From the Architect

Sometimes there is software that just won’t work “out of the box” on a provisioned image when in shared image mode. Trend OfficeScan Antivirus client is one such beast. Here’s a solution.

The problem arises because when the client registers with the management server, it uses a unique GUID. Now, if all our provisioned images contain the same unique GUID, your management server is not going to be able to differentiate between any of your provisioned clients, and you’ll be in a mess when it comes to reporting on infections or virus definition updates. This is only a problem when you are running your clients in shared image mode as any personalisation is lost between reboots. You can’t “sysprep” the server at each bootup otherwise you end up with lots of duplicate clients in the management console due to a new GUID being created at every boot.

So, Trend needs a little bit of tweaking to work correctly inside a provisioned image. Using a startup script, in combination with the Trend “imgsetup.exe” sysprep tool, (KB article here) you can ensure each provisioned client obtains a unique GUID, and then retains this across reboots.

Attached is a vbscript that allows Trend to operate correctly. The script uses a local cache disc to store the unique GUID, but theres no reason why you couldnt modify this to store the GUIDs centrally on a share, and read them from there if you didn’t have a local cache disc available. The imgsetup utility is part of the OfficeScan installation, although note if you’re using 64-bit provisioned clients you need to request the 64-bit version from Trend support (see this KB article)

You should configure the script to run at server startup (either in a local or group policy startup script)

Im summary the script checks whether the GUID file is present on permanent cache disc.
If so:
– Writes the GUID it into the registry
– Starts the Trend services
If not:
– Runs the Trend “sysprep” tool “ImgSetup.exe”
– Sets the Trend services to manual startup
– Reads the GUID created and writes in to the permanent cache disc

This has the effect that a client will maintain its GUID across reboots, and the correct values will be in the registry when the Trend services start.

‘ Trend Startup Script V1.0

‘ Note: Edit the “Cache drive” variable below to reflect the drive letter of the local hard disc

‘ The Trend ImgSetup.exe needs to be in c:\temp\trend

‘ The script write to a logfile in C:\temp\Trend\Trend_log.txt

‘ Script by Daniel Gothard & Neil Spellings

Option Explicit

On Error Resume Next

Dim WSHShell, FSO

Dim objFolder, objFile

Dim WSHEnvironment

Dim WSHFileSystem

Dim Env

Dim strFolder, strFile, strRegGUID, strRegClientString, strLogFilePath, strCacheDrive

Const ForReading = 1

Const ForWriting = 2

Const ForAppending = 8

Set WshShell = WScript.CreateObject(“WScript.Shell”)

Set FSO = CreateObject(“Scripting.FileSystemObject”)

Set WSHEnvironment = WSHShell.Environment(“PROCESS”)

strCacheDrive = “d”

strFolder = strCacheDrive & “\Trend”

strFile = “Trend.txt”

strLogFilePath = “C:\temp\Trend\Trend_log.txt”

‘ The file deletion text is left in just for when the image is in private mode just in case it is not deleted before

‘ being put back into standard mode.

If FSO.FileExists(trLogFilePath) Then

FSO.DeleteFile(trLogFilePath)

End if

Set objFile = FSO.CreateTextFile(strLogFilePath)

objFile.Close

If FSO.DriveExists(strCacheDrive) Then

If FSO.FolderExists(strFolder) Then

If FSO.FileExists(strFolder & “\” & strFile) Then

Read_GUID

LogFile (strFile & ” file found. Exiting script.”)

Wscript.Quit

Else

Set objFile = FSO.CreateTextFile(strFolder & “\” & strFile)

LogFile (strFile & ” file not found. Running Check_Trend procedure.”)

Check_Trend

LogFile (“Check_Trend procedure complete – exiting script.”)

Wscript.Quit

End if

Else

LogFile (strFolder & ” not found. Creating folder and file.”)

Set objFolder = FSO.CreateFolder(strFolder)

Set objFile = FSO.CreateTextFile(strFolder & “\” & strFile)

LogFile (“Running Check_Trend Procedure after creating folder and file.”)

Check_Trend

Wscript.Quit

End If

Else

LogFile(strCacheDrive &” drive could not be found. Quitting the script.”)

Wscript.Quit

End if

‘The following procedure will run if the Trend sysprep process needs to be executed.

‘This is happens if the trend.txt file cannot be found.

