Client Task on Demand Scan with Shutdown Runs about 12 Hours Late

[OEC GROUP IT 0]

At the company I work at, we use ESET to shut down all of our computers everyday at 10PM through the use of a scheduled client task through ESET Remote Administrator (Server), Version 6.3.136.0 with ESET Endpoint Antivirus version 6.3.2016.0 for an on demand scan and shut down after the scan.  Attached are the trigger settings for:

 

Daily

Start: (schedule begin date) 22:00:00

End: no end

Schedule: every 1 days

Invoke ASAP if Event missed: NO

Use Local Time: Yes

 

The problem is that we have had a few cases where every day, the scan won't start until 10AM the day after and shutdown the computer. If a user is away from their desk, this is a huge problem because they lose all of their work.  There is an option to cancel the shutdown, but there's only about a 10 second window to cancel.  From checking the logs of when the task is actually running, on these computers facing this issue, the task is showing successfully ran at 10AM. 

 

I've looked around just about everywhere I can think of as to why this may be happening but I cannot find a thing.

- The task is running based on the local server's time and the computer's time is synced from the server's time. 

- I've doubled checked the computers' time and it is definitely not set to PM when it's actually AM time and visa versa.

- Invoke ASAP if event missed is not checked in the task.

- There are no left over tasks to be ran if missed.

- I've uninstalled both ESET and ERA remote agent from one of the affected computers as well as deleted the host name in ESET remote administrator.

- Completely recreated the scheduled client task

- There are no locally scheduled tasks on the computer to scan with option to shut down after scan

- Within ESET antivirus on the computer, the "Action after Scan" is set to "No Action"

- The applied Antivirus and Remote Agent policy has no set action to shut down after on demand scans and the policy is applied to 270 other computers that are not experiencing this issue

- There are no scheduled tasks created through windows to shutdown the computer

- The system logs show that the shutdown is triggered by ESET

 

I am flat out of ideas.  The only thing that prevents this from happening is disabling the client task on the affected computers so it's definitely an issue with the scheduled client task through ERA.  But why only a few select computers???  Can someone please give some insight as to what could be causing this?

 

[OEC GROUP IT 0]

Does anyone have any input on this at all???

[MartinK 378]

We have not seen any such issues, so I will have few questions:

• Please check "Task execution history" of this specific task on affected client and search for timestamp next to "Task started" .. does it corresponds to time shown by time show directly in Endpoint Antivirus log?
• Could you please check both local and UTC time on affected machine and compare it with other working machines? What is your UTC offset? Scan task is started by AGENT, therefore local time on client computer is relevant.
• Verify that AGENT actually connects to SERVER between you create/modify trigger and time of its execution.

In case you won't be able to find out what could be problem - you can try to enable full trace.log verbosity of affected AGENT by policy and send me PM with trace.log for analysis (or analyze it yourself)