Enable Early Launch Anti-Malware Protection on Endpoints
OfficeScan supports the Early Launch Anti-Malware (ELAM) feature as part of the Secure Boot standard to provide boot time protection on endpoints. Administrators can enable this feature to start OfficeScan agents before other third-party software drivers when endpoints start up. This feature enables OfficeScan agents to detect malware during the operating system boot process.
After scanning all third-party software drivers, the OfficeScan agent reports the driver classification information to the system kernel. Administrators can define actions based on the driver classifications in Group Policy in Windows and view scan results using Event Viewer on endpoints.
ELAM is supported only on Windows 8, Windows Server 2012, or later versions.