Endpoint Protection

I have just installed SEP v 12.1.671.4971.  On 7 different Windows 2008 SP2, 32bit Remote Desktop servers.  Now when users connect and start to work, they are getting pop-ups in their session window.  (Which is bad and confusing to them).  I need to be able to 1) Remove the Scheduled Active Scan for each user's profile and 2) prevent the users from seeing any pop-ups in their sessions.

Currently, I have the following set: Auto-Protect is enabled with notifications not enabled.   I have a scan triggered only when a file is modified.  I have followed the older version's Terminal Server best practice document and have excluded several folders.  Including the pagefile, C:\Windows\System32\spool and several different application folders.  This hasn't seemed to be enough though.

Any suggestions would be appreciated.

Regards.

Same here.  It seems to affect only an unmanaged client (in my case), and will happen with any client whether an XP workstation with multiple user profies or a Terminal Server.  When I joined it to the SEPM as a managed client it fixed. 

I have another TS that is unmanaged.  Symscanrmv tool does not work.  I have a call in to see if there is an updated tool available.  I am not able to have it managed at the moment. 

Hello pantanct,

If your users are seeing the Active Scan popup when they logon, then you likely have Show Scan Progress selected in the Virus and Spyware Policy. You could either change this so that scan progress is hidden (the users would not see any popups) or you could disable Startup Scans.

Hiding scan progress

1. Login to the SEPM
2. Click Clients
3. Select your group which is affected by this issue
4. Click the Policies tab (at the top)
5. Open your Virus and Spyware Protection policy
6. Click Administrator-Defined Scans
7. Click Advanced
8. Under Show scan pgoress options, select Do not show scan progress.
9. Click OK.
10. Let the SEP client pick up the new policy and test it out. Does the problem still occur?

Should you prefer to disable startup scans altogether, you can do this at step 7 by removing the checkmark which reads "Allow startup scans to run when users logon".

James

What about unmanaged clients?

Hello Robert,

I checked my SEP 12.1 unmanaged client and I do not see any options for disabling ActiveScan on login. Are you seeing ActiveScans occur when users login?

The unmanaged SEP client is more limited in what can be configured than the managed client. If you need to change a setting in the unmanaged client which is not available in the unmanaged client's GUI, you have two options.

Either 1) make the client managed or 2) configure a managed SEP client (using the SEPM) exactly how you want it, export the policy from the managed SEP client, and import it into the unmanaged SEP client. Option 2 is cumbersome and involved, but it works.

If you need more details on this, let me know.

James

Yep, option 2 is what I am trying now

thanks

r

We are having the same problem here: http://www.symantec.com/connect/forums/symantec-endpoint-protection-active-scan-upon-startup-non-stop

Telling us to make the client managed isn't really a solution.  There is no reason that we should be seeing scans running every day that we log in.  Why exactly is this happening and why is there no option to disable this!???

Hi Robert,

We have been experiencing the same issue. Did you manage to resolve this ?

Have you tried the "Advanced Scan Options", Dialog Options?  ( I came across this option when looking at Trevence's post here http://www.symantec.com/connect/forums/symantec-endpoint-protection-active-scan-upon-startup-non-stop)

I've changed the seletion to "Show scan progress if risk detected" (although it was this already!!) and i also checked the "Close the scan progress window when done" option.

So far this seems to work.

Cheers,

Colin

Open the GUI

Select Scan for Threats

Right the Active Scan and delete

Thanks Brian,

but i still want the Active Scan to run, just not display the progress pop-up everytime.

I beleive your suggestion will simply prevent autoscan?

The only way I found is option 2 as above. Actually I made an install package as an unmanaged client using the SEPM and then installed from this.  In this package I disabled the administrator scan.  Now no scans run, except the one I created manually in the Admin profile. 

I had deleted all scans in the gui, but scans still ran as described.  These scans are buried in the registry and by the time discovered, the scan has permeated each profile on the term server.  One could one by one delete the reg. entry if so inclined, but 30,40,50 profiles is tedious. 

I was mostly interested in the scans not running like they were, not only not seeing them.

Thanks for the update robert. Sounds like its Option 2 then.

The whole point is to just get the popup to stop. It's just as annoying as any stupid virus with a popup you can't control. You'd want the active scan to take place, but only in the background. popup when it finds a problem.

Symantec needs to simplify this. Can't understand why they would do this in the first place as the users don't care about what's running on their computers anyway. Not to sound too offensive, but this is just too stupid.

Please reference the answer that has been provided already in this thread from james back in August.

"2) configure a managed SEP client (using the SEPM) exactly how you want it, export the policy from the managed SEP client, and import it into the unmanaged SEP client"

I have the same issue on a hundred or so clients. I want to disable the scan results and have symantec run silently in the backround. Why is there no option to turn off the display of results? I have referd to James's anserw and I have no idea what this means ""configure a managed SEP client (using the SEPM) exactly how you want it, export the policy from the managed SEP client, and import it into the unmanaged SEP client"".

We use SEP as unmanged clients and do not have a management server. Is there anyway that the very gifted Syamantec employess could post a more detail oriented response/resolution to this. Instead of pointing at a two sentence resolution that only brings up more questions for me. Please forgive my ignorance and lack of understanding. I did RTFM and found nothing but a lot of managed client options with no refrence to unmanged clients or options. As Keenan Thompson from SNL moans, whats up with that?

Elaborate?

Regards,

Anonymousezero1

https://www-secure.symantec.com/connect/forums/symantec-endpoint-protection-active-scan-upon-startup-non-stop

I just posted in this other thread what I've found.