Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Scheduled full scan run twice on some servers

Created: 30 Sep 2013 • Updated: 30 Sep 2013 | 8 comments
S_K's picture

Hello,

I have the following issue. Full scan of 170 servers was scheduled to start this morning at 8am. Randomization option was selected and "Scan for up to 8 hours".

Now when running Scan log from the SEPM console I noticed that several servers ran full scan 2 times. Second scan started 1-2 hours after the first. What could be the reason for this? SEP client on servers is version 11 RU6 MP3 and newer. SEPM is 12.1 RU2.

Found one article but doesn't seem to be related to my issue because 1st - SEP is newer that the version mentioned and 2nd - I didn't have full scan scheduled before for the servers.

http://www.symantec.com/business/support/index?page=content&id=TECH98331&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D1380548015588F8jBH9Lih877tT21v440384fV9zYFUg53U13a

Thanks

Operating Systems:

Comments 8 CommentsJump to latest comment

.Brian's picture

Was the first scan stopped or cancelled for some reason?

So this affected multiple machines? How many out of the 170?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Chetan Savade's picture

Hi,

Thank you for posting in Symantec community.

I would be glad to answer your query.

It's highly recommended to have SEPM and SEP clients on the same version. At least on the same platform.

I would request you to upgrade clients to the SEP 12.1 version.

Following fix I could see in the previous releases:

Release Update 7 Maintenance Patch 2 (RU7 MP2)

Scan runs twice
Fix ID:
2409368
Symptom: Schedule scan runs 3 minutes after the last missed scheduled scan completes.
Solution: Fixed an issue where incorrect information was added into the registry key.

Reference: http://www.symantec.com/docs/TECH103087

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

Rafeeq's picture

Call support and get a tool to remove all scans, its called Symdelscan ( I dont remember the name)

let us know how it goes

Mithun Sanghavi's picture

Hello,

I believe you are talking about "SymRmvScans" Utility.

Using the "SymRmvScan" Utility

http://www.symantec.com/docs/TECH105319

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

S_K's picture

thanks, I will open a ticket to get this tool

SameerU's picture

Hi

Please upgrade to SEP 12.1.3 and check

Regards

.Brian's picture

Were you able to acquire and run the tool? Did it fix the problem?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

S_K's picture

No, didn't run this tool, but Symantec support said first to upgrade to 12.1 RU3 and if the issue still exists they will further investigate. So at first possibility we will upgrade SEP on those servers