Endpoint Protection

We are running Symantec Endpoint Protection on Windows 2003 Server. We have found that during a nightly 4am scan of the C:\Windows folder, Symantec updates the 'last accessed' date on each file metadata in the scan. This causes us a problem with our Storage Area Networking snapshot functionality, as files which have been accessed are being included in nightly snapshots. 

The result is very large snapshots, when in reality only a few files on the server have been changed.

How is it possible to run a virus scan without changing the 'last accessed' meta on a file? We know Symatec is set to preserve the 'date modified' date/time - but we are unable to find any means of getting it to preserve the 'last accessed' date.

Cheers,

Mark

This document sounds like it may be able to help you out:

Title: 'Incremental backup jobs create a full backup after Symantec Endpoint Protection runs a scan'
Document ID: 2007101816043548
> Web URL: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007101816043548?Open&seg=ent
 

Let me know if this works out for you.

We are going to check it out and get back to you

I'm afraid the registry update did not fix the issue.

Here are some screenshots that might help you understand what we did / what happened.

If you are happy we have done everything correctly as directed - are 
there any reasons why the new key would not work? Perhaps a service / 
server restart is required for this registry change to work?

Thanks for your help.

MarkD,

Can you try this?

1. Edit the scheduled scan on the machine

2. Click the Advanced button

3. Where it says "Storage Migration Options" choose "Skip Offline files"

4. Click OK

5. Test your scan

This is another solution that worked for a couple of customers with a similar issue. 

MarkD, Windows is behaving as normal, every time any application opens a file its going to update that stamp (even just to read it).

Have you seen this registry key?

http://technet.microsoft.com/en-us/library/cc758569.aspx

Can your backup/snapshot read from the date modified instead?