Trend Micro Apex Central
Patch 7Installation and Upgrade Guide
Centralized Security Management for Endpoints

TMTrend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:
http://docs.trendmicro.com/en-us/enterprise/apex-central.aspx
Trend Micro, the Trend Micro t-ball logo, Trend Micro Apex Central, Trend
Micro Apex One, Control Manager, and OfficeScan are trademarks orregistered trademarks of Trend Micro Incorporated. All other product orcompany names may be trademarks or registered trademarks of theirowners.
Copyright © 2023. Trend Micro Incorporated. All rights reserved.
Document Part No.: APEM79816/230828
Release Date: September 2023
Protected by U.S. Patent No.: 5,623,600; 5,889,943; 5,951,698; 6,119,165

This documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Table of Contents
Preface
Preface ................................................................................. 1
Documentation ..................................................................... 2
Audience .............................................................................. 3
Document Conventions ......................................................... 3
Terminology ......................................................................... 4

Chapter 1: Introducing Apex Central
About Apex Central ............................................................. 1-2
Key Features and Benefits ................................................... 1-2
Apex Central Architecture ................................................... 1-4

Chapter 2: Installation Planning
Identifying Deployment Architecture and Strategy ............... 2-2
Understanding Single-Site Deployment .......................... 2-3
Determining the Number of Managed Products andEndpoints .............................................................. 2-3
Planning for the Optimal Ratios of Server to Managed
Products ................................................................. 2-4
Designating Apex Central Servers ............................ 2-4
Understanding Multiple-Site Deployment ....................... 2-4
Grouping Managed Products ................................... 2-5
Determining the Number of Sites ............................ 2-6
Determining the Number of Managed Products andEndpoints .............................................................. 2-6
Planning for the Optimal Ratio of Server to Managed
Products ................................................................. 2-6
Designating Apex Central Servers ............................ 2-7
Deciding Where to Install the Apex Central Server .... 2-7
Planning for Network Traffic ......................................... 2-8iTrend Micro Apex Central™ Installation Guide

Apex Central Setup Flow ..................................................... 2-9
Testing Apex Central at One Location ................................... 2-9
Preparing for the Test Deployment ............................... 2-10
Selecting a Test Site ..................................................... 2-10
Beginning the Test Deployment ................................... 2-11
Evaluating the Test Deployment ................................... 2-11
Server Distribution Plan .................................................... 2-11
Understanding Administration Models ......................... 2-11
Understanding Apex Central Server Distribution ........... 2-12
Single-Server Topology ................................................ 2-12
Multiple-Server Topology ............................................ 2-13
Network Traffic Plan ......................................................... 2-13
Understanding Apex Central Network Traffic ................ 2-13
Sources of Network Traffic ..................................... 2-13
Traffic Frequency .................................................. 2-13
Logs ..................................................................... 2-14
Managed Product Agent Heartbeat ......................... 2-14
Network Protocols ................................................. 2-15
Source of Network Traffic .................................................. 2-15
Log Traffic .................................................................. 2-15
Trend Micro Management Communication Protocol Policies................................................................................... 2-16
Product Registration Traffic ......................................... 2-16
Policy Deployment ...................................................... 2-17
Deploying Updates ............................................................ 2-17
Data Storage Plan .............................................................. 2-19
Database Recommendations ........................................ 2-19
ODBC Driver ............................................................... 2-20
Authentication ............................................................ 2-20
Web Server Plan ................................................................ 2-20

Chapter 3: Installation
System Requirements ......................................................... 3-2ii

Table of Contents

Installing the Apex Central Server ....................................... 3-7
Apex Central Installation Flow ...................................... 3-8
Installing All Required Components .............................. 3-9Specifying the Installation Location ............................. 3-12
Activating the Product and Services .............................. 3-13
Specifying Apex Central Web Server Settings ................ 3-14
Specifying Backup Settings .......................................... 3-16
Setting Up the Root Account ........................................ 3-18
Configuring Database Information ............................... 3-19

Chapter 4: Post-installation Tasks
Automatic Post-installation Tasks ........................................ 4-2
Verifying the Server Installation or Upgrade ......................... 4-2
Activating Your Software ..................................................... 4-3
Activating Apex Central ................................................. 4-4
Converting to the Full Version ....................................... 4-4
Configuring Active Directory Connection Settings ................ 4-5
Configuring User Accounts .................................................. 4-8
Downloading the Latest Components ................................... 4-8
Configuring Event Notifications ........................................... 4-8

Chapter 5: Upgrades and Migration
Upgrading to Apex Central .................................................. 5-2
Supported Versions for Upgrade .................................... 5-2
Server Files to Back Up Before Migration ....................... 5-3
Pre-migration Checklist ................................................ 5-3
Upgrade and Migration Scenarios ........................................ 5-5
Upgrade Flow ............................................................... 5-5
Scenario 1: Upgrading a Control Manager Server to Apex
Central ......................................................................... 5-5
Upgrading by Backing Up the Previous Control Manager
Server and Database ............................................... 5-6
iii

Trend Micro Apex Central™ Installation Guide

Upgrading by Backing Up the Entire Operating Systemof the Server and the Apex Central Database ............ 5-6
Scenario 2: Migrating to a Fresh Apex Central Installation
Using the Agent Migration Tool ..................................... 5-7
Migrating a Control Manager Server to a Fresh
Installation of Apex Central ..................................... 5-7
Planning Apex Central Agent Migration ............................... 5-7
Rapid Upgrade .............................................................. 5-8
Phased Upgrade ........................................................... 5-8
Migrating the Apex Central Database ................................... 5-9
Migrating a Apex Central SQL Database to Another SQL
Server .......................................................................... 5-9
Using the Database Configuration Tool (DBConfig.exe).............................................................................. 5-9

Chapter 6: Post-Migration Tasks
Verifying a Successful Upgrade or Migration ........................ 6-2
Migrating Apex One Server Settings to Apex Central ............. 6-2
Enabling Application Control .............................................. 6-4
Enabling Vulnerability Protection ........................................ 6-5
Enabling Endpoint Sensor ................................................... 6-7
Configuring Apex One Server Settings for Endpoint Sensor ... 6-9

Chapter 7: Uninstallation
Removing Apex Central ...................................................... 7-2
Manually Removing Apex Central ........................................ 7-3
Removing the Apex Central Application ......................... 7-3
Stopping Apex Central Services ............................... 7-4
Stopping Apex Central Services from the Windows
Services Screen ................................................ 7-4
Stopping IIS and Apex Central Services from theCommand Prompt ............................................ 7-4
Removing Apex Central IIS Settings ......................... 7-5
iv

Table of Contents

Deleting Apex Central Files/Directories and Registry
Keys ....................................................................... 7-6
Removing the Database Components ....................... 7-7
Removing Apex Central ODBC Settings .............. 7-7
Removing the SQL Server 2017 Express Database ....
7-7
Removing the Apex Central Service ......................... 7-8

Chapter 8: Apex Central System Checklists
Server Address Checklist ..................................................... 8-2
Port Checklist ..................................................................... 8-3
Apex Central Conventions ................................................... 8-3
Core Processes and Configuration Files ................................ 8-4
Communication and Listening Ports .................................... 8-6

Index
Index ............................................................................... IN-1v

vi

Preface

Preface
Welcome to the Trend Micro Apex Central™ Installation and Upgrade Guide.
This document discusses requirements and procedures for installing theApex Central server, and upgrading from a previous installation.
Topics in this section:

1Trend Micro Apex Central™ Installation Guide

Documentation
Apex Central documentation includes the following:
Document

Description

Readme file

Contains a list of known issues and may also contain late-breaking
product information not found in the Online Help or printed
documentation

Installation andUpgrade Guide

A PDF document that discusses requirements and procedures for
installing the Apex Central
Note
The Installation and Upgrade Guide may not be available forminor release versions, service packs, or patches.

SystemRequirements

A PDF document that discusses requirements and procedures for
installing Apex Central

Administrator's Guide

A PDF document that provides detailed instructions of how to
configure and manage Apex Central and managed products, andexplanations on Apex Central concepts and features

Online Help

HTML files compiled in WebHelp format that provide "how to's", usage
advice, and field-specific information. The Help is also accessible fromthe Apex Central console

Widget and Policy
Management Guide

Contains information that explains how to configure dashboard
widgets and policy management settings in Apex Central
To access this guide, go to https://docs.trendmicro.com/en-us/
enterprise/trend-micro-apex-central-2019-widget-and-policymanagement-guide/preface-(wpg)_001.aspx.

2

Automation Center

Online user guides and references that explain how to use the Apex
Central Automation APIs: https://automation.trendmicro.com/apexcentral/home

Data Protection Lists(Chapter 1 only)

A PDF document that lists predefined data identifiers and templates
for Data Loss PreventionPreface

Document
Knowledge Base

Description
An online database of problem-solving and troubleshooting
information. It provides the latest information about known productissues. To access the Knowledge Base, go to the following website:
http://success.trendmicro.com

Download the latest version of the PDF documents and readme at:
http://docs.trendmicro.com/en-us/enterprise/apex-central.aspx

Audience
Apex Central documentation is intended for the following users:• Apex Central Administrators: Responsible for Apex Central installation,
configuration, and management. These users are expected to haveadvanced networking and server management knowledge.
• Managed Product Administrators: Users who manage Trend Micro
products that integrate with Apex Central. These users are expected tohave advanced networking and server management knowledge.

Document Conventions
The documentation uses the following conventions.
Table 1. Document Conventions
Convention

Description

UPPER CASE

Acronyms, abbreviations, and names of certain commands
and keys on the keyboard

Bold

Menus and menu commands, command buttons, tabs, andoptions

Italics

References to other documents

Monospace

Sample command lines, program code, web URLs, file names,and program output

3

Trend Micro Apex Central™ Installation Guide

Convention
Navigation > Path

Description
The navigation path to reach a particular screen
For example, File > Save means, click File and then click
Save on the interface

Note

Tip

Important

WARNING!

Configuration notes

Recommendations or suggestions

Information regarding required or default configuration
settings and product limitations

Critical actions and configuration options

Terminology
The following table provides the official terminology used throughout theApex Central documentation:
Terminology

4

Description

Administrator (or Apex Central
administrator)

The person managing the Apex Central server

Security Agent

The managed product program installed on an endpoint

Components

Responsible for scanning, detecting, and taking actions
against security risks

Preface

Terminology
Apex Central console, web
console, or management
consoleDescription
The web-based user interface for accessing, configuring, andmanaging a Apex Central
Note
Consoles for integrated managed products areindicated by the managed product name. For
example, the Apex One web console.

Managed endpoint

The endpoint where the managed product Security Agent isinstalled

Managed productA Trend Micro product that integrates with Apex Central

Managed server

The endpoint where the managed product is installed

Server

The endpoint where the Apex Central server is installed

Security risk

The collective term for virus/malware, spyware/grayware,and web threats

Product service

Apex Central services hosted through Microsoft Management
Console (MMC).

