Endpoint Protection

I have users who keep getting the pop up "Symantec Endpoint Protection detected risks while you were logged out.  You may need to open the Antivirus and Antispyware Protection Risk Log to view and take action on the risks."

There is nothing in that log, and I have this pop up disabled by policy on SEPM.    Only thing in the logs are SEP sending suspicious files to Symantec.   Such as software we bought from IBM.

 So how do I stop this pop up? 

You can go into the AV policy and uncheck this setting

its here:

>>There is nothing in that log, and I have this pop up disabled by policy on SEPM. 

As mentioned in my original post, I have that setting unselected.  I have two different policies assigned to various PC groups.  Both policies have this option unselected.  

The pop up still occurs when the users log in.    Affects 12.1, not 11.0.6300.

I just wanted to chime in and say that I am having the same problem. We were running SEP 11 MR5, and I upgraded 3 servers and my machine to SEP 12.1. After the upgrade all 4 machines come up when I log in with the "Detected risks" popup. The quarantine is empty, and no risks were really found. My servers only have the AV component, and my machine has all components. This would appear to be some problem with SEP 12.1 as far as I can tell.

I really don't want to shut off the notification option, if possible, because if there *were* to be some sort of problem, I'd like to know about it. It seems that shutting off the notification option is not the ideal thing to do for the best security.

Same problem. Any solution?

Thank  you Paul.  The setting does not work reliably.  There seems to be a decrease in the number of systems where the pop-up appears, but maybe that's because the machines have fewer false positives that are triggering.  Regardless, we have multiples workstations where this message appears even though the policy shows that the client-side notifications have been disabled as you suggest.

Could you or someone else at Symantec confirm that this is a known issue and that it is being worked on or may be resolved in the next maintenance release?  It's very frustrating to see these issues being reported over and over, but no response to indicate that a resolution is in-work.

Thanks again for your help.