System drive on Terminal Server fills up with TMP files during a scan

Products

• Endpoint Protection

Issue/Introduction

With Endpoint Protection installed on a Terminal Server with a large ammount of user profiles when a scheduled or on-deman scan runs, a large ammount of TMP files are created in the directory "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt".  This can result in the system drive running out of disk space during a scan if there is not enough room on disk for the TMP files.  In normal operation if there is enough room on disk to support the scan, the files are cleaned up after the scan completes.

Environment

• Terminal Services
• Citrix servers
• Many user profiles

Cause

Endpoint Protection will create a copy of the users' registry profiles during a scan to reduce I/O for performance improvements.  After the scan completes these files are normally deleted.  If there is not enough free disk space to support a copy of all the user profiles during the scan the system disk can run out of disk space and the .tmp files will not be deleted and the scan fails to complete and cleanup the .tmp files.

Resolution

This issue is fixed in the latest Virus and Spyware Protection definition updates November 14, 2016 and newer.  This will update the Eraser Engine to version 116.1.1.6.  Please ensure that the clients are using the latest virus definitions to fix this issue.