Dual-stack

Entities that have both IPv4 and IPv6 addresses

Pure IPv4

An entity that only has an IPv4 address

Pure IPv6

An entity that only has an IPv6 address

5Chapter 1

Introducing Apex Central
This section introduces Trend Micro Apex Central™ and provides an
overview of its features and capabilities.
Topics include:• About Apex Central on page 1-2• Key Features and Benefits on page 1-2• Apex Central Architecture on page 1-4

1-1Trend Micro Apex Central™ Installation Guide

About Apex Central
Trend Micro Apex Central™ is a web-based console that provides centralized
management for Trend Micro products and services at the gateway, mailserver, file server, and corporate desktop levels. Administrators can use thepolicy management feature to configure and deploy product settings tomanaged products and endpoints. The Apex Central web-based management
console provides a single monitoring point for antivirus and content security
products and services throughout the network.
Apex Central enables system administrators to monitor and report on
activities such as infections, security violations, or virus/malware entry
points. System administrators can download and deploy components, suchas antivirus pattern files, scan engines, and antispam rules, throughout the
network to ensure up-to-date protection. Apex Central allows both manualand pre-scheduled updates, and allows the configuration and administrationof products as groups or as individuals for added flexibility.

Key Features and Benefits
Apex Central provides the following features and benefits.
Feature1-2

Benefits

Active Directory
integration

Apex Central supports integration with multiple Active Directory
forests and allows you to import Active Directory groups in addition tousers. You can also enable Active Directory Federation Services (ADFS)
authentication to allow users or groups from federated business
partners across an extranet to securely log on to your Apex Central
network.

Dashboard

Use the Dashboard tabs and widgets for extensive visibility ofmanaged product and Apex Central information about threat
detections, component statuses, policy violations, and more.

Security Posture

Use the Security Posture tab to gain instant insights into the antivirus
pattern and Data Loss Prevention compliance status, critical threat
detections, as well as resolved and unresolved events on yournetwork.

Introducing Apex Central

FeatureBenefits

User/Endpoint
Directory

View detailed information about all the users and endpoints within
the Apex Central network and any security threat detections.

Product Directory

System administrators can immediately deploy configuration
modifications to managed products or even run a manual scan fromthe Apex Central web console during a virus/malware outbreak.

Global Policy
Management

System administrators can use policies to configure and deploy
product settings to managed products and endpoints from a single
management console to ensure consistent enforcement of yourorganization's virus/malware and content security policies.

Logs

Use a single management console to view consolidated logs from all
registered managed products without having to log on to eachindividual product console.

Event Notifications

Keep administrators informed of network events at all times byconfiguring Apex Central to send notifications by email, Windows
syslog, SNMP trap, or an in-house or industry-standard application
used by your organization.

Reports

Create comprehensive reports from custom or static templates toobtain the actionable information you need to ensure network
protection and security compliance.

Component Updates

Securely download and deploy antivirus patterns, antispam rules,
scan engines, and other antivirus or content security components to
help ensure that all managed products are up to date.

Connected Threat
DefenseApex Central brings together a host of Trend Micro products andsolutions to help you detect, analyze, and respond to targeted attacks
and advanced threats before they unleash lasting damage.

Securecommunication
infrastructure

Apex Central uses a communications infrastructure built on the Secure
Socket Layer (SSL) protocol and can even encrypt messages withauthentication.

Role-based
Administration

Grant and control access to the Apex Central web console by assigning
specific web console privileges to administrators and providing only
the tools and permissions necessary to perform specific tasks.

1-3

Trend Micro Apex Central™ Installation Guide

FeatureBenefits

Command Tracking

Command Tracking allows you to continuously monitor whether
commands executed using the Apex Central web console, such as
antivirus pattern updates and component deployment, havesuccessfully completed.

License management

Deploy new Activation Codes or reactivate existing Activation Codeson managed products.

Security Agent
installation

Download Security Agent installation packages for Apex One or Apex
One (Mac) directly from the Apex Central console.

Two-Factor
Authentication

Two-Factor Authentication provides extra security on user accounts byrequiring users to type the verification code generated by the Google
Authenticator app in order to sign in to Apex Central.

Browser support

This version of Apex Central includes support for the following:• Microsoft™ Internet Explorer™
• Microsoft™ Edge™
• Google™ Chrome™

Apex Central Architecture
Trend Micro Apex Central™ provides a means to control Trend Micro
products and services from a central location. This application simplifies theadministration of a corporate virus/malware and content security policy.
The following table describes the components that Apex Central uses.

1-4

Introducing Apex Central

Component
Apex Central server

Description
Acts as a repository for all data collected from the agents. The
Apex Central server includes the following features:• An SQL database that stores managed productconfigurations and logs
Apex Central uses the Microsoft SQL Server database(db_ApexCentral.mdf) to store data included in logs,
managed product information, user account, network
environment, and notification settings.
• A web server that hosts the Apex Central web console• A mail client that delivers event notifications throughemail messages
Apex Central can send notifications to individuals orgroups of recipients about events that occur on the Apex
Central network. Send event notifications by email, SNMP
trap, syslog, or any in-house/industry standard application
used by your organization to send notifications.
• A report server that generates antivirus and content
security product reports
The Apex Central report is an online collection of figures
about security threat and content security events that
occur on the Apex Central network.

Trend Micro Management
Communication Protocol

MCP handles the Apex Central server interaction with managed
products that support the next generation agent.
MCP agents install with managed products and use one/two
way communication to communicate with Apex Central. MCP
agents poll Apex Central for instructions and updates.

Web Service Integration
communication

An agent-less integration model that allows Apex Central tocommunicate with managed products

1-5Trend Micro Apex Central™ Installation Guide

Component
Web-based management
consoleDescription
Allows an administrator to manage Apex Central from virtually
any computer with an Internet connection and web browser
The Apex Central management console is a web-based console
published on the Internet through the Microsoft Internet
Information Server (IIS) and hosted by the Apex Central server.
It lets you administer the Apex Central network from any
computer using a compatible web browser.

Widget Framework

1-6

Allows an administrator to create a customized dashboard tomonitor the Apex Central network.

Chapter 2

Installation PlanningThis chapter helps you plan for deployment and manage a Apex Central test
deployment.
Topics include:• Identifying Deployment Architecture and Strategy on page 2-2• Apex Central Setup Flow on page 2-9• Testing Apex Central at One Location on page 2-9• Server Distribution Plan on page 2-11
• Network Traffic Plan on page 2-13
• Source of Network Traffic on page 2-15
• Deploying Updates on page 2-17
• Data Storage Plan on page 2-19
• Web Server Plan on page 2-20

2-1

Trend Micro Apex Central™ Installation Guide

Identifying Deployment Architecture and Strategy
Deployment is the process of strategically distributing Apex Central servers
in your network environment to facilitate and provide optimal managementof antivirus and content security products.
Deploying enterprise-wide, client-server software like Apex Central to a
network requires careful planning and assessment.
For ease of planning, Trend Micro recommends two deploymentarchitectures:• Single-site deployment: Refers to distributing and managing servers,
managed products, and endpoints from a single Apex Central located ina central office. If your organization has several offices but has fast andreliable local and wide area network connections between sites, singlesite deployment still applies to your environment.
• Multiple-site deployment: Refers to distributing and managing Apex
Central servers in an organization that has main offices in different
geographical locations.

2-2

Installation Planning

Understanding Single-Site Deployment
Single-site deployment refers to distributing and managing servers, managed
products, and endpoints from a single Apex Central located in a central
office.

Figure 2-1. A single-site deployment using a single Apex Central server

Before deploying Apex Central to a single site, complete the following tasks:
1. Determine the number of managed products and endpoints
2. Plan for the optimal ratios of server, managed products and endpoints
3. Designate the Apex Central server

Determining the Number of Managed Products and Endpoints
Determine how many managed products and endpoints structures you plan
to manage with Apex Central. You will need this information to decide whatkind and how many Apex Central servers you need to deploy, as well as
where to put these servers on your network to optimize communication andmanagement.

2-3Trend Micro Apex Central™ Installation Guide

Planning for the Optimal Ratios of Server to Managed Products
The most critical factor in determining how many managed products andendpoints a single Apex Central server can manage on a local network is theagent-server communication.
Use the recommended system requirements as a guide in determining the
CPU and RAM requirements for your Apex Central network.

Designating Apex Central Servers
Based on the number of managed products and endpoints, decide anddesignate your Apex Central server.
Locate your Windows servers, and then select the ones to assign as Apex
Central servers. You also need to determine if you need to install a dedicatedserver.
When selecting a server that will host Apex Central, consider the following:• The CPU load
• Other functions the server performs
If you are installing Apex Central on a server that has other uses (forexample, application server), Trend Micro recommends that you install on aserver that is not running mission-critical or resource-intensive applications.
Depending on your network topology, you may need to perform additionalsite-specific tasks.

Understanding Multiple-Site Deployment
As with single-site deployment, collect relevant network information andidentify how this information relates to deploying Apex Central to yourmultiple sites.
Given the uniqueness of each network, exercise judgment as to how many
Apex Central servers would be optimal.
Deploy Apex Central servers in a number of different locations, including thedemilitarized zone (DMZ) or the private network. Position the Apex Central
server in the DMZ on the public network to administer managed products,
2-4

Installation Planningendpoints, or other servers and access the Apex Central web console over theInternet.

Figure 2-2. A multi-site deployment using multiple Apex Central servers

Consider the following for multi-site deployment:• Group managed products, endpoints, or servers• Determine the number of sites• Determine the number of managed products, endpoints, and servers• Plan for network traffic• Decide where to install the Apex Central serverGrouping Managed Products
Consider the following when you group managed products:

2-5Trend Micro Apex Central™ Installation Guide

Table 2-1. Considerations Grouping Managed Products
Consideration

Description

Company networkand security policies

If different access and sharing rights apply to the company network,group managed products, endpoints, and servers according tocompany network and security policies.

Organization andfunctionGroup managed products, endpoints, and servers according to thecompany's organizational and functional division. For example, have
two Apex Central servers that manage the production and testinggroups.

Geographicallocation

Use geographical location as a grouping criterion if the location of the
managed products, endpoints, and servers affects the communication
between the Apex Central server and its managed products,
endpoints, or servers.

Administrative
responsibilityGroup managed products, endpoints, and servers according to systemor security personnel assigned to them. This allows groupconfiguration.

Determining the Number of Sites
Determine how many sites your Apex Central deployment will cover. You
need this information to determine the number of servers to install, as wellas where to install the servers.
Gather this information from your organization's WAN or LAN topology
charts.

Determining the Number of Managed Products and Endpoints
You also need to know the total number of managed products, and endpoints
Apex Central server will manage. Trend Micro recommends gathering
managed product, and endpoint population data per site. If you cannot get
this information, even rough estimates will be helpful. You will need thisinformation to determine how many servers to install.

Planning for the Optimal Ratio of Server to Managed Products
When deploying Apex Central across a WAN, the Apex Central server in themain office administers managed products, endpoints, and other servers in
2-6

Installation Planning

remote offices. Managed products, endpoints, or servers in remote offices
may require different network bandwidth when communicating with theApex Central server over a WAN. Apex Central prioritizes communication
with the managed products, endpoints, or servers with the fasterconnections.
Use the recommended system requirements as a guide in determining the
CPU and RAM requirements for your Apex Central network.

Designating Apex Central Servers
Based on the number of managed products and endpoints, decide anddesignate your Apex Central server.
Locate your Windows servers, and then select the ones to assign as Apex
Central servers. You also need to determine if you need to install a dedicatedserver.
When selecting a server that will host Apex Central, consider the following:• The CPU load
• Other functions the server performs
If you are installing Apex Central on a server that has other uses (forexample, application server), Trend Micro recommends installing on aserver that does not run mission-critical or resource-intensive applications.

