Article ID: 2896610 - View products that this article applies to.
Consider the following scenario. You log on to your system and notice a spinning icon for Microsoft Forefront Endpoint Protection 2010 or Microsoft System Center Endpoint Protection 2012. (This indicates that the application is performing an action.) You open the application UI and notice that a scan is running.
In this scenario, the value that is displayed for Start time in the application UI may not reflect the actual start time of the scan in progress if the scan was started before you logged on.
Note If the scan was started before you logged on, the Start time value will be the time when the UI was started (that is, when the Msseces.exe process was started).
When a scan starts, EventID 1000 is logged. The time stamp of EventID 1000 can be considered the start time of the scan (although there can be an insignificant logging delay). You can correlate the start and stop events in the event log by using the ScanID value that is part of the event data.
If a scan start event (EventID 1000) does not have correlating scan stop event, the scan is still in progress.
To determine when a scan in progress was started, review the System log. To do this, follow these steps:
Article ID: 2896610 - Last Review: November 6, 2013 - Revision: 1.0