Home / server / Questions / 433046
Accepted
David
Asked: 2012-09-29 10:00:59 +0800 CST

Easiest way to get MS Security Essentials to run for people who turn off their computers?

  • 772

All the employees at my work shutdown their Windows 7 computers (iMacs running BootCamp) when they leave work. This ends up with people having MS Security Essentials say their computer is at risk, due to not having been scanned recently.

Is there a way to not have MS Security Essentials say this? I'd like to be able to scan their computers daily or weekly, but not interrupt their work by slowing down their computers with a scan.

security

3 Answers

  1. Best Answer

    Configure Security Essentials to scan the computer when you are confident that it will be on. In Security Essentials you can adjust the schedule by opening the program, going to the Settings tab, choose Scheduled Scan on the left, then adjust the parameters as necessary.

    Screenshot of Microsoft Security Essentials "Settings" tab

    Where I work the security team has configured our anti-virus program to start a quick scan at noon once a week and a full scan at noon once a month. Our security folks found that most users go to lunch at noon and merely lock their screens rather than shutdown or put their computers to sleep. Therefore, they settled on noon as a good time to start the scan. Depending on what your users do with their computers during lunch, you might want to consider setting the time to 12:00 PM.

    A setting of Tuesday would be a good choice for the day. Mondays and Fridays are most often taken off for vacation to make long weekends. Choosing a scanning day other than those has a higher chance of running due to the user being in the office and the computer on.

    With 10 devices or less you should be able to easily determine if it's better to schedule a quick scan or full scan. A quick scan completed on my laptop in two minutes, but I know a full scan takes more than an hour. You can also set the percentage of CPU that the scan will use so that the scan doesn't adversely impact the user's computer usage.

    Some experimentation will help you figure out what works best for your users while still meeting the requirements of your security policy.

    Edit:

    Here's another alternative. It's possible to start a scan using the command line. For example, the following command will start the default scan as configured in the GUI.

    "c:\Program Files\Microsoft Security Client\MpCmdRun.exe" -scan

    You could create a scheduled task to run a scan at an appropriate interval. When editing the scheduled task, go to the Settings tab and check the box for "Run task as soon as possible after a scheduled start is missed". I've outlined this option in red in the screenshot below. This will ensure that the scan runs the next time the user boots up the computer.

    You can also use this method to perform different scans at different intervals. For example, if you have the GUI configured to perform a quick scan once a week, then you can create a scheduled task to execute the following command to run a full scan once a month:

    "c:\Program Files\Microsoft Security Client\MpCmdRun.exe" -scan -scantype 2

    Screenshot of Create Task window with the Settings tab selected.

    • 7

  2. Send a Wake-on-LAN a few minutes before the scheduled scan time.

    • 5

  3. Just as an aside to the other answers, since your network is so small you could use Wake On LAN to power the computers up an hour or two before people arrive at the office (assuming these are workstations and not laptops that people take home) and run the scan, with the added bonus that their machines will be ready to go as soon as they arrive :-)

    EDIT: How did I miss Michael Hampton's answer?

    • 2