Deciding Where to Install the Apex Central ServerOnce you know the number of clients and the number of servers you need to
install, find out where to install your Apex Central servers. Decide if you
need to install all your servers in the central office or if you need to installsome of them in remote offices.
Place the servers strategically in certain segments of your environment tospeed up communication and optimize managed product, endpoint, andserver management:• Central office: A central office is the facility where the majority of the
managed products, endpoints, and servers in the organization arelocated. The central office is sometimes referred to as headquarters,
2-7Trend Micro Apex Central™ Installation Guide

corporate office, or corporate headquarters. A central office can haveother smaller offices or branches (referred to as "remote offices" in thisguide) in other locations.
Tip
Trend Micro recommends installing a server in the central office.

• Remote office: A remote office is defined as any small professional officethat is part of a larger organization and has a WAN connection to thecentral office. If you have managed products, endpoints, and servers in aremote office that report to the server in the central office, they may
encounter difficulties connecting to the server. Bandwidth limitations
may prevent proper communication to and from the Apex Central
server.
The network bandwidth between your central office and remote office
may be sufficient for routine client-server communication, such as
notifications for updated configuration settings and status reporting, but
insufficient for deployment and other tasks.

Planning for Network Traffic
Apex Central generates network traffic when the server and managed
products/endpoints communicate. Plan the Apex Central network traffic tominimize the impact on an organization's network.
These are the sources of Apex Central-related network traffic:• Heartbeat• Logs• Managed product registration to Apex Central server
Apex Central servers, by default, contain all the product profiles
available during the Apex Central release. However, if you register a newversion of a product to Apex Central, a version that does not correspondto any existing product profiles, the new product will upload its profile
to the Apex Central server.

2-8

Installation Planning

For brand-new Trend Micro products that have not had a productprofile, Trend Micro delivers updates to enable Apex Central to identify
these products.
• Downloading and deploying updates• Policy deployment• Suspicious object synchronization

Apex Central Setup Flow
Setting up your Apex Central system is a multi-step process that involves thefollowing:
1. Planning the Apex Central system installation (server distribution,
network traffic, data storage, and web server considerations).
2. Installing the Apex Central server.
Note
During installation of the Apex Central server, provide a location for backup
and restoration files.

Testing Apex Central at One Location
A pilot deployment provides an opportunity for feedback to determine how
features work and the level of support likely needed after full deployment.
Tip
Trend Micro recommends conducting a pilot deployment before performing afull-scale deployment.

Piloting Apex Central at one location allows you to accomplish the following:• Gain familiarity with Apex Central and managed products• Develop or refine the company's network policies
2-9Trend Micro Apex Central™ Installation Guide

A pilot deployment is useful to determine which configurations need
improvements. It gives the IT department or installation team a chance torehearse and refine the deployment process and to verify that yourdeployment plan meets your organization's business requirements.
A Apex Central test deployment consists of the following tasks:• Preparing for the test deployment• Selecting a test site
• Beginning the test deployment• Evaluating the test deployment

Preparing for the Test Deployment
Complete the following activities during the preparation stage.
Procedure
1.

Decide the Apex Central server and agent configuration for the test
environment.
• Establish TCP/IP connectivity among all systems in a trial
configuration.
• Verify bidirectional TCP/IP communications by sending a pingcommand to each agent system from the manager system and viceversa.

2.

Evaluate the different deployment methods to see which ones are
suitable for your particular environment.

3.

Complete a System Checklist used for the pilot deployment.

Selecting a Test Site
Select a pilot site that best matches your production environment. Try tosimulate, as closely as possible, the type of topology that would serve as anadequate representation of your production environment.
2-10Installation Planning

Beginning the Test Deployment
After completing the preparation steps and System Checklist, begin the pilot
deployment by installing the Apex Central server and agents.

Evaluating the Test Deployment
Create a list of successes and failures encountered throughout the pilot
process. Identify potential pitfalls and plan accordingly for a successful
deployment.
You can implement the pilot evaluation plan into the overall production
installation and deployment plan.

Server Distribution Plan
Consider the following when planning for server distribution:• Administration models• Apex Central server distribution• Single-server topology• Multiple-server topology

Understanding Administration Models
Early in the Apex Central deployment, determine exactly how many people
you want to grant access to your Apex Central server. The number of users
depends on how centralized you want your management to be. The guiding
principle being: the degree of centralization is inversely proportional to thenumber of users.
Follow one of these administration models:• Centralized management: This model gives Apex Central access to as
few people as possible. A highly centralized network would have only
one administrator, who then manages all the antivirus and content
security servers on the network.
Centralized management offers the tightest control over your network
antivirus and content security policy. However, as network complexity
2-11

Trend Micro Apex Central™ Installation Guide

increases, the administrative burden may become too much for one
administrator.
• Decentralized management: This is appropriate for large networks
where system administrators have clearly defined and established areasof responsibility. For example, the mail server administrator may also be
responsible for email protection; regional offices may be independently
responsible for their local areas.
A main Apex Central administrator would still be necessary, but he or
she shares the responsibility for overseeing the network with otherproduct or regional administrators.
Grant Apex Central access to each administrator, but limit access rights
to view and/or configure segments of the Apex Central network that areunder their responsibility.
With one of these administration models initialized, you can then configure
the Product Directory and necessary user accounts to manage your Apex
Central network.

Understanding Apex Central Server Distribution
Apex Central can manage products regardless of physical location, and so it
is possible to manage all your antivirus and content security products using asingle Apex Central server.
However, there are advantages to dividing control of your Apex Central
network among different servers. Based on the uniqueness of your network,
you can decide the optimum number of Apex Central servers.

Single-Server Topology
The single-server topology is suitable for small to medium, single-siteenterprises. This topology facilitates administration by a single
administrator, but does not preclude the creation of additional administrator
accounts as required by your Administration plan.
However, this arrangement concentrates the burden of network traffic (agent
polling, data transfer, update deployment, and so on) on a single server, and

2-12

Installation Planning

the LAN that hosts it. As your network grows, the impact on performance
also increases.

Multiple-Server Topology
For larger enterprises with multiple sites, it may be necessary to set up
regional Apex Central servers to divide the network load.
For information on the traffic that a Apex Central network generates, see
Understanding Apex Central Network Traffic on page 2-13.

Network Traffic Plan
To develop a plan to minimize the impact of Apex Central on your network, it
is important to understand the network traffic generated by Apex Central.
The following section helps you understand the traffic that your Apex Central
network generates and develop a plan to minimize its impact on yournetwork. In addition, the section about traffic frequency describes whichsources frequently generate traffic on a Apex Central network.

Understanding Apex Central Network Traffic
To develop a plan to minimize the impact of Apex Central on your network, it
is important to understand the network traffic generated by Apex Central.

Sources of Network Traffic
The following Apex Central sources generate network traffic:• Log traffic• MCP policies• Product registration• Downloading and deploying updates• Deploying policy settings

Traffic Frequency
The following sources frequently generate traffic on a Apex Central network:
2-13

Trend Micro Apex Central™ Installation Guide• Logs generated by managed products• MCP polling and commands

Logs
Managed products send logs to Apex Central at different intervals, dependingon their individual log settings.

Managed Product Agent Heartbeat
By default, managed product agents send heartbeat messages every 60
minutes. Administrators can adjust this value from 5 to 480 minutes (8hours). When choosing a heartbeat setting, choose a balance between theneed to display the latest status information and the need to manage system
resources.
The default setting will be satisfactory for most situations, however should
you feel the need to customize these settings, consider the following:• Long-Interval Heartbeats (above 60 minutes): The longer the interval
between heartbeats, the greater the number of events that may occur
before the Apex Central console displays the interval.
For example, if a connection problem with an agent is resolved between
heartbeats, it then becomes possible to communicate with an agent even
if its status appears as Inactive or Abnormal.
• Short-Interval Heartbeats (below 60 minutes): Short intervals between
heartbeats present a more up-to-date picture of your network status at
the Apex Central server. However, short-interval heartbeats increase theamount of network bandwidth used.
Note
Before adjusting the interval to a number below 15 minutes, study yourexisting network traffic to understand the impact of increased use of
network bandwidth.

2-14Installation Planning

Network Protocols
Apex Central uses the UDP and TCP protocols for communication.

Source of Network Traffic
Log Traffic
Constant sources of network traffic in a Apex Central network are "productlogs", logs that managed products regularly send to the Apex Central server.
Table 2-2. Apex Central Log Traffic
Log

Contains Information About

Virus/Spyware/
GraywareDetected virus/malware, spyware/grayware, and other security threats

Security

Violations reported by content security products

Web Security

Violations reported by web security products

Event

Miscellaneous events (for example, component updates, and genericsecurity violations)

Status

The environment of a managed product. The Status tab of the ProductDirectory displays this information

Network Virus

Viruses detected in network packets

Performance Metric

Used for previous product versions

URL Usage

Violations reported by web security products

Security Violation

Violations reported by Network VirusWall products.

Security ComplianceEndpoint compliances reported by Network VirusWall products

Security Statistic

The difference between security compliances and security violations
calculated and reported by Network VirusWall products.

Endpoint

Violations reported by Web security products.

Data Loss Prevention
Log

Detections related to Data Loss Prevention policy violations

2-15

Trend Micro Apex Central™ Installation Guide

Log

Contains Information About

Behavior Monitoring
Log

Behavior-based malicious activity detections

Network Inspection
Log

Includes IP address or domain detections

Predictive Machine
Learning Log

Predictive Machine Learning detections

Virtual Analyzer Log

Detections reported by Virtual Analyzer for suspicious sample
submissions

File Hash Detection
Log

Detections triggered by File or File SHA-1 suspicious objects

Trend Micro Management Communication Protocol Policies
The Trend Micro Management Communication Protocol (MCP) is the Apex
Central communications backbone. MCP implements the following policies:• MCP Heartbeat: The MCP heartbeats to Apex Central ensure that Apex
Central displays the latest information and that the connection between
the managed product and the Apex Central server is functional.
• MCP Command Polling: When an MCP agent initiates a command poll
to Apex Central, Apex Central notifies the agent to send managed
product logs or issues a command to the managed product. Apex Central
also interprets a command poll as a passive heartbeat verifying theconnection between Apex Central and the managed product.

Product Registration Traffic
Product profiles provide Apex Central with information about how tomanage a particular product. Managed products upload profiles to the Apex
Central server the first time they register with the server.
Each product has a corresponding product profile, and in many cases,
different versions of a product have their own, version-specific profile.
Profiles contain the following information:

2-16

Installation Planning• Category (for example, antivirus)• Product name• Product version• Menu version• Log format• Update component information – updates that the product supports (forexample, virus pattern files)• Command information
By default, Apex Central servers contain all the product profiles for managed
products that use Web Services Integration communication. Managed
products that use the Trend Micro Management Communication Protocol(MCP) upload product profiles during initial registration with the Apex
Central server.

Policy Deployment
Apex Central generates network traffic when deploying policy settings tomanaged products and endpoints. The traffic originates from the following
sources:• Periodic policy enforcement
Apex Central enforces the policy settings on managed products andendpoints every 24 hours.
• Deployed information
A policy contains the Globally Unique Identifier (GUID) information foreach endpoint and the setting information. A policy containing 50,000
targets and a full set of settings can generate up to 1.8MB of network
traffic.

