Missed Schedule Scan

[spnkzss]

I've setup a Daily Threat Scan and told it to scan every night at 11:30pm for all Groups.  If the machine is off during that time, it does not scan.  How do I set it up to scan at next time it starts?

[djacobson]

Hi @spnkzss, there is no recover if missed by settings for the endpoint protection version scans at this time. You will need to change the schedule to have the scans run when you know the computers will be on. To reduce user impact, make sure your policies are set to run the scan at a low priority.

[kahml]

Please consider adding that requirement as an enhancement request.

Not every site has users that have consistent hours...

[spnkzss]

I agree.  Especially my laptops of field guys that work random times and sometimes don't see internet for days.  These are the ones I want scanned the most as they are the most likely to get something.

I thought a good work around for this would be to schedule a task, but the task expires at 3 days.  I would really like the option to change that expire time to never for those special occasions.  ESPECIALLY on a delete quarantine.  There is no reason to have a 3 day expire on that.  That needs to happen as soon as the machine is seen again.  Even if that's a month down the road.

Rob

[djacobson]

You can instead split the remote machines off to their own group and policy then create alternate scan schedules that include these other remote machines on other groups/policies.

[spnkzss]

13 hours ago, djacobson said:

You can instead split the remote machines off to their own group and policy then create alternate scan schedules that include these other remote machines on other groups/policies.

I'm confused by the statement.  They already are in their own group just in case I can do something special, but I can't create a scan schedule for something that is only online occasionally at random times.

[djacobson]

The machines only need to be online once to receive the scheduled scan you create in your cloud settings. You can create as many schedules, and assign whichever groups to them as you need, to ensure your scans will happen at a time when the roaming machines are on.

[spnkzss]

That makes more sense, except my problem is they are technicians and they don't have a set schedule on when those PCs are even turned on.  It's not just about being connected to the internet.

[djacobson]

That'll mean creating a variety of possible schedules as mentioned before to ensure at least one is picked up and ran when the machine is on, or go full manual and send those machines an on-demand scan when they do show as online from the portal. These two paths are your only recourse until the cloud has reached its final form through iterative release updates.

[IT_Guy]

18 hours ago, djacobson said:

That'll mean creating a variety of possible schedules as mentioned before to ensure at least one is picked up and ran when the machine is on, or go full manual and send those machines an on-demand scan when they do show as online from the portal. These two paths are your only recourse until the cloud has reached its final form through iterative release updates.

So your solution is that rather than add the feature to scan on next connection, that we administrators should just make up a schedule for every possible minute of the day that our users might connect? And you're charging for this software? Can we fix your RansomWare memory leak too? I feel like I might have paid too much for the level of confidence this software is inspiring.

Nothing like taking a whole day just to create schedules for broken software...

[djacobson]

On 10/4/2017 at 5:58 AM, IT_Guy said:

So your solution is that rather than add the feature to scan on next connection, that we administrators should just make up a schedule for every possible minute of the day that our users might connect?

I did not say that you needed to go to that sort of extreme, a scan every minute of the day, nor did I say we would never add that as a feature. I was giving solutions for "right now", to get around the current limitations, and work with what does exist in the here and now. You quoted my post, yet I feel like you may have glossed over the entire point, the info there in that last sentence...

On 10/3/2017 at 11:04 AM, djacobson said:

These two paths are your only recourse until the cloud has reached its final form through iterative release updates.

There are many features planned and in store for you guys, with a target culmination of Q1 in 2018. I know you guys have had patience, thank you for that, but we all still need to hang tight. We welcome constructive feedback around what you want to see and be able to do in the cloud console, and those of us in support will do our best to help get your voices heard and steer the product towards that.