Scheduled scans do not run when local user is logged off of the computer under Windows NT/2000/XP/2003

Article:TECH98766  |  Created: 2000-01-26  |  Updated: 2005-01-10  |  Article URL
Article Type
Technical Solution



You are using the Norton AntiVirus Corporate Edition or Symantec Antivirus Corporate Edition client, and have configured a scheduled scan. If you are logged off when the scheduled scan is supposed to take place, then the scheduled scan does not run.


creating the scan locally puts the data in HKEY_CURRENT_USER.


Symantec recommends using the Symantec System Center to schedule a scan to run on managed clients. Scheduling the scan through the Symantec System Center allows the client to use the System account, and launch the scan while the user is logged off.

When you set up a scheduled scan locally on a computer, the registry key to initiate that scan is placed in the HKEY_CURRENT_USER key. When Windows NT/2000/XP/2003 is locked or logged off, there is no Current User. Therefore, the registry key for that scan is not read. When you set up a scheduled scan from the Symantec System Center, the registry key for the scan is placed in HKEY_LOCAL_MACHINE, which can be read when no user is logged on. The software is operating as designed for Windows NT/2000/XP/2003 compliance.

To configure a scheduled scan from Symantec System Center
  1. Open the Symantec System Center, and then unlock the server group.
  2. Right-click the parent server that contains the clients you want to configure.
  3. Click All Tasks > Norton AntiVirus or Symantec AntiVirus > Scheduled Scans.
  4. Click the Client Scans tab.
  5. Click New to create a new scheduled scan.
  6. Configure the scan settings, and set the time and frequency of the scheduled event.
  7. Click OK to save the scheduled scan.

If you are using an unmanaged client, then you can either enable the Missed Events option or manually run the scheduled scan.

To enable the Missed Events option to handle missed scans
  1. Open the Symantec AntiVirus user interface.
  2. Select Scheduled Scans.
  3. Select the scheduled scan that you want to modify.
  4. Click Edit.
  5. Click the Schedule tab.
  6. Click Advanced.
  7. Check Handle missed events within.
  8. By default, Symantec AntiVirus will prompt you to run a missed scan up to 8 hours after the scheduled time. Configure this value if necessary.
  9. Click OK to save changes.

To manually run the scheduled scan
  1. Open the Symantec AntiVirus user interface.
  2. Click Scheduled Scans.
  3. Click the scheduled scan that you want to start.
  4. Click Scan.

The Norton AntiVirus service stops responding and the Event Log contains "Scan could not open file..."

Supplemental Materials


Legacy ID


Article URL

Terms of use for this information are found in Legal Notices