Deploying Updates
Updating the Apex Central network is a two-step process:

2-17Trend Micro Apex Central™ Installation Guide

1. Obtain the latest update components from Trend Micro.
Apex Central can download components either directly from the Trend
Micro update server, or from an alternative location.
2. Deploy these components to the managed products.
Apex Central deploys update components to managed products,
including:• Pattern files/Cleanup templates• Engines (scan engines, damage cleanup engines)• Antispam rules• Apex One Plug-in Manager Plug-in Programs• Product programs (depending on the product)
Tip
Trend Micro strongly recommends regularly updating thesecomponents to help ensure managed products can protect yournetwork against the latest threats. For product program updates,
refer to the specific program's documentation.

Deploying updates to managed products is a bandwidth-intensive
operation. If possible, it is important to perform deployments when
they will have the least impact on the network.
You can stagger the deployment of component updates using
Deployment Plans.
Furthermore, check that the network connection between yourApex Central server and managed products can accommodate theupdates. The connection is a factor to consider when deciding how
many Apex Central servers your network needs.

2-18Installation Planning

Data Storage Plan
Apex Central data must be stored in an SQL database. When you install Apex
Central on a server that does not have its own database, the installation
program provides the option to install the Microsoft SQL Express. However,
due to the limitations of SQL Express, large networks require an SQL server.
Note
Apex Central uses SQL and Windows authentication to access the SQL server.

Database Recommendations
This section provides recommendations for administrators when installing
Apex Central and the SQL server on the same computer.
• Production environment• Use a computer with more than 10GB of disk space
Note
The minimum disk space requirement to install Apex Central is
10GB, but the recommended requirement is 80GB. Trend Microrecommends at least 80GB of disk space for installing Apex Central
and the SQL server on the same computer.

• Configure the maximum amount of memory used by the SQL server
Leave at least 8GB of memory for Apex Central and system usage.
For example, if a computer has 80GB of memory, set the maximum
memory usage of the SQL server to 72GB. In this case, 8GB ofmemory is available for Apex Central and system usage.
• Test environment
Leave at least 8GB of memory for Apex Central and system usage.

2-19

Trend Micro Apex Central™ Installation Guide

Note
For details on how to configure memory usage for the SQL server, see https://
docs.microsoft.com/en-us/sql/database-engine/configure-windows/servermemory-server-configuration-options.
Tip• For Apex Central managing more than 1,000 products (including Apex
One Security Agents and ServerProtect Normal servers), Trend Microrecommends using a dedicated SQL server.
• If Apex Central and the SQL server are installed on different computers,
set the same time zone on both computers.
• Trend Micro highly recommends using Microsoft SQL Server Standard orEnterprise Edition. SQL Express is suitable for testing purposes but notfor production environments.

ODBC Driver
Apex Central installs Open Database Connectivity (ODBC) Driver 13 for SQL
Server to support Microsoft SQL Server communications and Transport
Layer Security (TLS) 1.2.

Authentication
Apex Central supports both SQL database authentication and Windows
authentication.

Web Server Plan
The web server information screen in the Apex Central setup program
presents similar server identification options as the host ID definition
screen: host name, FQDN, or IP address. The decision considerations for the
web server name are the same:• Using the host name or FQDN facilitates Apex Central server IP addresschanges, but makes the system dependent on the DNS server
2-20Installation Planning• The IP address option requires a fixed IP
Use the web server address to identify the source of component updates. The

SystemConfiguration.xml file stores this information and sends it to agentsas part of a notification for these agents to obtain updates from the Apex
Central server. Update source related settings appear as follows:
Value=http://Web server address>:port>/TvcsDownload/
ActiveUpdate/component>

Where:• Port: The port that connects to the update source. You can also specify
this on the web server address screen (default port number is 80)• TvcsDownload/ActiveUpdate: The Apex Central setup program creates
this virtual directory in the IIS-specified website• Component: This depends on the updated component. For example,
when the virus pattern file is updated, the value added here is:Pattern/vsapi.zip
Pattern corresponds to the \\. . . Control Manager\WebUI\download\activeupdate\pattern folder on the Apex Central server.
Vsapi.zip is the virus pattern in compressed form.

2-21

Chapter 3

Installation
This chapter guides you through installing the Apex Central server. The
chapter also contains post-installation configuration information as well as
instructions on how to register and activate your software.
Topics include:• System Requirements on page 3-2• Installing the Apex Central Server on page 3-7

3-1

Trend Micro Apex Central™ Installation Guide

System Requirements
Apex Central runs on Windows Server and requires specific Windowsfeatures and hotfixes in order to install. Apex Central also requires a
supported version of Microsoft SQL Server, at least 8 GB of RAM, and at least
10 GB of available disk space.
• For complete system requirements and supported Windows Server andMicrosoft SQL Server versions, download the Apex Central System
Requirements document from http://docs.trendmicro.com/en-us/
enterprise/apex-central.aspx.
• For detailed managed product and Security Agent system requirements,
see the managed product documentation.
The following tables list the minimum Windows Server requirements forrunning the Apex Central installation program.
• Windows Server 2012 on page 3-3• Windows Server 2012 R2 on page 3-4• Windows Server 2016 on page 3-5• Windows Server 2019 on page 3-6• Windows Server 2022 on page 3-7

3-2

Installation

Note• The following Windows hotfixes are not automatically installed byWindows Updates but are required for the respective operating systems
prior to Apex Central installation:• KB2999226• KB2919355• KB2919442• The following Windows hotfixes are only required for the respective
operating systems to support TLS 1.2:
• KB2975331• KB3000850
Table 3-1. Windows Server 2012
Item

Requirement

Editions (no Service
Pack required)• Standard

Processor• At least 2.3 GHz Intel™ Core™ i5 or compatible CPUs

• Datacenter• AMD™ 64 processor• Intel™ 64 processorRAM• 8 GB minimum

Available Disk Space• 10 GB minimum• 80 GB recommended (SAS)3-3

Trend Micro Apex Central™ Installation Guide

Item
Windows Features

Requirement• Microsoft IIS 8.0• Microsoft IIS Windows Authentication• Microsoft IIS ASP• Microsoft IIS ASP.NET 4.5• Microsoft IIS ASP.NET Extensibility 4.5• Microsoft IIS CGI• Microsoft Message Queuing Service (MSMQ)

Windows Hotfixes• KB2999226• KB2975331

Table 3-2. Windows Server 2012 R2
Requirement

Item
Editions (no Service
Pack required)• Standard

Processor• At least 2.3 GHz Intel™ Core™ i5 or compatible CPUs

• Datacenter• AMD™ 64 processor• Intel™ 64 processorRAM• 8 GB minimum

Available Disk Space• 10 GB minimum• 80 GB recommended (SAS)3-4Installation

Item
Windows Features

Requirement• Microsoft IIS 8.5• Microsoft IIS Windows Authentication• Microsoft IIS ASP• Microsoft IIS ASP.NET 4.5• Microsoft IIS ASP.NET Extensibility 4.5• Microsoft IIS CGI• Microsoft Message Queuing Service (MSMQ)

Windows Hotfixes• KB2919355• KB2919442• KB3000850

Table 3-3. Windows Server 2016
Requirement

Item
Editions (no Service
Pack required)• Standard

Processor• At least 2.3 GHz Intel™ Core™ i5 or compatible CPUs

• Datacenter• AMD™ 64 processor• Intel™ 64 processorRAM• 8 GB minimum

Available Disk Space• 10 GB minimum• 80 GB recommended (SAS)3-5

Trend Micro Apex Central™ Installation Guide

Item
Windows Features

Requirement• Microsoft IIS 10.0
• Microsoft IIS Windows Authentication• Microsoft IIS ASP• Microsoft IIS ASP.NET 4.6• Microsoft IIS ASP.NET Extensibility 4.6• Microsoft IIS CGI• Microsoft Message Queuing Service (MSMQ)

Windows Hotfixes• N/A

Table 3-4. Windows Server 2019
Item

Requirement

Editions (no Service
Pack required)• Standard

Processor• At least 2.3 GHz Intel™ Core™ i5 or compatible CPUs

• Datacenter• AMD™ 64 processor• Intel™ 64 processorRAM• 8 GB minimum

Available Disk Space• 10 GB minimum• 80 GB recommended (SAS)Windows Features• Microsoft IIS 10.0
• Microsoft IIS Windows Authentication• Microsoft IIS ASP• Microsoft IIS ASP.NET 4.7• Microsoft IIS ASP.NET Extensibility 4.7• Microsoft IIS CGI• Microsoft Message Queuing Service (MSMQ)

3-6

Installation

Item
Windows Hotfixes

Requirement• N/A

Table 3-5. Windows Server 2022
Item

Requirement

Editions (no Service
Pack required)• Standard

Processor• At least 2.3 GHz Intel™ Core™ i5 or compatible CPUs

• Datacenter• AMD™ 64 processor• Intel™ 64 processorRAM• 8 GB minimum

Available Disk Space• 10 GB minimum• 80 GB recommended (SAS)Windows Features• Microsoft IIS 10.0
• Microsoft IIS Windows Authentication• Microsoft IIS ASP• Microsoft IIS ASP.NET 4.8• Microsoft IIS ASP.NET Extensibility 4.8• Microsoft IIS CGI• Microsoft Message Queuing Service (MSMQ)

Windows Hotfixes• N/AInstalling the Apex Central Server
After deciding on the topology to use for your network, you can begin to
install your Apex Central server.
See Server Address Checklist on page 8-2 to help you record relevant
information for installation.
You need the following information for the installation:
3-7

Trend Micro Apex Central™ Installation Guide• Relevant target server address and port information• Apex Central Registration Key• Security Level to use for Server-Agent communication
The following are database-related considerations:• Decide if you want to use an SQL server with Apex Central. If the SQL
server is located on a server other than the Apex Central server, obtainits IP address, FQDN, or NetBIOS name. If there are multiple instancesof the SQL server, identify the one that you intend to use• Prepare the following information about the SQL database for Apex
Central:• User name for the database• Password
Note
Apex Central allows you to use Windows authentication or SQL
authentication to access the SQL server.

• Determine the number of managed products that Apex Central willhandle. If an SQL server is not detected on the server, Apex Central
installs SQL Server 2017 Express, which can only handle a limited
number of connections

Apex Central Installation Flow
Installing Apex Central requires performing the following steps:
1. Install all required components
2. Specify the installation location
3. Register and activate the product and services
4. Specify the backup settings
5. Set up the root account

3-8Installation

6. Configure database information
Tip
Trend Micro recommends upgrading to the latest version of Apex Central
instead of doing a fresh installation.

Installing All Required Components
Procedure1.

Run the Apex Central installation program (Trend Micro Apex

Central.exe) on the server.

The installation program checks your system for required components.
• If .NET Framework 4.6.1 or above is not already installed, proceed
to step 2.
• If .NET Framework 4.6.1 or above is already installed, skip to step 3.
2.

Click Accept and Install to accept the Microsoft license terms and install
the framework.
The installation program installs .NET Framework 4.6.1.
Note
You may need to restart the server to after installing the missing
component.

3.

Click Yes to continue the installation.

3-9

Trend Micro Apex Central™ Installation Guide

The Welcome screen appears.

Figure 3-1. The Welcome screen

The installation program checks your system for existing components.
Before proceeding with the installation, close all instances of theMicrosoft Management Console.
4.

3-10

Click Next.

Installation

The Software License Agreement screen appears.

Figure 3-2. Agree with the License Agreement

5.

Read the terms of the license agreement and choose one of thefollowing:• If you do not agree with the terms of the license, click No.
The installation stops.
• To proceed with the installation, click Yes.
The Local System Environment Analysis Screen appears.

3-11

Trend Micro Apex Central™ Installation Guide

Note
If a SQL server database is not already installed, the installation
program will install Microsoft SQL Server 2017 Express at the end of
the procedure.
For more information, see Configuring Database Information on page
3-19.

