Should domain controllers, SQL Server and Hyper-V hosts run antivirus, and what should be excluded?

Servers should use supported antimalware controls, but exclusions must follow role and vendor guidance, with minimum scope, current documentation and performance validation.

1. Conclusion and scope

Both “servers must never run antivirus” and “exclude the entire data drive” are unsafe positions. Windows Server roles need malware protection, while databases, virtual disks, replication and high-I/O files require carefully scoped handling to avoid locking, latency or consistency problems.

This issue involves server security, access boundaries and performance. Exclusions and exceptions must be minimal and reviewed.

2. Risk signals that deserve priority

• After endpoint protection deployment, SQL I/O latency, Hyper-V VM pauses or DFSR/AD events increase.
• To fix performance, an entire disk, every SQL process or all VM directories have been excluded.

3. Pre-change assessment checklist

1. Identify Microsoft Defender or third-party protection and whether automatic server-role exclusions are active.
2. Record actual paths for AD DS, SQL Server, Hyper-V, backup agents and business applications.
3. Review detections, quarantine, scan schedules and CPU/storage impact.
4. Use Microsoft and application-vendor documentation to distinguish file, directory, extension and process exclusions.

Get-MpComputerStatus
Get-MpPreference | Select ExclusionPath,ExclusionProcess,ExclusionExtension
Get-Process MsMpEng | Select CPU,WorkingSet
Get-Counter "\LogicalDisk(*)\Avg. Disk sec/Transfer"

4. Recommended implementation sequence

1. Prefer built-in role exclusions and current vendor recommendations rather than copying an old internet list.
2. Exclude only required paths and processes and scope them to actual instance directories, never an entire system or data volume.
3. Use separate policies and scan windows for SQL data/log/backup and Hyper-V VHDX/configuration.
4. After change, monitor performance and security coverage and review exclusions as product guidance changes.

5. Validation, rollback and common mistakes

• AD replication, SQL transactions, Hyper-V I/O and backup remain stable.
• The security product still detects test files and threats outside the excluded scope.
• Every exclusion has an owner, documented basis, defined scope and review date.

Common mistakes

• Skipping all malware protection because the server has no internet access.
• Copying a broad exclusion list from another organisation.
• Disabling real-time protection when performance drops without finding the cause.

Official references

• Microsoft: Defender Antivirus exclusions on Windows Server
• Microsoft: Configure antivirus software to work with SQL Server
• Microsoft: Recommended antivirus exclusions for Hyper-V hosts

Frequently asked questions

Can a domain controller run third-party antivirus?

Yes, when the product supports AD DS and role-specific exclusions and change procedures are followed.

Does Defender automatically exclude every SQL directory?

No. Not every third-party workload path is automatically covered; configure SQL Server according to actual paths and current guidance.