Endpoint Protection

I have upgraded from symantec 10.1.5.5002 to the latest endpoint protection.

The install packages have been deployed to about 25 pc´s - and in the policy it has been set up that weekly scans etc is disabled.

But on this one pc, every monday is set to an virus scan if I look in the schedule on the pc. I have tried to remove the software and again from the server to start the install, but afterwards the weekly scan still stand in sep.

I have no rights on the pc to disable it, and on the server there is not set this weekly scan up - so where do it get this scan ?!?

Can anyone tell me how to solve this

Here is the default Admin Defined Scanand if you have created few more scans for this users it will also be listed in the same location but with a different name.

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\LocalScans\5df13630-79f7-4c70-002b-16b8952f5533 ( name can be any hexadecimal name )

So you can delete this and see whther the scan is happening..

Hello,

Did you try the Symantec "SymRmvScan" utility?

I am emailing you the same.

Well - actually I was wrong.

For some reason it seems that the weekly scan is scheduled on every client, besides the server where the SEP console is installed.

I installed a complete new machine today, and afterwards the weekly scan was set to every monday.

Do I have to run this cleanup on the server also ?

If the client is able to communicate to SEPM,if you chage the policy in SEPM that will do.If it is an unmaged client you have to remove manually...

Hello,

Yes please. It is important as much as it is important on the Clients.

I have run SymRmvScan both on the server, where the console is installed and on several workstations.

The job dissapear on the clients, but after some time it appears again.

I have looked on the policy´s on the server and deleted everything regarding schedules scans - but somewhere it must get this scan from ?

Were your symantec 10.1.5.5002 clients set to do a scan every Monday?

The scan could have reappeared whether AV policy assign to clients has scheduled scan or not.

"I have looked on the policy´s on the server and deleted everything regarding schedules scans - but somewhere it must get this scan from ?"

Do you mean you just removed scheduled scan from the policy once you noticed scheduled scan was back on clients? If yes, you need to wait for clients to update their policy in order to erase scheduled scan entry locally.