Specifying the Installation Location
Procedure
1.

Click Next.
The Select Destination Folder screen appears.

Figure 3-3. Select a destination folder

3-12Installation

2.

Specify a location for Apex Central files. Click Browse to specify analternate location.
Note• The default location on 64-bit operating systems is C:\Program
Files (x86)\Trend Micro.
• The setup program installs files related to Apex Central
communication (MCP) in predetermined folders in the Program
Files folder.

Activating the Product and Services
Procedure
1.

Click Next.

3-13

Trend Micro Apex Central™ Installation Guide

The Product Activation screen appears.

Figure 3-4. Provide the Activation Code to activate and services

2.

Type the Apex Central Activation Code in the space provided.

Specifying Apex Central Web Server Settings
Procedure
1.

Click Next.
The Specify Web Server Information screen appears.

3-14

Installation

The settings on the Specify Web Server Information screen define
communication security and how the Apex Central network identifies
your server.

Figure 3-5. Specify web server information

2.

From the Web site list, select the website to access Apex Central.

3.

From the IP address list, select the FQDN/host name, IPv4, or IPv6
address you want to use for the Apex Central Management Console. Thissetting defines how the Apex Central communication system identifies
your Apex Central server. The setup program attempts to detect both theserver's fully qualified domain name (FQDN) and IP address anddisplays them in the appropriate field.
If your server has more than one network interface card, or if you assign
your server more than one FQDN, the names and IP addresses appear

3-15

Trend Micro Apex Central™ Installation Guide

here. Choose the most appropriate address or name by selecting thecorresponding option or item in the list.
If you use the host name or FQDN to identify your server, make sure that
this name can be resolved on the product computers; otherwise theproducts cannot communicate with the Apex Central server.
4.

From the Web access security level list, select one of the following
security security levels for Apex Central communication:• High - HTTPS only: All Apex Central communication uses HTTPS
protocol. This ensures the most secure communication between
Apex Central and other products.
• Medium - HTTPS primary: If supported all Apex Central
communication uses HTTPS protocol. If HTTPS is unavailable,
agents use HTTP instead. This is the default setting when installing
Apex Central.
• Low - HTTP based: All Apex Central communication uses HTTP
protocol. This is the least secure communication method between
Apex Central and other products.
Note
Trend Micro does not recommend selecting this option.

Specifying Backup Settings
Procedure
1.

3-16

Click Next.

Installation

The Choose Destination Location screen appears.

Figure 3-6. Choose a destination location for backup and authentication files

2.

Specify the location of the Apex Central backup and authentication files.
Click Browse to specify an alternate location.
Note
The default location on 64-bit operating systems is C:\Program Files(x86)\Trend Micro\CmKeyBackup.
For more information, see Server Files to Back Up Before Migration on page
5-3.

3-17

Trend Micro Apex Central™ Installation Guide

Setting Up the Root AccountProcedure
1.

Click Next.
The following screen appears.

Figure 3-7. Provide information for the Apex Central root account2.

Provide the following account information:• User name (required)• Full name• Password (required)• Confirm password (required)

3-18

Installation• Email address

Configuring Database Information
Procedure
1.

Click Next.
The Setup Apex Central Database screen appears.

Figure 3-8. Choose the Apex Central database2.

Select a database to use with Apex Central.
• Install Microsoft SQL Express: The setup program automaticallyselects this option if an SQL server is not installed on this computer.
Do not forget to specify a password for this database in the fieldprovided.

3-19

Trend Micro Apex Central™ Installation Guide

Tip
Microsoft SQL Server Express is suitable only for a small number ofconnections. Trend Micro recommends using an SQL server forlarge Apex Central networks.

• SQL Server: The setup program automatically selects this option if
the program detects an SQL server on the server. Provide thefollowing information:• SQL Server (\Instance): This server hosts the SQL server thatyou want to use for Apex Central. If an SQL server is present on
your server, the setup program automatically selects it.
To specify an alternative server, identify it using its FQDN, IPv4
address, or NetBIOS name.
If more than one instance of SQL server exists on a host server(this can be either the same server where you are installing
Apex Central, or another server), you must specify the instance.
For example: your_sql_server.com\instance
Note
If users choose to use a remote SQL server, do not specify an
IPv6 address in the SQL Server field. Apex Central cannot
identify the remote database by its IPv6 address.

3.

Provide credentials to access the SQL server in Databaseauthentication.
WARNING!
For security reasons, do not use an SQL database that is not password
protected.

3-20Installation

Important
Both the SQL Server Account and Windows Account should meet thefollowing requirements:• Belongs to the “Administrators Group”• Contains the “Log on as a service” user right• Contains the “db_creator” or “db_owner” database roles• The “db_creator” role is required if creating a new database (thetarget database does not already exists).
• The “db_owner” role is sufficient if the target database alreadyexists.
Tip
If using an existing database, Trend Micro strongly recommends
preparing an empty database for Apex Central installation.

• SQL Server AccountBy default, the user name is sa.
• Windows AccountType the user name in the following format: domain name\user

name.

4.

Under Trend Micro Apex Central database, provide a name for theApex Central database.
The default name is db_ApexCentral.

5.

Click Next to create the required database. If the setup program detects
an existing Apex Central database, you have the following options:• Delete existing records, and create a new database: The existing
database is deleted, and another is created using the same name.

3-21

Trend Micro Apex Central™ Installation Guide• Create a new database with a new name: You are returned to theprevious screen to allow you to change your Apex Central database
name.
6.

Click Next.

7.

Click Finish to complete the installation.

Figure 3-9. Setup complete

3-22Chapter 4

Post-installation Tasks
This chapter discusses the tasks Trend Micro recommends performing after
the Apex Central installation completes.
Topics include:• Automatic Post-installation Tasks on page 4-2• Verifying the Server Installation or Upgrade on page 4-2• Activating Your Software on page 4-3• Configuring Active Directory Connection Settings on page 4-5• Configuring User Accounts on page 4-8• Downloading the Latest Components on page 4-8• Configuring Event Notifications on page 4-8

4-1

Trend Micro Apex Central™ Installation Guide

Automatic Post-installation Tasks
Apex Central automatically performs the following tasks after successfully
upgrading or migrating from Control Manager 6.0 Service Pack 3 Patch 3.
• Migrate previously configured Active Directory server settings• Synchronize Active Directory server data

Verifying the Server Installation or Upgrade
After completing the installation or upgrade, verify the following items:
Item
Programs list

Description
The following programs appear on the Add/Remove Programs list
(Control Panel > Add/Remove Programs) on the server computer.
• Trend Micro Apex Central• Microsoft Visual C++ 2005, 2008, 2012, 2015 Redistributable• Microsoft Report Viewer 2012 Runtime• Microsoft SQL Server 2017
• Microsoft SQL Server 2017 Native Client• Microsoft SQL Server 2017 Setup• Microsoft SQL Server 2017 Setup Support Files• Microsoft SQL Server Browser• Microsoft SQL Server VSS Writer

Directory folders

The following folders appear in the C:\Program Files (x86)directory on the server computer:• Trend Micro\CmKeyBackup• Trend Micro\COMMON\TMI• Trend Micro\Control Manager

Apex Central
Database files

4-2• db_ApexCentral.mdf• db_ApexCentral_Log.LDF

Post-installation Tasks

Item

Description

The setup program creates the following services and processes:
Apex Central services• Trend Micro Apex Central• Trend Micro Management Infrastructure

IIS process• w3wp.exe (Internet Information Services)

ISAPI filters• ReverseProxy• TmcmRedirect

Apex Central
processes• CasProcessor.exe• CMEFScheduler.NET.exe• CmdProcessor.exe• CmdProcessor.NET.exe• LogForwarder.exe• LogProcessor.exe• LogReceiver.exe• LogRetriever.exe• MDRProcessor.NET.exe• MsgReceiver.exe• ProcessManager.exe• ReportServer.exe• sCloudProcessor.NET.exe• TICAgentForMDR.exe

Activating Your Software
Activating Apex Central allows you to use all of the product features,
including downloading updated program components.
For more information, see the following topics:• Activating Apex Central on page 4-4

4-3

Trend Micro Apex Central™ Installation Guide• Converting to the Full Version on page 4-4

Activating Apex Central
The License Management screen allows you to activate Apex Central after
obtaining an Activation Code from your Trend Micro sales representative orreseller.
If you purchased a license for Apex One Sandbox as a Service, you can also
activate the license from the License Management screen.
Important
After activating Apex Central, log off and then log on to the Apex Central web
console for changes to take effect.

Procedure
1.

Go to Administration > License Management > Apex Central.
The License Information screen appears and displays the current
license information.

2.

Click the Specify a new Activation Code link.

3.

Type your Activation Code.

4.

Click Activate.

5.

Log off and then log on to the Apex Central web console for the changes
to take effect.

Converting to the Full Version
Activate your Apex Central to continue to use it beyond the evaluation
period. Activate Apex Central to use its full functionality including
downloading updated program components.

4-4

Post-installation Tasks

Procedure
1.

Purchase a full version Registration Key from a Trend Micro reseller.

2.

Register your software online.

3.

Obtain an Activation Code.

4.

Activate Apex Central according to the instructions in the procedure
above.

Configuring Active Directory Connection SettingsSpecify the connection settings to allow Apex Central to synchronize
endpoint and user information from Active Directory servers.
Note
Apex Central supports synchronization with multiple Active Directory forests.
Adding an Active Directory domain automatically synchronizes all domains
from the same forest.
For more information about forest trusts, contact your Active Directoryadministrator.

Procedure
1.

Go to Administration > Settings > Active Directory and Compliance
Settings.

2.

Click the Active Directory Settings tab.

3.

Select Enable Active Directory synchronization and authentication.

4.

Configure the connection settings to access an Active Directory server.
Field
Server address

Description
Type the FQDN or IP address (IPv4 or IPv6) of the Active Directory
server.

4-5

Trend Micro Apex Central™ Installation Guide

Field
User name

Description
Type the domain name and user name required to access theActive Directory server.
Example format, domain\user_name

Password

5.

Type the password required to access the Active Directory server.

• To add another Active Directory server, click the add icon ().

• To delete an Active Directory server, click the delete icon ().

From the Synchronization frequency (in hours) drop-down list, selecthow often Apex Central synchronizes data with Active Directory servers.
Note
Active Directory synchronization times vary based on the size andcomplexity of the Active Directory database. You may need to wait for
more than an hour before synchronization completes.

6.

(Optional) Expand Advanced settings to configure the Synchronization
source or Connection mode.
a.

Select one of the following synchronization sources:• Domain controllers: Synchronizes all domains from multiple
forests with trust relationships• Global catalog: Synchronizes all domains from a single forest
ImportantSome information used by Apex Central, such as geographic
location and user membership in global groups or domain
local groups, cannot be synchronized from a global catalog
with default settings. Choose to synchronize from a global
catalog only if your network policy restricts Apex Central fromconnecting to all domain controllers.

4-6

Post-installation Tasksb.

Select one of the following connection modes:• SSL
Important
To use an SSL connection, import the Active Directory
Certificate to the Apex Central server.

• Non-SSL
7.

(Optional) Click Test Connection to test the server connection.
Note
Testing the connection does not save the Active Directory server settings.

The Active Directory server connection status icon (front of the server address.
8.

or) appears in

Click Save.
Apex Central synchronizes endpoint and user information from theActive Directory server(s) according to the synchronization frequency.

