Wednesday, January 2, 2013

Symantec Endpoint Protection 12.1 clients are holding onto multiple virus definitions, using a lot of disk space

There is a known issue with Symantec Endpoint Protection 12.1 clients where it does not delete the old virus definition files. These definition files build up and start consuming gigs and gigs of disk space.

They do have a fix for it now, which involves upgrading to Update Rollup 2 (UR2). Unfortunately,  you might not be able to upgrade right away. As a workaround, I wrote the powershell script below that will cleanup the old definition files. I schedule this to run daily.


########################################################
##    Cleanup old Symantec Definition files
##    http://NerdsKnowBest.blogspot.com
##    Always evaluate any script before use.
##    Caution: Use at your own risk. 
##    No warranty expressed or implied.
##    Written by: Greg Kjono on 12/14/2012
########################################################
$version = gwmi win32_operatingsystem | select version
$version = $version.version.substring(0,4)
$ErrorActionPreference = "Continue"
c:

## Set the definition path based on the OS version
if ($version -ge "6.0."){
      ## >=W2k8
      [String]$dir = 'C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\VirusDefs'
}else{
      ## <= W2k3
      [String]$dir = 'C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\VirusDefs'
}

## Get directory list
$dirs = Get-ChildItem $dir | Where {$_.PsIsContainer -and $_.Name -match "^201"} | Sort-Object Name -Descending

## Identify the most current definition(s)
$Current = $dirs[0].Name.substring(0,8)

## Remove the older definition files
Get-ChildItem $dir | Where {$_.PsIsContainer -and $_.Name -match "^201" -and $_.Name -notmatch "^$Current"} | Remove-Item -Recurse -Force

Please evaluate the script for your systems/environment. Use at your own risk.

Show your appreciation by liking/sharing/+1ing this blog below.