Do you run Antivirus Software on Domain Controllers?

Question

Do you run server-specific antivirus, regular antivirus, or no antivirus at all on your servers, particularly your Domain Controllers?

Here's some background about why I'm asking this question:

I've never questioned that antivirus software should be running on all windows machines, period. Lately I've had some obscure Active Directory related issues that I have tracked down to antivirus software running on our domain controllers.

The specific issue was that Symantec Endpoint Protection was running on all domain controllers. Occasionally, our Exchange server triggered a false-positive in Symantec's "Network Threat Protection" on each DC in sequence. After exhausting access to all DCs, Exchange began refusing requests, presumably because it could not communicate with any Global Catalog servers or perform any authentication.

Outages would last about ten minutes at a time, and would occur once every few days. It took a long time to isolate the problem because it was not easily reproducible and generally investigation was done after the issue resolved itself.

Answer 1

Anti-virus software should definitely be running on all machines in a properly-managed network, even if other threat prevention measures are in place. It should run on servers too, for two reasons: 1) they're the most critical computers in your environment, much more than client systems, and 2) they're no less at risk only because nobody actively uses (or at least should not being actively using) them for surfing the web: there's plenty of malware which can automatically spread across your network if it can get hold even of a single host.

That said, your problem is more related to properly configuring your anti-virus software.

The product you're using comes with built-in firewalling: that's something that should be taken into account when running it on server systems, and configured accordingly (or turned off at all).

Some years ago, anti-virus software was (in)famous for randomly deleting Exchange databases if by chance it came across a viral signature inside some e-mail message stored in the physical data file; every anti-virus vendor warned about this in the product manual, but some people still failed to grasp it and got their stores nuked.

There's no software you can "just install and run" without thinking twice about what you're doing.

Answer 2

All of our servers (including file/sql/exchange) run Symantec Antivirus with realtime scanning and weekly scheduled scans. The software increases the load on the machines by ~2% for average workloads (average 10% cpu usage during the day w/o realtime scanning, 11.5-12.5% with realtime scanning with on our file server).

Those cores weren't doing anything anyways.

YMMV.

Answer 3

I have always had AV software with on-access scanning enabled on all Windows servers and have been grateful for it more than once. You need software that is both effective and well behaved. While I know there are a few who will disagree I have to tell you that Symantec is about as bad a choice as you could make.

"All in one" type packages are rarely as effective as well chosen individual components (as in, I've never seen a decent example yet). Select what you need for protection and then choose each component separately for best protection and performance.

One thing to be aware of is that there's probably no AV product that has decent default settings. Most these days go for scanning both read and write. While that would be nice it often leads to performance problems. Bad enough at ay time but very bad when your DC has problems because a file it needs to access has been locked while the AV scanner is checking it. Most scanners also scan a very large number of file types that can't even be infected because they cannot contain active code. Check your settings and adjust with discretion.

Answer 4

We generally set up AV on a schedule and don't use Real-Time scanning (i.e., files aren't scanned as they are created).

That seems to avoid most issues that come up with having AV on a server. Since no one (ideally) is actually running anything on the server, the need for real time protection is diminished, especially considering the clients have AV with Real Time.

Answer 5

We run Vexira's server product on our servers, but it may be more a function of discounted pricing than effectiveness. We've had several workstations using their desktop product that will refuse to update unless we uninstall and reinstall with the latest version.

Answer 6

I get the feeling that a lot of these problems are caused by people configuring AV on servers as if they were home PCs. This may be down to shortsighted management, tightwad beancounters, rigid adherence to corporate policies that don't take proper account of different needs for different users/machines, or a former admin who wasn't quite up to scratch, but the end result is the same: havoc.

In an ideal world I would say "use a different AV product for your servers as is on your PCs, ensure before you buy it that it's a proper server AV product, and grab anything with the word 'Symantec' on it by the ears and throw it out the door".