Endpoint Protection

 View Only
  • 1.  Machines that have never been scanned

    Posted Jul 08, 2010 02:08 PM

    Is there a report / log that will me show me individual machines that have never had a scan run? Or even machines that have not scanned in over 2 weeks, 1 month, 3 months?


  • 2.  RE: Machines that have never been scanned

    Posted Jul 08, 2010 02:11 PM
    you should be able to see that under
    monitors- logs - scan
    advanced optioin...is there a event you can select?


  • 3.  RE: Machines that have never been scanned

    Posted Jul 08, 2010 02:19 PM
    I can only select:

    All
    Completed
    Canceled
    Started


  • 4.  RE: Machines that have never been scanned
    Best Answer

    Posted Jul 08, 2010 02:27 PM

    Hello Brain,
    You can take this in reports > Scan > Computers Not Scanned.

    Best Regards.
    Fatih



  • 5.  RE: Machines that have never been scanned

    Posted Jul 08, 2010 02:29 PM
    Just what I needed. Thank you.


  • 6.  RE: Machines that have never been scanned

    Posted Jul 08, 2010 02:30 PM

    There is a way to somewhat perform what you are wanting to see.

    If you open the Reports page within the SEPM and select Report Type: Scan you can select a report for Computers Not Scanned and then select an appropriate time range.

    Also, if you open the Monitors page in the SEPM and select the Logs tab on the right then select Log Type: Computer Status and expand the Advanced Options. Under Advanced Options on the lower left you will see "Last scan time older than:". Clicking the drop-down menu will allow you to specify a time range for the last scan. Once the report is open you can scroll to the right and locate the Last Scan column. Clicking on the header of the column will allow you to sort by scan date. You could then locate any systems that have a Last Scan of Never or any systems that have not scanned for a longer period of time than you desire.

    In addition to being able to locate the systems you may also select specific clients and run a command on them from the drop-down menu on the upper left, such as forcing clients to run a system scan.

    You can also locate clients last scan time from the Clients page by selecting Protection technology from the View drop-down menu and as with the report you may click on the Last Scan header and organize by last scan date/time.

    From the Monitors>Logs you can also select Scan for Log type as mentioned above and under Advanced Options you can choose a scan status, i.e. whether a scan was completed, canceled, or started to filter the results if you're looking specifically for this information.

    Also I'd advise putting an enhancement request at the following URL: https://www-secure.symantec.com/connect/security/ideas?product=1403

    This report functionality should be able to be included into a future build of the SEP product to allow searching logs specifically for systems that have never scanned.


    Let us know if this helps out or not.

    Regards,



  • 7.  RE: Machines that have never been scanned

    Posted Jul 08, 2010 02:39 PM

    Thanks Kurt, very helpful info!


  • 8.  RE: Machines that have never been scanned

    Posted Jul 08, 2010 05:42 PM
    Your Welcome :)
    This is good to heard to help people :)

    Best Regards.
    Fatih