I realize that this thread is quite old, but I felt that the topic wasn't discussed completely, as the only mention was in regards to Anti-Virus aka, 'AV' software protection on the DC server.
1.) In my opinion software AV's have come a long way in effectiveness, yet there are pitfalls. Not only is the AV potentially buggy, AV's have a tendency to consume memory and not release it, not good, in a production environment, can you really afford that? Ouch.
2.) Think about it... If your first line of defense starts on your DC and on other servers, you are already more than halfway defeated. Why should anyone want to begin their defense scheme on the inside of their servers???? To begin the effort of putting up active resistance against threats at the core of the network universe is insane. Putting up an active defense at this layer of your security model should mean that your network has been obliterated by hackers and you are trying to save your network in a last ditch attempt (yes, your network is no longer connected to anything on the outside and you are actively fighting the infection internally), that is how bad this should be in order to begin your defense on the DC and other servers. Filter out and actively defend against threats long before the threat is on your servers. How so? Item 3.
3.) This is why some CCIE/CCNP's make the big bucks. Any organization worth their salt will buy some type of hardware from Cisco / Barracuda / Juniper, or otherwise to get a hardware solution in place (because software AV doesn't come close to cutting the mustard). Most software AV's (even the often touted as Enterprise versions of Symantec, McAfee, Norton, etc, etc, etc...) simply do not come close to providing you the same protection as an IronPorts setup from Cisco, or other similar products from any major vendor. For a paltry $10k out of your IT Dept budget, you can have very respectable protection that software AV's simply won't provide you.
4.) I've chopped software AV's down to size, so allow me to build them back up. Software AV's, for me, are a must on any 'User' Workstations/PC's, no exceptions. They prevent the unknowing or malicious from hurting/destroying your networks from outside sources, for instance they brought in their flash drive from home and attempted to copy some work they did at home the previous night onto their Workstation. This area is the single biggest reason for having a good software AV. This is why software AV was invented (Vienna virus), for no other reason, woops.... almost forgot the real reason... to heist your money ok ok, nm.
5.) Anyways... Your DC is not really going to benefit or be hindered from having software AV on it. Your DB Servers, Web Servers are going to suffer, no software AV on them unless you really are under a known and sustained attack (you'll know of this firsthand because of IronPorts, etc,... mentioned in point 3).
6.) Last but not least, if you cannot afford a nice setup from Cisco or Juniper, go Linux! If you've got a spare machine or two laying around, check out your options with some of the OpenSource solutions available for your network... They are powerful... and as the chosen answer above highlighted, they must be configured correctly. Remember that CCIE/CCNP guy I was talking about..? Yep.