attn: server admins

[Myst]

I'm running about a 350 client domain controller and about 40 VM's. I'm wondering if any other server admins out there put anti virus on the actual server box. I shudder at the thought of CPU slowdown, but a virus would suck even more.

This is my defense for not getting antivirus for the server:

We have symantec for all of our clients, and since the only way for the server to get a virus is from it's own network, if the virus gets by a user's antivirus system it would have gotten through said server antivirus. Is my logic flawed? i'm scaring the shit out of the new server guy, and i'm starting to question my judgment. any feedback from server admins would be appreciated.

[Saphirea]

my reccomendation is take a seperate box and make it a NAV Server and make it push virus updates to clients on a daily. It will help with server slow down.

I too agree though with your logic as far as not running it on a server if it has no outside connection to the world.

However; does it run DNS for internal / external queries? That could become an issue as far as possible cache poisoning.

[Myst]

Our domain controllers are internal dns servers only. they dont accept external queries.

[Saphirea]

then i dont really see a problem with this set up... Mind you, I haven't been dealing with servers for quite a few years.

I still don't think you'll have a problem as long as they have nothing reaching out elsewhere.

[Mizango]

Fortunately I have been in situations where we have had to have server side Antivirus as well as hosting it on separate box and having it strictly client side. The ONLY issues I have ever had server side is when it is doing some sort of an update, then yes, you can and will experience some sort of lag. I wont lie, it does suck can be a real pain in the ass, but other times it is hardly noticeable.

On topic, Slovak AV makes a really neat AV for any platforms (Windows,OpenBSD, Linux etc...) that you may be running. I personally use it one of my Linux boxes at home. I mean you could just map the drives right? But then again that really does not solve the issue(s) at hand due to the fact that since you would be scanning the drives that would leave your client side memory or a page that a client p.c. has currently loaded, exposed as a potential problem waiting to happen.


Edit: I will post when I get home and let you know the exact name. I beta test a lot of crap and I cant think of it atm. That and the fact that its Monday.

[Cephius]

Like you said the only way it's going to get infected is if Symantec misses something and allows it to spread over your network. You'd need to install the client in that case to get rid of the virus, so I guess my question is why not? If you use a SAV server machine to push updates you can use the admin console to get a decent overview of the company to see who's online, who's blocking updates from getting pushed, what servers are online ect. It's a nice tool to have, so if you have the ability I think you should set it up, it's not like there are any bad side effects.