We are planning how to roll out On Demand Scans and we ran into 2 bits of information. 1st that the ODS is incremental.
This is great since we were considering limiting the scan window to 8 hours and were concerned that the scan may not start where it left off on the big servers. But I just learned that if a DAT update is received during the scan the scan would start all over again.
We can change the window on when the DATs are sent out during the weekly full scans but even more important is the fact that this resets the scans when we were hoping they would start off where they left off the following week when the scan was to be run again.
Is this a fact and is there documentation for this? We've already presented the documentation on KB60915 - "How does an incremental On-Demand Scan work?". But this article does not state that a DAT update will negate the incremental ODS.
Also is there a way to increase the logging level of the ODS to show that the scan restarted after a DAT update?
This kinda makes sense due to ODS or OAS is using the latest DAT to perform the scan. Now, if the system receives a NEW DAT file while ODS or OAS is active I can kinda see the reasoning behind why it would start over again. Here's a new virus definition file to use (why use the old one). I haven't found any documentation...Just a guess..