Scheduled Tasks

The Console allows you to configure and schedule searches for the Agents. While each Agent has its own scheduled search feature, a policy-based scheduled task is different because it does not rely on the operating system scheduler or user passwords. Policy-based scheduled tasks are monitored, managed, and executed by the endpoint service on each Agent. Scheduled tasks do not apply to User Default polices and are hidden in the tree for the specific policy type.

The Policy View displays the following columns when Scheduled Tasks is selected:

Field Description
Name The name that the task was given when it was created.
Schedule How frequently the task runs.
Boundaries Shows the first date and time the task runs and, if configured, the final date and time the task runs. The time displays in a 24 hour format. So if you are in the Eastern Time Zone in the United States and create a scheduled task to begin on September 24, 2013 at 1:00 PM, it displays as 2013-09-24 13:00-04:00. 13:00 indicates the start time of 1:00 PM and -04:00 indicates the offset from GMT of your time zone. If you selected ‘Synchronize across time zones’, it would display as 2013-09-24 13:00Z, where the ‘Z’ indicates Zulu.

Add New Task

To add a new task, click the Add ribbon button in the Scheduled Tasks group. Alternatively, you may right click anywhere in the scheduled tasks list and select Add.

Field Description
Name The name of the task. This is the name that is displayed in the Task Name column in the Filter by Searches and the Task Name column of the Tasks tab in the Endpoint Status Detail.
Frequency

Specify how often, and when specifically, the task should recur.

  • One time: The task should only execute one time.
  • Daily: The task should execute on a recurring schedule every X days, where X is a user specified number.
    • Recur every: X days - Specify the recurrence interval. For example, specifying 2 runs the task every other day, specifying 90 runs the task every 90 days.
  • Weekly: The task should execute on a recurring schedule every X weeks, where X is a user specified number. Additionally, the task should only execute on the specified days.
    • Recur every: X weeks on: Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday - Specify the recurrence interval. For example, specifying 2 runs the task every other week, specifying 4 runs the task every 4 weeks. Specifying 2 and Monday only runs the task every other Monday. Specifying 4, Tuesday and Saturday runs the task every 4th Tuesday and Saturday.
  • Monthly: The task should execute on a recurring schedule every month or during the specified months. Additionally, the task should execute every day, or only on the selected days.
    • Months: Every Month, Only Selected, Jan-Dec - Specify the recurrence interval. For example, leaving this blank runs the task every month. Checking Only Selected and then checking individual months runs the task only during those months. For example, selecting January, April, July, and October runs the task quarterly.
    • Days: Every Day, Only Selected, 1-31, Last - Specify the recurrence interval. For example, leaving this blank runs the task every day during the selected month(s). Checking Only Selected and then checking individual days runs the task only on those days. For example, using the quarterly schedule above, checking 15 runs the task on Jan 15, Apr 15, Jul 15 and Oct 15. Checking Last runs the task on the last day of the specified month(s).
    • The: first, second, third, fourth, last, Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday of the month(s) - Specify the recurrence interval. For example, if you selected third and Tuesday and had Months: set to Every Month, the task would run on the third Tuesday of every month. If you had Months: set to January, May, and September and selected last and Monday, the task would run on the last Monday of the specified months.
Start: Date/Time

Specify the earliest time and date that the task can execute. The time is local to the Agent (unless "Synchronize across time zones" is selected). If the time is 12:00 PM, the task executes at noon locally on every associated endpoint - that is, the task executes at noon for an endpoint in New York and at noon (3 p.m. EST) for an endpoint in San Francisco.

  • Synchronize across time zones: Specifies that the Start Date/Time is GMT. When this option is enabled, the time entered is universal across all time zones. This means that three endpoints in three different time zones all start the task at the same time, regardless of time zone. For example if the time is 12:00 PM and this option is selected, the endpoints all execute the task simultaneously at noon in London, 7 a.m. (EST) in New York and 4 a.m. (PST) in San Francisco.
  • Begin after a randomized start time between X and Y minutes: Specify that the Agent should delay the specified start time with a random interval between X and Y minutes before starting the task. This is useful when a task is applied to endpoints that may be searching the same physical hardware such as a file server with home folders or a mail server as it can help stagger the search times and potentially reduce the load on the remote system.
Search using the local endpoint as this user

Specify the user context under which to run the task. If creating the task from within a Scheduled Task policy, the text reads 'Search using the local endpoint as this user'.

  • Local System Account: Specify that the search should be run as system or root. No graphical user interface is available to the end user and the Agent runs silently in the background. If run as soon as possible after a scheduled task is missed is configured when using the Local System Account, the next time the computer is powered on, it executes the search. Because no user credentials are available, certain locations (such as Browser Data and some email) cannot be searched.

