On access virus scanning on Servers?

[maniac]

Necessary or not?

 

I ask because I'm covering for the technical staff at another school at the moment, and will be tomorrow as well. They are having a ton of problems with system slowdowns, and slowed down a lot about 10 minutes ago. Checking the error logs on the servers and I think it may be down to the McAfee virus scanner on-access scanning, as this has a lot of errors in the event log around the time the slow-down occured.

 

Not that I'm going to make the change myself, as it's not my system to meddle with, but I'm just interested if it's considered essential to have on-access scanning enabled on the servers or not, so that I may be able to make a recommendation to the staff working here.

 

Many thanks,

 

Mike.

[srochford]

There's loads of stuff on the MS web site.

 

In general, you want to avoid double scanning. For example, if you have home directories on a server then scan them server side and don't scan the network drive on the client (should make things quicker; file is scanned on server and blocked if it's bad rather than copied to client, scanned and blocked)

 

there are certain folders you should avoid scanning - on an Exchange server, don't scan the folder with the actual Exchange databases (MDBData); on a domain controller, don't scan the ntds.dit files and so on.

[matt40k]

Get Sophos. Just stop it checking certain directories, SIMS Setups etc.

[CHR1S]

All depends on load and overheads, personally I would use it on the client PCs and do a daily scan on the server during quiet times (I.E. Night).

[mullet_man]

We use Sophos, we have it set to on read on the clients, and off on servers, the servers then do a nighty scan at 9pm.

 

Also we turn off scanning remote files on the clients, so it doesn't read SIMs etc.

[ricki]

Set the sophos clients ie the pcs not to scan external drives like the server. You can do this in the management console otherwise the client and then the server scans the file which is a pain.

 

Give this a try.

 

Richard

[CyberNerd]

Mcafee can be told to exclude certain directories, files etc.

We don't have fileservers scan on access.