Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

All the employees at my work shutdown their Windows 7 computers (iMacs running BootCamp) when they leave work. This ends up with people having MS Security Essentials say their computer is at risk, due to not having been scanned recently.

Is there a way to not have MS Security Essentials say this? I'd like to be able to scan their computers daily or weekly, but not interrupt their work by slowing down their computers with a scan.

share|improve this question
    
Did something change? Last time I looked Security Essentials is not licensed for business usage. You might want to look at AV software designed for business usage. –  Zoredache Sep 28 '12 at 18:25
5  
I wasn't aware of that, but I checked and we're fine under: b) Small Business. If you operate a small business, then you may install and use the software on up to ten (10) devices in your business. –  David Sep 28 '12 at 18:33
add comment

3 Answers

up vote 7 down vote accepted

Configure Security Essentials to scan the computer when you are confident that it will be on. In Security Essentials you can adjust the schedule by opening the program, going to the Settings tab, choose Scheduled Scan on the left, then adjust the parameters as necessary.

Screenshot of Microsoft Security Essentials "Settings" tab

Where I work the security team has configured our anti-virus program to start a quick scan at noon once a week and a full scan at noon once a month. Our security folks found that most users go to lunch at noon and merely lock their screens rather than shutdown or put their computers to sleep. Therefore, they settled on noon as a good time to start the scan. Depending on what your users do with their computers during lunch, you might want to consider setting the time to 12:00 PM.

A setting of Tuesday would be a good choice for the day. Mondays and Fridays are most often taken off for vacation to make long weekends. Choosing a scanning day other than those has a higher chance of running due to the user being in the office and the computer on.

With 10 devices or less you should be able to easily determine if it's better to schedule a quick scan or full scan. A quick scan completed on my laptop in two minutes, but I know a full scan takes more than an hour. You can also set the percentage of CPU that the scan will use so that the scan doesn't adversely impact the user's computer usage.

Some experimentation will help you figure out what works best for your users while still meeting the requirements of your security policy.


Edit:

Here's another alternative. It's possible to start a scan using the command line. For example, the following command will start the default scan as configured in the GUI.

"c:\Program Files\Microsoft Security Client\MpCmdRun.exe" -scan

You could create a scheduled task to run a scan at an appropriate interval. When editing the scheduled task, go to the Settings tab and check the box for "Run task as soon as possible after a scheduled start is missed". I've outlined this option in red in the screenshot below. This will ensure that the scan runs the next time the user boots up the computer.

You can also use this method to perform different scans at different intervals. For example, if you have the GUI configured to perform a quick scan once a week, then you can create a scheduled task to execute the following command to run a full scan once a month:

"c:\Program Files\Microsoft Security Client\MpCmdRun.exe" -scan -scantype 2

Screenshot of Create Task window with the Settings tab selected.

share|improve this answer
1  
Ooh, didn't know about the CPU usage limit part. That's really useful, thanks! –  David Sep 28 '12 at 19:02
add comment

Send a Wake-on-LAN a few minutes before the scheduled scan time.

share|improve this answer
add comment

Just as an aside to the other answers, since your network is so small you could use Wake On LAN to power the computers up an hour or two before people arrive at the office (assuming these are workstations and not laptops that people take home) and run the scan, with the added bonus that their machines will be ready to go as soon as they arrive :-)

EDIT: How did I miss Michael Hampton's answer?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.