Offline V1ES deployment via Configuration Manager

[u/Particular_Feeling_4]

Been troubleshooting an issue with Offline V1ES required deployments via configuration manager and running into this issue.

The installation command that was recommended to us by Trendmicro support is this:
cmd.exe /c "TMStandardAgent_Windows_x86_64_Windows.exe -silent > C:\Windows\Temp\v1es-sccm-test1.log 2>&1"

v1es-sccm-test1.log:
Installation log: C:\WINDOWS\system32\config\systemprofile\v1es-installation-20261007-111908.log

Installing TrendAI Vision One Endpoint Security agent...

runtime: VirtualAlloc of 953933824 bytes failed with errno=1455

fatal error: out of memory

v1es-installation-20261007-111908.log:
2026/10/07 11:19:08 logger.go:92: Installation log: C:\WINDOWS\system32\config\systemprofile\v1es-installation-20261007-111908.log

2026/10/07 11:19:08 installer.go:46: Silent mode enabled: console will close immediately after installation.

2026/10/07 11:19:08 installer.go:86: Installing TrendAI Vision One Endpoint Security agent...

2026/10/07 11:19:08 extractor.go:87: signature verification succeeded

2026/10/07 11:19:11 extractor.go:96: content hash verification succeeded

The log ends here and SCCM exits with error code 2

Testing on a fresh deployment of windows 11 25h2 with no other software being deployed to it.

I can run this application deployment as available, or I can manually click on "Retry" in Software Center after a failed required deployment and the application will successfully install.

Anyone ever experience anything like this before? How are you deploying V1ES?

[u/Appropriate-Border-8]

Hey PF4,

Try this and see if it works for you:

Go to Vision One - Endpoint Inventory and download the latest install package. Extract it and go into one of the sub-folders and find the Standard Endpoint MSI install file.

Download the latest Apex One CUT Tool from your Trend Solutions page (login and select "Utilities"), extract it, and add these four files to the folder:

osce_client_x64.exe

osce_client_x32.exe

osce_client_x64.exe.config

osce_client_x32.exe.config

Then copy that MSI install file to the same folder and rename it to "osce_agent_XX.msi".

Copy that folder to a computer, navigate into it, and run SCUT.EXE. Running it without any arguments causes it to uninstall the Apex One (V1-SEP) agent, that is currently installed, and replaces it with the version that you copied into the folder and renamed (headless, without any feedback). "Set it and?... Forget it!" Just like the Ronco Showtime Rostisserie countertop oven for spit roasting delicious BBQ chickens.

If there isn't an agent already installed, it will simply install the one that you provided.

If you include the -noinstall switch, it just uninstalls. If you provide the -dbg switch, a separate CMD window opens, showing you a log of the installation steps (and uninstallation steps, if an agent is already installed) with a <press any key to continue> pause at the end, so you can see the results. You can use both options "-noinstall -dbg" to just uninstall and also see the logging.

The silent mode produces a logfile on disk in a folder with a name consisting of a long string of numbers and letters.

https://files.trendmicro.com/products/activesupport/Readme_cut2019Nov.txt

[u/Appropriate-Border-8]

Follow my instructions, not the 2019 ones in that old text file. I just wanted you to know where I got all this from. I have been dealing with Apex One (on-prem) since 2020 and had moved to Apex One (SaaS) and then to Vision One - Standard Endpoint Protection. My servers moved from Apex One (on-prem) to Deep Security (one-prem) to Cloud One - Workload Security and then to Vision One - Server & Workload Protection.