Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What do you use or recommend for an enterprise anti-virus solution? Please include your good and bad experiences; they're valuable information for others considering solutions.

Please be specific about versions, some products have improved or not over the years.

Consider the term enterprise anti-virus to mean a company-wide or location-wide managed anti-virus solution that mostly consists of a central server that administers the updates and communications with the anti-virus clients.

This is not limited to Windows environments only.

Note: made into community wiki since there is not a definitive answer. Just looking for a collection of experiences to help others make a more informed buying decision.

share|improve this question

closed as off-topic by Falcon Momot, Jacob, Jenny D, MadHatter, Bryan Jul 18 '13 at 11:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Falcon Momot, Jacob, Jenny D, MadHatter, Bryan
If this question can be reworded to fit the rules in the help center, please edit the question.

add comment

14 Answers

up vote 13 down vote accepted

My organization uses Symantec Endpoint Protection (version 11). As many of you know, Symantec products were not the best during the last few years. I am happy to report that the newest version performs much better. It has a small memory footprint and thanks to pull updates, it will not clog your network with useless traffic. It has powerful management capabilities, you can define very granular policies that apply to specific organizational groups, users or even locations (i.e. different policies for out of office laptops vs ones currently in the office).

This is a very powerful tool that is not only an antivirus, but an Endpoint Compliance product as well. With that beings said, I think that the management console has a steep learning curve and is not intuitive at all. Trying to implement something new will often lead you to reading the documentation and FAQs. There is also no real time reporting from the clients like in the old Symantec Antivirus. In case of an infection, you have to generate multiple reports (again, not intuitive), schedule a full scan, and WAIT for results to appear at some point, since the client does not report in real time, but rather gives periodic updates to the console.

Oh, and of course: Microsoft only.

share|improve this answer
    
We used Symantec Endpoint Protection version 9 and 10. The upgrade from 9 to 10 was super painful, which is why we are now using Trend Micro. Thanks for your comments on version 11. It's nice to see that the memory and performance has improved, but unfortunate that the management tools have not. –  Brian May 29 '09 at 17:05
    
Much as I hate to admit it, Symantec (v11 now) support is pretty stellar. At least, after the fact. Found out AFTER the install that anyone who'd installed VMWare player (not standard load) would have their Symantec installation corrupted on upgrade. At least they were quick to ID the issue and send me a resolution. –  Kara Marfia May 29 '09 at 17:13
    
I can confirm that Symantec support, although outsourced, has improved drastically over the years and all of our issues were resolved quickly. This includes issues with SEPM and Backup Exec. I would give them a B+ for support. –  kamilg33k May 29 '09 at 17:19
    
That's good to know, I've been holding out with Symantec Corporate 10.2 after the trouble with earlier upgrades. –  charlesbridge May 29 '09 at 18:41
    
At work, we use Symantec as well. For some reason Symantec AV for business is pretty good while the consumer version blow. –  Jack May 30 '09 at 5:45
show 3 more comments

We use ESET Nod32. It's pretty well known and has Advanced+ detection rates, as rated by Av-Comparatives.

The features I most like about it are:

  • Very small footprint
  • Management console notifies and reports on threats, as well as missing Windows updates in real time.
share|improve this answer
add comment

We are currently using Symantec Antivirus Corporate 10.1 (precursor to Endpoint Protection), but are considering upgrading to NOD32. We have heard great things about NOD32, and is apparently cheaper.

You can view comparisons of viable solutions at the AV Comparatives site.

share|improve this answer
add comment

This is a good resource-

It has indepth reviews on a handful of enterprise AV options, including screenshots and lots of tables.

share|improve this answer
add comment

Has anybody tried or used Eeye's Blink? How do you feel about it compared to something like Symantec Endpoint?

share|improve this answer
add comment

Just bough Symantec Endpoint Protection 12 and it has worked pretty well. The interface is not bad at all. System resource is light as well.

share|improve this answer
add comment

We use Sophos Enterprise Edition and it works brilliantly for us, granted we're relatively small (~120 desktops) but it basically runs itself - as long as your desktop permissions are set correctly, it will remotely deploy itself to new machines and take care of business from there. We also install the standalone version on the PCs of any staff who are remoting back into the office from home (a free perk of having the enterprise version).

share|improve this answer
    
You're soooooooooo right to say "as long as your desktop permissions are set correctly". I had a lot of trouble at the beginning with DCOM permissions. –  Manu Jul 23 '09 at 19:32
add comment

I've been using TrendMicro OfficeScan for 6 or 7 years, and have been very happy with it. I've had no true infections. The management console is web based and isn't the greatest, but it works.

share|improve this answer
add comment

We just moved from Symantec Endpoint Protection to VIPRE Enterprise by Sunbelt Software. They tout small resources, small footprint and quick scans compared to the other vendors. Of course, they did seem to be comparing their software to the consumer versions of other software.

