While the Symantec Endpoint Protection (SEP) 12.1 product is fully supported and optimized for use in a VMWare virtual environment, Symantec is not currently using the vShield Endpoint API for agent-less AV on virtual machines in Symantec Endpoint Protection (SEP) 12.1. vShield support is planned to be integrated into future releases of the product.

The virtualization optimizations in SEP 12.1 include:

• Shared Insight Cache; a remote cache that allows clients to share scan results and skip scanning files previously scanned inside other virtual machines.
• Virtual Image Exception; a feature which allows to exclude from scanning all files on a known-clean baseline image.
• Offline Image Scanner; a standalone tool to scan offline VMWare image files (*.vmdk).
• Resource Leveling; a feature to randomize the exact time of scheduled scans and definition updates, resulting in a more even load on the host OS.
• Virtual Client Tagging; allows searching and reporting based on the client virtualization platform, which can be used to assign more performance-sensitive policies to virtual endpoints.

These features provide a hybrid protection capability which gives the same type of performance improvement as an agent-less AV is intended to provide, but with the benefit of not removing the Intrusion Prevention (IPS), Application and Device Control (ADC) and other protection technologies provided by the Symantec Endpoint Protection client for each virtual machine.

For further details regarding the Shared Insight Cache feature please see the following articles: HOWTO55311 and TECH174123

Additionally the following article contains general best practices for SEP in virtual environments: TECH95300