Good antivirus for Terminal Services environment (Windows Server 2008)

A well run webserver should IMHO not have a commercial anti-virus (AV) package installed. The kind of Office macro viruses and mass-market trojans that AV packages are optimized for are a poor match to the problems of a web server.

What you should do is:

1. Absolutely obsess over input validation. Examples: that users can't upload malicious content to your site (virus, SQL injection etc); that you're not vulnerable to cross site scripting attacks, etc.
2. Keep your server patched up with the latest security updates, and configured according to best-practices. Look at things like Microsofts security toolkit.
3. Have a separate firewall. Doesn't help you much with regards to intrusions, but it adds another layer of defense against misconfigured network services, and helps with simple DOS attacks. It also helps a lot with locking down remote management possibilities etc.
4. Install a host intrusion detection system (H-IDS) on your server, along the lines of the venerable Tripwire.

There is a lot of confusion about the terms, the words are often used in many different ways here. To be clear, what I mean by an H-IDS here is:

• a service on a computer
• which continuously check-sums all executable files on the computer
• and throws an alert whenever a executable file has been added or modified (without authorization).

Actually a good H-IDS will do a bit more than this, such as monitoring file permissions, Registry access etc, but the above gets the gist of it.

A host intrusion detection system takes some configuration, since it can give a lot of false errors if not set up properly. But once it's up and running, it will catch more intrusions than AV packages. Especially H-IDS should detect a one-of-a-kind hacker backdoor, which a commercial AV package probably will not detect.

H-IDS also lighter on the server load, but that's a secondary benefit -- the main benefit is a better detection rate.

Now, if the resources are limited; if choice is between a commercial AV package and doing nothing, then I'd install the AV. But know that it isn't ideal.

This is a very generic MS Error Code. The relevant part of your log file is the first two lines.

Most of the time it would appear that this is caused by a service that the role relies on not being detected correctly, and requires a lot more information than what you've got there.

If you check in the Event Log, do you see a related failure in there? If you can find it, can you update your post with the failure(s) so that we can have a look?

Update:

Hmm, sorry, I'm all out of ideas. Those event codes are no help (Event 0 = started, Event 18 = TS Licensing Server Not Activated - both pretty normal).

ErrorCode: 0x80070bc9 doesn't have a specific generic meaning, although it commonly seems to mean "Restart Required from Previous Update". I'm guessing that's not its meaning in this situation though (I assume you've already restarted).