FCS Intervals

So you've seen the following options with your FCS settings and are wondering how do these work???

Malware Scanning 

"Run a Quick Scan at set interval (hours):"

Security state assessment

"Scan at set interval (hours):"

Malware Definition Updates

"Check for updates at set interval (hours):"

We had a customer recently ask about this as they were having systems miss their scheduled scans for too many times which eventually causes the client to return the wonderful Orange Box with regards to haven't had a scan in more then 10 days.  Initially it appeared that their scheduled scan was set to 5am or something of that like and the systems in question (mostly laptops) were turned off during this time period.  Based on this we recommended setting a quick scan interval which the customer did however they were still having problems with missing scans.  When we checked into the interval being used the customer had set it to 24 hours for quick scans...

So here's the problem and how it works.  When the FCS client/service starts it basically creates a timer object which says right now is time 0 and at "interval" hours from now I will run whatever it is that needs to run Quick Scan/SSA Scan/Definition Update.  The problem here is that when systems are turned off this timer object goes away and is basically restarted when the system restarts.  So in our customers case the systems in question were being turned off at night and the 24 hour interval was never reached and the scan never performed.  Based on the users computing habits we have basically recommended that the interval be set to something around 5-6 hours so that it will hopefully run at least 1x during the work day while the system is on but not multiple times so to not cause performance issues while the user is working.

Another side note of interest is that if your system hibernated between the intervals it should not reset the timer from what we have seen and the scan should still occur.  Supposedly if your system is hibernated/in sleep mode it should also try to scan when you resume however I have not been able to test that yet to confirm (if anyone has a laptop and wants to try let me know your results).