Endpoint Protection

Hi All,

I inherited a symantec endpoint protection setup and trying to figure out what specifies the frequency in which a clients computer will run a scan.

If I look in the symantec scan logs of a users computer, I will see scans occur maybe 2 or 3 times a day as shown below. In the managament console I can see that the previous admin had a full scan scheduled every Sunday at 8pm and I can see that in the client logs. That makes sense. What I dont understand is what's controlling the time for the other daily scans as shown in the image below.

I looked all over the management console settings and I cant find anything that specifies a daily scan and the frequency? Am I misinterpreting this? Are these log entries just showing me the times the client machine pulled updates and sent updates to the management console server?

It looks like an active scan when new defs arrive. See this KBA:

http://www.symantec.com/docs/TECH106098

As Brian mentioned this is defwatch scan - frequency for it cannot be set manually and is trigered by defs updated on clients:

-------------------

Run an Active Scan when new definitions arrive Starts an Active Scan when new definitions arrive to check for any risks that the new definitions can detect

By default, an Active Scan is run when new definitions arrive. If you disable this option, you weaken the protection available to your client computers. You should only disable this option if you have special configuration or exclusion needs that conflict with this automatically triggered scan.

This option is enabled by default.

Thanks guys. One last question is there anyway to not have the scan run after a defintition update for a specific machine or all machines. I would rather the scans only run at the time we specify in the scheduled scans.

Sorry never mind _Brian answered my question abiut shutting off the def scans.