Symantec AV groups?

[bofhrevenge2]

Hi all, I am using Symantec AV corp 9 edition and am having a problem with setting options via groups.

I might not have understood properly but I assumed if I created some groups under my master server and then moved PC's into them then I could apply different settings. What I’m wanting to achieve is to turn off active scanning on a group of old PC's as it's killing them, I have moved them into another folder and told the group "not to inherit settings from server group" then turned off active scanning in this folder.
I have left it like this for a couple of days and the setting hasn't taken effect am I doing something wrong?

I am using a 2k3 server as the master and the PC's are 2k, the PC's are receiving updates ok so as far as I can tell everything else is fine.

Hope someone can point me in the right direction.


Thanks.

 

[yubman]

I've used groups for similar purposes. I have a group of clients that don't want to run the weekly scan.

After you move the clients into the groups have you tried the "reset all" button? You right click the group > all tasks > symantec antivirus > client real-time protection options > reset all (at the bottom).

I believe it re-creates the GRC.dat for that particullar group if I'm following Symantec's tech pages correctly. My first thought was that it would un-do any changes I made, but from what I've read, it refreshes the GRC.dat.

Hope that helps.

tony

 

[bofhrevenge2]

Ah no i hadn't seen that i'll try it when i get back to the office.

Thanks.

 

[bofhrevenge2]

Yep that worked cheers.

Don't suppose you have any idea how much load active scanning has on a file server, i was thinking of turning it off and running a nightly scan instead.

Thanks.

 

[yubman]

I don't know the percent load that real time virus scanning puts on a system persay, but RTVSCAN can eat up alot of CPU time if your file server gets alot of traffic. However, the more traffic a server gets, the more I want to protect the data from viruses and malicious software.

I did notice that on slower servers, and servers with only 1 processor, or little memory (less than 256mb) it did impact proformance, but not that work couldn't be done. I still stop the Symantec Client Service once in a while especially when I was backing up, or moving large amounts of data around (robocopy, etc) to speed things along.

The biggest problem I've seen and it's turned up for me in all versions of SAV (7.01, 7.61, 8.0, 8.11) that I've tried, is from time to time the RTVSCAN.EXE process would go to 99 or 100%, and the server would get really sluggish/non-responsive. The fix would be to stop and start the service, but half the time, it wouldn't respond leaving me no choice but to reboot the box. Thankfully it doesn't happen too often.

Also you can tweak the heuristics/sensitiviy of the scan process as some people have noted that can impact proformance.

Right click group/server > all tasks > symantec antivirus > client realtime protection options > advanced (button on right side near top) > heuristics (button on left bottom). Its set to default out of the box, but you can either turn down the sensitivity, or turn it up.

As long as your server's have enough memory and processor power, and your not taking on high speed data dumps, I'd leave it on for maximum protection.

yubman

 

[TamerEid]

Symantec Antivirus Corporate Update


Copy cescript.txt and cegetter.bat to c:\ drive of Norton server.

From start ? settings ? control panel ? scheduled task
Make 2 or 3 schedules to run cegetter.bat at different day time for example one to run at 6:00 am and one at 6pm. I do three.

File cescript.txt:

open ftp.symantec.com
anonymous
nobody@lowpricebazar.com
cd public/english_us_canada/antivirus_definitions/norton_antivirus/static
lcd C:bin
hash
prompt
get navup8.exe
quit


File cegetter.bat

ftp -s:cescript.txt
call "c:\navup8.exe"
move /y %systemdrive%\*.xdb "C:\Program Files\SAV"
del /q c:\navup8.exe

Tamer Eid
MCSE, CCNA
6 years as system admin