Sub Check_trend

On Error Resume Next

Dim strSource, strDestination, strFile2

Dim strComputer, objWMIService, colServList, objService, errReturnCode

strFile2 = “ImgSetup.exe”

strSource = “C:\temp\Trend\”

strDestination = “C:\program Files\Trend Micro\OfficeScan Client\”

LogFile (“Adding Run command for imgsetup.exe.”)

wshshell.regwrite “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Trend OfficeScan ImageSetup”, chr(34) & strDestination & strFile2 & chr(34) & ” -HideWindow”, “REG_SZ”

If NOT FSO.FileExists(strDestination & strFile2) Then

LogFile (strDestination & strFile2 & ” not found.”)

LogFile (“Copying ” & strFile2 & ” from ” & strSource)

FSO.CopyFile strSource & strFile2, strDestination

End if

LogFile (“Running Trend Sysprep.”)

WshShell.Run  chr(34) & strDestination & strFile2 & chr(34), 0 , TRUE

‘Sets tmlisten service startup mode to Manual

strComputer = “.”

Set objWMIService = getObject(“winmgmts:” _

& “{impersonationLevel=impersonate}!\\” & strComputer & “\root\cimv2”)

Set colServList = objWMIService.ExecQuery (“Select * from Win32_Service where Name = ‘tmlisten'”)

For Each objService in colServList

LogFile(“Setting ” & objService.Displayname & ” to manual.”)

errReturnCode = objService.Change(,,,, “Manual”)

Next

strRegGUID = WshShell.RegRead (“HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\GUID”)

LogFile (“GUID =” & strRegGUID)

objFile.Close

Logfile(“Writing ” & strRegGUId & ” to the ” & strFolder & “\Trend.txt file.”)

Set objFile = FSO.OpenTextFile(strFolder & “\” & strFile, ForWriting)

objFile.Writeline strRegGUID

objFile.Close

LogFile (“Starting the Trend Realtime scan service.”)

wshshell.run “net start ntrtscan”, 0, TRUE

LogFile (“Script Finished.”)

End Sub

‘The following procedure will run if the \trend\Trend.txt file is found.

‘It will read the contents of the file and populate the GUID registry key

Sub Read_GUID

Dim strLine

Set objFile = FSO.OpenTextFile(strFolder & “\” & strFile, ForReading)

LogFile (“Running Read_GUID procedure.”)

Do While objFile.AtEndOfStream = False

strLine = objFile.Readline

LogFile (“Writing GUID ” & strLine & ” to the registry.”)

wshshell.regwrite “HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\GUID”, strLine, “REG_SZ”

Loop

objFile.Close

LogFile (“Starting tmlisten.”)

LogFile (“Starting ntrtscan.”)

wshshell.run “net start tmlisten”, 0, TRUE

wshshell.run “net start ntrtscan”, 0, TRUE

LogFile (“Script Finished.”)

End Sub

Sub LogFile(Message)

Dim LogFile, LogFileName

Set FSO = CreateObject(“Scripting.FileSystemObject”)

Const ForAppending = 8

set LogFile = FSO.OpenTextFile(strLogFilePath, ForAppending, True) ‘ Open the log file for writing

LogFile.WriteLine now & ” – ” & Message ‘ Write a line of text to the log file

End Sub

‘ Trend Startup Script V1.0′ Note: Edit the “Cache drive” variable below to reflect the drive letter of the local hard disc’ The Trend ImgSetup.exe needs to be in c:\temp\trend’ The script write to a logfile in C:\temp\Trend\Trend_log.txt’ Script by Daniel Gothard & Neil Spellings

Option Explicit
On Error Resume Next
Dim WSHShell, FSODim objFolder, objFileDim WSHEnvironmentDim WSHFileSystemDim EnvDim strFolder, strFile, strRegGUID, strRegClientString, strLogFilePath, strCacheDrive
Const ForReading = 1Const ForWriting = 2Const ForAppending = 8
Set WshShell = WScript.CreateObject(“WScript.Shell”)Set FSO = CreateObject(“Scripting.FileSystemObject”)Set WSHEnvironment = WSHShell.Environment(“PROCESS”)
strCacheDrive = “d”
strFolder = strCacheDrive & “\Trend”strFile = “Trend.txt”strLogFilePath = “C:\temp\Trend\Trend_log.txt”
‘ The file deletion text is left in just for when the image is in private mode just in case it is not deleted before’ being put back into standard mode.If FSO.FileExists(trLogFilePath) Then FSO.DeleteFile(trLogFilePath)End if
Set objFile = FSO.CreateTextFile(strLogFilePath)objFile.Close

