How to delay the initial Host Integrity Check

Products

• Network Access Control

Issue/Introduction

You need delay the Host Integrity Check after the computer starts.

Resolution

Initial Host Integrity check can be controled with DWORD registry "Initial_HI_Delay".

Before making any changes to the registry, Symantec recommends that you backup each affected system's registry before making any changes.

1. Open the registry with Regedit and navigate to the following key:
   "HKEY_Local_Machine\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC"
2. Add the following String Value:
   DWORD: Initial_HI_Delay

The default value is: 1. The value is in minutes.

If Tamper protection is enabled on SEP12.1 with SNAC feature enabled, adding registry key under symantec will be blocked by Tamper Protection. You need to disable Tamper Protection before changing the registry keys.

Note: The maximum "Initial_HI_Delay" value is equal to the HI check interval  which is configured in [Check Host Integrity every] in HI policy of SEPM. If the "Initial_HI_Delay" value is bigger than the HI check interval, it will only delay for about HI check interval.