## Client commands reference

The following commands can be issued to the Symantec Endpoint Protection client to remediate issues that are detected while monitoring the network. See Monitoring client state and activity.

If you are a developer of a third-party remote management application, you may want to take some of this information into account as you design your user interface, or you may want to provide it to your customers.

Note: | Commands to disable individual technologies include a timeout parameter. After the timeout interval, the technology returns to the state that it was in before the command was issued. For more information, see the Reference Guide.

For more information about client commands and about the protection technologies that they manage, see the Symantec Endpoint Protection documentation.

Table: Client commands

Command | Definition | When and how to use
--- | --- | ---
Scan | Scan the client computer, list of clients, or group of clients for threats or risks. You also specify the scan type: Active, Full, or Custom. A custom scan must be defined in the Symantec Endpoint Protection Manager console. | If the client(s) report Infected but Up to date.
Update Content | Run LiveUpdate on the client(s). | If you want to update content on the client without running a scan at the same time
Update Content and Scan | Run LiveUpdate on the client(s) and then scan to check for any new risks. | If the client(s) report Infected and you are not certain that the client has the latest content.
Enable Auto-Protect | Enables Auto-Protect for the file system on the client(s)
Note: | Does not affect Auto-Protect for email.
| If you let endpoint users disable Auto-Protect, or if you needed to disable it temporarily by policy from the management console. There is no corresponding command to disable Auto-Protect because it should remain enabled most of the time. See About Symantec Endpoint Protection.
Enable Network Threat Protection and Disable Network Threat Protection | Enables or disables the firewall and intrusion prevention features on the client(s). | Network Threat Protection is designed to be compatible with most applications that use the network. On rare occasions, however, you may need to disable these technologies temporarily. You enable Network Threat Protection if users have disabled it or after the requirements for which you disabled it are met.
Enable Download Insight and Disable Download Insight | Enables or disables download blocking based on file reputation | You may rarely need to disable Download Insight temporarily. You enable Download Insight if users have disabled it or after the requirements for which you disabled it are met.
Run Power Eraser Scan See Calling the Power Eraser commands. | Detects or remediates threats on the client that are resistant to eradication. |
Warning: | Power Eraser scans are very aggressive. Use sparingly, only when client computers are unstable or demonstrate persistent problems.
For Power Eraser scans only, remediation is a separate step from the scan itself, and cannot be configured to run automatically. For more information, see the product documentation.
Run Quarantine command See Calling the Quarantine command. | Places the client in the Quarantine location that is specified by a Host Integrity policy | If you detect issues on the client and want to limit the client's access to the network while you research issues further.
Note: | You must assign a Host Integrity policy that includes a Quarantine Firewall location before you can run the Quarantine command. The Quarantine command is available only as a web service. No corresponding command exists in the management console.
Run Evidence of Compromise command See Calling the Evidence of Compromise command. | Checks the client state against Indicators of Compromise (IoCs). `\SEPM_WebService_SDK\​Sample_Code\PowerShell\​EoCFiles\eoc.xsd` | The IoCs against which to check are specified in an XML file that must conform to the following schema: `\SEPM_WebService_SDK\​Sample_Code\PowerShell\​EoCFiles\eoc.xsd` You specify the Evidence of Compromise (EoC) XML file as a parameter to the object that you pass to the EoC command.

See Running commands on clients.