I'm assuming we're talking about an on-demand scan task? In which case, most users can't even *see* it
When an on-demand scan task is run from ePO, there is no user interaction. The only way the user can see it is by looking in task manager, and they can't kill it by using "end process." They can kill it with something like PSKill if they have access to it (and VSE isn't detecting it as a PUP and removing it.)
i create a notification from epo to send me email once a scan is canceled. which scan meant by it ??