In short
Antivirus for Windows Server protects file, application, database and Remote Desktop servers. Most vendors license servers separately or at a server tier: Sophos server licences, ThreatDown Endpoint Protection for Servers, the Trend Micro Pro tier. CrowdStrike, SentinelOne, Bitdefender, Webroot and Check Point count servers per device. Servers also need vendor-recommended exclusions for SQL Server and Exchange.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
Does Windows Server need antivirus?
Yes. A server is often the most valuable device you own: it holds shared files, line-of-business databases, accounts data or the Remote Desktop sessions your staff work in. Ransomware that reaches a file server encrypts everyone's work at once, and a compromised server is an ideal base for an attacker to move across the network.
Microsoft agrees that servers need protection. Windows Server 2016 and later turn on Microsoft Defender Antivirus automatically, and Microsoft's own guidance for SQL Server and Exchange Server is about how to run antivirus on those servers safely, not whether to. Microsoft's SQL Server guidance says the highest-risk servers generally include those open to the public internet, those that host file shares, run web servers such as IIS or Apache, or read and execute files from other servers.
The real question is whether built-in Defender on each server, managed one by one, is enough for your organisation, or whether you want server protection managed alongside your other devices with central policies, alerts and reporting. Our is Windows Defender enough? guide covers that decision from the business side.
Why servers need their own licences
Most business antivirus is licensed differently for servers, and that surprises people at renewal time. There are good reasons: servers run more sensitive workloads, often need extra protections, and one server can support many users.
| Vendor | How servers are licensed | Server-specific points |
|---|---|---|
| Sophos | Separate server licence (computers are per user) | Sophos now markets server protection as Sophos Workload Protection; adds unauthorised file protection; Remote Desktop Services sessions are covered by the host's server licence |
| ThreatDown | Endpoint Protection for Servers, counted separately from workstations | Same console as your workstations; EDR also has a server version |
| Trend Micro | Per endpoint; Pro is the server tier | Pro adds server intrusion prevention (virtual patching), integrity monitoring, log inspection, the recommendation scan and container protection |
| Bitdefender | Per protected endpoint, servers included | Covers Windows servers, Linux and virtual machines from the same console |
| CrowdStrike | Per endpoint, same as workstations | One Falcon sensor for workstations and servers |
| SentinelOne | Per endpoint, same as workstations | Packages include cloud workload protection for servers and VMs |
| Webroot | Per device | Webroot lists current Windows Server releases, including Essentials editions |
| WatchGuard | Per endpoint | If servers make up more than a tenth of your endpoints, WatchGuard requires an additional server licence for the extra ones |
| Check Point | Per protected device | Lists Windows Server and terminal server and VDI environments, including VMware and Citrix |
So the first job in any quote is to count servers separately from workstations, including virtual machines and cloud servers. How much does business antivirus cost? explains how server counts, tiers and add-ons shape a quote, without published figures.
Not sure which licence fits? Ask us
Tell us what you need and we will help you choose the right licence.
Exclusions for SQL Server, Exchange and other server roles
One of the main risks with server antivirus is not malware but the antivirus itself locking a file a server application needs. Microsoft publishes detailed exclusion lists for its server products, and they are the starting point for any policy:
- SQL Server: Microsoft recommends excluding the SQL Server processes and data, log and backup files from scanning, and testing the server under load before and after installing antivirus. It warns that scanning a database file while SQL Server opens it can lead to the database being marked as suspect.
- Exchange Server: Microsoft lists folders, processes and file name extensions to exclude, because locking or quarantining an open Exchange database or log file can cause serious problems, including data loss. Microsoft also notes that server antivirus does not replace email security for threats that arrive only by email.
- Failover clusters: Microsoft's SQL Server guidance says antivirus on a cluster must be cluster-aware, and lists cluster locations to exclude.
- Other applications: accounts, practice management and ERP systems often have their own vendor exclusion lists. Ask your software supplier for theirs.
Two cautions apply to every exclusion. First, an excluded file is not scanned, so keep exclusions as narrow as the guidance allows (specific paths and processes rather than whole drives). Second, review them when software is upgraded or moved, because paths change. Business products help here, because exclusions are set centrally by policy, so every server of a type gets the same list.
If you also run SQL Server or Exchange in Microsoft's cloud, workload protection there is a different subject; cloud-security.cloud explains cloud workload protection.
Microsoft Defender on servers alongside another product
When you install a third-party antivirus on Windows 10 and 11 devices that are not onboarded to Defender for Endpoint, Microsoft documents that Defender Antivirus moves to disabled mode automatically. On Windows Server it does not change mode automatically. For servers that are not onboarded to Defender for Endpoint, Microsoft says to disable or uninstall Defender Antivirus manually when another product is the primary antivirus; servers that are onboarded can run Defender in passive mode, which has to be set deliberately.
