1

What antivirus products have you used in SharePoint 2007 (WSS v3 and MOSS 2007) implementations?

I've had quite a bit of experience with Forefront Security for SharePoint and its my default recommendation, but it looks like there's other vendors out there that are finally offering coverage for SharePoint 2007, instead of the prevision version of the platform.

Do you think its better to use the same vendor for SharePoint AV that is running for the OS? What I mean is if McAfee is protecting Windows Server is it better to use their solution for SharePoint to keep things consistent from an AV perspective, or is one product way better than another?

I'm aware of all the benefits Forefront is said to have (multiple AV engines, etc), but interested in everyone's real world experiences and thoughts.

Improve this question
1

4 Answers 4

Reset to default
3

A customer uses McAfee and we found that it didn't check for viruses, if the EICAR file was uploaded inside an InfoPath form into SharePoint via a webservice.

Forefront did check there and found the signature. So it seems that the McAfee product uses other hooks into SharePoint.

Improve this answer
1
  • It seems that McAfee PortalShield doesn't check the base64 attachments of InfoPath forms. Our customer has opened a call at McAfee, I will keep you updated on the progress.
    – Hinek
    Commented Mar 17, 2010 at 13:28
2

Just note that whatever Virus scanning software you use, There are some Files/Folders that need to be excluded from the virus scanning software to not affect Sharepoint. This is for Both the SharePoint front ends as well as the SQL server.

More details can be found here

Improve this answer
1

We use PortalShield 2.0 from McAfee.

Improve this answer
1
  • Lisa, what's been your experience with it? Seems like Forefront uses about 800-900 MB of RAM to run its scan engines and needs to be handled carefully during patches and upgrades, but its pretty effective day-to-day and otherwise. What sort of benefits/issues are you seeing w/ McAfee's product?
    – John Ferringer
    Commented Feb 19, 2010 at 4:41
0

In many environments the different may be minor, but in other environments like where there is very active high capacity scanning or frequent content moves, it may have more of an impact. It has enough of an impact that we are sure to disable the agents when doing a system migration since it can exponentially increase the processing time.

If you are in a large environment with lots of activity, it is probably worth a performance test with multiple products.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.