Anti-Virus best practice for File Server

[fiza]

What is best practice for Anti-Virus on File Servers? Should on-access scanning be disabled and a scheduled scan done every night?

[fiza]

anyone?

[Rob_D]

We do scheduled scan every night to reduce server load.

And all the end-user PCs have OAS enabled so that should be scanning the shares anyway.

[chazzy2501]

I put in the server version of the AV program and accept the defaults.

[Zoom7000]

What is best practice for Anti-Virus on File Servers? Should on-access scanning be disabled and a scheduled scan done every night?

 

Wouldn't you want on-access scanning switched on given ransomware attacks? I know the historical arguments about causing delays when opening files, but in this case it's better safe than sorry right?

[fiza]

We have Sophos Central and our problem seems to be that Sophos scanning is taking up all the RAM (16GB) on the File Server which then grinds to a halt. The Scan is activating on write and on read which we thought might be the reason its hogging the RAM.

[mikemcsharry]

Have you asked Sophos for any ideas? Isuspect if you put more RAM in it will eat that as well. Just trying to think this logically..

If you are scanning as the file is written, at the server level, then you're also scanning it on any modifications.

If that's so then the bulk of reads are actually done by clients, so if they have on access scanning in place then maybe you don't need read at the server level.

I'm not entirley sure if my logic is correct there, what does anyone else think?

[TwistedHelixis]

I think we do it the other way round and disable clients from scanning network drives but have on access for any drives on the server.

[CHiLL]

We have OAS disabled on the servers, with a scheduled scan every night. Our clients have OAS enabled and specifically excluded network shares from the scheduled scan.

[TechMonkey]

We have OAS disabled on the servers, with a scheduled scan every night. Our clients have OAS enabled and specifically excluded network shares from the scheduled scan.

 

This. All recommendations I have seen have said disable OAS as it could grind your server to a halt or disrupt file actions. If a client is uploading a dodgy file then it would detect it and act, rather than the server. The nightly scans are a belt and braces measure.