Video Screencast Help

multiple schedule scan running but it is unable to stop

Created: 14 Sep 2012 | 9 comments

Some of our clients (12.1) have multiple schedule scan running and I am unable to stop them. It looked like the first schedule scan was stuck and the sebsquent scans were stuck after. However, I can't seem to stop these scans. When I reboot, the scans are still there. Also, how can I identify what is the cause of these stuck scans?

Thanks

 

 

Comments 9 CommentsJump to latest comment

Ashish-Sharma's picture
Scheduled scan runs repeatedly in a multi-user environment
Fix ID: 2613428/2618423
Symptom: Multiple users have scans scheduled to run at or near the same time. As soon as one finishes, the next one starts.
Solution: This release introduces a new registry value which can be added by the administrator to disable all user scans:
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint
Protection\AV\AdministratorOnly\General\EnableUserScans = 0
The administrator can add EnableUserScans as a DWORD. When the value is 0 all user scans are disabled. When the value does not exist or is non-zero, all user scans are enabled (default behavior). Administrator-defined scans are not affected by this registry value.

Thanks In Advance

Ashish Sharma

 

 

lastday's picture

We only have one schedule scan defined for these PCs and it is done by the SEPM server. So your solution doesn't seem to apply to our situation.

 

 

pete_4u2002's picture

only one scan run on the system.

if you have stopped the SEP service while scan, it might be showing as running and it does not have end date/time of scan.

to confirm this you can start the next scan.

Is this laptop user? chances are getting into hibernation.

lastday's picture

Pete, some of them are laptops and some are destops.

Ashish, is there anyway I can remove these scan without using registry. In fact, I am hoping to be able to resolve the issue by the SEPM as there might be potentialy few ten machines that has similar problem.

 

Thanks

6ft_under's picture

was this ever solved?

we seem to have this problem on 2 older servers upgraded from win2003 to win2008. for a long time I was wondering why almost whenever I want to restart either of those servers it asks me if I want to cancel a scan?

Recently disabled the Admin Scheduled scans on those machines via SEPM and yet the problem persists.

 

I cannot edit the registry as per Ashish solution (error "cannot create value: error writing to registry"), neither SEPM nor SEP clients show any schedule for other scans ... how to forcefully remove those hidden scans from past old versions?

Ashish-Sharma's picture

hi,

Try to disable tamper protection after edit the registry..

Thanks In Advance

Ashish Sharma

 

 

6ft_under's picture

thanks, that worked. was able to create teh registry key disallowing any kind of users scans.

lastday's picture

I have to use the clean wipe utilty to remove SEP and reinstalled SEP. After that, the problem was fixed.