I'd like to create a group with all computers which have the on access scan disabled.

Actually when a computer have the scan disabled, the service "Network Associates McShield" is on Paused.

So how can I do to have a group of these computers?

thank you.

In order to determine how we can make a configuration group for this, we need to ask some follow up questions:

·         Is the process associated with Network Associates McShield scan service running when the service is in the paused state?

·         Is there any indication in the registry settings for the service to indicate it is in the paused state? Check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<McShield Service name>.  There are values called Start and Type. What are those set to? Are there any other values that may be relevant to the paused state?

Let us know what you learn.