When logging into a Windows the following notification may appear.
"Symantec Endpoint Protection detected Risks while you were logged out. You may need to open the AntiVirus and Antispyware Protection Risk Log to view and take action on the risks."
When you see the pop-up, you should check Endpoint Protection logs to determine if AutoProtect or a scheduled scan detected threats while the user was logged off, and take action as necessary. Note: You must do this under an Administrative user account in order to see all logs. Administrative or System scan results, for example, will not be visible to limited users. If there are no threats logged, then the pop-up was caused by the DefWatch Wizard scan after a definition update.
To disable the DefWatch Wizard scan
If you want to leave this pop-up enabled, but prevent its display after definitions have been updated when no one is logged on, disabled the DefWatch Wizard's scan of items in quarantine. This can be done by editing the policy in the Endpoint Protection Manager: Antivirus and Antispyware policy->Quarantine settings, and set "When New Virus Definitions Arrive" to "Do nothing." On SEP Small Business Edition, or on unmanaged clients, this setting is not available in the GUI and you must set the following registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Quarantine\DefWatchMode=3 (REG_DWORD).
DefWatchMode
value action
0 Automatically repair and restore files in Quarantine silently
1 Repair the files in Quarantine silently without restoring
2 Prompt user
3 Do nothing
To disable the pop-up entirely
1. Managed clients can be configured by using the checkbox in Endpoint Protection Manager policy: Antivirus and AntiSpyware policy->Administrator-Defined Scans ->Advanced, uncheck the checkbox "Display notifications about detections when the user logs on".
2. On Endpoint Protection Manager 14.x, the checkbox in Endpoint Protection Manager policy > Virus and Spyware Protection policy > Advanced Options > Global Scan Options, uncheck the checkbox "Display notifications about detections when the user logs on".