Scan Methods

OfficeScan clients can use either conventional scan or smart scan when scanning for security risks.

Conventional scan is the scan method used in all earlier OfficeScan versions. A conventional scan client stores all OfficeScan components on the client computer and scans all files locally.

Smart scan is a next-generation, in-the-cloud based endpoint protection solution. At the core of this solution is an advanced scanning architecture that leverages threat signatures that are stored in-the-cloud.

Scan Methods Compared

Basis of Comparison	Conventional Scan	Smart Scan
Availability	Available in this and all earlier OfficeScan versions	Available starting in this OfficeScan version
Scanning behavior	The conventional scan client performs scanning on the local computer.	The smart scan client performs scanning on the local computer. If the client cannot determine the risk of the file during the scan, the client verifies the risk by sending a scan query to a Smart Scan Server. Using advanced filtering technology, the client "caches" the scan query result. The scanning performance improves because the client does not need to send the same scan query to the Smart Scan Server. If a client cannot verify a file’s risk locally and is unable to connect to any Smart Scan Server after several attempts: The client flags the file for verification. The client allows temporary access to the file. When connection to a Smart Scan Server is restored, all the files that have been flagged are re-scanned. The appropriate scan action is then performed on files that have been confirmed as infected.
Components in use and updated	All components available on the update source, except the Smart Scan Agent Pattern	All components available on the update source, except the Virus Pattern and Spyware Active-monitoring Pattern
Typical update source	OfficeScan server	OfficeScan server

Switching From Conventional Scan to Smart Scan

If you are switching clients from conventional scan to smart scan, take note of the following:

To use smart scan, ensure that you have activated the licenses for the following services and that the licenses are not expired:

Smart scan clients connect to a Smart Scan Server to send scan queries and verify a file’s risk against the Smart Scan Pattern. The Smart Scan Server to which a client connects depends on the client’s location. Internal clients connect to a local Smart Scan Server, while external clients connect to the Trend Micro Global Smart Scan Server.

If connection to the Global Smart Scan Server requires proxy authentication, specify authentication credentials. For details, see External Proxy.

OfficeScan provides two types of local Smart Scan Servers. Both servers have the same functions.

If you installed the integrated server during OfficeScan server installation, configure the update settings for this server and ensure the server has the latest updates. For details on updating this server, see Smart Scan Server Update.

If you want clients to connect to this server through a proxy server, configure proxy settings. For details, see Internal Proxy.

If you have not set up any of these servers, install them first before switching clients to smart scan. Refer to the Trend Micro Smart Scan for OfficeScan Getting Started Guide for information on reactivating the integrated server, and installing and managing the standalone server.

Add the Smart Scan Servers you have set up to the Smart Scan Server list. Clients refer to the list to determine which Smart Scan Server to connect to. The client tries connecting to other servers on the list if it cannot connect to a particular server.

OfficeScan includes a location awareness feature that identifies the client computer’s location and determines whether the client connects to the global or a local Smart Scan Server. This ensures that clients remain protected regardless of their location.

Ensure that clients can connect to the OfficeScan server. Only online clients will be notified to switch to smart scan. Offline clients get notified when they become online. Roaming clients are notified when they become online or, if the client has scheduled update privileges, when scheduled update runs.

Also verify that the OfficeScan server has the latest components because smart scan clients need to download the Smart Scan Agent Pattern from the server. To update components, see OfficeScan Server Update.

Switching a relatively small number of clients at a time allows efficient use of OfficeScan server and Smart Scan Server resources. These servers can perform other critical tasks while clients change their scan methods.

When switching to smart scan for the first time, clients need to download the full version of the Smart Scan Agent Pattern from the OfficeScan server. The Smart Scan Pattern is only used by smart scan clients.

Consider switching during off-peak hours to ensure the download process finishes within a short amount of time. Also consider switching when no client is scheduled to update from the server. Also temporarily disable "Update Now" on clients and re-enable it after the clients have switched to smart scan.

Scan method is a granular setting that can be set on the root, domain, or individual client level. When switching to smart scan, you can:

Switching From Smart Scan to Conventional Scan

When switching back to conventional scan, clients will likely download the full version of the Virus Pattern and Spyware-active Monitoring Pattern from the OfficeScan server. These pattern files are only used by conventional scan clients.

Scan method is a granular setting that can be set on the root, domain, or individual client level. When switching to conventional scan, you can: