topic Re: ArcGIS Enterprise and Antivirus Software in Esri Software Security & Privacy Questions

ArcGIS Enterprise and Antivirus Software

Kathleen_Crombez — Wed, 21 Aug 2024 14:37:26 GMT

I am looking for a new Antivirus Solution for ArcGIS Enterprise.

Let me know what you are using!

Re: ArcGIS Enterprise and Antivirus Software

CodyPatterson — Wed, 21 Aug 2024 14:43:58 GMT

My company uses SentinelOne as AV, personally, I've had no issue installing and using the various ArcGIS Enterprise software while this AV is active. I previously worked for IT in the same company, and have found the AV to be quite reliable, I would personally recommend it.

Cody

Re: ArcGIS Enterprise and Antivirus Software

GregoryCarson — Wed, 21 Aug 2024 14:46:19 GMT

We have used Crowdstrike in the past and now use Cortex without any issues.

Re: ArcGIS Enterprise and Antivirus Software

MarceloMarques — Wed, 21 Aug 2024 14:51:37 GMT

@Kathleen_Crombez

Sophos, CrowdStrike

New Technical Paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts (esri.com)

Re: ArcGIS Enterprise and Antivirus Software

Kathleen_Crombez — Wed, 21 Aug 2024 15:20:29 GMT

@CodyPatterson-

Thank you for the information!

Did you have to configure all the exceptions as recommended in the ArcGIS Antivirus Guidance

From my past experience most anti-virus software is destructive to the ArcGIS Enterprise suite and makes installation/upgrades downright impossible while the software is active. So I am really happy to receive a recommendation from someone with both GIS and IT experience.

Thank you again!

Kathleen

Re: ArcGIS Enterprise and Antivirus Software

Kathleen_Crombez — Wed, 21 Aug 2024 15:45:17 GMT

@GregoryCarson-

Thank you!

Was there a reason you switched from CrowdStrike to Cortex? Do you notice any benefits or downsides from one to the other in comparison?

Any issues with installation or upgrades?

Thanks again!

Kathleen

Re: ArcGIS Enterprise and Antivirus Software

Kathleen_Crombez — Wed, 21 Aug 2024 15:49:12 GMT

@MarceloMarques-

Thank you for the link. I have seen this post in the past but they have updated the link for the ArcGIS Antivirus Guidance document.

Are Sophos and CrowdStrike both tested and used in production at ESRI?

Do you notice any benefits or downsides from one to the other in comparison?

Thanks again,

Kathleen

Re: ArcGIS Enterprise and Antivirus Software

GregoryCarson — Wed, 21 Aug 2024 15:51:49 GMT

We were purchased by a bigger company and change to Cortex was due to parent company. I did not do anything to our Esri servers with Crowdstrike or Cortex, as neither of them caused any issues. (We have numerous ArcGIS servers (10.8.1 to 11.3) federated to our 11.3 portal)

Re: ArcGIS Enterprise and Antivirus Software

MarceloMarques — Wed, 21 Aug 2024 15:58:19 GMT

Are Sophos and CrowdStrike both tested and used in production at ESRI?

Yes, we use it internally and have customers that use it too.

Do you notice any benefits or downsides from one to the other in comparison?

Your IT department will have to evaluate that but usually price is the decision factor.

Re: ArcGIS Enterprise and Antivirus Software

CodyPatterson — Wed, 21 Aug 2024 16:08:45 GMT

Hey @Kathleen_Crombez

Currently, none of the exceptions were made in my AV when assembling ArcGIS Enterprise. We do not exclude any file from being scanned and these scans that take place have not caused any significant strain on the servers that host the environment. I can definitely understand an AV causing issues, as I've worked with quite a few, but this one is quite straight forward! I've had no issues with false positives as well.

Cody

Re: ArcGIS Enterprise and Antivirus Software

SimonSchütte_ct — Thu, 17 Oct 2024 10:31:40 GMT

As a side note: be aware that some Antivirus software will move the Portal content directory into quarantine when installing Portal for ArcGIS. Had this happened to me a few times, causing the installation/update to fail. Some programs are sensitive to the Portal for ArcGIS installer extracting 60.000 files in the contents directory...
So make yourself familiar with the software you or your IT department uses and how it may interfere with ArcGIS Enterprise.

