Endpoint Protection

Hello,

According to the SEP12.1 documentation for the liveupdate idle detection:

Idle Detection

Specifies that a scheduled LiveUpdate should not run until the computer is idle. If the computer is never idle, then after the final threshold is reached, the LiveUpdate runs even if the computer is not idle.

If unchecked, the scheduled LiveUpdate always runs at the scheduled time, regardless of how busy the computer is.

That great, Does someone know when/how Symantec see that a computer is in an idle situation ?

Is this cpu usage detection (<10% for something like 5 minutes) ?

Is this I/O disk detection (few IO => Idle) ?

Both ? More ?

Hello,

To ease client computer performance issues, you can configure content downloads to run when client computers are idle. This setting is on by default. Several criteria, such as user, CPU, and disc actions, are used to determine when the computer is idle.

If Idle Detection is enabled, once an update is due, the following conditions can delay the session:

After one hour, the blocking set is reduced to CPU busy, Disk I/O busy, or no network connection exists. Once the scheduled update is overdue for two hours, as long as a network connection exists, the scheduled LiveUpdate runs regardless of idle status.

Check this Article: