You need more details about the Options in the Policies of the Symantec Endpoint Protection Manager (SEPM)
Antivirus and Antispyware Policy
You can use the Scans tab to add a scheduled scan to an Antivirus and Antispyware Policy or to specify settings for on-demand scans. Administrators define scheduled scans to run on client computers at configurable intervals. Administrators can predefine a specific set of scan settings for running on-demand scans on clients from the management console. On-demand scans are manual scans run on a client at the administrator's request.
Table 1: Scheduled scan options
Option | Description |
Add | Specifies to add a new scheduled scan to this policy |
Edit | Specifies an existing scheduled scan that you want to change |
Delete | Specifies an existing scheduled scan that you want to delete |
Table 2: On-demand scan options
Option | Description |
Edit | Specifies that you want to change the on-demand scan settings |
Use this tab to set options for scheduled, startup and triggered scans, and for users on the computers that run these scans.
Table 3: Scheduled scan advanced options
Option | Description |
Delay scheduled scans when running on batteries | Specifies that scheduled scans be delayed when a computer is running on batteries
This option is enabled by default. You can disable this option to allow scheduled scans to run as scheduled, even when a computer is running on batteries. |
Allow user-defined scheduled scans to run when the scan author is not logged on | Specifies that user-defined scheduled scans run as scheduled when the scan author is not logged on
By default, user-defined scheduled scans always run at the scheduled time. This option can be particularly useful in the case of unmanaged client computers that do not use administrator-defined scheduled scans. You can disable this option to prevent user-defined scheduled scans from running when the user who created the scan is not logged on. You may want to disable this option for multiuser computers. Note! If this option is enabled and the user is logged off when the scan begins, the scan progress dialog box does not display. You can check scan status in this instance by looking in the System log. On multiuser workstations, when this option is enabled, scan progress is displayed as follows:
Users who are not logged in when their scan runs must look at the Scan Log to see the scan results. |
Table 4: Startup and triggered scan advanced options
Option | Description |
Run startup scans when users log on | Specifies that startup scans run when a user logs in
You can disable startup scans on a global basis only. If you disable this option, you disable all startup scans, including any custom startup scans that users have configured. |
Allow users to modify startup scans | Determines whether users can modify startup scans
This option is enabled by default. This option is only available when the Run startup scans when users logs on parameter is enabled. |
Run an Active Scan when new definitions arrive | Starts an Active Scan when new definitions arrive to check for any risks that the new definitions can detect.
By default, an Active Scan is run when new definitions arrive. If you disable this option, you weaken the protection available to your client computers. You should only disable this option if you have special configuration or exclusion needs that conflict with this automatically triggered scan. This option is enabled by default. |
Table 5: Advanced user options
Option | Description |
Scan progress | Specifies what users see on their computers when a scan is running
Select one of the following:
|
Close the scan progress window when done | Specifies that the scan progress window closes automatically when the scan is finished
This option becomes available when you select Show Scan progress. |
Allow the user to stop the scan | Allows users to stop scans that start on their computers
This option becomes available when you select Show Scan progress. |
Allow the user to pause or delay a scan | Allow users to pause or snooze the scans that start on their computers
This option to delay a scan becomes available when you select Show Scan progress. |
Use the Scan Details tab to configure scanning and drive type options for Auto-Protect scans of files and processes.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Use centralized exceptions to specify exclusions for files or directories.
Table 6: Auto-Protect scan detail options
Option name | Description |
Enable File System Auto-Protect | Enables or disables Auto-Protect
By default, Auto-Protect is enabled. |
File types | You can scan all file types or only files with selected extensions.
The following options are available:
|
Extensions | Specifies that only certain file extensions should be included in the scan
You can add or remove file extensions to scan. Only the file extensions that you specify are scanned. The client does not scan any files that have extensions that are not in the list. Note! If you want to exclude files or directories from scans, create a centralized exception. The exception applies to all antivirus and antispyware scans that you run. |
Additional options | Additional options include the following:
|
Network Settings | Network settings provides the following options:
|
You can configure action and remediation options for scans.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 7: Action options
Detection type | Action options |
Macro virus
Non-macro virus |
You can configure a first action to take and a second action to take if the first action fails.
Actions for viruses include the following:
|
Security risks
|
You can configure security risk actions as follows:
|
Table 8: Remediation options
Option | Description |
Back up the file before attempting to repair | Backs up the infected file before repairing it
By default, this option is enabled. The original virus-infected file is encrypted and then copied into the Quarantine directory. If you need, you can use this unrepaired backup file to return the file to its original, but infected state. Note! If you disable this option, files that contain viruses are not backed up before repairs are tried. This setting applies only to virus-infected files. For security risks, if the action you have configured is Delete risk, no backup files are created. If the action that you configure is Quarantine risk, the security risk files are always backed up, regardless of this setting. |
Terminate processes automatically | Enables or disables notifications on infected computers when the client must terminate a process to remove or repair a risk.
If this option is enabled, the client automatically takes the necessary action without notifying users. Note! Users are always notified when a restart is required. They are allowed to save data and close open applications or to opt out of the restart. |
Stop services automatically | Enables or disables notifications on infected computers when the client must stop a service to remove or repair a risk
If this option is enabled, the client automatically takes the necessary action without notifying users. Note! Users are always notified when a restart is required. They are allowed to save data and close open applications or to opt out of the restart. |
You can set notification options for File System Auto-Protect.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 9: Notification options
Option | Description |
Display a notification message on the infected computer | Enables or disables displaying notifications on infected computers when Auto-Protect finds a virus or a security risk
You can modify the type of information that you want to appear in the notification . |
Display the Auto-Protect results dialog on the infected computer | Enables or disables displaying results on infected computers |
Table 10: Notification message fields
Field | Description |
SecurityRiskName | The name of the virus or security risk that was found. |
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured. |
Status | The state of the file: Infected, Not Infected, or Deleted.
This message variable is not used by default. To display this information, manually add this variable to the message. |
Filename | The name of the file that the virus or the security risk has infected. |
PathAndFilename | The complete path and name of the file that the virus or the security risk has infected. |
Location | The drive on the computer on which the virus or security risk was located. |
Computer | The name of the computer on which the virus or security risk was found. |
User | The name of the user who was logged on when the virus or security risk occurred. |
Event | The type of event, such as "Risk Found." |
LoggedBy | The type of scan, on-demand, scheduled, and so on, that detected the virus or security risk. |
DateFound | The date on which the virus or security risk was found. |
StorageName | The affected area of the application, for example, File System Auto-Protect or Lotus Notes Auto-Protect. |
ActionDescription | A full description of the actions that were taken in response to detecting the virus or security risk. |
You can configure advanced options for File System Auto-Protect.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 11: Advanced options for File System Auto-Protect
Option | Description |
Startup and Shutdown | The following options are available:
|
Auto-Protect Reloading and Enablement | The following options are available:
|
Additional Options | Sets the options for the file cache and Risk Tracer |
You can configure details for Auto-Protect scans of Internet email.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Use centralized exceptions to specify exclusions for files or directories.
Table 12: Scan Details options
Option | Description |
Enable Internet Email Auto-Protect | Enables or disables Auto-Protect for Internet email. |
File types | Scans all file types or only files with selected extensions.
The following options are available:
|
Selected Extensions | Specifies that only certain file extensions should be included in the scan
You can add or remove file extensions to scan. Only the file extensions that you specify are scanned. Auto-Protect does not scan files with unlisted extensions. Note! If you want to exclude files or directories from scans, create a centralized exception. The exception applies to all antivirus and antispyware scans that you run. |
Compressed files | Specifies whether or not to scan files inside compressed files and how many levels to include
The following options are available:
These types of compressed files may be included in virus scans:
|
You can configure action and remediation options for Auto-Protect scans of Internet email, Microsoft Exchange, or Lotus Notes.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 13: Action options
Detection type | Action options |
Macro virus
Non-macro virus |
You can configure a first action to take and a second action to take if the first action fails.
Actions for viruses include the following:
|
Security risks
|
You can configure the following security risk actions:
|
You can configure notifications options for Auto-Protect scans of Internet email. You can configure the information that you want to include in notifications and whether or not progress indicators are available on client computers.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 14: Notifications options
Option | Description |
Notifications | Enables or disables the display of notification messages on infected computers
The following option is available:
|
Email Notifications | Enables or disable the notifications about infected email
The following options are available:
|
Progress Notifications | Enables or disables the display of a progress message and an icon on client computers during email scans
The following options are available:
|
Table 15: Notification message fields
Field | Description |
SecurityRiskName | The name of the virus or security risk that was found. |
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured. |
Status | The state of the file: Infected, Not Infected, or Deleted.
This message variable is not used by default. To display this information, manually add this variable to the message. |
Filename | The name of the file that the virus or the security risk has infected. |
PathAndFilename | The complete path and name of the file that the virus or the security risk has infected. |
Location | The drive on the computer on which the virus or security risk was located. |
Computer | The name of the computer on which the virus or security risk was found. |
User | The name of the user who was logged on when the virus or security risk occurred. |
Event | The type of event, such as "Risk Found." |
LoggedBy | The type of scan that detected the virus or security risk. |
DateFound | The date on which the virus or security risk was found. |
StorageName | The affected area of the application, for example, File System Auto-Protect or Lotus Notes Auto-Protect. |
ActionDescription | A full description of the actions that were taken in response to detecting the virus or security risk. |
You can configure connection settings for Auto-Protect scans of Internet email.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 16: Advanced options for Auto-Protect scans of Internet email
Option | Description |
Connection Settings | The following options are available:
|
Encrypted Connections | The following options are available:
|
Mass Mailing Worm Heuristics | The following options are available:
|
You can configure details for Auto-Protect scans of Microsoft Exchange email clients.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Use centralized exceptions to specify exclusions for files or directories.
Table 17: Scan Details options
Option | Description |
Enable Auto-Protect for Microsoft Exchange | Enables or disables Auto-Protect for Microsoft Exchange email clients |
File types | Scans all file types or only files with selected extensions.
The following options are available:
|
Selected Extensions | Specifies that only certain file extensions should be included in the scan
You can add or remove file extensions to scan. Only the file extensions that you specify are scanned. Auto-Protect does not scan files with unlisted extensions. Note! If you want to exclude files or directories from scans, create a centralized exception. The exception applies to all antivirus and antispyware scans that you run. |
Compressed files | Specifies whether or not to scan files inside compressed files and how many levels to include
The following options are available:
These types of compressed files may be included in virus scans:
|
You can configure action and remediation options for Auto-Protect scans of Internet email, Microsoft Exchange, or Lotus Notes.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 18: Action options
Detection type | Action options |
Macro virus
Non-macro virus |
You can configure a first action to take and a second action to take if the first action fails.
Actions for viruses include the following:
|
Security risks
|
You can configure the following security risk actions:
|
You can configure notifications options for Auto-Protect scans of Microsoft Outlook or Lotus Notes. You can configure the information that should appear in notifications.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 19: Notifications options
Group: Option | Description |
Notifications | Display a notification message on the infected computer
Enables or disables the display of a notification message on an infected computer when Auto-Protect finds a security risk. When this option is enabled, you can modify the type of information that you want to appear on the affected computer. |
Email Notifications | The following options are available:
|
Table 20: Message variables
Field | Description |
SecurityRiskName | The name of the virus or security risk that was found. |
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured. |
Status | The state of the file: Infected, Not Infected, or Deleted.
This message variable is not used by default. To display this information, manually add this variable to the message. |
Filename | The name of the file that the virus or the security risk has infected. |
PathAndFilename | The complete path and name of the file that the virus or the security risk has infected. |
Location | The drive on the computer on which the virus or security risk was located. |
Computer | The name of the computer on which the virus or security risk was found. |
User | The name of the user who was logged on when the virus or security risk occurred. |
Event | The type of event, such as "Risk Found." |
LoggedBy | The type of scan that detected the virus or security risk. |
DateFound | The date on which the virus or security risk was found. |
StorageName | The affected area of the application, for example, File System Auto-Protect or Lotus Notes Auto-Protect. |
ActionDescription | A full description of the actions that were taken in response to detecting the virus or security risk. |
You can configure details for Auto-Protect scans of Lotus Notes email.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Use centralized exceptions to specify exclusions for files or directories.
Table 21: Scan Details options
Option | Description |
Enable Lotus Notes Auto-Protect | Enables or disables Auto-Protect for Lotus Notes |
File types | Scans all file types or only files with selected extensions.
The following options are available:
|
Selected Extensions | Specifies that only certain file extensions should be included in the scan
You can add or remove file extensions to scan. Only the file extensions that you specify are scanned. Auto-Protect does not scan files with unlisted extensions. Note! If you want to exclude files or directories from scans, create a centralized exception. The exception applies to all antivirus and antispyware scans that you run. |
Compressed files | Specifies whether or not to scan files inside compressed files and how many levels to include
The following options are available:
These types of compressed files may be included in virus scans:
|
You can configure action and remediation options for Auto-Protect scans of Internet email, Microsoft Exchange, or Lotus Notes.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 22: Action options
Detection type | Action options |
Macro virus
Non-macro virus |
You can configure a first action to take and a second action to take if the first action fails.
Actions for viruses include the following:
|
Security risks
|
You can configure the following security risk actions:
|
You can configure notifications options for Auto-Protect scans of Microsoft Outlook or Lotus Notes. You can configure the information that should appear in notifications.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 22: Notifications options
Group: Option | Description |
Notifications | Display a notification message on the infected computer
Enables or disables the display of a notification message on an infected computer when Auto-Protect finds a security risk. When this option is enabled, you can modify the type of information that you want to appear on the affected computer. |
Email Notifications | The following options are available:
|
Table 24: Message variables
Field | Description |
SecurityRiskName | The name of the virus or security risk that was found. |
ActionTaken | The action that was taken in response to detecting the virus or security risk. This action can be either the first action or second action that was configured. |
Status | The state of the file: Infected, Not Infected, or Deleted.
This message variable is not used by default. To display this information, manually add this variable to the message. |
Filename | The name of the file that the virus or the security risk has infected. |
PathAndFilename | The complete path and name of the file that the virus or the security risk has infected. |
Location | The drive on the computer on which the virus or security risk was located. |
Computer | The name of the computer on which the virus or security risk was found. |
User | The name of the user who was logged on when the virus or security risk occurred. |
Event | The type of event, such as "Risk Found." |
LoggedBy | The type of scan that detected the virus or security risk. |
DateFound | The date on which the virus or security risk was found. |
StorageName | The affected area of the application, for example, File System Auto-Protect or Lotus Notes Auto-Protect. |
ActionDescription | A full description of the actions that were taken in response to detecting the virus or security risk. |
You can configure what types of risks proactive threat scans detect. You can also configure what actions the client takes when proactive threat scans detect the commercial applications. Commercial applications are keylogger and the remote control applications that could be used for malicious purposes.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Both the Scan for trojans and worms and the Scan for keyloggers options must be enabled for client computers to show a Proactive Threat Protection status of On.
Table 25: Scan details options
Option | Description |
Scan for trojans and worms | Not supported on the client computers that run Windows server operating systems or Windows XP 64-bit operating systems
Specifies whether or not proactive threat scans detect processes that behave like Trojan horses and worms (default is enabled) When this option is enabled, the following options are available:
|
Scan for keyloggers | Not supported on the client computers that run Windows server operating systems or Windows XP 64-bit operating systems
Specifies whether or not proactive threat scans detect processes that behave like key loggers (default is enabled) When this option is enabled, the following options are available:
|
Detecting Commercial Applications | Specifies the type of action that the client takes when proactive threat scans detect certain types of commercial applications (default is Log)
The following options are available:
You can specify the type of action taken: Log, Quarantine, Terminate, or Ignore. |
Table 26: Actions for proactive threat scan detections
Option | Description |
Log | Logs the detection and leaves the process alone
If notifications are enabled, the user can right-click the name of the risk, and select one of the following actions: Terminate or Move To Quarantine. Note! If Use defaults defined by Symantec is enabled, detections with this action only appear in a notification message if the scan engine recommends remediating the risk. The user can also use the entry in the proactive threat log to specify the type of remediation action to take on each individual detection. |
Quarantine | Tries to move any of the files associated with the process to the Quarantine on the infected computer
The client removes or repairs any side effects of the process. The repairs might include any of the following:
Users can use the proactive threat log or the notification message to restore quarantined items. If you restore a process, the process does not automatically restart. You must manually restart it. |
Terminate | Tries to terminate the process
Use this action with caution, because in some cases, terminating processes can cause applications to lose functionality. If the client cannot terminate a process, detailed information about the termination attempt appears in the notification message and the proactive threat log. Users can use the proactive threat log or the notification message to move terminated items to the Quarantine. |
Ignore | Ignores the process
This action is only available for commercial application detections. When the client applies this action, it does not log the detection. |
You can configure whether or not notifications should appear on client computers to show the results of proactive threat scans.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 27: TruScan notifications options
Option | Description |
Display a message when there is a detection | Displays the results on a client computer when a proactive threat scan makes a detection (default is enabled)
When the detections dialog box appears on the client computer, the user can specify additional remediation actions for the detections. |
Prompt before terminating a process | Prompts the user before the client terminates a process that a proactive threat scan detects (default is enabled)
When the prompt appears on the client computer, the user can decide to terminate the process or not. |
Prompt before stopping a service | Prompts the user before the client stops a service that a proactive threat scan detects (default is enabled)
When the prompt appears on the client computer, the user can decide to stop the process or not. |
You can configure how often the proactive threat scan should run.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 28: Proactive threat scan frequency options
Option | Description |
At the default scanning frequency | Runs the proactive threat scans on a Symantec-determined frequency (1 hour)
By default, this option is enabled. |
At a custom scanning frequency | Runs the proactive threat scans immediately or on a manually set frequency
When this option is enabled, the following options are available:
|
You can use this tab to set the options for the local Quarantine.
