Endpoint Protection

I'm using endpoint protection verion 12.1 on a pc running windows xp and have this problem.

the client is unmanaged and not connected to a server.

Every time i run liveupdate and it downloads new definition the hard disks are scanned for about 15 minutes...

I have read on forum that I have to disable "run an active scan when new definitions arrive" on the client using SEPM to modify the policy but the problem is that there is no SEPM on my PC!!!

how can I do to disable active scan on new definition?

when I have installed endpoint I have selected unmanaged client, is this the reason that I have no SEPM to manage policy?

can someone help me?

Many thanks

Maurizio

There is a registry key that needs to be modified. What is the exact version here?

the version is 12.1.4013.4013

thanks

You can disable the Defwatch Quick Scan by editing the registry.

Disable tamper protectin first then try this

For a unmanaged client in order to disable the Defwatch wizard scan you will have to make the following registry change below.

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Quarantine\DefWatchMode=3 (REG_DWORD)

DefWatchMode
value  action
0          Automatically repair and restore files in Quarantine silently
1          Repair the files in Quarantine silently without restoring
2          Prompt user
3          Do nothing

I'have tried but regedit signals an error when i try to modify value to 3!!!

maybe i have to stop some service?

That reg key is for quarantine scanning NOT scanning when new defs arrive

Ok

so which key have i to change?

Thanks

I believe this setting only pertains to managed clients.

In your case, you may want to try the steps at this link:

http://www.symantec.com/docs/TECH171788

Disable the Tamper protection and try editing the key, 

I follow this document 

http://www.symantec.com/business/support/index?page=content&id=TECH91622

thanks,

i have followed the steps in the link but the requested key "MinOfDay" is missing in my register!!!

I think that this tecnical note refers to  version different from 12.1.4013.4013

Ok

I have applied.

Now I have to wait for the next new definitions (hoping to solve the problem...)

I am having the same issue on several of our unmanaged clients, but it doesn't appear from this thread that it applies to my version 12.1.4013.4013 unmanaged.  We have notifications created but not on the client side.  My end users have Windows 7 x64 Pro and have noticed this after a local admin policy change (which could be irrelevant).

Any help would be gratefully appreciated.