I have some workstations that i'm monitoring where they have had high CPU usage after rebooting for quite awhile that is tied to mcshield.exe. These are running ENS and are managed by ePO. The on-demand scan is set to run overnight, and the computers are on during that time, so i don't think it should be running that on reboot.
I'm still learning to tweak settings, particularly with ENS, so any suggestions on things i may check would be helpful. Even to lower that CPU usage a little or reduce how long it is high.
Can you check in you have "Scan processes on service startup and content update" enabled in policy:
*** McAfee Endpoint Security 10.6.0 - Threat Prevention Client Interface Reference Guide - Windows
and if you do, can you un-check it and see if that resolves the issue?
@Kenchee_etfThank you for that little tip. I checked that out and I do not have that box checked.
Just out of curiousity, what's the difference between Enable On-Access Scan and Enable On-Access Scan on system startup? I have both of those selected.
Any other tips greatly appreciated.
"Enable On-Access Scan on system startup" is making sure that OAS is always enabled when system starts/reboots regardless of policy enforcement interval comparing to "Enable On-Access Scan".
For example, you disabled OAS, policy enforcement occurs, in most environment every 60 min by default, and ENS re-enables OAS at that time.
If you disable OAS and reboot machine it will stay disabled till next enforcement interval kicks in to "Enable On-Access Scan" unless you have "Enable On-Access Scan on system startup" checked, which will enable OAS right away.
I hope I am explaining myself properly.