Endpoint Protection

Hi all

Please see full scan configuration below, tuning: best scan performance

we are having an issue because most of the workstations is unable to finish the scan, is there an event viewer like or report that can show the reason why the scan was suspended?

also is there a calculator like that can compute the scan duration (even just estimation) of full scan if the:

CPU core is:
RAM is:
Hard disk is:
Free space is:

then the scan duration is = ???

Before, most of the user of our customer is complaining that their workstations is slowing down because of the scheduled scan at 4pm so we set this up at 8pm office hours is done (the users are all morning shift)

i suspect that having 12 hours scan duration duration is not enough for other workstations with low specs or capacity, i want to get back to our customer that i can show to them their low specs workstations and their users whos maybe turning off the workstations are the reason why the full scan was never completed

i hope someone can help

Thank you in advanced

Winston VP

I'm not aware of any sort of calculator for this.  As you've surmised, there are so many variables involved from machine resources, to disk speed/size/fragmentation, that it's difficult for any form of accurate prediction.

And that's not even including SEP's Insight feed which allows for skipping known-good files, to try to speed things up.

I'd recommend just taking a look at your Scan Logs (SEPM Console -> Monitors -> Log Type = Scan), and taking a look at the results.  You will be able to see from the Staus column how many completed, and how many cancelled after 12hours.  Those that cancel before 12 hours, are likely to have been interrupted by an admin or user.

Of course, you could always remove the option from the users to stop scans if you so wish (found in the AV Policy -> ADministrator Defined Scans -> ADvanced -> Scan Progress Options).