What is the nature of Symantec Endpoint Protection protection for USB flash drives?
Out of the below-mentioned types of scans in Symantec Endpoint Protection:
The File System Auto-Protect scan is the only type which would automatically scan a USB drive connected to the system. This type of scan, by default, would only run when a file is accessed or modified (scans the files when they are written, opened, moved, copied, or run).
This means that if any infections/threats present on the USB drive attempt to access or modify any of the content on the system, it would be detected. The detection mechanism within File System Auto-Protect ensures safety from threats present on the USB drives.
Symantec Endpoint Protection does not currently run an automatic System Scan on the contents of flash drives when they are first plugged in. A manual scan on the contents of an external drive can be initiated by right-clicking on the drive in My Computer and choosing Scan for Viruses.
About Auto-Protect Scans
About Administrator-defined Scans
About TruScan Proactive Threat Scans
Types of Scans in Symantec Endpoint Protection or Symantec Antivirus:
Several other scans like Email Auto-Protect Scans and Port Scans (POP3/SMTP) are also present but they could be covered under the above mentioned types.