Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Checking if scheduled scan has been triggered in the OfficeScan (OSCE) client/agent

    • Updated:
    • 17 Oct 2016
    • Product/Version:
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan XG.All
    • Platform:
    • Windows 2003 Compute Cluster Server
    • Windows 2003 Datacenter Server
    • Windows 2003 Datacenter Server Edition 64-bit
    • Windows 2003 Enterprise Server
    • Windows 2003 Standard Server Edition
    • Windows 2003 Standard Server Edition 64-bit
    • Windows 2003 Storage Server
    • Windows 2003 Web Server Edition
    • Windows 2008 Datacenter Server
    • Windows 2008 Datacenter Server Edition 64-bit
    • Windows 2008 Enterprise Server
    • Windows 2008 Enterprise Server Edition 64-bit
    • Windows 2008 Standard Server Edition
    • Windows 2008 Standard Server Edition 64-bit
    • Windows 2008 Storage Server
    • Windows 2008 Web Server Edition
    • Windows 2008 Web Server Edition 64-bit
    • Windows 2012 Enterprise
    • Windows 2012 Standard
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Professional
    • Windows XP Professional 64-bit
Summary

Know the steps when verifying if scheduled scan is configured and triggered in the OSCE clients/agents.

Details
Public

Do either of the following:

On the OfficeScan server console

For "Scan End time" or to verify if the scheduled scan finished, you can export a log from the OfficeScan server console.

  1. Log in to the OfficeScan server console. 
  2. In OfficeScan 10.6, go to Networked Computers > Client Management. In OfficeScan 11.0 and XG, go to Agents > Agent Management.
  3. Click on the Export button to save an Officescan_Client_Listing.csv file.
  4. Open the file and look for "Last Virus Scan (Scheduled)" and "Last Spyware Scan (Scheduled)" when the actual scanning is finished.

You can also access this same information if you click on the Status icon in the OfficeScan server console (under Networked Computers > Client Management page). If you are using OfficeScan 11.0, you can find this on the Agents > Agent Management page.

On the OfficeScan client/agent machine

Do the following:

  1. Open the Registry Editor.
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
  2. Check the following registry keys to verify the scheduled scan configuration:

    HKLM\Software\TrendMicro\PC-cillinNTcorp\CurrentVersion\PreScheduled Scan Configuration:

    REG_DWORD: Enable
    Possible Values: 1=Enable;0=Disable

    REG_DWORD: Frequency
    Possible Values: 2=Weekly; 3=Daily
    4=Hourly; 5=Execute once only

    REG_DWORD: Hour
    Possible Values: 0~12

    REG_DWORD: DayOfWeek
    Possible Values:
    1=Mon; 2=Tues;
    3=Wed ; 4=Thurs
    5=Fri ; 6=Sat; 7=Sun

    REG_DWORD: AmPm
    Possible Values: 1=AM; 2=PM

    REG_DWORD: Minute
    Possible Values: 0~59

  3. The following registry keys will show the scheduled time and the next scheduled scan time:
    • HKLM\Software\TrendMicro\PC-cillinNTcorp\CurrentVersion\PreScheduled Scan Configuration\ScanStartTime
    • HKLM\Software\TrendMicro\PC-cillinNTcorp\CurrentVersion\PreScheduled Scan Configuration\ScanStartTime\NextScanTime
  4. Close the Registry Editor.
  5. To investigate further on the scan start time and scan duration, enable and look for the following keyword strings in the ofcdebug.log file:
    1. For start time, look for this keyword:

      [ntrtscan.exe]CreateThread (Schedule) OK

      or

      [ntrtscan.exe][tmntScheduleScan] TempPathName

    2. For scan duration (in milliseconds), look for this keyword:

      [ntrtscan.exe][Schedule] Total processing time:

To enable debug mode, follow the steps in this KB article: Manually enabling debug mode on OfficeScan

Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1057865
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.