The Endpoint Protection client Defwatch scan time is taking too long and using too many resources

Products

• Endpoint Protection

Issue/Introduction

Defwatch scan are taking too long to complete and using too many resources.

Symantec Endpoint Protection (SEP)

Cause

Examination of the Symantec Endpoint Protection (SEP) Client AV.Log shows two (2) Defwatch scans occurring at the same time.

Both 32bit and 64bit SEP drivers are loaded.
A previous Windows 2003 32bit server was upgraded to a Windows 2008 R2 64bit server. The upgrade of SEP from 32bit to 64bit did not successfully remove all the 32bit SEP version.

 

Resolution

Remove SEP with Windows Programs and Features and reinstall the correct version.