34
votes

Here's an argument that I've had at over a dozen companies:

Should you install an antivirus client on your Windows servers?

Obviously, you should not install AV on your SQL Server. I think there is also a general consensus that it doesn't belong on your web server.

But what about all of the other servers in an enterprise?

  • Exchange
  • Active Directory
  • File server
  • OCS
  • Utility servers
  • etc

Do you think it's appropriate to run AV on those machines?

2
  • 2
    Poll: Should I change this to community wiki and keep it open/unanswered? After reading the replies, not sure there is a "correct" answer.
    – Portman
    May 4, 2009 at 13:38
  • I'd like to see opinions on web servers too Aug 31, 2009 at 15:02

12 Answers 12

21
votes

Yes, although for the most part they are configured to scan for viruses overnight with real-time file protection disabled, the exceptions are:

  • File servers - Set to scan on write only. Full nightly scan.
  • Sharepoint - No current anti-virus, waiting on Sophos for SharePoint to come out of beta.
  • Exchange - Exchange specific anti-virus soloution. Overnight scans exclude data stores.
  • Application Servers - SQL Data stores excluded from overnight scans.
  • AD/DC/DHCP - Overnight scan set to exclude service specific data files and logs
1
  • +++. This answer takes into account the idea that the risk vs reward equation is full of variables which hold different values. There is no canonical "yes" or "no" answer to the root question. There is only the (formal or informal) process of adding up the positives and the negatives, and answering the question on a case-by-case basis. The proper question is not simply 'should I run AV?' It is also 'how should that AV be configured?'
    – quux
    Aug 26, 2011 at 23:40
19
votes

This sums up my opinion.

3
  • If it's a file server that lots of windows desktops store files on, then AV to scan the **** that the users bung on the server is probably better off being run on the server than on the desktops. Jun 1, 2009 at 11:12
  • I'd say both, but I agree with your comment in general
    – Mikeage
    Jun 7, 2009 at 8:22
  • 4
    @Mikeage, The problem is that the teacher is a pedophile, who is trying to reassure the parents by wearing a condom... The problem is the pedophile, not the condom.
    – Chris S
    Aug 26, 2011 at 18:55
14
votes

Definitely yes on file servers; you can then scan the files people store on the server without having to rely on desktop AV (which can fail)

Exchange, I'd advise installing a proper exchange product (Sybari AntiGen was the original; that's now MS ForeFront for Exchange but there's lots of competition now) that will scan the content of the emails; there's little point scanning the file system on an exchange server.

AD, I wouldn't bother

OCS, get the Forefront plug-in if you're connecting to the outside world.

Basically, I don't think there's a one-size-fits-all answer to that question; you need to work out where the risks are. Generally, apart from a file server, I wouldn't suggest generic file AV on servers; you want something more specific to the role of the server.

6
votes

We run AV on everything that has Windows. With basic configuration (excluding databases, scan on write only, etc) the overhead is so minimal that the cost is virtually zero. The one exception in my organization is Hyper-V Servers; which are very carefully isolated from the rest of the network.

Some would argue that the potential benefit is also almost zero; but seeing as the cost is similar they still balance. Security should be applied in layers, not held up by a single point like Atlas.

4
votes

Generally I'd say you do want some sort of AV on many servers, yes, but, and this is a big one, you need to be careful with the exceptions.

First of all, Anti-Virus products can have a very significant impact on performance, especially with certain workloads. Make sure you are selecting the correct AV product for the machine, and make sure it's configured correctly.

Special note, be really careful with Exchange, and never install client-type AV software on it. We had a guy who brought our Exchange server to its knees at my previous job after he installed an AV client (intended for desktops) on it that was trying to scan every e-mail going in or out and operated very slowly.

2
  • 3
    if you install the tools aimed at servers, this issue with regards to Exchange is nonexistent - every Exchange server I've personally run across is running a server AV tool
    – warren
    Oct 8, 2009 at 13:52
  • We had big problems here with a client type AV on an Exchange server. The company now provides a separate AV specially designed for Windows Server.
    – kafka
    Aug 28, 2012 at 13:56
4
votes

A couple arguments in favor of running AV on Windows servers:

  • Not-so-capable users who happen to have access to the system, and may think it's a good idea to surf and install programs there. Adobe Reader, especially ancient Adobe Reader, is always just one malicious PDF download away from a disaster.
  • Alerting on the presence of common attack tools. A copy of netcat or pwdump getting dropped on the system is always a good thing to get notified about - this goes for external threats as well as internal ones.
2
  • 1
    Even current and up to date Adobe Reader... Aug 26, 2011 at 19:03
  • 2
    @Holocryptic Really just anything that says "Adobe" on it. ;) Aug 26, 2011 at 19:04
3
votes

Many times it's not up to you. If you're bound by certain policies, it may be required. I'm not current on PCI standards, but back when they first came out, it required us to put AV software on all our servers.

1
  • 2
    Yes PCI requires AV software on all servers.
    – Aros
    Apr 19, 2011 at 15:14
1
vote

For SharePoint, I'd add ForeFront Security for SharePoint. You certainly want AV for documents uploaded to SharePoint.

1
vote

I think the real argument for having AV on windows servers is Worms or other viruses that can spread without the need for a incompetent (or unlucky) admin. It has been a long time since I have seen a good worm that exploited a MS bug and could freely move from computer to computer. This requires no user or admin intervention to spread. Servers are especially dangerous as they are usually on 24x7 and many of them don't get logged onto on a regular basis (i.e. you may not see the problem(s) right away.

You then have to compare that against the risk of having your data stolen, servers potentially damaged, reputation hurt, time spent fixing, paranoia that you didn't clean it all up, etc...

My policy is that ALL windows boxes get AV installed on them (linux is different story). Tweaked to offer protection with minimal performance impact. Also boxes that run functions such as email will need AV that is specifically tailored to that environment. Nothing is worse than AV trying to dig into mail databases and grab viruses...

My two cents. Better be safe than sorry.

0
votes

I have clamwin and do a weekly scan on my file server which doesn't see much activity. I had Symantec AV previously and the scan on file access was killing performance.

0
votes

Yes. I use Trend Micro for most of my clients. The Worry Free Business Security 5.1 standard for boxes without Exchange and WFBS Advanced for those with.

The client gets installed automatically for the first server, and is an easy install for any others.

The Real Time will hopefully not be needed very often, but the sweeps I select for weekly or daily, after hours, can find things that might have been missed previously (i.e. virus was not part of the previous definitions).

The performance hit is rare, and the alternative is a nightmare, especially for a shared resource like a server.

Although, I have met a few admins who think nothing of re-mastering a box from a backup image... But I'd rather spend my time doing other things. :)

-4
votes

Antivirus is necessary only if "dumb" clients have execution/administrator rights on computers. So if your server admin is "dumb" then you DO need antivirus. If you have a REAL server admin - then he will never run any file on the server that does not come from trusted source. Admin can always scan a file on his own machine.

If a server is set up correctly - then it can NOT be affected by virus, even if there is a virus on it's fileshare. So for me it does not make any sense having antivirus on the server. For exchange - executable files should be forbiden. Have not seen virus in my email for last 6 years.

It is always better to have proper security set up on the client side, than slowing down the server just for the sake of pretending that it will be any safer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .