Windows 11 KB5014019 breaks Trend Micro ransomware protection

This week's Windows optional cumulative update previews have introduced a compatibility issue with some of Trend Micro's security products that breaks some of their capabilities, including the ransomware protection feature.

"The UMH component used by several Trend Micro endpoint and server protection products is responsible for some advanced features such as ransomware protection," the antivirus vendor revealed.

"Trend Micro is aware of an potential issue where customers who apply the optional Microsoft Windows 11 or Windows 2022 optional preview patches (KB5014019) and reboot would then find that the Trend Micro UMH driver would stop."

The known issue affects the User Mode Hooking (UMH) component used by several Trend Micro endpoint solutions, including Apex One 2019, Worry-Free Business Security Advanced 10.0, Apex One as a Service 2019, Deep Security 20.0, Deep Security 12.0, and Worry-Free Business Security Services 6.7.

The Japanese cybersecurity company is now working on a fix to address this issue before the update previews are pushed to all Windows customers as part of the June 2022 Patch Tuesday.

How to restore Trend Micro endpoint solution capabilities

Luckily, unlike regular Patch Tuesday Windows updates, this week's preview updates are optional and they were issued to test bug fixes and performance improvements before the general release.

Windows users have to manually check for them from Settings > Windows Update. They will not be installed until you click the 'Download now' button, limiting the number of potentially impacted users.

Impacted Windows platforms include both client and server versions with the problems experienced on systems running Windows 11, Windows 10 version 1809, and Windows Server 2022.

Trend Micro customers who have installed the optional Windows optional patch may either uninstall the patch temporarily or reach out to support to get a UMH debug module that should revive their security solution's capabilities.

Windows users can remove the preview updates using the following commands from an Elevated Command Prompt.

Windows 10 1809: wusa /uninstall /kb:5014022 
Windows 11: wusa /uninstall /kb:5014019
Windows Server 2022: wusa /uninstall /kb:5014021

Windows 11 KB5014019 breaks Trend Micro ransomware protection