Endpoint Protection

Good afternoon,

I've had multiple users reporting to me that their weekly scheduled scans are no longer working. The scan will start, but immediately stops with the message "scan cancelled by the user" when the users did not stop the scan. The users have told me that they will not provide any input and the scans will still stop, even if they are not doing anything on their system when the scan initiates.

I troublehsooted the issue by creating a new scheduled scan using the same parameters as the default weekly scheduled scan (minus the exact time, of course) to work around the issue, but I wanted to find out what is causing the issue since this may be happening with more users in our environment.

Thanks in advance,

-Johnathan

This will report like this when the machine is rebooted.

Or by chance do th ey have user exceptions set to exlcude C:?

whats the version your are running? previous versions had this bug

Brian,

You said it will report this when the machine is rebooted - do you mean if it was rebooted during the scan? I've had users sitting at the desktop watching the scan begin and then it immediately says cancelled by user despite their lack of input.

Rafeeq,

As noted in the title, we're currently running 12.1.4013.4013. I believe I saw that version 12.1.5xxx is out - do you know if this was a bug that was address in one of these releases or was it something before our current version?

Correct. Some users get annoyed and reboot to cancel the scan.

You can check release notes for 12.1.5 to see if this was an issue

New fixes and features in Symantec Endpoint Protection and Network Access Control 12.1.5

Is the scan bar hidden or visible to users? why dont you hide it??

http://www.symantec.com/business/support/index?page=content&id=HOWTO54967

I didn't see anything in the list of fixed issues on that page that pertained to this issue.

The scan window is currently visible to users, yes. We could possibly hide the bar from users, but unless you believe that would somehow solve the issue I don't think we specifically want to hide the scan. Because of the intrusiveness of a full scan, we want users to be able to pause or stop scans if they are prompted while the user is interacting with the systems. For example, the scans will automatically start upon boot if the computer was not on when the scan was scheduled. If we hid the window to users then they would have to deal with a very slow system due to the high I/O of the hard drive during scans.

I'm not completely against considering this route if that solves the issue, but I don't see why the visibility of the window would cause this issue if the users are not stopping the scans.

I doubt hiding the window would magically fix it. May want to check in with support....