The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Best practice: Regularly scheduled scans per system type

Prev Next

We recommend scheduling on-demand scans at regular intervals, with the interval based on the system type.

Scanning active user workstations

Because some locations on active user workstations are often targets of malware attacks, Trellix recommends that you scan these workstations more frequently than other systems. Because the locations are limited, the scans are less likely to affect users.

To scan active user workstations, configure a Custom On-Demand Scan:

  1. Specify these locations to scan:

    • User profile folder

    • Temp folder

    • Registered files (Windows only)

    • Windows folder (Windows only)

  2. Schedule to run the scan at least weekly, or even daily.

Regular server systems

To scan regular server workstations, configure a Custom On-Demand Scan:

  1. Select the Boot sectors option (Windows only).

  2. Specify these locations to scan:

    • Scan subfolders

    • Memory for rootkits (Windows only)

    • Running processes (Windows only)

    • All local drives

  3. Schedule to run the scan at these intervals.

    Daily

    Only if you have had a major malware outbreak

    Weekly

    Recommended — Aggressive and provides good protection

    Monthly

    Acceptable — Provides decent protection with acceptable risk

    Quarterly

    Bare minimum scheduling interval

Note

To improve system performance during on-demand scans of All local drives, set System utilization to Below Normal or Low.