On-Demand Scan page

The On-Demand Scan settings specify the behavior for the preconfigured and custom scans that run on Windows, Mac, and Linux client systems.

These settings specify the scanner behavior when you:

Select Full Scan or Quick Scan from the Scan Now page in the Trellix Endpoint Security (ENS) Client.
As an administrator, run a custom on-demand scan from Tasks in the Trellix Endpoint Security (ENS) Client.
Right-click a file or folder on a Windows client system and select Scan for threats from the pop-up menu.
Note
Right-Click Scan is supported on Windows systems only.
Schedule a Full Scan or Quick Scan Policy-Based On-Demand Scan client task from Trellix ePO - On-prem.

Option definitions
Section	Option	Definition
What to Scan	Boot sectors (Windows only)	Examines the disk boot sector. Best practice: Deselect boot sector scanning when a disk contains a unique or abnormal boot sector that can't be scanned.
	Files that have been migrated to storage (Windows only)	Scans files that Remote Storage manages. Some offline data storage solutions replace files with a stub file. When the scanner encounters a stub file, which indicates that the file has been migrated, the scanner restores the file to the local system before scanning. The restore process can negatively impact system performance. Best practice: Deselect this option unless you have a specific need to scan files in storage. This option doesn't apply to files stored in Microsoft OneDrive. The on-demand scanner doesn't download OneDrive files or scan files that haven't been downloaded.
	Compressed MIME-encoded files	Detects, decodes, and scans Multipurpose Internet Mail Extensions (MIME) encoded files. (Apple mail messages on Macintosh systems.)
	Compressed archive files	Examines the contents of archive (compressed) files, including .jar files. Best practice: Select this option only in scans scheduled during off hours when the system isn't being used. Scanning compressed archive files can negatively affect system performance.
	Subfolders (Right-Click Scan only)	Examines all subfolders of the specified folder.
Additional Scan Options	Detect unwanted programs	Enables the scanner to detect potentially unwanted programs. Windows and Mac — The scanner uses the information you configured in the Threat Prevention Options settings to detect potentially unwanted programs.
	Detect unknown program threats	Windows and Mac — Uses Trellix GTI to detect executable files that have code resembling malware. Linux — Enables the scanner to detect unknown program threats.
	Detect unknown macro threats	Windows and Mac — Enables the scanner to detect unknown macro threats. Linux — Enables the scanner to detect unknown macro threats.
Scan Locations	(Full Scan and Quick Scan only)	Specifies the locations to scan. These options apply to Full Scan, Quick Scan, and custom on-demand scans only.
File Types to Scan	All files	Scans all files, regardless of extension. Trellix strongly recommends enabling All files. Caution Failure to select this option leaves your system vulnerable to malware attacks.
	Default and specified file types	Scans: Default list of file extensions defined in the current AMCore content file, including files with no extension Any additional file extensions that you specify Separate extensions with a comma. (Optional) Known macro threats in the list of default and specified file extensions macOS — For the list of default file types scanned with this option, see KB79626. Linux — For the list of default file types scanned with this option, see KB79626.
	Specified file types only	Scans either or both: Only files with the (comma-separated) extensions that you specify All files with no extension
Trellix GTI		Enables and configures Trellix GTI settings.
Exclusions		Specifies files, folders, and drives to exclude from scanning.
Exclusions	Add	Adds an item to the exclusion list.
	Edit	Changes an item in the exclusion list.
	Delete	Removes an item from the exclusion list.
	Delete All	Removes all items from the exclusion list.
	Overwrite exclusions configured on the client (Windows only)	Excludes only items specified in this scan policy. Deselect this option to enable the client system to use both the exclusions specified in the policy in Trellix ePO - On-prem and the exclusions specified locally on the client.
Actions		Specifies how the scanner responds when it detects a threat.
Scheduled Scan Options		These options apply to Full Scan, Quick Scan, and custom on-demand scans only.