Re: ArcGIS Enterprise and Antivirus Software

SStopyak_BruceHarris — Wed, 19 Mar 2025 17:24:06 GMT

I saw people posting that Sophos and Crowdstrike are good. Please do not believe it. I have seen both render Portal broken and inaccessible. Those are literally the biggest two to absolutely avoid. Just run Defender. Any AV could mess up your enterprise, honestly and all of them will slow it down.

Re: ArcGIS Enterprise and Antivirus Software

MarceloMarques — Wed, 19 Mar 2025 19:08:04 GMT

I have used Sophos and Crowdstrike, and worked with customers using these Anti-Viruses software. The trick is that the IT department needs to white-list the ArcGIS Enterprise software installation folders, the configure store folder. Then, there will not be any issue with ArcGIS Enterprise performance. More info at ArcGIS security—ArcGIS Trust Center | Documentation

Please, see the white paper below.

Technical Paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts

https://community.esri.com/t5/esri-software-security-privacy-blog/new-technical-paper-considerations-for-configuring/bc-p/1500566/highlight/true

Use this link to open the PDF document - ArcGIS Antivirus Guidance

Here is a link highlighting the document in trust center:

https://trust.arcgis.com/en/customer-documents/?p=0.2941289993696301#:~:text=Considerations%20for%20...

FAQ: How Do I Troubleshoot ArcGIS pro Performance Issues Related to Antivirus Software (Ex

I hope this helps.

Re: ArcGIS Enterprise and Antivirus Software

Kathleen_Crombez — Wed, 19 Mar 2025 18:00:44 GMT

The whole reason for my original question was because our IT department installed Sophos and it corrupted our Portal. We had thousands of orphaned SOC processes that would never end and would run the machine out of resources. It also caused issues during upgrades that absolutely rendered the Portal inaccessible. We did have IT implement the white list and still had tons of issues that broke ArcGIS Enterprise. So I cannot get on board with Sophos and ArcGIS Enterprise compatibility claims.

We made IT uninstall Sophos and we were able to restore our Portal and start using it again without issues. Now our IT department now wants to force CrowdStrike on us. We are already running it on our workstations and (again, white list exceptions are already in place) we see nothing but issues. Projects locking up and crashing constantly. Simple attribute edits that take minutes to commit. With the issues we have with Pro I am very hesitant to have it installed on our ArcGIS Enterprise servers.

I should point out that there are several typos in the white list and we had to navigate to every single folder to get the actual path (not just blindly copying and pasting the bad paths with typos into the exceptions.)

I am starting to believe that ESRI just doesn't care about their customers as their software is getting progressively worse over time (not better as one would expect from a company with such a large market). Pro (the most user unfriendly software ever developed) and ArcGIS Enterprise are so bug ridden now that it makes me want to retire early.

Re: ArcGIS Enterprise and Antivirus Software

MarceloMarques — Wed, 19 Mar 2025 19:07:38 GMT

I understand your frustration. I had many challenges with Anti-Virus and ArcGIS software myself. During the ArcGIS Enterprise upgrade the best approach is to temporarily disable the Anti-Virus if possible. Please, see the white paper below. I hope this helps.

Technical Paper: Considerations for configuring antivirus software for ArcGIS Enterprise hosts

https://trust.arcgis.com/en/customer-documents/?p=0.2941289993696301#:~:text=Considerations%20for%20...

FAQ: How Do I Troubleshoot ArcGIS pro Performance Issues Related to Antivirus Software (Ex

Re: ArcGIS Enterprise and Antivirus Software

Kathleen_Crombez — Thu, 20 Mar 2025 15:01:41 GMT

Thanks @MarceloMarques

It is very frustrating. And posting dead links that reroute to the trust center does not help.

Re: ArcGIS Enterprise and Antivirus Software

MarceloMarques — Thu, 20 Mar 2025 16:13:22 GMT

I realized the link in the main article was broken as well.

https://community.esri.com/t5/esri-software-security-privacy-blog/new-technical-paper-considerations...

Hence, I updated the previous reply with the links that work. They are listed below again.

Use this link to open the PDF document - ArcGIS Antivirus Guidance

Here is a link highlighting the document in trust center:

https://trust.arcgis.com/en/customer-documents/?p=0.2941289993696301#:~:text=Considerations%20for%20...

FAQ: How Do I Troubleshoot ArcGIS pro Performance Issues Related to Antivirus Software (Ex

I hope this helps.