Client Side Virus Checkers

[SadOldGoth]

Hi Folks,

Before we start, let me say I'm not responsible for the citrix environment, just one of the suffering users.

On the client side we seem to have Anti-Virus software running, and to my mind that's a bit Butt-Backwards. Especially as it's carrying out real-time checking, ie, every file that's opened, etc.

A number of our machines have access to A: and C: drives so I can understand them having AV software on, but surely we should only have virus checking on the server?

Any light shed would be blindly walked into ;0)

Thanks,

Jes

 

[CitrixEngineer]

It's a good idea to have AV on the client PCs - but AV that is symapthetic to local network sources that have already been scanned, or that can be tuned to selectively scan.

In an ideal setup, there would be no data stored on a Citrix server, and no need for any AV on that server - all data should be scanned for viruses on servers that do store data, and client machines.

If the client has Internet access, a floppy drive and local storage, then it is a potential source of viruses for the entire network.

We use Trend ServerProtect AV, which seems to be almost completely unobtrusive - even on the Citrix servers.

Hope this helps CitrixEngineer@yahoo.co.uk

 

[SadOldGoth]

Hi,

Thanks for the answer. Can you resolve something a little further for me. As I said above, only a limited number of machines have access to the A: and C: drives - I'm happy with these having AV.

However, the rest of the machines have no local storage whatever and everything is stored on a SAN. Surely the right way is to have the AV on the SAN and check any downloaded files. Is there an issue anywhere of internet connected machines downloading/executing software that wouldn't be picked up by the AV on the SAN?

As I said, I'm happy to listen to any advice, but I haven't had any clarity from this end.

Thanks,

Jes

 

[CitrixEngineer]

If you're using thin-clients, then there's little point, as you say. The data that they work on is purely in memory, so, as long as you KNOW the source has been scanned, you're OK.

This means A/V on the MetaFrame servers is needed, since presumably you have thin-client users running browsers or web-enabled apps like Word inside a session.

As to my previous comments, I was obliquely referring to the fact that there is no such thing as an ideal setup...

Hope this helps CitrixEngineer@yahoo.co.uk