Hello everyone,
I've found a few discussions about my problem, but so far no solution. About twice a day, when new definitions arrive, a few PCs of our company get highly irresponsive. After about 30 minutes everything is OK. During this period hdd is running at 100%. According to symantec logs, it looks like the "problem" lies in Defwatch. From what I found in other discussions it could be the functionality of Auto-protect that is rescanning my file cache. Problem is that I cannot disable it as there is no Advanced button under Auto-protect tab, where, according to other discussions, I could tweek a file cache settings.
My PC is managed by SEPM. I checked the settings in SEPM, but problem is that there is no Advanced button under Policies settings either. It looks like there are registry entries concerning the file cache settings, but when I change the values, they get overwriten by SEPM after next restart. But it looks like I cannot set them in SEPM.
I tried to reinstall whole system without success. There are no files in quarantine.
Maybe the problem could be in one of the many applications I use. I don't know how to properly set up debug logs to get any meaningful information about what it is actually doing during this 30 min period. When I run active scan it takes only 20 seconds. The only way out of the irresponsive state is "smc -stop" followed by "smc -start" which I use quite frequently lately.
Please let me know if you have any suggestions.