When administrators add Active Directory (AD) domains to the "ADSyncOUList.config" approved list without specifying the Organizational Unit (OU), Apex Central is unable to synchronize the Active Directory domains.

When the Active Directory (AD) manager has only one reporting staff and the staff account on the AD server is disabled between synchronization tasks, Apex Central is unable to synchronize the Active Directory.

Apex Central may not be able to send scheduled reports by email when there is a large number of reports.

In C&C callback event notifications, the callback address field may contain complete URLs of malicious websites which users can click.

Users encounter an error message while editing an existing user account.

The SIEM server displays inaccurate information when Apex Central sends Attack Discovery logs containing JSON content.

The Trend Micro Infrastructure (TMI) service stops unexpectedly.

Apex Central is unable to deploy new components downloaded from the ActiveUpdate (AU) server.

There is a typographical error in the syslog content for the following log types:

• Virus/Malware
• Web Violations
• Content Violations

The "%vloginuser%" token does not display any information in C&C callback notifications.

An issue may corrupt the "Systemconfiguration.xml" file and prevent services from starting properly.

Some components on the Dashboard are out-of-date.

A database timeout issue prevents policy deployment.

An issue prevents programs in the Plug-in Program List from appearing on Manual Update and Scheduled Update program lists.

If a Root Cause Analysis does not return any matching targets, "N/A" appears in the corresponding "Users/Endpoints" field.

Users cannot click the "Deploy" button when creating a new policy.

User name information does not appear in Virus/Malware syslog messages.

In environments where a proxy server is required to establish the connection between Apex One and Apex Central, a communication error occurs and prevents Apex Central from deploying policies successfully.

Some directory and file names that end with an extra space disappear from the imported scan exception list.

Users cannot move Security Agents to another server using the EnableMoveNATClient feature, this happens due to an enhanced security check mechanism for moving Security Agents in the previous hotfix.

Users cannot move agents to a specific domain on the target server using the EnableMoveNATClient feature in the following command format:

• #moveto_<target Server IP or hostname>:HTTP port|HTTPS port\targetdomain

This happens because the backslash "\" prevents the feature from retrieving the full domain name from the SQL database.

When connecting to the VPN server, the IP changes and the firewall is re-applied. It takes time to apply all firewall rules and a timing issue may cause the exception rule to be removed before the security level policy rule. When this happens, the traffic is blocked by the high or medium firewall policy.

The Security Agent might start a scheduled scan, even when the scheduled scan feature is disabled.

The file name of the exported list of blocked Virtual Analyzer Suspicious Objects has changed to "ExportBlockedListInfo".

The web installer checks the compatibility of the target endpoints (including system requirements and conflicting applications) before automatically downloading and installing the Security Agent package from Trend Micro servers.

The Command Tracking screen on Apex Central displays whether Apex Central successfully registered to, or unregistered from, Trend Micro XDR.

This hotfix improves IIS stability.

This hotfix adds the "UK: RD&E Hospital Number" field to the DLP module rule template.

This hotfix adds the "User Name" column to the Product Status log query results.

If an Active Directory domain only has one child domain, Apex Central does not automatically a parent domain when filtering policy targets by Active Directory structure.

This hotfix enables Apex Central to support the "Network Content Inspection Engine (3.10, Kernel mode, 64-bit, Conf: 5700)" engine component for Trend Micro Deep Discovery Inspector 5.7.

The "System" and "SSO_User" user accounts and user roles are hidden by default.

This Hotfix updates the Apex One server program to display the Data Loss Prevention(TM) (DLP) engine version of the Security Agent in Scheduled Scan Report on the Apex Central web console.

Add a promotion (blue) bar on the page to navigate users to assess XDR console.

Users can view related objects based on specific ratings on the Root Cause Analysis details panel.

This Hotfix allows administrators to move agents to a specific domain on the target server using the EnableMoveNATClient feature by creating domain hierarchy under the "#moveto_<target Server hostname>:HTTP port|HTTPS port" domain on the source server.

Increased the maximum number of entries in scan exclusion list to 100.

Security Agent consoles running build 13.95 display an incorrect policy name. To resolve this issue, upgrade the Security Agent to 14.0. After the Security Agent contacts the server, the policy name displays correctly.

Off-premises and Security Agents in Independent mode cannot update the Certified Safe Software Pattern from external update sources.

Coexist mode Security Agents on endpoints with Windows Defender may experience installation issues or be unable to upload data to the Apex One server due to a file locking issue. To resolve this issue, add Endpoint Sensor (ESEServiceShell.exe and ESClient.exe) in the exclusions list of Windows Defender to prevent the locking issue.

After copying a file to a remote server using a relative path as the source, Apex One is unable to translate the relative path into the full system directory.

The quality of RCA analysis chain image files is reduced when viewing the files using Windows 10 Photo Viewer.

When attempting to start a Historical Investigation from the Attack Discovery Detections widget that includes Registry value name or Registry value data criteria, the Historical Investigation displays an error message if the length of the Registry value name exceeds 260 characters or the Registry value data exceeds 64 characters.

After updating the Attack Discovery Pattern file (tmesadp.ptn) on Security Agents, a database schema error may occur that causes the Endpoint Sensor feature to continuously report the same detections to the server during each synchronization. This causes duplicate records to display on the Apex Central server.

Root Cause Analysis email attachment results may also include temporary files created when the user saved the file.

The number of matched endpoints that display on a Root Cause Analysis chain may appear to be greater than the total if the Security Agent on an endpoint was uninstalled or no longer reports to the same managing server.

The Endpoint Sensor service may have high memory usage.

The Endpoint Sensor may have high peak CPU usage occasionally.

Endpoint Sensor has CPU peak during Windows Update phase.

The user or account name in ADE detection may be empty.

After enabling the Scan Time Machine option for Manual Scan and Scheduled Scan, Apex One (Mac) cannot perform any actions (clean, quarantine, or delete) on detected malware threats due to a permission limitation in Mac OS. Configured scan actions are displayed as unsuccessful in the product logs.

When performing a historical investigation on Apex One (Mac) endpoints, the system replaces a backslash (/) with a colon (:) in file names, preventing users from searching for file names that contain backslashes in investigation results.

To resolve this issue, use a colon (:) to search for the files.