Looking for ArcGIS Enterprise Antivirus Recommendations and Feedback

[Kathleen_Crombez]

I am looking for recommendations and feedback on users experience running antivirus software on machines running ArcGIS Enterprise.

Our IT department uses Sophos antivirus and we have all the exclusions set per the technical paper in the ArcGIS Trust Center referenced in this post..

https://community.esri.com/t5/esri-software-security-privacy/new-technical-paper-considerations-for-...

However we still were experiencing issues with ArcSOC processes getting killed off and orphaned causing the server to start consuming dangerously large amounts of RAM to the point where the machine becomes unresponsive.

At one point we had over 300 ArcSOCs tied to a single service even though the max number of instances for that service was set to 10.

We are set up with Portal, 1 federated hosting Server with DataStore and 1 additional federated Server that is also licensed for Image Server. Version 10.8.1

I am looking for input from others who are using antivirus on their Enterprise systems.

1. What antivirus are you using?
2. Are you (or have you) experienced any issues with the antivirus interfering with ArcGIS Enterprise?
3. Do you have exclusions set?

I am also looking for any recommendations for antivirus solutions that does not disrupt the ArcGIS Enterprise software from functioning properly.

Thanks!

[Gianluca]

Hi KathleenCrombez,

we have the same problem with Sophos.

Have you found any solution?

Thank you

[Kathleen_Crombez]

@Gianluca 

We forced our IT department to remove Sophos from the servers running ArcGIS Enterprise. They were not happy about it, but we had no choice since the two pieces of software do not seem to play well together. We are still looking for a good Antivirus solution that does not interfere with ArcGIS Enterprise. Our IT department is looking into CrowdStrike, but I have yet to find any information on it's compatibility with ESRI software.

If you are running ArcGIS Enterprise version 10.8 (or 10.8.1) there is a server patch you can install that may help with the orphaned services.

ArcGIS Server Orphaned Processes Patch

https://support.esri.com/en/Products/Enterprise/arcgis-server/ArcGIS-Server/10-8-1#downloads?id=7916

Thanks,

Kathleen

[AndreaB_]

Did you go with CrowdStrike? That's what our IT dept uses and I'm researching if it will work well with our new installation of ArcGIS Enterprise. 

[Scott_Tansley]

I upgrade/maintain multiple environments for multiple clients.  CrowdStrike is by far the solution that gives the least issues to the operations I am tasked with.  It's not my place/specialism to recommend it, but I always breath a sigh of relief when a client says they're using it.