Endpoint Protection

Hi,

I have moved a few maachines from a client group to a new group, to which I copied the settings, and then changed only the scheduled scan times, from weekly sundays at 12.00 to 4.00AM.

Now I pulled scan history and see that respective machines ran scheduled scan at 12.00AM, as in previous home groups, plus the new setting 4.00 AM.

Computer	Status	Total Files	Infected	Logged By	Started On	Completed
	Scan Complete	704072	0	Scheduled scan	1/10/2010 4:00	1/10/2010 4:37
	Scan Complete	704072	0	Scheduled scan	1/10/2010 0:02	1/10/2010 0:40

Any ideas why? I only dragged the machines from old client group to new one. Should I have unassigned first? I don't do this normally and I don't run into issues.

Machines in case are servers and I'm not the owner, so no restart or AV restart took place. Is it necessary as a rule?

Let me know if you have any idea on this.

Thanks,

Hi,

You can check the registry at the client machine for the details of the scans it is applying. It can be found in the location below:

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\LocalScans

Aniket

Is this valid for SAV10 as well? and I need to know if the schedule time is in a clear text format.

Thanks,

This is the doc you should be referring to

Unexpected scheduled scans run on a Symantec AntiVirus client

 http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/e7693a5ae9ea09548825710100790b3a?OpenDocument

Thank you, Vikram, for the reference.