To know which files Symantec Endpoint Protection (SEP) scans with File System Auto-Protect (AP).
SEP does not log each file that it scans to the client logs, as doing so would result in a loss of performance and usability of the computer. However, you can see the last file that the AP engine scanned, using the Auto-Protect Scan Statistics.
To view Auto-Protect Scan Statistics
In the SEP client user interface, in the left pane, click Status.
In the middle pane, next to Virus and Spyware Protection, click Options.
On the resulting drop-down list, click View File System Auto-Protect Statistics. The Auto-Protect Scan Statistics window appears.
In the Auto-Protect Scan Statistics window, in the Last file scanned section, you can see the last file that the AP driver scanned, and the path for that file.
Note: This information should not be used to determine if files exception are appropriately applied, as excluded files still touch the AP driver and appear here. See File System Auto-Protect Scan Statistics shows excluded files being scanned.The 'Last file scanned' entry will show the last file that was actively* scanned by the Symantec Endpoint Protection Auto-Protect engine.
Please note that with the 'File Cache' option enabled for Auto-Protect you may see that recently touched files may not be listed in the viewer. To know more about the Auto-Protect File cache feature see Customizing Auto-Protect for Windows clients.
Subscribing will provide email updates when this Article is updated. Login is required.