User logons taking 20 to 30 seconds longer on non-persistent VDI clients after upgrading to Endpoint Protection 14

Products

• Endpoint Protection

Issue/Introduction

After upgrading from Symantec Endpoint Protection (SEP) 12.1 to SEP 14 you may notice an increase to user logon times on non-persistent VDI clients.

Cause

SEP 14 Auto-Protect user mode scanning.

Resolution

This issue is by design.  When Auto-Protect (AP) scans in kernel mode (12.1 and earlier versions) it starts scanning PE files during boot up. With SEP 14 we have changed our virus scan logic to AP user mode.  This change was done to reduce kernel memory usage and provides greater system health. When AP scan is in user mode, it starts scanning PE files before logon and continues through logon. For non-persistent VDI clients every time the system boots up it starts a new OS and other 3rd party software/tools. SEP has to reload definitions, and AP scanning is triggered by new processes near user logon time. As a result, an increase in logon time is expected.