Endpoint Protection

Hi All,

I have problems regarding Scheduled scan. I set the schedule scan running from Monday 8PM to Tuesday 8AM and also I enable retry scan to 1 day, So my schedule scan is set from Monday 8PM until Wednesday 8AM. But the big problem is most of the clients is not running scheduled scan even the clients are online. See the Scheduled Scan settings beloww.

Also as per checking on SEPM groups the Last Scan Started is dated September 20, 2016 at 8PM onwards. But as I export the scan report, the client with last scan started dated 9/20/2016 is not showing in the scan report. See image below for reference.

So what are the main reasons aside the client is offline or sleep why SEP client not running scheduled scan.

Thank in advance.

Is your scheduled scan enabled? when you come out of it is the enabled tick box checked? 

To take your questions in order:

• Last Scan Started timestamp - Can you share a further screenie with the full time visible please?  If these ran at 8AM, then it would actually be consistent with your policy (i.e. the scan started when the machines were turned on, on Tuesday morning).  Considering they're all around 8 or 9, this certainly seems logical
• Inaccurate Scan Report - Which report are you using, and can you post an example demonstrating the mismatch please?
• Scans not running according to schdule - This article might help:
  http://www.symantec.com/docs/TECH234012

Hi GeoGeo

The scheduled scan is enabled. See snapshot below.

HI SMLatCST

1. Actually we have roughly 11k clients, some of the workstations did not run the scheduled scan within the set time( from Monday 8PM to Tuesday 8AM, and we have retry scan until Wednesday 8AM).
2. I exporting Scan logs on SEPM. See snapshot below.

I filter the report so you can see that on group 259 only 4 workstations run scheduled scan. But as per checking on SEPM on Last Scan Started, workstations run scan on 9/19 and 9/20. See snapshot below for reference.

That's why i was wondering if SEPM is unable to show all the scan activities of the clients. The data is different on Scan log report and SEPM client status.

Thanks for your reply guys.

So focussing on the the actual issue is log mismatch, what results do you see if you were to choose "Past week" in the time range?  Also, does the Scan Report under the REPORTS section demonstrate the same mismatch?

The SEPM clearly has the info regarding the recent scans, as you can see from the CLIENTS section, so I'm trying to figure out the nature of the mismatch.

are these laptops? you can delay the scan if its running on batteries

HI SMLatCST

Im not sure if it is log mismacth or what. Once i export the scan report and set the time range "Past week" or manually select dates the data is almost the same.

Will check on the enpoints if the scheduled scan run or not.

Hi Rafeeq,

These are all desktop pc running either Windows XP an Windows 8.1.

Thanks for your reply.

Hi All

As per checking in one of the workstation under group 259 based on the scan log of SEP client scan started last 9/13/2016 and finished scan 9/27/2016. But per checking on SEPM last scan started at 9/26/2016 and on exported scan report no scan registered for workstation 259B. See snapshots below for reference.

It certainly seems as if the SEPM's logs were correct on this occasion.  As the scan started on 13th, it should not be in the logs for the past week.  This suggests if the CLIENTS view that is off.

That said, is this what you're seeing for all your desktops?  I don't see how it's possible for the machine's previous scan to have lasted 3+ weeks.  Are these machines only switched on for small spells at a time?

I'd suggest getting these machines left on for a while to see if this makes a difference (maybe a week or so, to cover your scan schedule).  You may also want to look into rescheduling the scans for when the machines are likely to be switched on too.  Finally, do your users have the ability to pause/cancel scans?

Yes, most of them is not running the full scan. The workstations is turned on overnight starting Monday to Tuesday. But we are not sure if the users are complying to turn on the workstations overnight.

Our users can't pause/cancel the scan. The scan is not visible to the end users meaning it runs on the background.

And also we come to think to change the scan time schedule. Previously the our scan schedule is set starting Monday 4PM but most of the users reporting of slowdown of ther workstations so we move the scanning time to 8PM.

While obviously not applicable to all companies, I find the majority of our customers have most luck (i.e. lowest number of performance complaints) when scheduling full scans for Friday lunchtimes, with all set to best application performance.

Hi SMLatCST,

I guess we will adjust the scan schedule time longer to have enough time for workstations to run full scan.

Thanks for your help i really appreciate your comments.