×
×
×
×

Specifications and Settings

Last Updated On: 16 Oct 2026|
9 minutes read |

This page covers the system requirements for Malware Protection component and explains how to configure its key settings, including exclusions, data cleanup, notifications, scan settings, and add-on configurations.

System Requirements

To ensure optimal performance and security, the system must meet the requirements outlined below. These cover hardware and software compatibility, including supported operating systems, CPU and RAM usage, and network bandwidth. Failure to meet these specifications may result in reduced performance, compromised security, or system instability.

Note
Malware Protection (NGAV and Anti-Ransomware) is supported on Windows operating systems only. macOS and Linux endpoints enrolled in Endpoint Central do not receive NGAV/EDR capability.
SpecificationDetails
CompatibilityCan seamlessly coexist with antivirus software and other third-party security programs.
Supported client operating systems
  • Windows 8
  • Windows 8.1
  • Windows 10
  • Windows 11
Supported server operating systems
  • Windows Server 2012 R2
  • Windows Server 2016
  • Windows Server 2019
  • Windows Server 2022
CPU consumptionLess than 1%
RAM usageLess than 100 MB
Network bandwidthNegligible

Configuring Settings

To configure the settings below, navigate to Settings.

Exclusions

In certain scenarios, you may need to exclude specific files or folders from Malware Protection scrutiny — for example, to prevent false positives or avoid interference with trusted applications. Refer to this guide to add exclusions.

Exclusion Settings screen showing the option to add files and folders excluded from Malware Protection scans
Exclusion Settings — add files and folders to exclude from Malware Protection scans.
Note
Exercise caution when configuring exclusions — mismanagement may introduce security risks. Consult your IT security team for guidance before adding exclusions.

Cleanup Settings

This setting defines how long detected incidents and their related information are retained. Reducing the retention period can help optimize storage usage, but incident data will be permanently erased after the specified number of days.

Cleanup Settings screen showing the retention period configuration for detected Malware Protection incidents
Cleanup Settings — configure how long detected incident data is retained before automatic deletion.

Notification Settings

Configure notifications to keep administrators informed about security events and activities related to Malware Protection. The following notification channels are available:

  • Email notification — Enable email alerts and specify the email addresses of the administrators who should receive them.
  • Mobile app notification — Enable in-app alerts and select the admin users who should receive notifications through the mobile application.

Click Modify to configure or update the notification settings.

Notification Settings screen showing the email and mobile app notification configuration options for Malware Protection
Notification Settings — configure email and mobile app alerts for Malware Protection events.

Scan Settings

Scan settings let you configure how scan-based detection operates on managed endpoints. The following controls are available:

  • USB Scan — Enable or disable scanning of USB devices when connected.
  • On-Demand Agent Scan — Enable or disable the ability to trigger scans on demand from the agent.
  • Eject USB on Malware Detection — Automatically eject a USB device if malware is detected on it.
  • Scanning Toast UI — Show or hide the toast notification displayed to users during a scan.
  • Initiate Scan on Endpoint Registration — Automatically trigger a scan when an endpoint registers with the server.
  • Scheduled Scan Policy — Enable automatic scans at configured intervals for ongoing threat detection.

For detailed information about individual scan controls, removable storage scanning, scan schedules, scan modes, and performance settings, refer to the Configuring Scan Policy guide.

Scan Settings screen showing the USB Scan, On-Demand Scan, Scheduled Scan Policy, and other scan control toggles
Scan Settings — configure USB scan, on-demand scan, scheduled scan policy, and other endpoint scan controls.

Add-on Configurations

The Add-on Configurations section provides details about the Malware Protection add-on and its current subscription. The following information is displayed:

  • License type
  • Activation date
  • Subscription expiry date
  • Licensed modules
  • Number of licenses purchased and currently in use, for both workstation and server OS machines

Malware Protection requires a separate add-on license; it is not included in the regular Endpoint Central device or server license. An insufficient-license notification for Malware Protection can therefore appear even when the regular Endpoint Central license has unused capacity. Check the workstation and server OS license counts for the Malware Protection add-on separately.

You can also view and modify the Management Scope to control which endpoints have Malware Protection enabled. If the number of managed endpoints exceeds the available licenses, a license notification is displayed with an option to manage the plan.

Add-on Configurations screen showing license type, activation date, subscription expiry, licensed modules, and management scope settings
Add-on Configurations — license details, subscription status, and management scope for Malware Protection.
Disabling Malware Protection

You can disable Malware Protection when it is no longer required for your managed endpoints. Navigate to Add-on Configurations and click Disable Malware Protection or Disable Early Access, if it has been enabled through Early Access, to deactivate the module for endpoints within the configured management scope. Ensure that Malware Protection is no longer required before disabling it, as endpoints will no longer receive the security protection provided by the module.

After clicking Disable Malware Protection, the following occurs:

  • Policy is marked for removal on next agent refresh
  • Agent removes NGAV/Anti-Ransomware component during refresh (~90 minutes)
  • Quarantined files and incident history are deleted post disable.

Also, once the Malware Protection subscription or trial expires, the Add-on Configurations section becomes read-only. To re-enable Malware Protection, renew the subscription. Until renewal, agents on enrolled devices continue running NGAV but no policy changes can be made.