I received an email about two weeks after several PCs on our network were swapped out. These Windows XP Pro systems were running a certain network application ( Mas90 version 4.0.5 ) very slowly. Printing was even slower. While looking over these systems, I discovered the
Symantec Corporate settings did not match the server.
After much frustration and vocabulary exercise, I discovered that the little padlock is the key to it all. While this setting noticeably locks the users out of the client configuration screen, it hides the fact that this setting is necessary to force clients to exclude files specified by the server.
Apparently, the lock mandates server settings are to be forced on the clients. Without this "lock down" setting active, the server suggests the exclusions to the clients and they can accept them if they feel like it. The end result is that everyone can have different settings without lockdown.
Yes, the document from Symantec did mention that little lock, but since I had no way of looking at the settings on each client, I didn't keep it locked. Big mistake! I did locate the registry keys that coincide with the exclusion settings and that's an easy place to verify the clients are configured correctly. I was able to check all clients' registry settings right from my desktop (logged on as a domain administrator).
These two registry locations are for excluded file and folder specifications. (extensions, network drives and folder paths):
HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Storages\Filesystem\RealTimeScan
"ExcludedExtensions"="SOA,M4T,M4L,LIB,DDF,DDE,DD"
HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\Storages\Filesystem\RealTimeScan\NoScanDir
"u:"=dword:00000001
Yes, these can be imported into the registry by a login script if your clients are unmanaged, but hey, why do you have Symantec Corporate if it's unmanaged ?!! (hehe .. just kidding)
This is the configuration article on Symantec's website along with the instructions for client configuration. They specifically say to click the lock, but if you don't think that's important, have fun trying to figure out why it doesn't work~!
Excluding specific drives and folders from Symantec AntiVirus scans
To set up Auto-Protect exclusions for Symantec AntiVirus clients by using Symantec System Center
- Right-click a server group, server, or client group, and then click All Tasks > Symantec AntiVirus > Client Auto-Protect Options (or Client Realtime Protection Options).
- Check Exclude selected files and folders and then click the lock icon so that it appears as locked.
- Click Exclusions.
- If you use Symantec AntiVirus 8.x, check Check for exclusions before scanning and then click the lock icon so that it appears as locked.
- Click Extensions, and follow the on-screen instructions.
Add the extensions without punctuation.
- Repeat the previous steps for as many extension exclusions as necessary, and then click OK.
- Click Folders, and follow the on-screen instructions.
- To exclude a drive, type the drive letter followed by a colon.
These are a few of the search phrases used in researching this issue:
symantec client file folder extension exclusions not taking from server group setting
symantec client file folder extension exclusions
symantec exclusions not propagating
symantec exclusions propagating
( Symantec Corporate Mas90 )
