Endpoint Protection

 View Only
Expand all | Collapse all

Why do some workstations run a manual scan upon startup when the policy is scheduled to run once a week?

  • 1.  Why do some workstations run a manual scan upon startup when the policy is scheduled to run once a week?

    Posted Jun 04, 2009 06:16 PM
    Some of our workstations run a scan upon startup when the policy is set to run once a week...other workstations in the same group run the schedule scans configured in the policy.


  • 2.  RE: Why do some workstations run a manual scan upon startup when the policy is scheduled to run once a week?

    Posted Jun 04, 2009 06:17 PM
    (Serengeti)

    what scans does the AV policy for the group specify?

    The Administrator-defined scans include any scheduled scans you might create e.g. weekly plus in the Advanced tab there are:
    startup scans when user logs on
    active scan when new defs arrive

    The scheduled scans will have a retry period, which will make them start within x hours or days if they are missed. Maybe some clients are starting again within that retry period?

    The client scan log will show when scans ran. It displays what kind of scan - manual, Defwatch, Startup, Scheduled.
    Cross-check with the Windows Application log - source: Symantec AntiVirus, Event ID2 - scan completed, Event ID 3 - scan started