9.

(Optional) Configure which Active Directory domains and OUs Apex
Central synchronizes by modifying the ADSyncOUList.config
configuration file located at:<Apex Central installation directory>\ADSyncOUList.config

10. (Optional) Click Synchronize Now to manually synchronize Active
Directory data.
The Active Directory server connection status icon (front of the server address.

or) appears in

11. To remove a synchronized Active Directory server:a.

Clear the Enable Active Directory synchronization check box.

b.

Click Clear Data to purge the Apex Central server of data from theremoved Active Directory server.
4-7

Trend Micro Apex Central™ Installation Guide

Apex Central removes the synchronized Active Directory server.
Note
Clicking Clear Data triggers a scheduled task, which runs every 2
minutes, to purge all data of the removed Active Directory servers
from the Apex Central database.

Configuring User Accounts
Create Apex Central user accounts based on your needs. Consider thefollowing when creating your accounts:• The number of different user roles (Administrators, Power Users, andOperators)• Assign appropriate permissions and privileges to each user role
• For users to take advantage of the more advanced functions, they needto have Power User rights or greater

Downloading the Latest Components
After the installation, manually download the latest components (Pattern
files\Cleanup templates, Engine updates) from the Trend Micro ActiveUpdate
server to help maintain the highest security protection. If a proxy server
exists between a Trend Micro server and the Internet, configure the proxy
server settings (in the web console, select Administration > Settings > Proxy
Settings).

Configuring Event Notifications
After the installation, configure the events that will trigger notifications tomonitor significant virus/malware attacks and related security activities.
Besides specifying notification recipients, choose notification channels andtest them to make sure they work as expected (in the web console, go to
Detections > Notifications > Event Notifications).

4-8

Chapter 5

Upgrades and Migration
This chapter discusses how to upgrade or migrate to Apex Central from aprevious version of Apex Central or Control Manager.
Topics include:• Upgrading to Apex Central on page 5-2• Upgrade and Migration Scenarios on page 5-5• Planning Apex Central Agent Migration on page 5-7• Migrating the Apex Central Database on page 5-9

5-1

Trend Micro Apex Central™ Installation Guide

Upgrading to Apex Central
Migrating a Control Manager installation to Apex Central preserves all yourprevious settings, logs, reports, Product Directory structure, and integrated
Active Directory structure.
Important• Apex Central only supports upgrading or migrating from Control
Manager 6.0 Service Pack 3 Patch 3, Control Manager 7.0, or Control
Manager 7.0 Patch 1.
• Before migrating to Apex Central, ensure that your server has sufficientsystem resources.
For more information, see Pre-migration Checklist on page 5-3 or
download the Apex Central System Requirements PDF document at http://
docs.trendmicro.com/en-us/enterprise/apex-central.aspx.
WARNING!
Always back up the existing server before performing the upgrade.
For more information, see Server Files to Back Up Before Migration on page
5-3.

Supported Versions for Upgrade
Apex Central supports upgrading from the following versions:• Control Manager 6.0 Service Pack 3 Patch 3• Control Manager 7.0• Control Manager 7.0 Patch 1
WARNING!
Always back up the existing server before performing the upgrade.

5-2

Upgrades and Migration

Server Files to Back Up Before Migration
Before performing upgrading or migrating a previous Control Manager
installation to Apex Central, create a backup of the following server files:
Information
Database

Location
Use SQL Server Management Studio to back up the database.
• For migration from a previous version of Control Manager, thedatabase name is db_ControlManager.
• For Apex Central, the database name is db_ApexCentral.

Authentication
information\Program Files (x86)\Trend Micro\CmKeyBackup\*.*(Ensures that managed products reporting to the Apex Central server
will report to the same server if Apex Central is restored)

ActiveUpdate files\Program Files (x86)\Trend Micro\Control Manager\webui\download\Activeupdate

Control Manager
registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\TVCS
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\CommonCGIHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TMCM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TMCM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrendMicro_NTP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQL$SQLEXPRESS

Pre-migration Checklist
Before upgrading or migrating Control Manager to Apex Central, ensure thatyour system satisfies the following minimum requirements.

5-3

Trend Micro Apex Central™ Installation Guide

Important• Apex Central only supports upgrading or migrating from Control
Manager 6.0 Service Pack 3 Patch 3, Control Manager 7.0, or Control
Manager 7.0 Patch 1.
• For complete system requirements and supported Windows Server andMicrosoft SQL Server versions, download the Apex Central System
Requirements document from http://docs.trendmicro.com/en-us/
enterprise/apex-central.aspx.
Item
Operating System

Minimum Requirement
Windows Server 2012
Important
If you are running Control Manager on an operating systemthat is older than Windows Server 2012, you will need to
upgrade or migrate to Windows Server 2012 or anothersupported version.

Available Disk Space

10 GB minimum
80 GB recommended (SAS)Note
If you are running Control Manager on a server with less than
10 GB of available disk space, you will need to migrate toserver with at least 10 GB (80 GB recommended) of available
disk space.

SQL Server

Microsoft SQL Server 2008
Important
Ensure that the SQL Server is running prior to migration.

5-4

Upgrades and Migration

Item
Trend Micro Services

Minimum Requirement
Ensure that the following services are running prior to migration:• Trend Micro Control Manager• Trend Micro Management Infrastructure

Upgrade and Migration Scenarios
Apex Central supports the following migration scenarios.
• Scenario 1: Upgrading a Control Manager Server to Apex Central on page
5-5
• Scenario 2: Migrating to a Fresh Apex Central Installation Using the Agent
Migration Tool on page 5-7

Upgrade Flow
To upgrade a previous version of Control Manager to Apex Central, run the
installation program (Trend Micro Apex Central.exe) as described in step
1 of Installing All Required Components on page 3-9.
ImportantApex Central only supports upgrading or migrating from Control Manager 6.0
Service Pack 3 Patch 3, Control Manager 7.0, or Control Manager 7.0 Patch 1.

Scenario 1: Upgrading a Control Manager Server to Apex
CentralWhen upgrading a previous version of Control Manager directly to Apex
Central, administrators can choose to back up the previous Control Manager
installation or back up the entire operating system of the server on which
Control Manager installs. Backing up the operating system is more labor
intensive but provides better security to prevent data loss.

5-5

Trend Micro Apex Central™ Installation Guide

ImportantApex Central only supports upgrading or migrating from Control Manager 6.0
Service Pack 3 Patch 3, Control Manager 7.0, or Control Manager 7.0 Patch 1.

Upgrading by Backing Up the Previous Control Manager Serverand Database
ImportantApex Central only supports upgrading or migrating from Control Manager 6.0
Service Pack 3 Patch 3, Control Manager 7.0, or Control Manager 7.0 Patch 1.

Procedure1.

Back up the previous Control Manager database.

2.

Back up all the files under \Trend Micro\CmKeyBackup\*.*.

3.

Back up all folders of the previous Control Manager server.

4.

Back up the registries of the previous Control Manager server.

5.

Install Apex Central over Control Manager.

Upgrading by Backing Up the Entire Operating System of theServer and the Apex Central Database
ImportantApex Central only supports upgrading or migrating from Control Manager 6.0
Service Pack 3 Patch 3, Control Manager 7.0, or Control Manager 7.0 Patch 1.

Procedure

5-6

1.

Back up the operating system of existing Control Manager server.

2.

Back up the existing Control Manager database.

Upgrades and Migration

3.

Install Apex Central over Control Manager.

Scenario 2: Migrating to a Fresh Apex Central Installation Using
the Agent Migration Tool
This scenario involves installing Apex Central on a separate server from theexisting Apex Central / Control Manager server. This method allows you to
slowly decommission the previous server. See Planning Apex Central Agent
Migration on page 5-7 for more information about migrating agents.
ImportantApex Central only supports upgrading or migrating from Control Manager 6.0
Service Pack 3 Patch 3, Control Manager 7.0, or Control Manager 7.0 Patch 1.

Migrating a Control Manager Server to a Fresh Installation ofApex Central
ImportantApex Central only supports upgrading or migrating from Control Manager 6.0
Service Pack 3 Patch 3, Control Manager 7.0, or Control Manager 7.0 Patch 1.

Procedure1.

Back up the existing Control Manager database.

2.

Perform a fresh installation of Apex Central on a different computer.

3.

Use the Agent Migration Tool to migrate entities from the Control
Manager server to the Apex Central server.

Planning Apex Central Agent Migration
There are two ways to migrate agents to a Apex Central server:• Rapid upgrade
5-7Trend Micro Apex Central™ Installation Guide• Phased upgrade

Rapid Upgrade
Rapid upgrade works using the approach presented in the table below.
Table 5-1. Rapid Upgrade
Original Server/
Agent
Control Manager 6.0
Service Pack 3 Patch
3 with MCP agents

ActionRegister MCP agents to the Apex Central server and then re-organize
the Product Directory structure

Control Manager 7.0
with MCP agentsControl Manager 6.0
Service Pack 3 Patch
3 with mixed agents

Register MCP agents to the Apex Central server and then re-organize
Product Directory structure

Control Manager 7.0
with mixed agents

Trend Micro recommends rapid upgrade for migrating agents in a laboratory
setting or in relatively small networks, preferably during test deployments(see Testing Apex Central at One Location on page 2-9). However, since you
cannot stop the migration once it starts, this method works best for smaller
deployments. The degree of difficulty increases with the size of the network.

Phased UpgradeTrend Micro recommends a phased upgrade for large, single-server Control
Manager 6.0 Service Pack 3 Patch 3 or 7.0 networks. This is essential for
multiple-server networks. This method offers a more structured approach tomigrating your system, and follows these guidelines:• Start migration on systems with the least impact on the existing
network, and then proceed to the systems with progressively greater
impact• Upgrade the old network in well-planned stages, rather than all at once
5-8

Upgrades and Migration

This will simplify any troubleshooting that may be required.
Phased upgrade involves the following steps:
1. Install Apex Central on a server that does not have any previous Control
Manager version installed (preferably without any managed products).
2. Run the AgentMigrateTool.exe tool on the Apex Central server.
Use the Apex Central agent installation together with the Agent Migration
tool to plan the upgrade of agents on existing Apex Central networks. The
Agent Migration tool can generate a list of servers with Apex Central agents.
Doing so eliminates the need to manually select the agent servers.

Migrating the Apex Central Database
To migrate a preexisting database for Control Manager 6.0 SP3 Patch 3 or 7.0,
install Apex Central on the Control Manager server.
The Apex Central setup program automatically upgrades the database
version.

Migrating a Apex Central SQL Database to Another SQL Server
To move a Apex Central database from an SQL Server to another SQL Server,
use the DBConfig tool to perform the migration.

Using the Database Configuration Tool (DBConfig.exe)
The DBConfig.exe tool allows users to change the user account, password,
and the database name for the Apex Central database.
The tool offers the following options:• DBName: Database name
• DBAccount: Database account• DBPassword: Database password• Mode: Database authentication mode (SQL Server Authentication orWindows Authentication)
5-9

Trend Micro Apex Central™ Installation Guide

Note
The default database authentication mode is SQL Server Authentication
mode. However, Windows Authentication mode is necessary when
configuring for Windows authentication.

Procedure
1.
2.

Open a command prompt on the Apex Central server.
Use the following command to locate the directory which contains the

DBConfig.exe file:

cd <Apex Central installation directory>\DBConfig

3.

Type dbconfig and press ENTER.
The DBConfig tool interface appears.

