Question on Computer Scans

[JMcDowell 0]

This may be a dumb question, but I'm just testing this out on trial for now as I migrate away from Symantec (finally!)

Scans are configured via web management under "Media to Scan" for local and removable drives, network drives are disabled.

I am however getting different behavior for scans on different machines.

Laptop has the internal C drive and internal R drive, works as expected, scans both drives.

Desktop has internal  C drive, internal I drive and an internal raid array R configured on an Areca raid card. Scan your computer only scans the C drive, even though the scan window lists the I drive as well. Selecting custom scan > scan targets > local drives selects C, I and R. The R drive also shows up under "Removable Media Scan." The I drive is not listed under removable media. I'll assume that's some quirk of the raid card, but even then I would expect that the I drive should at least be scanned as well based on the policy.

Server 2016 is a VM on ESXi 6.7 using "File Security for Windows Server." Same policy configuration (separate policy though,) scan local and removable drives, network drive scans are disabled. Local drives C, Q, R and S. Here I have the same situation as the desktop, running a computer scan only scans the C drive. Custom Scan >Scan Targets > local drives selects C, Q, R, and S. Th Q, R and S drives are also listed under the removable media scan option.

So after the long winded explanation of the setup, how do I get the policy setup to scan all the drives? Clearly I am missing something.

[Marcos 5,074]

Please provide logs collected with ESET Log Collector. I assume those drives are reported as removable in the system.

[JMcDowell 0]

That was amazingly fast, thank you.

I have attached the log from my desktop machine. This is the one with and internal (not removable) drive I and the raid array, drive R, which is listed as removable.

 

Only the C drive scans when "scan your computer" is clicked.

ees_logs.zip

[Marcos 5,074]

Both the I: and R: drives were reported as fixed drives by SysInspector, however, the product may use different API calls which returned a different result. I'd recommend opening a ticket with your local ESET support that should contact developers at ESET HQ with your logs to find out why the two drives were detected as removable.

[JMcDowell 0]

Thanks Marcos, I have opened a support ticket.