  12. Click Create.
  13. Select OSCE for the Application pool, then click OK.

 

Try to re-establish communication using autopcc.exe

  1. On the client/agent computer, open My Network Places then access the\ofcscan folder.
  2. Double-click the autopcc.exe file.
  3. Open the management console then verify if the client now appears correctly.

 

Try to re-establish communication using IpXfer.exe

  1. On the server machine, open the ..\PCCSRV\ofcscan.ini file in a text editor.
  2. Note the values of the following parameters:
    Master_DomainName
    Master_DomainPort
    Client_LocalServer_Port
  3. Copy the ..\PCCSRV\Admin\Utility\IpXfer\IpXfer.exe file to the OfficeScan Client/Agent folder on the client/agent machine.
  4. On the client/agent machine, open a command prompt window.
  5. Go the OfficeScan Client/Agent directory.
  6. Run the following command:
    IpXfer.exe -s servername -m 1 -p serverport -c clientport
    where:
    servername is the Master_DomainName value
    serverport is the Master_DomainPort value
    clientport is the Client_LocalServer_Port value
  7. Open the management console then verify if the client/agent now appears correctly.

 

The Windows Firewall on the client/agent may be blocking the communication ports

  1. On the server machine, open the ..\PCCSRV\ofcscan.ini file in a text editor.
  2. Note the values of the following parameters:
    Master_DomainPort
    Client_LocalServer_Port
  3. On the client machine, click Start > Settings > Control Panel.
  4. Double-click Windows Firewall.
  5. Click the Exceptions tab then click Add Port.
  6. Enter the values of the Master_DomainPort and Client_LocalServer_Port using the TCP protocol.
  7. Restart the OfficeScanNT Listener service.
  8. Clear the Internet Explorer temporary internet files, offline content, and cookies.
  9. Open the management console then verify if the client/agent now appears correctly.

 

Change the client/agent's domain

  1. Do one of the following:
    • For OfficeScan 11.0, open the OSCE management console and navigate to Agents > Agent Management.
    • For OfficeScan 10.5 and 10.6, open the OfficeScan management console and click Clients.
  2. On the client tree, click Add.
    For OfficeScan 11.0, click Add Domain on the Manage Agent Tree.
  3. Type a name for the domain, then click OK.
  4. Drag the client/agent that has an offline or disconnected status to the new domain.
  5. On the client/agent machine, restart the OfficeScanNT Listener service.
  6. Right-click the OfficeScan icon on the system tray then click Update Now.
  7. Refresh the management console then verify if the client/agent now appears correctly.

 

Verify if the client/agent can resolve the server's hostname

  1. On the server machine, open the ..\PCCSRV\ofcscan.ini file in a text editor.
  2. Note the values of the following parameters:
    Master_DomainName
    Master_DomainPort
    Master_SSLPort
  3. On the client/agent machine, open a browser then type the following address:

    For OfficeScan with SSL:
    https://<servername>:<sslport>/officescan/cgi/cgionstart.exe
    For OfficeScan without SSL:
    http://<servername>:<port>/officescan/cgi/cgionstart.exe

    where:
    servername is the Master_DomainName value
    port is the Master_DomainPort value
    sslport is the Master_SSLPort value
  4. If the page displays "-2", the client can communicate with the server.

 

The server's database may be corrupted

  1. On the OfficeScan server, stop the OfficeScan Master Service.
  2. Open the ..\PCCSRV\HTTPDB folder then move its contents to a temporary folder.
  3. Start the OfficeScan Master Service
  4. Restart the OfficeScanNT Listener service on the client/agent, or restart the computer.
  5. Open the management console then verify if the client/agent now appears correctly.

 

The CGI folder may be missing after upgrading to OfficeScan 7.x

  1. On the OfficeScan server, open the ..\PCCSRV\Web folder then verify if the CGI folder exists.
  2. If it does not exist, do the following:
    1. Download the OfficeScan installer file then extracts its contents to a temporary folder.
    2. Copy the \output\_wgroup\Web\CGI folder from the extracted files to the ..\PCCSRV\Web folder on the OfficeScan server.
    3. Restart the OfficeScan Master Service.
    4. Open the management console then verify if the client now appears correctly.
If the issue persists after following the procedures above, do the following:
  1. Note down the following:
    1. When did the issue first occur? Was it working properly before?
    2. How many clients/agents are managed by your server?
    3. How many clients/agents and what operating systems are affected? Do some clients/agents show up properly in the management console?
    4. Are the clients/agents on the same local area network as the server? Are there any proxies/firewalls/NATs between them?
  2. Use the Case Diagnostic Tool to collect debugging information. Run it once on both the server and the affected client/agent.
  3. Collect IIS logs from the server:
    1. Open the IIS Manager then expand [server name] > Web Sites > OfficeScan.
    2. Right-click the OfficeScan web site then click Properties.
    3. On the Web Site tab, select Enable logging then click Properties.
    4. Configure the log settings as necessary then click OK.
    5. Copy the log files in the location you selected (the default location is %WinDir%\System32\LogFiles\W3SVC1).
  4. Collect the ofcscan.ini files from both the server and client/agent machines. Rename the ofcscan.ini from the client to ofcscan-client.ini.
  5. Export either of the following registry hives in the client/agent:
    For 32Bit machine:
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfficeScanCorp\CurrentVersion
    For 64Bit machine:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\OfficeScanCorp\CurrentVersion
  6. Send all the information above to Trend Micro Technical Support or contact your Technical Account Manager.


Rate this Solution
Did this article help you?

Please provide your comments to help us improve this solution.

 
  *This form is an automated system. General questions, technical, sales and product-related issues submitted through this form will not be answered.
 
 

Connect with us on