0

Let's say an organization has a department with 10-15 users who sometimes need to share files between each other. They currently have an open share, where anyone read read / write to the share.

If such a share were in place, would this be a vector for malware or worms to quickly propagate between machines? Would it be a "best practice" to have an AV scanner run on each write to the share, or something similar?

6

Are file shares a vector for malware to propagate? Absolutely.

Does the share being wide open vs. restricted to authenticated/authorized users make a difference? Not really. In my experience, most of your infection vectors will be from authenticated users and not rogue machines on your network.

Should you have an AV solution in place to monitor the share? Of course. But whether it needs to be something that actively scans each write is debatable and depends largely on the workload and your business needs. Many places do just fine with a periodic scan. Presumably, your AV solution on the server is combined with an AV solution on your clients as well, right?

| improve this answer | |
  • Hey Ryan, thanks for the answer. I'm pretty new to networking, especially domains, which is why I asked this question. All clients have antivirus, but I have read in a few places (including some TechNet article) that AV on servers is not recommended (despite the whole defense in depth thing - and messing with AD objects, etc. if it's set to scan them). Should file-sharing services be separate from the AD server so that they can be scanned as well as not hosting malware on the AD-DC? – cutrightjm Dec 17 '14 at 6:08
  • 3
    but I have read in a few places (including some TechNet article) that AV on servers is not recommended - Generally speaking, I would disagree with that statement for the majority of Windows systems. You should have AV software installed on your file server as well as on most, if not all, of your other Windows servers. Knowing what impact AV software can have on a particular role and knowing how to configure AV software for the specific role (Exchange, SQL, AD, etc.) is important. – joeqwerty Dec 17 '14 at 6:58
  • 1
    I agree with joeqwerty. Antivirus is a must, but don't just install and run. Vendors should have a white paper for installing on a server with X roles on it. – blaughw Dec 19 '14 at 3:55
  • 1
    And it really depends what you do. SQL Server - no need for AV because data is not viruses and noone except the admin for maintenance will anyway access it. File server: MUST HAVE. – TomTom Dec 20 '14 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.