Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here's an argument that I've had at over a dozen companies:

Should you install an antivirus client on your Windows servers?

Obviously, you should not install AV on your SQL Server. I think there is also a general consensus that it doesn't belong on your web server.

But what about all of the other servers in an enterprise?

  • Exchange
  • Active Directory
  • File server
  • OCS
  • Utility servers
  • etc

Do you think it's appropriate to run AV on those machines?

share

locked by voretaq7 Nov 12 '12 at 6:10

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

2  
Poll: Should I change this to community wiki and keep it open/unanswered? After reading the replies, not sure there is a "correct" answer. –  Portman May 4 '09 at 13:38
    
I'd like to see opinions on web servers too –  Mauricio Scheffer Aug 31 '09 at 15:02

12 Answers 12

Yes, although for the most part they are configured to scan for viruses overnight with real-time file protection disabled, the exceptions are:

  • File servers - Set to scan on write only. Full nightly scan.
  • Sharepoint - No current anti-virus, waiting on Sophos for SharePoint to come out of beta.
  • Exchange - Exchange specific anti-virus soloution. Overnight scans exclude data stores.
  • Application Servers - SQL Data stores excluded from overnight scans.
  • AD/DC/DHCP - Overnight scan set to exclude service specific data files and logs
share
    
+++. This answer takes into account the idea that the risk vs reward equation is full of variables which hold different values. There is no canonical "yes" or "no" answer to the root question. There is only the (formal or informal) process of adding up the positives and the negatives, and answering the question on a case-by-case basis. The proper question is not simply 'should I run AV?' It is also 'how should that AV be configured?' –  quux Aug 26 '11 at 23:40

This sums up my opinion.

share
    
If it's a file server that lots of windows desktops store files on, then AV to scan the **** that the users bung on the server is probably better off being run on the server than on the desktops. –  Richard Gadsden Jun 1 '09 at 11:12
    
I'd say both, but I agree with your comment in general –  Mikeage Jun 7 '09 at 8:22
4  
@Mikeage, The problem is that the teacher is a pedophile, who is trying to reassure the parents by wearing a condom... The problem is the pedophile, not the condom. –  Chris S Aug 26 '11 at 18:55

Definitely yes on file servers; you can then scan the files people store on the server without having to rely on desktop AV (which can fail)

Exchange, I'd advise installing a proper exchange product (Sybari AntiGen was the original; that's now MS ForeFront for Exchange but there's lots of competition now) that will scan the content of the emails; there's little point scanning the file system on an exchange server.

AD, I wouldn't bother

OCS, get the Forefront plug-in if you're connecting to the outside world.

Basically, I don't think there's a one-size-fits-all answer to that question; you need to work out where the risks are. Generally, apart from a file server, I wouldn't suggest generic file AV on servers; you want something more specific to the role of the server.

share

We run AV on everything that has Windows. With basic configuration (excluding databases, scan on write only, etc) the overhead is so minimal that the cost is virtually zero. The one exception in my organization is Hyper-V Servers; which are very carefully isolated from the rest of the network.

Some would argue that the potential benefit is also almost zero; but seeing as the cost is similar they still balance. Security should be applied in layers, not held up by a single point like Atlas.

share

Generally I'd say you do want some sort of AV on many servers, yes, but, and this is a big one, you need to be careful with the exceptions.

First of all, Anti-Virus products can have a very significant impact on performance, especially with certain workloads. Make sure you are selecting the correct AV product for the machine, and make sure it's configured correctly.

Special note, be really careful with Exchange, and never install client-type AV software on it. We had a guy who brought our Exchange server to its knees at my previous job after he installed an AV client (intended for desktops) on it that was trying to scan every e-mail going in or out and operated very slowly.

share
3  
if you install the tools aimed at servers, this issue with regards to Exchange is nonexistent - every Exchange server I've personally run across is running a server AV tool –  warren Oct 8 '09 at 13:52
    
We had big problems here with a client type AV on an Exchange server. The company now provides a separate AV specially designed for Windows Server. –  kafka Aug 28 '12 at 13:56

A couple arguments in favor of running AV on Windows servers:

  • Not-so-capable users who happen to have access to the system, and may think it's a good idea to surf and install programs there. Adobe Reader, especially ancient Adobe Reader, is always just one malicious PDF download away from a disaster.
  • Alerting on the presence of common attack tools. A copy of netcat or pwdump getting dropped on the system is always a good thing to get notified about - this goes for external threats as well as internal ones.
share
1  
Even current and up to date Adobe Reader... –  Holocryptic Aug 26 '11 at 19:03
2  
@Holocryptic Really just anything that says "Adobe" on it. ;) –  Shane Madden Aug 26 '11 at 19:04

Many times it's not up to you. If you're bound by certain policies, it may be required. I'm not current on PCI standards, but back when they first came out, it required us to put AV software on all our servers.

share
2  
Yes PCI requires AV software on all servers. –  Aros Apr 19 '11 at 15:14

For SharePoint, I'd add ForeFront Security for SharePoint. You certainly want AV for documents uploaded to SharePoint.

share

I think the real argument for having AV on windows servers is Worms or other viruses that can spread without the need for a incompetent (or unlucky) admin. It has been a long time since I have seen a good worm that exploited a MS bug and could freely move from computer to computer. This requires no user or admin intervention to spread. Servers are especially dangerous as they are usually on 24x7 and many of them don't get logged onto on a regular basis (i.e. you may not see the problem(s) right away.

You then have to compare that against the risk of having your data stolen, servers potentially damaged, reputation hurt, time spent fixing, paranoia that you didn't clean it all up, etc...

My policy is that ALL windows boxes get AV installed on them (linux is different story). Tweaked to offer protection with minimal performance impact. Also boxes that run functions such as email will need AV that is specifically tailored to that environment. Nothing is worse than AV trying to dig into mail databases and grab viruses...

My two cents. Better be safe than sorry.

share

I have clamwin and do a weekly scan on my file server which doesn't see much activity. I had Symantec AV previously and the scan on file access was killing performance.

share

Yes. I use Trend Micro for most of my clients. The Worry Free Business Security 5.1 standard for boxes without Exchange and WFBS Advanced for those with.

The client gets installed automatically for the first server, and is an easy install for any others.

The Real Time will hopefully not be needed very often, but the sweeps I select for weekly or daily, after hours, can find things that might have been missed previously (i.e. virus was not part of the previous definitions).

The performance hit is rare, and the alternative is a nightmare, especially for a shared resource like a server.

Although, I have met a few admins who think nothing of re-mastering a box from a backup image... But I'd rather spend my time doing other things. :)

share

Antivirus is necessary only if "dumb" clients have execution/administrator rights on computers. So if your server admin is "dumb" then you DO need antivirus. If you have a REAL server admin - then he will never run any file on the server that does not come from trusted source. Admin can always scan a file on his own machine.

If a server is set up correctly - then it can NOT be affected by virus, even if there is a virus on it's fileshare. So for me it does not make any sense having antivirus on the server. For exchange - executable files should be forbiden. Have not seen virus in my email for last 6 years.

It is always better to have proper security set up on the client side, than slowing down the server just for the sake of pretending that it will be any safer.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.