VDI Anti-virus Solutions

[MAHC]

We are in the process of setting up VDI in our network and would like to use the pools that delete after first use and a few Individual desktops. Is there any managed antivirus solutions out there that work or how do you set this up to work? We are currently using the Symantec End Point Solution on our hardware devices.

Thanks

[admin]

Current suggestions are to install an Anti-Virus solution into the template from which you will provision VDI VMs. I guess this would mean having an AV product which is licensed appropriately!!

[MAHC]

Licensing is not a problem because I am planning on having to purchase a product for this but I am not aware of any solutions that are available for the type of setup that I want to perform.

I will try the idea of putting it on the template but the current system that we have is Symantec End Point and is managed. I am just concerned that there might be issues if I have them managed and the antivirus will be registered wrong. I will post my results. Thanks

[mittim12 · Accepted solution]

We are also using Symantec End Point protection and have it installed to our template. We have not had any issues with the clients registering or being managed. Check out the link below and see if it helps you out any.

If you found this or any other post helpful please consider the use of the Helpfull/Correct buttons to award points

[Saadi]

We trialed a few AV solutions in our VDI infrastructure and found Sophos end point security and control to work best on individual VDs (in terms of resource usage, detection, etc). But it would be good to have an AV product at the server level which is aware of, and protects VDs - without having to roll out AV on each VD.

In fact a threat detection engine which offloads work to another dedicated server would be even better.

[RobBeekmans]

Look towards McAfee and Trend Micro, they both have or wiil soon have a VDI compatible product.

[tacticsbaby]

You may want to check out McAfee MOVE. MOVE is designed for the type of use that you specified. I am currently setting up a trial for our environment. The main thing that I like about MOVE is that it easily adds to your existing McAfee VSE/EPO infrastructure, if you use that, and because of the scanning virtual appliance the clients that get installed in your VMs are only 20mb in size. Here is a link to info on this product. Oh, just for the record MOVE stands for McAfee Optimized for Virtual Environments. Hope you find it useful.

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/22000/PD22832/en_US/...

[jonschmuland]

We're a VMware View 'linked-clones' shop, and we've been a TrendMicro customer for awhile, but we're looking at alternatives.  The Trend client isn't bad, but the installation of the client has caused us some problems.  We've got it loaded on the base image, and we use their 'imgsetup.exe' program to reset the GUID when a new VM spins off the base.  HOWEVER, we don't grant our users admin rights to their VM's so the 'imgsetup.exe' program fails when the VM is assigned to our end users.  The workaround Trend has suggested is give users admin rights or have a system admin log into each new VM so the 'imgsetup.exe' program can complete it's process.  Neither option is good, hence the search for a new AV provider.  I've even opened a ticket with Trend Micro and they sent me a link to the same doc I've read a hundred times.  Fantastic service.

[bhamm]

We're using SEP 12.1 and it's working fine.

Symantec has a tool that you can use to prep an image for use as a template or a replica in a linked clone pool:

http://www.symantec.com/business/support/index?page=content&id=HOWTO54706

It removes the IDs from the client, such that they're regenerated on reboot.  If you do this prior to marking a VM as a template or taking a snapshot to create a replica, the new ID will be generated during the sysprep or quickprep process.  The client will register with the manager as well.

If you're willing to linked clones and to refresh your desktop instead of deleting them, since the ID & computer name will be generated before the final snapshot is made, the client won't need to reregister with the manager.  There won't be any dupilcate entries, and each clone created will show up in the management console.

You will, however, lose any definition updates that are downloaded upon refresh, so you'll need to update the replica periodically.

[IP2008]

We have been running a pilot for many months now using Mcafee Move. Initial releases of Move caused us major issues whereby View agents would randomly go into an unreachable state. Since moving to version 1.8 that issue has now gone but we now have another issue. The issue at the moment is that whenever we insert a USB device, the VM freezes, you get disconnected, the agent goes 'unreachable' and you have to reset the VM ... not good! We have a call open with Mcafee but with no fix as yet. Move is not a true vShield Endpoint solution ... Mcafee have told us that is not due until May 2012. Until then we suffer on ...