Table 29: Quarantine options
Option | Description |
When New Virus Definitions Arrive | Specifies what happens when a computer receives new virus and security risk definitions
Select one of the following options:
|
Local Quarantine Options | Specifies the folder where files are quarantined
You can select the default folder or browse to any other folder that you want to use. |
You can use this option to enable the automatic deletion of repaired, backup, and quarantined files from the computer. You can delete the files based on file age, folder size, or both. If you set both types of limits, then all files older than the time you have set are deleted first. If the size of the folder still exceeds the limit, then the oldest files are deleted until the folder size falls below the limit. By default, these options are enabled.
Table 30: Clean-up options
Option | Description |
Enable automatic deleting of <repaired files | backup files | quarantined files that could not be repaired> | Enables the automatic deletion of any files that cannot be repaired |
Delete after | Specifies the number of days to keep the files
The maximum is 30 days. |
Delete oldest files to fit folder size limit (MB) | Specifies the maximum size the directory can reach
The default is 50 MB. |
You can configure whether or not client computers submit information to Symantec Security Response and how quarantined items are submitted to Symantec Security Response.
Note! You can lock or unlock an option that includes the padlock icon next to it. When you lock an option, users on client computers cannot change the option.
Table 31: Submissions options
Option | Description |
TruScan Proactive Threat Scans | The following options are available:
|
Detection Rates | The following options are available:
|
Quarantined Items | The following options are available:
|
You can use this tab to set miscellaneous Antivirus and Antispyware Policy options.
Table 32: Antivirus and Antispyware Policy miscellaneous options
Option | Description |
Disable Windows Security Center | Specifies whether to use Windows Security Center (WSC) on the clients
Select one of the following:
Note! Symantec product status is always available in Symantec Endpoint Protection, regardless of whether WSC is enabled or disabled. |
Display antivirus alerts within Windows Security Center | Specifies when WSC displays antivirus alerts
Select one of the following:
|
Display Windows Security Center message when definitions are outdated. Warn after | Set the time period after which WSC considers definitions files to be out of date and displays a message about it.
Specifies the number of days that definitions are allowed to be out of date. The value must be in the range from 1 to 30. The default value is 29 days. The client checks every 15 minutes to compare the out-of-date time, the date of the definitions, and the current date. Typically, no out-of-date status is reported to WSC because definitions are usually updated automatically. If you update definitions manually, you might wait up to 15 minutes to view an accurate status. |
Internet Browser Protection | Specifies a URL to use as the home page when a security risk hijacks a client computer's home page
The client uses this URL when it repairs the risk. You can click the lock icon to prevent users from changing the home page to be used when repairing side effects after a browser hijacking. |
Ask for a password before scanning a mapped network drive | Specifies whether or not clients prompt users for a password when the client scans network drives
The default password is symantec. You can change the password by clicking Change Password and setting the password. |
You can use this tab to set the options that are related to antivirus logs.
Table 33: Antivirus log handling options
Options | Description |
Show | Specifies the category of events you want to display
The following possibilities are included:
|
Delete logs older than | Specifies the number of days you want to keep antivirus-related events in the logs.
The option does not affect any events that the clients send to the management console. You can use the option to reduce the actual log size on the client computers. |
Send aggregated events every | Specifies the number of minutes that should pass before clients send aggregated events to the System log for antivirus-related events
Antivirus-related events are aggregated before they are sent to the event log to keep the number of events manageable. After the events are sent, aggregation starts again. |
You can configure notifications to appear on client computers when virus definitions are out-of-date or missing. You can also determine the URL and text to include in the error messages that appear on client computers.
Table 34: General notification options
Option | Description |
Display warning when definitions are outdated | Displays a message on client computers when definitions are out-of-date
You can specify the number of days. The notification message appears when definitions are out of date by more than the specified number of days. |
Display warning when Symantec Endpoint Protection is running without virus definitions | Displays a message on client computers when the Symantec Endpoint Protection client is running without definitions
You can specify the number of attempts to update definitions, and then customize the warning message that appears on the client computer. |
Display error messages with a URL to a solution | Enables or disables the error messages that appear on client computers and in the System log
The error messages appear when users encounter the errors that are related to the system, licensing, installation, and Antivirus and Antispyware Protection. In client control mode, error messages do not appear. You can include the following types of URLs (uniform resource locations) in the error messages:
|
Custom Error Message | Opens a dialog box in which you can edit the default error message that appears on client computers and in the System log |