4.

Specify which settings you want to modify:• Example 1: DBConfig -DBName="db_your_database>" -DBAccount="sqlAct" -DBPassword="sqlPwd" -Mode="SQL"• Example 2: DBConfig -DBName="db_your_database>" -DBAccount="winAct" -DBPassword="winPwd" -Mode="WA"• Example 3: DBConfig -DBName="db_your_database>" DBPassword="sqlPwd"

5-10Chapter 6

Post-Migration Tasks
Perform the following tasks to verify a successful upgrade or migration,
import settings from the Apex One server, or enable and configure additionalfeatures.
• Verifying a Successful Upgrade or Migration on page 6-2• Migrating Apex One Server Settings to Apex Central on page 6-2• Enabling Application Control on page 6-4• Enabling Vulnerability Protection on page 6-5• Enabling Endpoint Sensor on page 6-7• Configuring Apex One Server Settings for Endpoint Sensor on page 6-9

6-1

Trend Micro Apex Central™ Installation Guide

Verifying a Successful Upgrade or Migration
Perform the following procedure to verify that the previous version ofControl Manager successfully upgraded to Apex Central.
Procedure1.

Log on to the Apex Central web console.
The Apex Central web console successfully logs on and the Dashboard
appears.

2.

Go to Help > About
The About screen appears and displays the Apex Central product nameand Version.

3.

On the Apex Central server, verify that the following services are
running:• Trend Micro Apex Central• Trend Micro Management Infrastructure

Migrating Apex One Server Settings to Apex
CentralPerform the following procedure to migrate existing settings from anexisting Apex One server to Apex Central.
6-2

Post-Migration Tasks

Procedure
1.

2.

Export settings from the Apex One server.
a.

From the Apex One server, log on to the Apex One web console.

b.

Go to Administration > Settings > Server Migration.

c.

Download the Apex One Settings Export Tool to the Apex One
server.

d.

Run the ApexOneSettingsExportTool.exe program to export
settings from the Apex One server.

e.

Copy the export package (*.zip file) to a location that is accessibleby the Apex Central server.

Import the Apex One server settings.
a.

From the Apex Central server, log on to the Apex Central web
console.

b.

Go to Policies > Policy Management.

c.

Select Apex One Security Agent as the Product.

d.

Click Import Settings.

e.

Select and upload the *.zip file exported from the Apex One server.
The screen refreshes and displays the imported policy at the top of
the list.

f.

(Optional) Click the policy to edit the settings or perform thefollowing tasks:• Enabling Application Control on page 6-4• Enabling Vulnerability Protection on page 6-5• Enabling Endpoint Sensor on page 6-7

6-3

Trend Micro Apex Central™ Installation Guide

Enabling Application Control
Important
The Application Control feature requires special licensing. Ensure that you
have the correct Activation Code before deploying Application Control
policies to endpoints. For more information on how to obtain the Activation
Code, contact your sales representative.

Procedure
1.

Deploy the Activation Code to the managed product servers:a.

Go to Administration > License Management > Managed Products.
The License Management screen appears.

b.

Click Add and Deploy.
The Add and Deploy a New License > Step 1: Input Activation Codescreen appears.

c.

Type the Activation Code for the product you want to activate in the
New activation code field.

d.

Click Next.
The Add and Deploy a New License > Step 2: Select Targets screen
appears.

e.

Select the target Apex One server(s) to deploy the Activation Code.

f.

Click Deploy.
The License Management screen appears and the Activated
Products column displays the number of managed product serversthat have successfully deployed the Activation Code.

2.

Go to Policies > Policy Management.
The Policy Management screen appears.

6-4

Post-Migration Tasks

3.

Select Apex One Security Agent as the Product.

4.

Specify or edit the Policy Name.

5.

Specify targets.

6.

Create or edit a policy.
a.

To create a policy, click Create.

b.

To edit a policy, click a policy name in the Policy column.

7.

Expand Application Control Settings.

8.

Select Enable Application Control.

9.

Click Deploy or Save.
The Policy Management screen appears and displays the policy
deployment status.
Note
Deployment times vary depending on the size of your network
environment. It may take some time to finish deploying the policy to all
specified targets.

Enabling Vulnerability Protection
Important
The Vulnerability Protection feature requires special licensing. Ensure thatyou have the correct Activation Code before deploying Vulnerability
Protection policies to endpoints. For more information on how to obtain the
Activation Code, contact your sales representative.

Procedure
1.

Deploy the Activation Code to the managed product servers:
6-5

Trend Micro Apex Central™ Installation Guidea.

Go to Administration > License Management > Managed Products.
The License Management screen appears.

b.

Click Add and Deploy.
The Add and Deploy a New License > Step 1: Input Activation Codescreen appears.

c.

Type the Activation Code for the product you want to activate in the
New activation code field.

d.

Click Next.
The Add and Deploy a New License > Step 2: Select Targets screen
appears.

e.

Select the target Apex One server(s) to deploy the Activation Code.

f.

Click Deploy.
The License Management screen appears and the Activated
Products column displays the number of managed product serversthat have successfully deployed the Activation Code.

2.

Go to Policies > Policy Management.
The Policy Management screen appears.

6-6

3.

Select Apex One Security Agent as the Product.

4.

Specify or edit the Policy Name.

5.

Specify targets.

6.

Create or edit a policy.
a.

To create a policy, click Create.

b.

To edit a policy, click a policy name in the Policy column.

7.

Expand Vulnerability Protection Settings.

8.

Select Enable Vulnerability Protection.

9.

Click Deploy or Save.

Post-Migration Tasks

The Policy Management screen appears and displays the policy
deployment status.
Note
Deployment times vary depending on the size of your network
environment. It may take some time to finish deploying the policy to all
specified targets.

Enabling Endpoint Sensor
Important• The Endpoint Sensor feature requires special licensing and additional
system requirements. Ensure that you have the correct license before
deploying Endpoint Sensor policies to endpoints. For more information
on how to obtain licenses, contact your support provider.
• Connected Apex One servers require additional hardware and software
requirements for the Endpoint Sensor feature to work. For more
information, refer to the Apex One Installation and Upgrade Guide.

Procedure
1.

Deploy the Activation Code to the managed product servers:a.

Go to Administration > License Management > Managed Products.
The License Management screen appears.

b.

Click Add and Deploy.
The Add and Deploy a New License > Step 1: Input Activation Codescreen appears.

c.

Type the Activation Code for the product you want to activate in the
New activation code field.
6-7Trend Micro Apex Central™ Installation Guided.

Click Next.
The Add and Deploy a New License > Step 2: Select Targets screen
appears.

e.

Select the target Apex One server(s) or Apex One (Mac) servers to
deploy the Activation Code.

f.

Click Deploy.
The License Management screen appears and the Activated
Products column displays the number of managed product serversthat have successfully deployed the Activation Code.

2.

Go to Policies > Policy Management.
The Policy Management screen appears.

3.

Select Apex One Security Agent as the Product.

4.

Specify or edit the Policy Name.

5.

Specify targets.

6.

Create or edit a policy.
a.

To create a policy, click Create.

b.

To edit a policy, click a policy name in the Policy column.

7.

Expand Endpoint Sensor Settings.

8.

Select Enable Endpoint Sensor.

9.

Click Deploy or Save.
The Policy Management screen appears and displays the policy
deployment status.
Note
Deployment times vary depending on the size of your network
environment. It may take some time to finish deploying the policy to all
specified targets.

6-8

Post-Migration Tasks

Configuring Apex One Server Settings for Endpoint
SensorImportant• The Endpoint Sensor feature requires special licensing and additional
system requirements. Ensure that you have the correct license before
deploying Endpoint Sensor policies to endpoints. For more information
on how to obtain licenses, contact your support provider.
• Connected Apex One servers require additional hardware and software
requirements for the Endpoint Sensor feature to work. For more
information, refer to the Apex One Installation and Upgrade Guide.
• The following procedure assumes you have already enabled Endpoint
Sensor by creating or editing an Apex One Security Agent policy.
For more information, see Enabling Endpoint Sensor on page 6-7.

Procedure
1.

Go to Policies > Policy Management.
The Policy Management screen appears.

2.

Select Apex One Server as the Product.

3.

Specify or edit the Policy Name.

4.

Specify targets.

5.

Create or edit a policy.

6.

a.

To create a policy, click Create.

b.

To edit a policy, click a policy name in the Policy column.

Expand Endpoint Sensor to configure the following settings:

6-9

Trend Micro Apex Central™ Installation Guide

OptionDescription

Maximum metadatastorageSpecify the maximum size allowed for metadata storage.
Specify a size between 1024 to 4096 GB. The default storage sizeis 1024 GB. Once the metadata storage reaches this size, theserver purges old records to accommodate new ones.

Maximum memory
allocation

Specify the maximum amount of memory allocated to themetadata cache. Specify a size between 4 GB and 64 GB. The
new size specified must be higher than the current size. The
default allocation size is 4 GB.
Note
Memory size affects the performance of data uploads
and investigation speed. To improve performance,increase the memory size of the affected server.

7.

Click Deploy or Save.
The Policy Management screen appears and displays the policy
deployment status.
Note
Deployment times vary depending on the size of your network
environment. It may take some time to finish deploying the policy to all
specified targets.

6-10

Chapter 7

Uninstallation
This chapter contains information about how to uninstall Apex Central andremove related files.
Topics include:• Removing Apex Central on page 7-2• Manually Removing Apex Central on page 7-3

7-1

Trend Micro Apex Central™ Installation Guide

Removing Apex Central
Uninstall Apex Central from the server by using one of the following
methods:
Procedure• From the Start menu, click Start > Trend Micro Apex Central >Uninstalling Trend Micro Apex Central.
• Using Add/Remove Programs:a.

Go to Start > Control Panel > Add/Remove Programs.

b.

Select Trend Micro Apex Central and click Uninstall.
A confirmation dialog appears.

c.

Click Yes to uninstall Apex Central.

d.

Choose whether to uninstall the Apex Central database:
Note
Keeping the database allows you to reinstall Apex Central on theserver and retain all system information, such as agent registration
and user account data.

• To uninstall the database, select the Remove Apex Central
database check box.
• To keep the database, do not select the Remove Apex Central
database check box.
e.

Click Next.
• The uninstallation program removes Apex Central from theserver.
• If you selected Remove the Apex Central database, theuninstallation program also removes the database.

7-2

Uninstallation• If you reinstall the Apex Central server without deleting theoriginal database and removing the managed products thatoriginally reported to the previous server, then the managed
products will re-register to the Apex Central server when:• Managed product servers restart MCP agent services• MCP agents verify their connection after an 8-hour period

Manually Removing Apex Central
This section describes how to remove Apex Central manually. Use theprocedures below only if the Windows Add/Remove function or the Apex
Central uninstall program is unsuccessful.
Note
Windows-specific instructions may vary between operating system versions.
The following procedures are written for Windows Server 2012.

Removing Apex Central actually involves removing distinct components.
These components may be removed in any order; they may even be removed
together. However, for purposes of clarity, the uninstallation for each module
is discussed individually, in separate sections. The components are:• Apex Central application• Apex Central Database (optional)
Note
After removing all components, you must restart your server. You only have todo this once — after completing the removal.

