Citrix XenApp and Citrix EdgeSight Anti Virus Recommendations

The following are some guidence to help ease the negative effect that standard Anti-virus settings can cause on Citrix XenApp servers.
We all know that XenApp or for that matter simple Terminal Servers are not used as we do with workstations or desktop, so there is quite a few things to keep in mind.
The scan and realtime engines tend to have a bit of aggressiveness when it comes to performance and theirfore needs to be adjusted for the Antivirus Software or performance will be affected.

Citrix XenApp settings

• Change what gets scanned to scan inbound only. Typical settings are to scan on write, read access, etc.
• Scan local drives only
• Exclude the pagefile from being scanned.
• Exclude .dat and .tmp files.
• Exclude C:\Documents and Settings\*.*
• Disable the heuristics mode of scanning, this setting can be very intensive on the system
• For Printing performance issues: Exclude the Spool folder, C:\WINDOWS\system32\spool to improve print performance
• Exclude the C:\Program Files\Citrix folder and all subfolders
• Exclude smss.exe, winlogon.exe, userinit.exe, csrss.exe and wfshell.exe
• For Symantec only: Disable "Tamper Protection".
• Scan on write events only
• Exclude the \Program Files\Citrix folder from being scanned (the heavily accessed local host cache and Resource Manager/EdgeSight Basic local database are contained inside this folder)
• If ICA pass-through connections are used, exclude the user‘s XenApp Plugin bitmap cache and the XenApp Plugin folders
• WARNING! Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. If users are connecting to a published desktop, Citrix recommends removing the antivirus-related calls from the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run registry key to improve performance

EdgeSight settings

You must NOT be running McAfee 8.0 with patch 10. If so, you MUST install patch 11 or later before installing the EdgeSight Agent.
Some paths are given in case they were not already excluded (from above)

Server

Folders

• C:\Program Files\Common Files\Citrix\System Monitoring\Server\RSSH
• C:\Program Files\Citrix\System Monitoring\Server\EdgeSight 4.0\scripts\rssh
• C:\Program Files\Citrix\System Monitoring\Server\EdgeSight 4.0\Pages
• C:\Program Files\Microsoft SQL Server\MSSQL\Reporting Services
• C:\Program Files\Microsoft SQL Server\MSSQL\Data

Agent

Exclude the following from being scanned:

Folders

• C:\Documents and Settings\All Users\Application Data\Citrix\System Monitoring\Data
  

Files

• C:\Program Files\Citrix\System Monitoring\Agent\Core\rscorsvc.exe
• C:\Program Files\Citrix\System Monitoring\Agent\Core\Firebird\bin\fbserver.exe

Be sure to always check with your antivirus vendor, if they have any recommedations on how to setup the antivirus for a multiuser environment.

If you have any other recomendations that you would like to contribute with to this article then please post a Comment!

• < Prev
• Next >