I noticed on 08/02/08 that the antivirus client was disabled on our exchange server.
I checked eventviewer and back on 29/01/08 it had this entry:
Event Type: Warning
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 6
Description: Auto-Protect Error: Auto-Protect is disabled because registration of the virus databases failed
This happened just 2 seconds after the daily definition update:
"New virus definition file loaded. Version: 100128r."
I could turn auto-protect back on manually, but the worrying part is that our exchange had been running without auto-protect for over a week.
Any ideas why the av client disabled itself and what I can do to prevent this from happening again?
Our exchange server runs on windows 2003 sp1.
Symantec client version 10.0.0.539, engine 220.127.116.11)
All clients get their definition updates from our primary server running Symantec System Center corporate enterprise edition 10.0.0.539.