Hi Symantec, as you should have noticed in "Case: 08518930 - Unwarranted disk activity [ ref:_00D30jPy._50050beQZa:ref ]", the Outlook Scanner accesses all disks in certain situations, such as when you attach a file located on disk C to my mail. If a disk is sleeping (as my second disk D always is), this means that Outlook totally freezes for a couple of seconds until the disk have spun up.
This is totally inacceptable, and you need to correct this bug. However, your technician will just archive the case, and proposes that I can send in "ideas for improvement" in this forum. Seems as a really strange way of handling things, as you should rather use the internal case as an input to your future corrections.
Anyway, below is a copy-paste of the last few relevant mails I have exchanged with one of your technician. This is mostly for other readers of the forum, as assume that you at Symantec can dig up the original case instead, including all the log files I made and sent to you.
/Gunnar
==============================
From: GunnarH
Sent: 4/14/2015 12:58 AM
To: enterprise_technical_support@symantec.com
Subject: RE: Case: 08518930 - Unwarranted disk activity [ ref:_00D30jPy._50050beQZa:ref ]
Hi Symantec,
thanks for the explanation. While I now understand the cause I need to point out that the design is not acceptable. Forcing the application (i.e. Outlook) to totally freeze during a couple of seconds during ordinary work is not ok. Never. Note that this does not only happen when you add an attachment, but also often when you send a mail. And I do send a lot of mails, as does most people. And even if it would only happen occasionally it is still not ok.
Of course, if all disks had been up and spinning the delay would probably be imperceptible to the user, but it must be seen as very common for a high-end laptop (or desktop) to have more than one disk, and that the disks which are not used are sleeping. Actually this sleep mode is often enforced by the disk itself (in my case a WD10SPCX), to save battery, it is typically not even possible to force the disk to be all-time-active by changing any Windows setting.
So frankly, your design team need to take this energy-saving behaviour of a typical PC into account, and SEP must never ever access a disk which is not active (at least not related to any user-initiated action). Which I guess translates into never access any other disk than the one the file in question resides on. So while you can close my specific case (as the workaround of turning of the Outlook scanner is ok to me), I don't think you can just archive and forget about the problem itself.
Again, thanks for the help with trouble-shooting, looking forward to see future SEP updates which does not cripple the user's computer.
Best regards
/Gunnar
============================
From: enterprise_technical_support@symantec.com [mailto:enterprise_technical_support@symantec.com]
Sent: 13 april 2015 22:47
To: GunnarH
Subject: RE: Case: 08518930 - Unwarranted disk activity [ ref:_00D30jPy._50050beQZa:ref ]
Gunnar,
After further investigation it has been determined that this behavior is expected and as designed. Symantec Endpoint Protection (SEP) is comparing the hash of the file added to the hashes stored in the database for unremediated scans. This database is stored on every drive in the system. If you had several drives, then the delay would be longer as you would see it hit all of the drives.
The fact the file resides on the C:\ drive and the D:\ drive is being accessed, does not make a difference. The software is reviewing the file against the systems unremediated file hashes.
When the file is not in that unremediated listing then the delay is 1-2 seconds until the disk spins up, and we don’t see the file being scanned. If it was listed in the unremediated scans and the file was not yet scanned with the current definitions you would see the file being accessed as well, also adding a further delay to the attachment.