Sophos Anti-Virus for Windows 2000+: installing without on-access scanning on servers

On servers running Windows 2000 and Windows Server 2003, you might not want to run the on-access scanner. Some network adminstrators do not use on-access scanning on Microsoft Exchange servers, or on other servers where performance could be affected.

If you disable the on-access scanner you should establish a scheduled scan, and manage all such computers as a group in Enterprise Console. This is best done when first installing your network.

What to do

1. Open Enterprise Console.
2. Move all of the servers on which you do not want to run on-access scanning into a group called Servers.
3. Set up updating policy as described in the 'Protect computers' section of the startup guide.
4. Highlight the Servers group.
5. In the bottom left-hand pane, right-click your Anti-virus and HIPS policy.
6. Select 'View/Edit policy' if you already have a special policy for your servers, or 'Duplicate policy' to create a new one.
7. Deselect 'Enable on-access scanning'.
8. In 'Scheduled scanning', click 'Add'.
9. The default scan is called 'New scheduled scan' and runs at 21.00 hours. Change any details you wish.
10. Click 'OK' to save the scan.
11. Click 'OK' to save your anti-virus policy.
12. A message about disabling on-access scanning will be displayed. Click 'Yes' to continue.
13. Right-click the Servers group.
14. Select 'Comply with' then select 'Group anti-virus and HIPS policy'.
15. The servers will be updated to comply with the new anti-virus policy.

All servers will show a grey shield with the text 'Inactive' in the 'On-access' column.

Monitoring the servers group

Check your servers group daily.

• In the 'Anti-virus and HIPS policy' column, all servers should report 'Same as policy'.
• The Alerts column will display any virus notifications.

To examine a server's details, right-click its name and select 'View computer details'. Information given includes the time of the last scheduled scan, what viruses were detected, and where they were found.

If the scheduled scan, or some other anti-virus policy, on a server has been changed, you can reinstate it by making the computer comply with group policy.

1. Right-click the affected computer's name.
2. Select 'Comply with'.
3. Select 'Group anti-virus and HIPS policy'.

For information on removing viruses displayed in the console, read 'Enterprise Console: removing viruses'.

If you need more information or guidance, then please contact technical support.