Every evening my computer annoyingly and automatically runs a Defwatch quickscan, I'm pretty sure after new definitions are loaded. I'd like to disable this. A while back I posted a question about this. At the time I had SEP 11, which I've now upgraded to 12.1.2015.2015, and I'm still having the same problem. The following suggestion was provided: 

You must set the following registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\Quarantine\DefWatchMode=3 (REG_DWORD).

DefWatchMode
value  action
0          Automatically repair and restore files in Quarantine silently
1          Repair the files in Quarantine silently without restoring
2          Prompt user
3          Do nothing

When I attempt to edit this value (it's still set at 0), I get an error that I'm unable to edit it. Any other suggestions?

P.S. In searching for a solution to this issue, I came across many posts for SEP 12 to uncheck an option in the settings that indicates to run a scan after new definitions are loaded. I've looked at every setting I can find, and I don't see any option for this. Why is this?

Hello,

I believe, you are talking about: https://www-secure.symantec.com/connect/forums/sep-110-defwatch-scan

Could you let us know the issue which you are facing and the reason you want to stop the defwatch scan from running?

Defwatch scan runs randomely which can not be scheduled as it runs as soon as the new definitions  arrives.

Try this : 

Hope that helps!!

I'd like to prevent it because it slows my computer down when it runs while I'm working.

I don't have an interface that looks like the screenshot you posted. I use Windows XP Pro SP3; I've attached a screenshot of the sort of console I see.

How can I disable Defwatch Quickscans?

Also, why do I get error messages when I attempt to change the registry value? This is my personal computer and I have all permissions (I'm the administrator since it's mine).

Hello,

The Screenshot I have provided is from Symantec Endpoint Protection Manager.

Whereas you have provided is the Screenshot from the SEP client. Is this an Unmanaged client?

If yes, you could not change any defwatch scan settings from SEP unmanaged client.

Hope that helps!!

Managed or unmanaged client? We need to know so we can look at some options.

For unamanged clients use the articles you have mentioned: http://www.symantec.com/docs/TECH105373

You may get the edit error message while trying to edit the registry - it will be protected by Tamper Protection - disable it to edit the registry:

http://www.symantec.com/business/support/index?page=content&id=HOWTO77121

You are right, this setting has to be done via registry

you wont be able to modify the registry if the tamper protection is enabled. disable it for a min make the changes

Enabling, disabling, and configuring Tamper Protection in Endpoint Protection on unmanaged Clients

Disabling Tamper Protection did it--thank you!!