Removing the Apex Central Application
Manual removal of the Apex Central application involves the following steps:
1. Stopping Apex Central Services on page 7-4
7-3

Trend Micro Apex Central™ Installation Guide

2. Removing Apex Central IIS Settings on page 7-5
3. Deleting Apex Central Files/Directories and Registry Keys on page 7-6
4. Removing the Database Components on page 7-7
5. Removing the Apex Central Service on page 7-8

Stopping Apex Central Services
Use the Windows Services screen to stop all of the following Apex Central
services:• Trend Micro Apex Central
Note
These services run in the background on the Windows operating system, not
the Trend Micro services that require Activation Codes (for example, Outbreak
Prevention Services).

Stopping Apex Central Services from the Windows Services Screen
Procedure
1.

Click Start > Programs > Administrative Tools > Services to open theServices screen.

2.

Right-click Trend Micro Apex Central and then click Stop.

Stopping IIS and Apex Central Services from the Command Prompt
Procedure• Run the following commands at the command prompt:
net stop w3svc

7-4

Uninstallation

net stop tmcm

Figure 7-1. View of the command line with the necessary services stopped

Removing Apex Central IIS Settings
Remove the Internet Information Services settings after stopping the Apex
Central services.
Procedure
1.

From the Apex Central server, click Start > Run.
The Run dialog box appears.

2.

Type the following in the Open field:%SystemRoot%\System32\Inetsrv\iis.msc

3.

On the left-hand menu, double-click the server name to expand theconsole tree.

4.

Double-click Default Web Site.

5.

Delete the following virtual directories:
7-5

Trend Micro Apex Central™ Installation Guide• ControlManager• TVCSDownload• TVCS• WebApp
6.

Select the ISAPI Filters tab.

7.

Delete the following ISAPI filters:• TmcmRedirect• ReverseProxy

Deleting Apex Central Files/Directories and Registry Keys
Procedure
1.

Delete the following directories:• .Trend Micro\Control Manager• .PHP• C:\Documents and Settings\All Users\Start Menu\Programs\PHP 7• C:\Documents and Settings\All Users\Start Menu\Programs\Trend Micro Apex Central

2.

Delete the following Apex Central registry keys:• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\MCPAgent• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OPPTrustPort• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\TMI• HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\TVCS• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\TMCM

7-6

Uninstallation

Removing the Database Components
This section describes how to remove the following database components
from the Apex Central server:• Removing Apex Central ODBC Settings on page 7-7• Removing the SQL Server 2017 Express Database on page 7-7

Removing Apex Central ODBC Settings
Procedure
1.

On the Apex Central server, click Start > Run.
The Run dialog box appears.

2.

Type the following in the Open field:
odbcad32.exe

3.

On the ODBC Data Source Administrator screen, click the System DSN
tab.

4.

Under Name, select ControlManager_Database.

5.

Click Remove, and then click Yes to confirm.

Removing the SQL Server 2017 Express Database
Procedure
1.

On the Apex Central server, click Start > Control Panel > Add/Remove
Programs.

2.

Scroll down to SQL Server 2017 and then click Remove to remove therelated files automatically.

7-7

Trend Micro Apex Central™ Installation Guide

Tip
For more information on removing SQL Server 2017 Express, refer to theMicrosoft documentation.

Removing the Apex Central Service
Procedure1.

Run the Microsoft service tool Sc.exe.

2.

Type the following command:sc delete "TMCM"

7-8

Chapter 8

Apex Central System Checklists
Use the checklists in this section to record relevant system information as areference.
Topics include:• Server Address Checklist on page 8-2• Port Checklist on page 8-3• Apex Central Conventions on page 8-3• Core Processes and Configuration Files on page 8-4• Communication and Listening Ports on page 8-6

8-1

Trend Micro Apex Central™ Installation Guide

Server Address Checklist
You must provide the following server address information during the
installation process, as well as during the configuration of the Apex Central
server to work with your network. Record the information here for easy
reference.
Table 8-1. Server Address Checklist
Information Required

ExampleApex Central server information
IP address

10.1.104.255

Fully qualified domain name
(FQDN)

server.company.com

NetBIOS (host) nameyourserver

Web server information
IP address

10.1.104.225

Fully qualified domain name
(FQDN)

server.company.com

NetBIOS (host) nameyourserver

SQL-based Apex Central database information
IP address

10.1.104.225

Fully qualified domain name
(FQDN)

server.company.com

NetBIOS (host) namesqlserver

Proxy server for component download

8-2

IP address

10.1.174.225

Fully qualified domain name
(FQDN)

proxy.company.com

NetBIOS (host) nameproxyserverYour ValueApex Central System Checklists

Information Required

ExampleYour Value

SMTP server information (Optional; for email message notifications)
IP address

10.1.123.225

Fully qualified domain name
(FQDN)

mail.company.com

NetBIOS (host) namemailserver

SNMP Trap information (Optional; for SNMP Trap notifications)
Community nametrendmicro

IP address

10.1.194.225

Syslog server information (Optional; for syslog notifications)
IP address

10.1.194.225

Server port

514

Port Checklist
Apex Central uses the following ports for the indicated purposes.
Sample

Port
SMTP

25

Proxy

8088

Web Console and Update/
Deploy components

443

Your Value

Apex Central Conventions
Refer to the following conventions applicable for the Apex Central
installation or web console configuration.
• User names

8-3

Trend Micro Apex Central™ Installation Guide• Max. length: 32 characters• Allowed: A-Z, a-z, 0-9, -, _, ., $• Folder names• Max. length: 32 characters• Not allowed: /, >, &, ", %, ^, =Note
For the Apex Central server host name, the setup program supports servers
with underscores ("_") as part of the server name.

Core Processes and Configuration Files
Apex Central saves system configuration settings and temporary files in XML
format.
The following tables describe the configuration files and processes used by
Apex Central.
Table 8-2. Apex Central Configuration Files
Description

Configuration File

8-4

AuthInfo.ini

Configuration file that contains information about private key
file names, public key file names, certificate file names, andthe encrypted passphrase of the private key as well as the hostID and port.

aucfg.ini

ActiveUpdate configuration file

TVCS_Cert.pem

Certificate used by SSL authentication

TVCS_Pri.pem

Private Key used by SSL

TVCS_Pub.pem

Public Key used by SSL

ProcessManager.xml

Used by ProcessManager.exe

CmdProcessorEventHandl
er.xmlUsed by CmdProcessor.exe

Apex Central System Checklists

Configuration File

Description

DMRegisterinfo.xml

Used by CasProcessor.exe

DataSource.xml

Stores the connection parameters for Apex Central processes

SystemConfiguration.xmlApex Central system configuration fileagent.ini

MCP agent file

Table 8-3. Apex Central Core Processes
Processes

Description

ProcessManager.exe

Launches and stops other Apex Central core processes

CmdProcessor.exe

Sends XML instructions, formed by other processes, tomanaged products, processes product registration, sends
alerts, performs scheduled tasks, and applies Outbreak
Prevention Policies

LogReceiver.exe

Receives managed product logs and messages. Starting with
Control Manager 3.0 Service Pack 4, LogReceiver.exe only
handles logs coming from Trend Micro Damage Control
Services and Trend Micro Vulnerability Assessment

LogProcessor.exe

Receives logs from managed products, and receives entity
information from managed products

LogRetriever.exe

Retrieves and saves logs in the Apex Central database

ReportServer.exe

Generates Apex Central reports

MsgReceiver.exe

Receives messages from the Apex Central server and managed
products

CasProcessor.exe

Allows a Apex Central server to manage other Apex Central
servers

inetinfo.exe

Microsoft Internet Information Service process

cm.exeManages dmserver.exe and mrf.exe

dmserver.exe

Provides the Apex Central web console log on page andmanages the Product Directory (Apex Central-side)

8-5

Trend Micro Apex Central™ Installation Guide

Processes

Description

sCloudProcessor.NET.exeRequests the Apex Central web console or other processes toprovide a job ID for the issuer to query statuses, query results,
and cancel requests; used by the User/Endpoint DirectoryCommunication and Listening Ports
These are the default Apex Central communication and listening ports.
Service

8-6Service Port

ProcessManager.exe

20501

CmdProcessor.exe

20101

comdProcessor.NET.exe

21003

LogReceiver.exe

20201

LogProcessor.exe

21001

LogRetriever.exe

20301

ReportServer.exe

20601

MsgReceiver.exe

20001

CasProcessor.exe

20801

sCloudProcessor.NET.exe

21002

IndexA
activating
Apex Central, 4-3, 4-4
Activation Code, 4-3
Active Directory
connection settings, 4-5
manual synchronization, 4-5synchronization frequency, 4-5
Apex Central, 1-1, 1-2, 1-5
about, 1-1, 1-2
activating, 4-3, 4-4command prompt, stopping
service from, 7-4
installation steps, 3-8
installing, 3-1, 3-7, 3-8
license information, 4-4
mail server, 1-5
manually removing, 7-3
MCP, 1-5
removing manually, 7-3
report server, 1-5
SQL database, 1-5system requirements, 3-2
web-based management console,
1-6

web server, 1-5
web service integration, 1-5
widget framework, 1-6
B

ports, 8-3
server address, 8-2
command polling
MCP, 2-16
command prompt
Apex Central, stopping service
from, 7-4
configuring
user accounts, 4-8
web server, 2-20
Control Manager
migrating database, 5-9
security levels, 3-16
testing pilot deployment, 2-9
converting
full version, 4-4
D
databaserecommendations, 2-19
data storageplan, 2-19
DBConfig tool, 5-9
deploymentarchitecture and strategy, 2-2
multiple-site, 2-4
single-site, 2-3
documentation, 2Fbacking up Apex Central, 5-3

full version
converting, 4-4CHchecklist

heartbeat, 2-14
IN-1

Trend Micro Apex Central™ Installation Guide

MCP, 2-16
I
installation
flow, 2-9
verify success, 4-2
installation steps
Apex Central, 3-8
installing
Apex Central, 3-1, 3-8
steps, 3-8Llicense information, 4-4
logs
traffic, 2-15
Mmanually
removing Apex Central, 7-3
manually uninstalling, 7-3
MCP, 1-5
command polling, 2-16
heartbeat, 2-16
policies, 2-16
migrating, 5-7
Control Manager SQL 2000, 5-9
database, 5-9phased upgrade, 5-8
rapid upgrade, 5-8
strategy, 5-7
multiple-site deployment
understanding, 2-4N
network trafficIN-2

sources, 2-15
network traffic plan, 2-13
O
ODBC
settings, Control Manager, 7-7Pphased upgrade, 5-8
pilot deployment
testing, 2-9
policies
MCP, 2-16
port
checklist, 8-3
product registration
traffic, 2-16
R
rapid upgrade, 5-8
recommendations
database, 2-19
Registration Key, 4-5
removemanualMicrosoft Data Engine, 7-7
removing
Apex Central manually, 7-3
manualApex Central, 7-3
S
serveraddress checklist, 8-2
server address checklist, 8-2
server distribution plan, 2-11

Indexsingle-site deployment
understanding, 2-3system requirements, 3-2
T
terminology, 4
tools
DBConfig tool, 5-9
traffic, network, 2-13
U
understanding
multiple-site deployment, 2-4
single-site deployment, 2-3
updates
deploying, 2-17
upgrading, 5-2
backing up Apex Central
information, 5-3
user accounts
configuring, 4-8
V
verify successful installation, 4-2
W
web server
configuration, 2-20
plan, 2-20
web server settings, 3-14
Windows Server 2012, 3-3
Windows Server 2012 R2, 3-4
Windows Server 2016, 3-5Windows Server 2019, 3-6
Windows Server 2022, 3-7

IN-3

Item Code: APEM79816/230828