Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good morning,

Ok, I'm looking for a good stand alone antivirus program that will work within Windows Server 2008 running Citrix/Terminal Services, without trying to deploy antivirus clients or trying to control the Terminal Services connections, it just needs to run in the background and protect the server itself.

I've spent a few hours now searching and haven't found anything for the server environment that's not an endpoint solution that wants to administrate the entire network's antivirus. So far it looks like Nod32 or Kaspersky may do what I need, but, I can't see any definite yeah/nay on if they're going to behave on a server or if they're going to kill the TS connections/launch AV Clients.

share|improve this question
up vote 0 down vote accepted

I have used ESET NOD32 Business Edition on a terminal server with up to 80 concurrent users. No problems to report. If I recall correctly, the system tray process does run in each user session, but it's lightweight enough not to cause a problem. Of course, the UI is password-protected, so end users cannot make changes.

On the same terminal server, Symantec Endpoint Protection would cause the system to freeze periodically, as the client UI processes on each user session would work in concert to max out the CPUs (no small feat on a dual quad-core Xeon system). Symantec provided a hack to disable the UI component; this eliminated the freezes, but it introduced a new problem. Specifically, the disabled component apparently played a crucial role in scheduling or postponing reboots when they were needed to update the AV engine. So, every month or so, SEP would randomly reboot the terminal server for AV engine updates during the day, without any warning at all.

I definitely would not recommend Symantec/Norton AV for any purpose due to its unique blend of high cost and low performance, but it is especially detrimental to terminal servers.

share|improve this answer
Thanks for the reply. Yeah, this machine came with SEP, and it's been a nightmare from day one. Finally ended up uninstalling it, and in true Symantec fashion it didn't ever completely uninstall (cleanly). I have the feeling we'll be going with the Nod32, as long as it doesn't actively attempt to install processes on the client machine. Thanks again, – user57944 Oct 22 '10 at 16:26
As far as the incomplete uninstall goes, beware that Symantec's "Cleanwipe" tool also uninstalls the drivers for your ethernet adapter. This is probably their idea of a punishment for switching vendors, and it's not particularly funny if someone tries to run it on a remote server (or a few hundred PCs at once). – Skyhawk Oct 22 '10 at 17:05

microsoft forefront should do what you are looking to do

share|improve this answer
Unfortunately I don't have a multi-thousand dollar expense account for security software. After a look at ForeFront it would cost approximately $2,900...and it tries to take over the world from the reviews I've read on it. Thanks for the reply tho, always nice to have multiple options/opinions. – user57944 Oct 22 '10 at 16:30
2900? how many users do you have? I don't know what you've read about forefront but I think you must be looking at the wrong product. Forefront is the most unobtrusive AV software I've seen, I run it on my home and work PCs. – Jim B Oct 24 '10 at 22:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.