EDR flags a self-deleting scheduled task when running SESC client offline packager

Products

• Endpoint Security
• Endpoint Security Complete
• Endpoint Security for Servers

Issue/Introduction

During the creation of a offline SESC client package using the SESC client packager tool,  your EDR logs a unknown scheduled task that is immediately self deleted.  You would like to know what this task was for and if it is normal. 

Environment

Server 2012, 2016, 2019, 2022
Windows-10 and Windows-11

Cause

Possible appearance of the scheduled task as seen in a third party vendors EDR log :
[ACCOUNT] – ###########
[HOSTNAME] - ##########
[IP ADDRESS] - ###.###.###.###
[TASK NAME] - \ Symantec_Agent_setup.exe
[NAME OF THE SCHEDULED JOB] - \ Symantec_Agent_setup.exe
[FILE LOCATION OF SCHEDULED JOB] - C:\ProgramData\Symantec\FSD\bin\Symantec_Agent_setup.exe
[DATE OCCURED] – ####### ###, 2024

Resolution

The offline packager for SESC when creating a local install package is reusing a component that is also used to install the SESC client,  in this reuse of the module that module creates a scheduled task to trigger the install of the SESC client at a later time.

When using the offline SESC packager to build a local package however the task is not needed and it is deleted immediately by the packer app to prevent the install action by the scheduled task. 

This is normal and as designed, no action is needed.