Endpoint Protection Small Business Edition

Whether it would be recommended to use “active scan” rather than “full scan” and randomization on the virtual servers to minimize the impact on the SAN?

Use randomization. Active scan doesn't scan the entire VM so the possibility of a risk not being found goes up.

Symantec Endpoint Protection 12.1 - non-persistent Virtualization Best Practices

Best Practice for Symantec Endpoint Protection Scheduled Scans in VMWare

Randomizing scans to improve computer performance in virtualized environments on Windows clients

Randomizing scans to improve computer performance in virtualized environments

Active Scan does not scan all the files, it just scans the loadpoints.

We have created different groups, 

they all start with 1 hour interval

12:00 AM

1:00 AM

2:00 AM

Hi,

In virtualized environments, where multiple virtual machines (VMs) are deployed, simultaneous scans create resource problems. For example, a single server might run 100 or more VMs. Simultaneous scans on those VMs drain resources on the server.

You can randomize scans to limit the impact on your server.

Randomizing scans to improve computer performance in virtualized environments

http://www.symantec.com/docs/HOWTO55262

Best Practices for Symantec Endpoint Protection in Virtual Environments

http://www.symantec.com/docs/TECH95300

Best Practice for Symantec Endpoint Protection Scheduled Scans in VMWare

http://www.symantec.com/docs/TECH95928

Shared Insight Cache versus Active Scans in Virtual Environments

https://www-secure.symantec.com/connect/forums/shared-insight-cache-versus-active-scans-virtual-environments

Use Shared Insight Cache in virtualized environments

Shared Insight Cache eliminates the need to rescan the files that Symantec Endpoint Protection has determined are clean. You can used Shared Insight Cache for scheduled and manual scans on your clients computers. Shared Insight Cache is a separate application that you install on a server or in a virtual environment.

Configuring your clients to communicate with Shared Insight Cache

http://www.symantec.com/docs/HOWTO55321