Sims & AntiVirus

[storkyIV]

Hi Guys,

 

I am in the process of rolling out symantec endpoint protection to all of our servers and client machines.

I haven't released this to our sims server as yet, because I seem to remember something about SQL and antivirus, but I cannot for the life of me remeber what this was.

 

Has anyone had any problems installing and running any antivirus on sims servers?

 

Any feedback would be useful.

 

Regards

[teejay]

Exclude the SQL folder, Document server folder and SIMS folder from the realtime scan. Schedule a scan overnight to do these.

Few tips with Endpoint:

Make sure you have the current MR5 release. MR4 works fine as well, but anything before that is a pain.

On servers only install Antivirus and Anti Spyware, don't install network threat protection or any of the other stuff. In fact, especially to start with do this on your workstations as well, as if you get the other stuff misconfigured (which it is by default!) you will end up with a complete nightmare.

[pete]

Our (mcafee) exclusions for SQL servers are:

 

.mdf, .ldf and the .ndf extension

.bak and .trn

 

DRIVE:\Program Files\Microsoft SQL Server\**\OLAP\Data\ (MSSQL folder name can be MSSQL.1 or MSSQL.2 etc etc. Using a '**' allows any number to be allowed in mcafee)

DRIVE:\Program Files\Microsoft SQL Server\**\OLAP\Backup\

DRIVE:\Program Files\Microsoft SQL Server\**\OLAP\Log\

 

IIRC these were pulled from a technet article that I can't find now

[Edu-IT]

I take it these exceptions should be added to the likes of Sophos too? I've disabled on access scanning on all servers.

[storkyIV]

Disabled on access scanning on all servers? Is that wise on something like the file server?

End point at the moment is real time protecting all servers (apart from sims) with no degredation of service. I'm quite impressed with symantec for once!

[pete]

Disabled on access scanning on all servers? Is that wise on something like the file server?

End point at the moment is real time protecting all servers (apart from sims) with no degredation of service. I'm quite impressed with symantec for once!

 

The answer is "It's a hotly contested topic". Not quite emacs vs vim, but....

 

If you're seeing no performance degredation or strangeness as a result, keep going with what you do. The main concern with servers is ensuring the AV doesn't do something stupid (such as, say quarantining the exchange db) because it thinks it may have detected something. Some AV is better at this than others.

 

Our fileservers scan shares on write and there's also a scheduled nightly scan.

[Edu-IT]

Disabled on access scanning on all servers? Is that wise on something like the file server?

Yes. A bad call on my part. Changed! Thanks.