SEP client performs a full scan after installation/reboot...WHY?
Updated: 21 May 2010 | 3 comments
This issue has been solved. See solution.
When I install the SEP client (MR4 MP1a) on a clean machine and then reboot, the client will perform a full scan. I have no Scheduled Scans configured in my AV policy.
After the client installs I verify that it has the latest policy and I verify that there are no scans listed in "Scan for threats". But once I reboot and login I see the CPU getting pegged. If I look at the Scan log file it says it's scanning and the "Logged By" column says Scheduled Scan. When the scan finishes it usually has scanned ~200,000 files.
Is this just a default action of the SEP client to run a full scan after initial install? Can this be disabled?
discussion Filed Under:
Comments
This behaviour is by design.
This behaviour is by design. There is no option to turn it off. If you don't want to wait until finish then reboot the machine when the scan occurs. It won't be run again even if it doesn't finish.
Workaround!
There is a workaround that to the issue:
1) Do not create a single executable while creating the package.
2) You should have a msi inside the package now.
3) Use the following way to install:
msiexec /i "\\servername\package\symantec antivirus.msi" /qb RUNSCAN=0 RUNLIVEUPDATE=1 REBOOT=REALLYSUPPRESS
You can also modify the package to be pushed across, If you would like it to be that way.
Make a batch file as:
msiexec /i "c:\temp\clt-inst\symantec antivirus.msi" /qb RUNSCAN=0 RUNLIVEUPDATE=1 REBOOT=REALLYSUPPRESS
Convert it to an exe with a converter like http://www.f2ko.de/ob2e/ob2e.html and rename it to setup.exe. Replace the setup.exe from the package to this new one. Push it across.
De facto when AV does something, it starts jumping up and down, waving its arms, and shouting "Hey! I found a virus! Look at me! I'm soooo goooood!"
(No subject)
Would you like to reply?
Login or Register to post your comment.