Endpoint Protection

Hi All,

Is it possible from the SEPM console to view or report which client that never done (always cancelled) the full scan ?

because some people here in my office complaints that the RTVScan.exe sometimes consume 100% cpu so they had to force power off their system and then sometimes stop the Symantec AV process.

Thanks.

Hello Albert

From the Monitors>Logs you can  select Scan for Log type as mentioned above and under Advanced Options you can choose a scan status, i.e. whether a scan was completed, canceled, or started to filter the results if you're looking specifically for this information.

https://www-secure.symantec.com/connect/forums/machines-have-never-been-scanned#comment-4187891

Another method is from the clients page:

Make sure you're in the clients tab of the Clients page. Then select the View (drop down) Protection Technology. One of the columns is "Last Scan" and you can issue a scan command from there. Right-click on the client.

ah yes, i could see it now, however some of the PC got:

Last Scan Time: 1970-01-01 00:00:00 (In progress) ?

what does that means.

is this machine the newly installed and has not contacted to SEPM after any of the first scan.

actually this is old machine and is still running though.

Which is the version?

open taskmanager and end rtvscan.exe

then check the scan details

That date is the NULL equivalent for SEP. Same applies to its definition dates.

Hi Albert,

Could you please post the screenshot here ?

so that we can analyze it.