A server which runs Symantec Endpoint Protection (SEP) and hosts network resources, processes network logon requests, etc... is observed as becoming unresponsive on a daily basis, usually at approximately the same time each day. Windows Event ID 2020 is logged during the period of unresponsiveness. Microsoft KB Article 272568 on Event ID 2020 indicates that the root cause of the issue is Symantec, and advises contacting Symantec Technical Support for further investigation.
Generally this is caused by a backup running during the time the issue occurs. SEP is scanning files as they are being backed which leads to depletion of the available Paged Pool memory on the server, causing the unresponsiveness.
Please take the following steps to address this issue:
1.) Within your Symantec Endpoint Protection Manager (SEPM), configure your Antivirus and Antispyware policy so that File System Auto-Protect does not scan files as they are being backed up, per the following steps:
a. Open the Antivirus and Antispyware Policy of the client group the affected system resides in. b. Click File System Auto-Protect. c. Click on Advanced Scanning and Monitoring under the Scan Details tab. d. Uncheck the option labeled 'Scan when a file is backed up'.
2.) Increase the available Paged Pool memory according to the Microsoft KB below -