It does seem as though it uses less resources but it still slows old computers down so much that it is hard to use them while scanning.

I have gotten used to the management tool and it works pretty well.

I did notice that the active protection really slowed down one of our internal web sites as it would scan the files that were cached in Temporary Internet Files. With active protection off, the website went from taking at 5 seconds to load to under a second. I have found a way of reducing this result by making some changes to the policies within the management console.

Overall, I'm decently happy with it for now. The long term will tell.

share|improve this answer
add comment

We currently use Trend Micro and it has been ok. So far, it has worked well as a set it and forget it. It keeps the updates flowing. The reporting leaves a lot to be desired.

share|improve this answer
add comment

We're using NORMAN antivirus here, 50+ clients 5+ servers, prior to that we were using AVG, everything was good except that AVG is a bit slow on updating it's virus database for local virus. (we have dozens crop up every month here in my country)

With norman, if i can submit a new undetected virus, i got a free 1 year subscription.

Ps. and i don't work for norman, hehe.

Norman SMB Solution

share|improve this answer
add comment

We use Computer Associates eTrust AV at my company of ~120 local and 10 remote users. I've found it to be bloated, expensive, and the source of more than a few problems when it actively scans all incoming/outgoing files.

I co-oped at a university where we used McAfee's ePO with VirusScan 8.5i. I'd agree with Kevin, it was quite bloated and would suck up a ton of system resources. I don't have any experiences with AVG/Avast enterprise, but their free for personal use solutions are great. (I'm running Windows 7 RC with AVG free on my home desktop, and Windows 7 RC with Avast on my home laptop)

share|improve this answer
add comment

As opposed to the Symantec solution mentioned above, McAfee has continued to become more and more bloated. The current version of McAfee VirusScan Enterprise (8.5i) is a severe enough resource hog that even fairly powerful systems will experience a performance hit.

I haven't used the central administration portion, but I have heard that it's terrible.

share|improve this answer
    
Actually 8.7i is current and it's decently better than 8.5i. We have it deployed on over 2000 machines and no one complains about performance issues. The new EPO Server can be managed by a remote console so you don't need to go through the garbage web interface anymore either. –  MDMarra Jul 23 '09 at 6:41
    
Thanks for the information, I'll have to see if our licensing allows for the upgrade to the newer version. –  KevinH Jul 23 '09 at 13:22
add comment

I tried several solutions including :

  • AVG : dropped because it let a virus enter our network...

  • Avast : dropped because it puts a very heavy weight on our servers

  • Sophos : a very good solution, too bad their technical support is very slow to answer Sophos provides a log of useful fonctionnality including ActiveDirectory automatic synchronisation and deployment

share|improve this answer
1  
ALL av software will let a virus through sooner or later, so don't judge a product by just one failure. We use Sophos and that also let a virus through a few months ago. Luckily my personal machine had AVG, which did block it and left me one clean machine from which to start the cleanup. –  John Gardeniers Jul 23 '09 at 4:55
    
To those using Sophos: How do you compare the administrative console to other solutions? We are using Sophos and are not happy. One of the biggest reasons is that we find the administrative console nearly useless. The reporting is not accurate (is it infected or not?) and it cannot adequately clean infected machines, even if it is a relatively minor infection. –  J.Zimmerman Jul 23 '09 at 8:40
    
I know that any AV solution may fail. That's why we choose to protect our computer with a combinaison of sophos and antivir (from avira). (plus two or three AVG and avast "just in case"). I agree that the sophos administrative console is poor in information but I find it ok for my needs. I only miss the fact that I cannot get a centralized report of a programmed analysis. –  Manu Jul 23 '09 at 19:30
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.