Endpoint Protection

Have been having problems with SEP 12.1.4 clients slow for a few mins in workday.

i checked event viewer and see that this happens around the time that new virus defs are loaded

under quarantine have "do nothing" selected when new defs arrive

have upgraded SEPM and SEP to 12.1.5, still the same problem

have found another setting for "File Cache" when new defs arrive

is it ok to disable file cache rescan?

thanks

Yes, if anything in quarantined it just won't get scanned. It's really up to you on how you want to handle this but it could improve performance.

All info on it is here:

About the file cache

Configuring how the Quarantine handles the rescanning of files after new definitions arrive

i tried to uncheck this setting but it just gets reverted to checked

i only allows me to uncheck the enable file cache which in turn disables all the other setting( i do want to use file cache)

You need to do it from the SEPM, not the client. The client will just grab the policy from the SEPM again when it checks in.

sure doing this on SEPM

OK found post about this problem

https://www-secure.symantec.com/connect/forums/option-rescan-cache-when-new-definitions-load-cannot-be-disabled

will log support case

Best to do that.