I am a developer, not a sysadmin, so I am seeking out some opinions and answers about virtualization. In order to solve some project deadline issues, the development team installed and setup a Windows Server 2008 Hyper-V "Bare Metal" edition (meaning there is very little of the Windows UI and functionality). The IT department has correctly raised some security concerns, and I have not been able to locate answers for them through Google searches.

  • Can the Bare Metal version run an antivirus product? Meaning the host OS, not the guest VMs. If no, how do you get around this limitation? Just leave the host open to attack? If yes, which ones are supported? Security Essentials only? Or are Symantec and other vendors supported?

  • Are group policies pushed to the Bare Metal version?

Thanks in advance for your expertise!


I'd say don't do it. Read this.

With a stripped down bare-metal hypervisor server, you shouldn't need it. A virus needs an attack vector...how is it getting on that machine? Network shares? Email? Web browsing? If it's a type-one hypervisor machine, it shouldn't have network services or workstation-like uses open to it.

Plus your adding scanning issues (what, you're going to have the AV file scanner real-time scanning virtual hard drives with each access?), security issues (AV software have bugs too), and you're increasing the attack surface (software that can be exploited) PLUS you can have issues if the software stops working, has update issues, etc. and all of that is on top of AV software being an imperfect solution in the first place to malware and viruses.

The full answer is that yes, it looks like you can run AV, and exclude most of the files that I railed on just a moment ago (but I wanted to emphasize...what are you putting on that computer aside from VM's and the base OS if it's bare-metal?) See here for information. I personally wouldn't want to do it and if you're using the machine properly, I think the only thing that needs the AV are the guests. The bare-metal system should be protected in that it is not running services other than the bare minimum necessary and not being used as a workstation, so the attack surface should be very very shallow.

If it were exploited, the work comes in restoring the VM's; even a reinstall of the hypervisor should be cake as it's meant to be very thin and small to restore from scratch.

| improve this answer | |
  • 1
    +1 Who hasn't seen antivirus software crash and bring down the machine? Then there is the problem of the very significant extra load that would be placed on the host (who hasn't complained about AV software slowing their machine down by an absurd amount?). – John Gardeniers Sep 30 '10 at 12:33
  • 1
    +1 Best practices are to keep the VH as stripped down as possible, no AV, and minimize every possible attack vector. Also, most viruses spread via user mistake or exploits in user programs. – Chris S Sep 30 '10 at 12:39
  • @John Agreed, but it is the policy framework which I must work within. – mgnoonan Sep 30 '10 at 12:40
  • Or on servers that in themselves get little extra attention having someone remember to check an obscure software package is still working properly (wait, this hasn't updated signatures in three months and it didn't alert me? Bloody @#%!) – Bart Silverstrim Sep 30 '10 at 12:40
  • 1
    @mgnoonan: work on getting the policy altered. You can damage the server and cause downtime pursuing that route. And if you take out one virtual host, you take out...how many VM's?... – Bart Silverstrim Sep 30 '10 at 12:41

I found that Kapersky, Sophos, and McAfee support Server 2008 Core edition. Main concerns would be that the product can be installed from a remote console, a remote script, or from command line (which is the majority of the interface that Core provides...)

It's likely that Symantec and Trend do as well, given that their previous editions could be managed entirely from the management console.

As said in the comments above, Check for Microsoft guidance with regards to AV, and ensure that any AV vendor supports Hyper-V.

UPDATE: A couple of resources:

Planning for Hyper-V Security

Microsoft KB961804

| improve this answer | |

I know that Kaspersky 6 works just fine using Server 2008 Core editions (which is the proper name as the regular version is bare-metal too by the way). Could tell you about other products sorry.

| improve this answer | |
  • 2
    Here's what confuses me; for bare-metal hypervisors, why would you need antiviruses? Nothing should be exposed on those systems other than an API to interact with a management tool of some sort. Other network services aren't turned off? Back when I was a young'un, I didn't use a software firewall because if you didn't want the service exploited, you didn't run it, and the services that did run you could limit in tcpwrappers for who got in...maybe I'm just rambling now. – Bart Silverstrim Sep 30 '10 at 12:15
  • Server Core is a different product. Hyper-V is a bare-metal hypervisor, Server Core is just a regular server OS which is stripped down. – ThatGraemeGuy Sep 30 '10 at 12:15
  • 1
    @Chopper3: I think you can. It's been a few months but you used to download Hyper-V for free as a standalone bare-metal server. It was to compete with ESXi (free) or Xen (or whatever Citrix called their free edition). So you can find and download a hyper-v server for free. – Bart Silverstrim Sep 30 '10 at 12:38
  • 1
    New feature req: comments shown as a tree that branches out to know where and what comments are referring to. HA! – Bart Silverstrim Sep 30 '10 at 12:39
  • 2
    @Bart, @Chopper3, @gWaldo; Hyper-V is a bare metal Hypervisor. The OS sits on top of it; and has special privileges to certain hardware, VMs show up as processes under it (but they are not the actual processes, it's actually a monitoring process), and is also responsible for storage access for the hypervisor. Hyper-V is not a service. Virtual Server and VirtualPC use paravirtualization and run as a service/application within the Host. – Chris S Sep 30 '10 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.