Do I need an antivirus program in each virtual machine

anti-virushyper-v-server-2012-r2windows-server-2012-r2

I have a 2012 R2 Hyper-V host running System center endpoint protection.
There are two virtual windows servers being hosted by it.

I have all .vhdx drives in a folder on d:/server/

Can I trust the antivirus to scan these files and find viruses or do I need to have an antiviurus program in each virtual machine?

If I scan these files manually endpoint protection almost immediately returns no viruses found, which makes me wonder if its even trying to scan them.

Best Answer

No, you should not be using AV software on the host to scan your VHD location. You can install AV software on the host but you need to exclude several Hyper-V related folders from the real time AV scanning engine and from any scheduled AV scans. You should then install AV software on the individual guest virtual machines.

https://support.microsoft.com/en-us/kb/961804

Ancillary

While doing some testing, I found the following that may be useful to people who still wish to move forward:

You can only SLM (Storage Live Migrate) an in-use VHDX to a ReFS-mirror volume if your destination is a folder where Integrity Streams have been disabled.
- If you attempt to do SLM onto a ReFS-mirror where Integrity Streams is enabled, you'll get an error with this in it: "The destination '...' is not valid because it is configured with the integrity stream attribute. Select a destination that does not have the integrity stream attribute to continue.". You get the same error when attempting via PowerShell.
Copying/Moving a file onto a ReFS-mirror will result in the file having its "integrity bit" set to match the setting from the destination folder.
You cannot get/set the integrity bit of a VHDX that is in-use.
Otherwise, the performance of a ReFS-mirror volume appears to be good enough (my opinion, of course) for Production. My "differences" test is here if anyone cares.

Server 2012 R2 – how to delete a file that is “open in System”

Yeah, I've run into this. It's very likely that Hyper-V is holding the file. You'll probably have to stop the Hyper-V Virtual Machine Management service in order to delete the VHD. Either that or reboot the Hyper-V host. Alternatively, you might check to see if there's a Virtual Machine Worker Process that corresponds to the deleted VM. If there is you can kill that which should then allow you to delete the VHD.

You can run this in Powershell to see if there's a process ID "GUID" that corresponds to a Virtual Machine Worker Process (found by right clicking the Virtual Machine Worker Process in Task Manager, selecting "Go to details", and looking at the username "GUID"). If you find a matching process for the deleted VM then kill that process and delete the VHD.

Get-WmiObject -Namespace root\virtualization -class msvm_computersystem | select elementname, operationalstatus, processid, name| ft -auto

Best Answer

Related Solutions

Is ReFS ready to host production VHDXs on Hyper-V 2012 r2 clusters

Ancillary

Server 2012 R2 – how to delete a file that is “open in System”

Related Topic