I have found that after a reboot of 16 VM's suddenly my SAN had >1000 IOPS on a host with just 16 VM's.

That might not look bad based on numbers but we still run more or less green and now we have just 16 VM's soon there will be 500+.

I rebooted the VM's simulating a HA situation and found the huge amount of IOPS for some time.

MSMPENG.EXE was scanning and we disabled all automatic scanning so I was looking in eventviewer.

There I discovered a signature update.

It is highly unwanted to have a partly or full scan on servers. So my question is how can we disabled this?

Hi,

I find a scan setting in Antimalware Policy - "Check for the latest definition updates before running a scan". You could check the policy in your SCCM console.

Please also confirm this is not a scheduled scan.

Best Regards,

Hi Joyce,

The setting you mention enables or disables updates before a scan. We have no scheduled scans configured not centrally or on the server. In previous versions using ADMX it was possible to disable scan after a definition update. It still seems to behave the same but ADMX is no longer used for 2012. How can we do similar now?

Hi,

Could you reproduce this issue? I manually updated the definition updates from a SCEP client, it didn't have a scan after update installation.

Could you find some information about scan in eventlog?

Best Regards,

Joyce