You are here: Home » MOSS AntiVirus Guidelines

MOSS AntiVirus Guidelines

Posted by bobbyhabib
No Comments »

I find that a lot of companies implementing MOSS into their organisations are not really thinking about Antivirus software that is running at the Operating System level. There are a number of products out there talking about MOSS Antivirus plug in etc, but these plug in are checking for documents that are being pushed into MOSS for viruses.

MS Fore Front Security for SharePoint:

http://www.microsoft.com/forefront/sharepoint/en/us/product-overview.aspx

McAfee:

http://us.trendmicro.com/us/products/enterprise/portalprotect/index.html

But there seems to be a big area that companies are forgetting about, that can effect the stability of MOSS servers and cause a lot of issues that really confuse IT professionals. The OPERATING SYSTEM ANTIVIRUS. Wink

To rule out any interference that the operating system antivirus software might bring to SharePoint's stability, the following exclusions from the antivirus real-time scan are recommended:

Windows 2003 Server

 

ú    The %systemroot% is normally the C:WINDOWS or C:WINNT directory depending on your OSú    %systemroot%System32Spool (and all the sub-folders and files)ú    %systemroot%SoftwareDistributionDatastoreú    Any Network Drives that are mapped Refer to the following article for information:

KB822158 – Virus scanning recommendations for computers that are running Windows
Server 2003, Windows 2000, or Windows XP http://support.microsoft.com/kb/822158
 

Internet Information Server

 The IIS compression directory (default compression directory is %systemroot%IIS Temporary Compressed Files)
 %systemroot%system32inetsrv folder
 Files that have the .log extension
Refer to the following knowledge base articles for reference:
KB817442 – IIS 6.0: Antivirus Scanning of IIS Compression Directory May Result in 0-Byte File
http://support.microsoft.com/kb/817442
KB821749 – Antivirus software may cause IIS to stop unexpectedly http://support.microsoft.com/kb/821749

SQL Server

 Exclude .MDF, .LDF, .NDF, .TRN, .BAK and .SLS
 Exclude sqlmangr.exe and sqlservr.exe
 SQL folder and databases files (or database file types) from scanning for performance reasons:
KB309422 – Guidelines for choosing antivirus software to run on the computers that are running SQL Server http://support.microsoft.com/kb/309422

WSS 3,0 / MOSS 2007 

 Drive:Program FilesMicrosoft Office Servers12.0
 Drive:Program FilesCommon FilesMicrosoft Sharedweb server extensions12
 Drive:DOCUME~1ALLUSE~1APPLICATION DATAMICROSOFTFIREWALL CLIENT*
 Drive:WINDOWSTempWebTempDir*
 Drive:DOCUMENTS AND SETTINGS<SPSServiceAccount>LOCAL SETTINGSAPPLICATION DATA*
 Drive:Documents and Settings\<SPSServiceAccount>Local SettingsTemp*
 Drive:WINDOWSsystem32LogFiles
 W3wp.exe, cbd.exe, cidaemon.exe, owstimer.exe (WSS)
(where Drive: is the drive letter where you installed SharePoint Portal Server)

 

MOM

ú    Drive:Documents and SettingsAll UsersApplication DataMicrosoftMicrosoft Operations Manager

ú    Drive:Program FilesMicrosoft Operations Manager 2005

 

If you are using Trend Micro the follow these guide lines:

 Temp folder:  C:Program FilesTrend MicroPortalProtect emp
 Quarantine folder, whose default location is:
Drive:Program FilesTrend MicroPortalProtectQuarantine
 Backup folder, whose default location is:
Drive:Program FilesTrend MicroPortalProtectBackup

The following link will provide you how you can configure MOSS anti-virus, not Operating System Anti-Virus.

http://technet2.microsoft.com/Office/f/?en-us/library/1289e6e2-03e0-4f10-8921-e516187891c61033.mspx

One of my recomendation before logging Microsoft PSS calls is to make sure you have these guidelines applied in your environment, this could save a lot of  time & money with regard to support issues. I hope this helps. Stick out tongue

I thought I would add this to the post; the offical KB article associated to "Folders may have to be excluded from antivirus scanning when you use a file-level antivirus program in Windows SharePoint Services 3.0 or in SharePoint Server 2007": http://support.microsoft.com/kb/952167

Your email is never shared.
Required fields are marked *




Allowed tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>