Running Antivirus Software

  • Article

Published : September 27, 2005

DPM is compatible with most popular antivirus software products. However, antivirus products can affect DPM performance, and, if not configured properly, can cause data corruption of replicas and shadow copies. To mitigate these issues, take the following steps:

  • Disable real-time monitoring of Msdpmfsagent.exe on the DPM server

    To minimize performance degradation, disable antivirus real-time monitoring of replicas and transfer logs for all protected volumes by disabling real-time monitoring of the DPM process msdpmfsagent.exe, which is located in the folder Program Files\Microsoft Data Protection Manager\DPM\bin.

    Real-time monitoring of replicas and transfer logs degrades performance because it causes the antivirus software to scan the transfer logs each time DPM synchronizes with the file server, and to scan all affected files each time DPM applies changes to the replicas. The problem is resolved when you disable the feature for the replicas and transfer logs. For instructions on configuring real-time monitoring based on process name, see your antivirus product documentation.

    Note

    McAfee antivirus software matches only the first 15 characters of a process name. If you use McAfee antivirus products, to disable real-time monitoring of Msdpmfsagent.exe, specify “Msdpmfsagent.ex” instead of “Msdpmfsagent.exe.”

  • Disable real-time monitoring of Csc.exe on the DPM server

    Additionally, if you experience degraded performance while using DPM Administrator Console, disable real-time monitoring of the csc.exe process, which is located in the folder %windir%\microsoft.net\framework\v1.1.4322\csc.exe. The csc.exe process is the C# compiler. Real-time monitoring of the csc.exe process can degrade performance because it causes the antivirus software to scan files that the csc.exe process emits when it generates XML messages. For instructions on configuring real-time monitoring based on process name, see your antivirus product documentation.

  • Delete infected files on file servers and the DPM server

    To prevent data corruption of replicas and shadow copies, configure the antivirus software to delete infected files rather than automatically cleaning or quarantining them. Automatic cleaning and quarantining can result in data corruption because these processes cause the antivirus software to modify files, making changes that DPM cannot detect.

    Any time that DPM attempts to synchronize a replica that has been modified by another program, data corruption of the replica and shadow copies can result. Configuring the antivirus software to delete infected files resolves this problem. For instructions on configuring your antivirus software to delete infected files, see the documentation for your antivirus software.

    Important

    You must run a manual synchronization with consistency check job each time that the antivirus software deletes a file from the replica, even though the replica will not be marked as inconsistent.