Scheduled Scan Options	Scan only when the system is idle (Windows & macOS only)	Runs the scan only when the system is idle. Threat Prevention pauses the scan when the user accesses the system using the keyboard or mouse. Threat Prevention resumes the scan when the user (and CPU) is idle for five minutes. Disable this option only on server systems and systems that users access using Remote Desktop Connection (RDP). Threat Prevention depends on the Trellix notification area icon to determine if the system is idle. On systems accessed only by RDP, the notification area icon doesn't start and the on-demand scanner never runs. To work around this issue, add the UpdaterUI.exe to the logon script.
		User can resume paused scans — Allows the user to resume a scan that has been paused due to user activity. (Enabled by default) (Windows only) Once the scan starts, the user can click Pause Scan to return the scan to automatically pause when it detects user activity. This option applies to Full Scan, Quick Scan, and custom on-demand scans only.
	Scan anytime (Windows & macOS only)	Runs the scan even if the user is active and specifies options for the scan.
		User can defer scans — Allows the user to defer scheduled scans, and specifies options for scan deferral. (Windows only) Maximum number of times user can defer for one hour — Specifies the number of times (1–23) that the user can defer the scan for one hour. User message — Specifies the message to display when a scan is about to start. The default message is: Trellix Endpoint Security is about to scan your system. Message duration (seconds) — Specifies how long (in seconds that the user message appears when a scan is about to start. The valid range for the duration is 30–300; the default is 45 seconds.
		User can pause and cancel scans — Allows the user to pause and cancel scheduled scans. (Disabled by default) (Windows only) This option applies to Full Scan, Quick Scan, and custom on-demand scans only.
		Do not scan when the system is in presentation mode — Postpones the scan while the system is presentation mode. (Windows only)
	Do not scan when the system is on battery power (Windows & macOS only)	Postpones the scan when the system is using battery power.
Performance	Use the scan cache (Windows & Linux only)	Enables the scanner to use the existing clean scan results. A trust scan will be executed in the absence of existing clean scan results (Windows only). Best practice: Select this option to reduce duplicate scanning and improve performance. If you enable logging of files scanned during an on-demand scan, the scanner doesn't log files in the clean scan cache.
	Specify maximum number of seconds for each file scan (Linux only)	Limits each file scan to the specified number of seconds. (Enabled by default) If a scan exceeds the time limit, the scan stops cleanly and logs a message.
	Specify maximum number of threads allowed (Linux only)	Limits the number of on-demand scan threads that can run simultaneously. Best practice: Specify more threads to improve performance of the scan. (Enabled by default)
	System utilization (Windows only)	Enables the operating system to specify the amount of CPU time that the scanner receives during the scan. Each task runs independently, unaware of the limits for other tasks. (Enabled by default) Low — Provides improved performance for other running applications. Sets the number of threads for the scan to 1. Best practice: Select this option for systems with end-user activity. Below normal (Default for the preconfigured Full Scan and Quick Scan) — Sets the number of threads for the scan to be equal to the number of CPUs. Normal (Default for custom scans) — Enables the scan to finish faster. Sets the number of threads for the scan to twice the number of CPUs. Best practice: Select this option for systems with large volumes and little end-user activity.
	Limit maximum CPU usage (Windows only)	Limits the maximum amount of CPU that the Full Scan, Quick Scan, or custom scan consumes when scanning files. (Disabled by default) Note Right-click scan is not supported. This option only applies to scanning files. It doesn't limit CPU usage when scanning other items, such as memory, registry, and boot sectors. Note This option is available only when the Scan anytime option is selected.
	Percentage (Windows only)	Specifies the maximum percentage of CPU that the scan consumes (between 25 and 100 percent). The default is 80 percent.
Account (Windows only)		Specifies the credentials to use for scanning network devices. Note If no credentials are specified, the on-demand scan runs as the local system Administrator account.
	User name	Specifies the user account.
	Password	Specifies the password for the specified user account.
	Confirm password	Confirms the password for the specified user account.
	Domain	Specifies the domain for the specified user account.