If FSO.DriveExists(strCacheDrive) Then
If FSO.FolderExists(strFolder) Then If FSO.FileExists(strFolder & “\” & strFile) Then Read_GUID LogFile (strFile & ” file found. Exiting script.”) Wscript.Quit Else Set objFile = FSO.CreateTextFile(strFolder & “\” & strFile) LogFile (strFile & ” file not found. Running Check_Trend procedure.”) Check_Trend LogFile (“Check_Trend procedure complete – exiting script.”) Wscript.Quit End if Else LogFile (strFolder & ” not found. Creating folder and file.”) Set objFolder = FSO.CreateFolder(strFolder) Set objFile = FSO.CreateTextFile(strFolder & “\” & strFile) LogFile (“Running Check_Trend Procedure after creating folder and file.”) Check_Trend Wscript.Quit End IfElse LogFile(strCacheDrive &” drive could not be found. Quitting the script.”) Wscript.QuitEnd if
‘The following procedure will run if the Trend sysprep process needs to be executed.’This is happens if the trend.txt file cannot be found.
Sub Check_trend On Error Resume Next Dim strSource, strDestination, strFile2 Dim strComputer, objWMIService, colServList, objService, errReturnCode
strFile2 = “ImgSetup.exe” strSource = “C:\temp\Trend\” strDestination = “C:\program Files\Trend Micro\OfficeScan Client\” LogFile (“Adding Run command for imgsetup.exe.”)
wshshell.regwrite “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Trend OfficeScan ImageSetup”, chr(34) & strDestination & strFile2 & chr(34) & ” -HideWindow”, “REG_SZ” If NOT FSO.FileExists(strDestination & strFile2) Then LogFile (strDestination & strFile2 & ” not found.”) LogFile (“Copying ” & strFile2 & ” from ” & strSource)  FSO.CopyFile strSource & strFile2, strDestination End if LogFile (“Running Trend Sysprep.”) WshShell.Run  chr(34) & strDestination & strFile2 & chr(34), 0 , TRUE ‘Sets tmlisten service startup mode to Manual strComputer = “.”
Set objWMIService = getObject(“winmgmts:” _ & “{impersonationLevel=impersonate}!\\” & strComputer & “\root\cimv2”)
Set colServList = objWMIService.ExecQuery (“Select * from Win32_Service where Name = ‘tmlisten'”)
For Each objService in colServList LogFile(“Setting ” & objService.Displayname & ” to manual.”) errReturnCode = objService.Change(,,,, “Manual”) Next

strRegGUID = WshShell.RegRead (“HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\GUID”) LogFile (“GUID =” & strRegGUID) objFile.Close
Logfile(“Writing ” & strRegGUId & ” to the ” & strFolder & “\Trend.txt file.”)
Set objFile = FSO.OpenTextFile(strFolder & “\” & strFile, ForWriting) objFile.Writeline strRegGUID objFile.Close LogFile (“Starting the Trend Realtime scan service.”) wshshell.run “net start ntrtscan”, 0, TRUE LogFile (“Script Finished.”)End Sub
‘The following procedure will run if the \trend\Trend.txt file is found.’It will read the contents of the file and populate the GUID registry keySub Read_GUID Dim strLine Set objFile = FSO.OpenTextFile(strFolder & “\” & strFile, ForReading) LogFile (“Running Read_GUID procedure.”) Do While objFile.AtEndOfStream = False strLine = objFile.Readline LogFile (“Writing GUID ” & strLine & ” to the registry.”) wshshell.regwrite “HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\GUID”, strLine, “REG_SZ” Loop objFile.Close LogFile (“Starting tmlisten.”) LogFile (“Starting ntrtscan.”) wshshell.run “net start tmlisten”, 0, TRUE wshshell.run “net start ntrtscan”, 0, TRUE LogFile (“Script Finished.”)End Sub

Sub LogFile(Message) Dim LogFile, LogFileName Set FSO = CreateObject(“Scripting.FileSystemObject”) Const ForAppending = 8 set LogFile = FSO.OpenTextFile(strLogFilePath, ForAppending, True) ‘ Open the log file for writing LogFile.WriteLine now & ” – ” & Message ‘ Write a line of text to the log file End Sub