SEP 12.1 Scheduled scans are not running during the appropriate times
We have just recently upgraded to SEP 12.1 and have a weekly scheduled scan set to run every Sunday at 12:30am. It is my assumption that if the computer is not on during this time, the scheduled scan will run the next time the computer boots up within the next 3 days (we have it retry the scan within 3 days if it is "missed"). So a scan would not run Thursday through Saturday and would try again the next Sunday at 12:30am.
What we are actually seeing is nothing like this. Some computers are running scheduled scans between Thursday and Saturday. Others are never even trying to run a scan at 12:30am on Sunday, even when the computer is on. Others are running their scheduled scans every Thursday. And of course some computers are running the scheulded scans at 12:30am on Sunday without an issue every week.
We did upgrade from 11.x to 12.1 but have never set scheduled scans before. I've seen posts about running a utility from Symantec to remove some old registry keys left over from previous versions scheduled scans. But since we have never set these scans before would that even help? Are my assumptions above not correct?
Any help is greatly appreciated, thanks!
Comments
For scan time SEP will refer
For scan time SEP will refer always the client system date and time.Can you double check wheter it is correct.Also assure that your client got latest policy.You can use the policy sl. no for identifying this.In Server you can find the policy serial number at SEPM-->clients-----> <corresponding group which the client is present>--->details and the same can be found in the client at Client GUI---->help and support---> Troubleshooting-->Management .Both should match...
http://www.symantec.com/business/support/index?pag...
Swapnil
SOC Team .
Please don't forget to mark your thread solved with whatever answer helped you.
Yes, computers are all AD
Yes, computers are all AD joined but I double checked and the date/time is correct. Policy is also up to date and matches the server Policy Serial Number.
do u have randomization
do u have randomization enabled
Don't forget to mark your thread as 'solved' or vote with the answer that best helped you!
have u looked the scan logs
have u looked the scan logs and confirmed the scans take place at any time
Don't forget to mark your thread as 'solved' or vote with the answer that best helped you!
Yes, the scan logs are what
Yes, the scan logs are what showed me that multiple computers are scanning out of the date range we had set up. It shows that most of them are scanning appropriately although I suppose it could just be that they were on during that time as well.
Don't know what you mean about randomization, the only option I found about that was when I edited the Scheduled Scan > Schedule tab and under Scan Duration. We do not have randomization setup there, just Scan Until Finished.
Ensure that AV scanning
Ensure that AV scanning policy has been applied to the group and the you run the update content on the said group
Same problem
Hi,
I encountered the same problem with SEP 12.1 RU1.
By deactivating the "retry window if the scan is missed" has solved this issue (a bit...). I say a bit because some computers still have the scheduled scans begin whenever SEP wants... but there are less than before.
I am interested if you find a solution. The Symantec support has not been able to answer me.
Regards,
Would you like to reply?
Login or Register to post your comment.