    Using the Local System/Root account allows access to all local files, but does not allow access to emails, Browsers, or remote files such as those on networked drives as those locations require user-specific authentication tokens.

  • Locally Logged on User (Interactive): Specify that the search should run with the credentials of the user that is logged in at the endpoint system. The graphical user interface of the Agent software is accessible to the user. Only locations to which the user has access (for example NTFS file permissions) can be searched. If no user is logged in at the scheduled start time, the task does not execute unless run as soon as possible or run with randomized start time is selected, in which case the very next time a user logs in, the task runs.
  • Locally Logged on User (Background): Specify that the search should run with the credentials of the user that is logged in at the endpoint system. No graphical user interface is available and the Agent runs silently in the background. Only locations to which the user has access (for example NTFS file permissions) can be searched. If no user is logged in at the scheduled start time, the task does not execute unless run as soon as possible or run with randomized start time is selected, in which case the very next time a user logs in, the task runs.

    Using the Locally Logged On User for a search applies only to the first user account logged on to the physical desktop of the system. It does not apply to any terminal services (RDP) sessions or any users logged on to multiple desktops that occur while the primary desktop session is still active.

Search using this Discovery Team A Discovery Team is composed of managed endpoints that have been grouped together for the purpose of automatically assigning the work of a search. For additional information, refer to the Searching with a Discovery Team article.
If Spirion is already running when this task begins, this task will

Only a single instance of the Agent can run at a time and therefore, if the Agent software is running when it is time for the task to execute, one of the following occurs:

  • not stop any instances of Spirion: This option causes the endpoint service (which executes the tasks) to wait for any already running instance of Spirion to finish before executing this task. While this wait occurs, no other scheduled tasks are processed on the endpoint.
  • only stop the same instance of Spirion: The endpoint service (which executes the tasks) only stops the current search if it is another instance of the same task. Each task has a unique identifier and this option allows you to restart an existing instance of the same search but not interfere if the currently executing search is different.
  • stop all instances of Spirion and run this search: The endpoint service (which executes the tasks) stops the current search and runs this task. If a user is currently interacting with the application, using this option causes the endpoint service to stop that search and close the application without prompting the user.
When task missed

If the task could not be executed at its scheduled time (for example if the system was off or another task was waiting to be launched and the current task was not evaluated before its start time). This option is disabled when Search Using this Discovery Team is selected.

  • do not run: The task is not executed. If this task was scheduled to run only once, it never executes. Otherwise it executes the next time it is scheduled to do so.
  • run as soon as possible: The task is executed as soon as possible after the reason for it being missed is resolved. For example, if the task is a user task and no user was logged on, it executes as soon as the user logs on. If the task was a system task and the system was off, it executes as soon as it is powered back on.
  • run with randomized start time After (min.): [Minutes] Before (min.): [Minutes]: The task is executed after a random delay after the reason for it being missed is resolved. For example, if this option is enabled and set to run after 5 minutes and before 30 minutes, and it is a user task but no user was logged on, the task executes somewhere between 5 and 30 minutes after the user logs on.
  • Except when endpoint is first installed or registered with Console: If a task is assigned to an endpoint and occurs in the past relative to the time when the software is first installed on the endpoint, it may be undesirable to run the task immediately after the software is installed. Selecting this option causes the task not to execute under the aforementioned circumstances. For example, if a task is part of a policy applied to all endpoints and it is scheduled to run every Monday, starting on January 1st - and the Agent software is installed on an endpoint on February 15th. In this case, the task has been "missed" and runs immediately (or after a randomized delay). If this is undesirable and you would like it to wait for the next scheduled search, select this option. This checkbox is hidden when the task frequency is set to One Time.
Expire this task (never run after): [Date and Time] If the task was unable to start between its scheduled time and this time, cancel the task and do not execute it.

If a task is configured with "do not run" after it is missed and to "not stop any instances of Spirion" if the Agent is already running when it is time to start the task, it is possible that the task never executes.

The status of the task can be viewed on the Status tab.

To edit a scheduled task, highlight the task to be edited and click the Edit ribbon button in the Scheduled Tasks group. Alternatively, you may right-click on a task and select Edit.

To remove a scheduled task, highlight the task to be removed and click the Remove ribbon button in the Scheduled Tasks group. Alternatively, you may right-click a task and select Remove. A confirmation dialog displays confirming "The selected row will be permanently deleted. Would you like to delete this row?".