Solved

Cannot stop clients from scanning

Posted on 2008-10-17
10
483 Views
Last Modified: 2013-12-09
I can't for the life of me figure out why we have clients scanning when some users log in, or after a computer turns on. It's happening on about 25 computers out of 150. On the server, Under "Client Adminstrator Only Options" under the scanning tab, I have all boxed unchecked for scanning exept the top one.

It's driving us nuts. Anyone have any further ideas on what could be causing this?
0
Comment
Question by:BryceRichert
  • 4
  • 3
  • 3
10 Comments
 
LVL 24

Assisted Solution

by:DMTechGrooup
DMTechGrooup earned 200 total points
ID: 22747133
Do you have it set to scan at next start-up/logon if missed becuase the computer is off?

http://service1.symantec.com/support/ent-security.nsf/pfdocs/2006012514020748

0
 
LVL 20

Accepted Solution

by:
jimmymcp02 earned 300 total points
ID: 22749678
do you have groups set up?
if so are the computer affected by the issue part of the same group?
0
 

Author Comment

by:BryceRichert
ID: 22762884
Where is the exact setting on "scan setup" for setting it to scan at next startup/logon missed because of power down situation?
0
 

Author Comment

by:BryceRichert
ID: 22762890
They are all in the same group and I'm applying these settings to the entire group.
0
 

Author Comment

by:BryceRichert
ID: 22762940
I founD THE "NEXT STARTUP/logon mnissed" item.

I need to know where I can choose to have the scan run even when the computer is logged off. This way it will scan on Sunday night when I tell it to. It looks like it might be trying to rescan if missed within three days of the sunday night scan.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 22762997
To schedule scans for Symantec AntiVirus clients
In the Symantec System Center console, right-click a server or individual client, and then click All Tasks > Symantec AntiVirus > Scheduled Scans.
In the Scheduled Scans dialog box, on the Client Scans tab, click New.
In the Scheduled Scan dialog box, under Name, type a name for the scan.
Set a frequency for the scan.
Set a time for the scan. You can type any time in increments of 1 minute or use the drop-down list to select a time in 15-minute increments.



======>>>>>>>>   Click Advanced.




In the Advanced Schedule Options dialog box, check Handle missed events within, and then set the time limit within which you want the scan to run. (For example, you may want a weekly scan to run only if it is within three days after the scheduled time for the missed event.)
Click OK.
In the Scheduled Scan dialog box, click Scan Settings.
Select the folders to scan.

--------------------------------------------------------------------------------
Note: This option is not available if you are scanning multiple computers because folders are specific to each computer.
--------------------------------------------------------------------------------
 
Click Options.
In the Scheduled Scan Options dialog box, you can:
Select file types and extensions to scan.
Assign primary and secondary actions for detected viruses. If deleting a threat can cause a system failure, the only available action is to log the threat.
Select file types or extensions to scan.
Enable scanning for threats that are in memory. (Scanning for in memory threats)
Enable expanded threat scanning and exclude threat categories from the scan if necessary.

--------------------------------------------------------------------------------
Note: When you exclude a folder, Symantec AntiVirus cannot protect the affected computer from infected files in the folder. When you exclude a threat category, Symantec AntiVirus cannot protect the affected computer from threats that are included in the category. See Configuring inclusions and exclusions on page 121 of the Symantec AntiVirus Administrator's Guide.
--------------------------------------------------------------------------------
 
Display a warning message on infected computers.
Exclude files and folders from the scan. (Not available for multiple clients or servers.)
Set throttling options. (Setting CPU utilization)
Click Advanced.
In the Scan Advanced Options dialog box, you can:
Set options for scanning compressed files.
Back up files infected by viruses or blended threats before attempting to repair them as a data safety precaution. The files are encrypted before Symantec AntiVirus backs them up. The files get backed up to the Quarantine directory. Once the file is backed up, it must be restored before it can be accessed again. Symantec AntiVirus does not back up threats other than viruses and blended threats; for example, Symantec AntiVirus does not back up spyware or adware files.
Determine whether a progress dialog box appears on the computer while the scan runs. You can configure the progress dialog box to close automatically when the scan has completed. You can also display or hide a Stop button on the remote computer. When this option is disabled, the scan cannot be stopped from the remote computer.
0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 22763035
Not sure.. I saw it when trying to set the scan localy but dont see it in the admin options..
0
 
LVL 20

Expert Comment

by:jimmymcp02
ID: 22763051
you mean this setting?(see attachment)
then open ssc then right click on the server the go to all task->symantec Anti-virus->scheduled scans->choose edit then click on advance.
That were the setting is located

also have you double check how roll out are set up

open ssc and right click on the parent server then go to all task->symantec Anti-virus->server tunning options and make sure you dont have start roll out to something like every 5 minutes that will slow your system down.
Mine is set to 480 minutes
scheduledscan.JPG
0
 

Author Comment

by:BryceRichert
ID: 22763061
Perfect. How long does it take the clients to get the new schedule from the server for knowing to "not" scan? How does propogation work here?
0
 
LVL 20

Expert Comment

by:jimmymcp02
ID: 22763121
well that depends how often you clients check in for updates. you can force the change by update virus definitions now but if a client is off line it will pick up the setting next time it checks in. Also keep in mind that it will force to update all of your clients at the same time which will cause a network slow down.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

As more computers now shipped with 64-bit version of Windows, more users are now using this Operating System.  So it's important to be aware how some 32-bit diagnostic tool works on these systems, so we know what to expect when analyzing the logs an…
PREFACE The purpose of this guide is to explain what the SEPC Status Utility is and how it works. I have written the utility using AutoIt and have included the source code for your review. You are welcome to modify the code to your liking, but I wi…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now