Endpoint Protection

Windows OS in general seems to be effected but mostly windows server 2008, and 2012. Latest virus definition on all 112 servers and workstations matches the day the last scan started, which was between the 19th and the 22nd. All those scans are still running/hung, and no virus definitions update have taken place since. I am not sure what the issue is. Communication logs from client to server look good, sylink logs look good as well from SEPM to client and show update packs being successfully downloaded. Any ideas?

Any input is appreciated.

You have a problem.

Multiple scan on-going at the same time.

One solution: uninstall and reinstall the SEP client.

However....

If you have not pushed out the new SEP version, you can also do a push from the SEPM.

Do the push for each SEPM group individally and set the polcies to be over-written.

That way, you keep the machines in the original group, over-write the policies (means the scans are gone) and you have upgraded your client.

I would start by running the symdiag tool on one of the affected machines:

Download SymDiag to detect Symantec product issues

This sounds like the SEP client is corrupt. or its either not reporting the status properly. check the client manually to see if its intact. If its updated and no scan is in progress in the home screen of the client it means the client is healthy. if not then this calls for a re-install.

Did this before posting, nothing came up as out of the ordinary.

This issue began after the virus definition update on the 19th of july. For example:

Server 1 Virus definition updated 07/19/2016.

Server 1 Daily Scan Begins 07/19/2016.

Since then there are two issues, one the virus definition update on 07/19/2016 is the last one it recieved, and two the daily scan that began on 07/19/2016 is still going. All clients involved are on the 12.1.6 MP5

This pretty much sounds like something went bad on 19th of July. try re-installing SEP on one of the affected machine. sometimes a repair install can also do the job for you.

I had similar issue - it would appear there were something 'bad' between 17-19th July and if I recall it correctly, about 5 servers were affected (2 x 2008 and 3 x 2012)

A reboot resolved it.

We have similar issue it occurs everyday. We have 400 servers mainly 2008 R2 running latest client 12.1.6 MP5. Randomly about 20 - 40 servers have problem with scanning which stuck or hang for multiple days, that cause Virus Definitions Not updating and the new daily scheduled scan doesn't run.

We have to reboot the servers for temporary resolve the problem, however, the problem will re-occur in few days later. 

We have tried reinstalling the client but without luck. 

It seems like it's a bug on SEP client version 12.1.6 MP5. 

Any Symantec employee can provide any suggestion?