Comments on: Is it necessary to have anti-virus on a Windows 2008 file server?

Question: Is it necessary to have anti-virus on a Windows 2008 file server?

colecovizion — Fri, 07 Sep 2012 15:51:04 -0800

Is it necessary to have anti-virus on a Windows 2008 file server?

My IT guy says it's not necessary to have any antivirus on our file server. He says it takes too many resources and that viruses are incapable of executing from clients.

This doesn't sound safe to me. My approach would be to install antivirus and disable real-time scanning. I would set a schedule for scans.

What is the best approach to ensure that we are protected?

Details: We have Kaspersky Business Space Security (which includes a license for a special Kaspersky File Server Version)

By: Cosine

Cosine — Fri, 07 Sep 2012 16:04:32 -0800

Sysadmin here, I manage around 1,000 servers, half of these run Windows, with very few exceptions all the Windows boxes run AV, we use MS Forefront and find it is pretty light on resources. It's just good IT practice.

By: deadmessenger

deadmessenger — Fri, 07 Sep 2012 16:14:16 -0800

21 year systems and security guy here. If I were to do a security audit on your company's systems, no AV on a piece of critical infrastructure would be almost certainly listed as a moderate-to-high risk deficiency, depending on any other mitigating controls.

So yes, you should most definitely have AV on your file server, it's just a no-brainer. Of course it consumes resources, but that just means that a good sysadmin should size the server to accommodate the additional resource hit. AV isn't a security panacea, but it's still a very necessary piece of defense in depth.

By: Diag

Diag — Fri, 07 Sep 2012 16:21:43 -0800

We run a Netapp NAS cluster for file sharing. While the NAS itself is highly unlikely to be infected (it runs a propitiatory O/S), it can certainly store virii and share them out to ~4000 connected CIFS users.

We have 4 dedicated A/V servers which constantly scan the NAS on file access, along with end-point A/V on every user's XP desktop.

By: pla

pla — Fri, 07 Sep 2012 16:44:57 -0800

Yes. Absolutely.

Your IT guy has apparently never heard of zero-day remote exploits.

Someday (probably his last day on whatever job he has at that time), he will.

By: colecovizion

colecovizion — Fri, 07 Sep 2012 17:25:40 -0800

Wow, thanks for all the experienced answers! It looks like it is unanimous.

By: jannw

jannw — Sat, 08 Sep 2012 10:24:24 -0800

Yep ... get this for a laugh ... I had a novel netware server wipe itself from a Dos boot sector virus on the boot partition ... (back in 1998) ... just because it is unlikely that the server will ever execute infected code doesn't mean that it can't somehow find its way on and cause havoc!

By: odinsdream

odinsdream — Sat, 08 Sep 2012 15:25:18 -0800

My IT guy says it's not necessary to have any antivirus on our file server. He says it takes too many resources and that viruses are incapable of executing from clients.

This is provably ridiculous. Drop a non-virus EXE on the fileserver and double-click it from a connected client. It will run.