Getting this wrong leaves two real-time scanners fighting over the same files, which is exactly the kind of locking and slowdown that hurts a database or file server. We can help you plan Defender's state for each server role as part of the rollout.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Remote Desktop, virtual and cloud servers
A few server types need extra thought:
- Remote Desktop Services hosts: users' sessions run on the server, so the antivirus has to cope with many people at once. Sophos says Remote Desktop Services sessions are covered when the host has a server licence, with no separate user licence needed for those sessions; other vendors count the host as a server endpoint.
- Virtual machines: each VM is normally a separate server endpoint. Template images need care, because agents cloned from a golden image can confuse the console if they share an identity, so follow the vendor's guidance for preparing images.
- Cloud servers: products such as Sophos, SentinelOne, Bitdefender and Trend Micro protect servers on premises and in public cloud with the same agent and licence model.
- Linux servers: covered on our Linux antivirus page, including container hosts.
Planning a server antivirus rollout
Servers deserve a slower rollout than laptops. A sensible order:
- List every server, its role (file, SQL, Exchange, RDS, application) and whether it is physical, virtual or cloud.
- Collect Microsoft's and your software suppliers' exclusion lists for each role.
- Build a server policy per role, with exclusions and scheduled scans set outside working hours.
- Set Defender's state, remove any old product and install on a low-risk server first.
- Watch performance and application logs, then move through the remaining servers in order of risk.
- Review detections and exclusions after the first few weeks, and again after software upgrades.
Server protection is also the natural place to start with detection and response, because servers are where attackers do most damage. For that, see EDR, XDR and MDR guidance on endpointsecurity.uk. For Sophos specifically, our sister site covers Sophos Intercept X for Server in depth.
How we help
Forever Systems supplies server antivirus from the vendors above and can help you plan it carefully:
- count servers and VMs correctly so the licence matches what you run
- compare server tiers and licence models across vendors in one quote
- gather exclusion guidance for your server roles and help build server policies
- plan Defender's state and the removal of your old product, server by server
Contact us with a list of your servers and their roles, and ask us for a quote.
Server antivirus by platform
How Forever Systems helps with endpoint protection
We are an independent UK IT and cyber security provider. We supply business antivirus and endpoint protection from several vendors, so we can recommend what fits your devices, your team and your budget rather than pushing one product.
- Review what you have: we look at your current antivirus, your Microsoft licences and the devices you need to cover before suggesting anything new
- Compare the options: next-generation antivirus, EDR and managed services from vendors including CrowdStrike, SentinelOne, ThreatDown, Bitdefender, Trend Micro, Sophos, Check Point, WatchGuard and Acronis
- Licensing and quotes: the right edition and licence count for your Windows, Mac, Linux, server and mobile devices, with pricing confirmed at quote
- Deployment and migration: we can help roll out agents, set policies and remove the old product cleanly
- Support after go-live: help with policy tuning, alerts and renewals, with the scope agreed at quote
We can also help with the rest of your security, from endpoint security and EDR to Cyber Essentials and security awareness training.
Frequently asked questions
Does Windows Server need antivirus?
Yes. Servers hold shared files, databases and user sessions, so an infection there affects everyone. Windows Server 2016 and later turn on Microsoft Defender Antivirus automatically; a business product adds central policies, reporting and server-specific protections.
Why do servers need a separate antivirus licence?
Vendors price servers differently because they run sensitive workloads and often get extra protections. Sophos and ThreatDown have separate server licences, Trend Micro's Pro tier is aimed at servers, and others such as CrowdStrike, SentinelOne and Webroot count each server as one device.
What should I exclude from antivirus on a SQL Server?
Start with Microsoft's published guidance, which lists SQL Server processes and data, log and backup file types and folders to exclude. Keep exclusions as narrow as possible, because excluded files are not scanned, and test performance before and after installing.
Can I run antivirus on an Exchange server?
Yes, but Microsoft lists folders, processes and file extensions that must be excluded, because locking an open database or log file can cause serious problems. Server antivirus also does not replace email security for threats arriving by email.
Does Microsoft Defender switch off when I install another antivirus on Windows Server?
Not automatically. Microsoft documents that on Windows Server, Defender Antivirus does not change mode by itself when a third-party product is installed. Microsoft says to disable or uninstall it manually on servers not onboarded to Defender for Endpoint, or set passive mode on onboarded servers, so two scanners do not compete.
Is a Remote Desktop server licensed per user?
It depends on the vendor. Sophos says Remote Desktop Services sessions are covered when the host has a server licence; other vendors count the host as a server endpoint. We confirm how your RDS hosts are counted when we quote.
Still have a question about server antivirus?
Ask us and a member of our team will reply by email.
More endpoint protection guides
SophosSophos antivirus for business: Sophos Endpoint's protection layers, servers and Linux, and how it is licensed.
Trend MicroTrend Micro's business antivirus in three tiers: Core, Essentials and Pro, licensed per endpoint.