Follow the guidelines established by your antivirus software vendor.

Note
Verify that the antivirus software you are adding is confirmed to work on domain controllers.

The following recommendations are general and should not be construed as more important than the specific antivirus software vendor’s own recommendations. These guidelines must be followed for correct Active Directory and FRS operation.

Note
Test the chosen antivirus software solution thoroughly in a lab environment to ensure that the software does not compromise the stability of the system.

• Antivirus software must be installed on all domain controllers in the enterprise. Ideally, such software should also be installed on all other server and client systems that have to interact with the domain controllers. Catching the virus at the earliest point, at the firewall, or the client system on which the virus is first introduced is best—that will prevent the virus from ever reaching the infrastructure systems upon which all clients depend.
  
  
• Use a version of antivirus software that is confirmed to work with Active Directory and uses the correct APIs for accessing files on the server. Older versions of most vendors’ software inappropriately modified file metadata as it was scanned, causing the FRS replication engine to think the file was changed and to schedule it for replication. Newer versions prevent this problem. For more information about antivirus software versions and FRS, see article 815263, "Antivirus, backup, and disk optimization programs that are compatible with the File Replication Service" in the Microsoft Knowledge Base on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=4441), and see the vendor-specific sites for compliant versions.
  
  
• Prevent the use of domain controller systems as general workstations. Users should not be using a domain controller to surf the Web or perform any other activities that could allow the introduction of malicious code.
  
  
• When possible, do not use the domain controller as a file sharing server. Virus scanning software must be run against all files in those shares and could place an unsatisfactory load on the processor and memory resources of the server.
  
  

McAfee VirusScan version 8.0 is known to cause problems when it is installed on a domain controller. Patching levels for McAfee VirusScan might also affect domain controller performance. If you have installed McAfee VirusScan version 8.0 on a domain controller, make the following changes:

1. Disable the Buffer Overflow Protection feature in the VirusScan Console. Buffer Overflow Protection is intended to be used on workstations only and might cause problems if used on a server role computer with a high IO load.
   
   
2. Disable the following driver:
   
   File name and location: C:\Windows\System32\Drivers\mfetdik.sys
   
   Company name: McAfee, Inc.
   
   File description: Anti-Virus Mini-Firewall Driver
   
   The driver is known to cause system crashes. To reduce complexity and increase system reliability, perform the following steps to disable the Anti-Virus Mini-Firewall Driver MVSDTi5x.SYS on servers:
   
   
   1. In Registry Editor, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\naiavtdi1.
      
      
   2. Set Start to a value of 4, which is disabled.
      
      

Exclude the following files and folders from being scanned. These files are not at risk of infection and including them could cause serious performance problems due to file locking and excessive replication between domain controllers. Furthermore, they may cause Active Directory and FRS to work improperly, causing Active Directory or FRS data loss. Where a specific set of files is identified by name, exclude only those files rather than the entire folder. In some cases, the entire folder must be excluded.

Do not exclude any of these based on the file name extension (that is, do not exclude all files with a .dit extension). Microsoft has no control over other files that might choose to use the same extension as those shown here. AV software must not modify any data files in the logs, database, and/or DSA working directories specified below.

• Main NTDS database files. The location of these files is specified in:
  
  HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File
  
  Default location is %windir%\ntds
  
  The file to exclude is: NTDS.dit
  
  
• Active Directory transaction log files. The log directory on any given server is specified in:
  
  HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path
  
  Default location is %windir%\ntds.
  
  The specific files to exclude are:
  
  
  • EDB*.log (notice the wildcard—there can be several)
    
    
  • RES1.log
    
    
  • RES2.log
    
    
• NTDS Working folder specified in:
  
  HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory
  
  Specific files to exclude are:
  
  
  • TEMP.edb
    
    
  • EDB.chk
    
    
• SYSVOL. Use the following table for folders and files to scan or exclude:
  
  

   

  Folder or File	Scan or Exclude
  %systemroot%\SYSVOL	Exclude
  %systemroot%\SYSVOL\domain	Scan
  %systemroot%\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory	Exclude
  %systemroot%\SYSVOL\domain\policies	Scan
  %systemroot%\SYSVOL\domain\scripts	Scan
  %systemroot%\SYSVOL\staging	Exclude
  %systemroot%\SYSVOL\staging areas	Exclude
  %systemroot%\SYSVOL\sysvol	Exclude

• FRS Working Directory specified in:
  
  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory
  
  Files to exclude:
  
  
  • <FRS Working Directory>\jet\sys\edb.chk
    
    
  • <FRS Working Directory>\jet\ntfrs.jdb
    
    
  • <FRS Working Directory>\jet\log\*.log
    
    
• FRS Database Log files specified in:
  
  HKEY_LOCAL_MACHINE\system\currentcontrolset\services\NtFrs\Parameters\DB Log File Directory
  
  Default location is %windir%\ntds.
  
  Files to exclude:
  
  
  • <FRS Working Directory>\jet\log\*.log (if registry entry is not set)
    
    
  • <DB Log File Directory>\log\*.log (if registry entry is set)
    
    
• FRS Replica_root files specified in:
  
  HKEY_LOCAL_MACHINE\system\currentcontrolset\services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Root
  
  
• Staging directory found in:
  
  HKEY_LOCAL_MACHINE\system\currentcontrolset\services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage
  
  
• FRS Preinstall directory located at:
  
  <Replica_root>\DO_NOT_REMOVE_NtFrs_PreInstall_Directory.
  
  The Preinstall directory is always open exclusively when FRS is running.
  
  

The following tasks for managing domain controllers are described in this objective:

• Preparing for Active Directory Installation
  
  
• Installing a Domain Controller in an Existing Domain
  
  
• Adding Domain Controllers in Remote Sites
  
  
• Installing a Domain Controller in an Existing Domain Using Restored Backup Media
  
  
• Performing an Unattended Installation of Active Directory
  
  
• Verifying Active Directory Installation
  
  
• Renaming a Domain Controller
  
  
• Decommissioning a Domain Controller
  
  
• Forcing the Removal of a Domain Controller