Antivirus software that isn't cluster-aware may cause problems with Cluster Services
This article provides help to solve problems with Cluster Services that be caused by antivirus software that isn't cluster-aware.
Original product version: Windows Server 2012 R2
Original KB number: 250355
Antivirus software that is not cluster-aware may cause unexpected problems on a server that is running Cluster Services. For example, you may experience resource failures or problems when you try to move a group to a different node.
This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
Antivirus software helps protect your computer from viruses. You must not download or open files from sources that you do not trust, visit Web sites that you do not trust, or open e-mail attachments when the antivirus software is disabled.
For more information about computer viruses, see How to prevent and remove viruses and other malware.
Most antivirus software uses filter drivers (device drivers) that work together with a service to scan for viruses. These filter drivers reside above the file system recognizer and scan files as they are opened and closed on a local hard disk. Antivirus software may not understand the shared disk model and may not correctly allow for failover.
If you are troubleshooting failover issues or general problems with a Cluster services and antivirus software is installed, temporarily uninstall the antivirus software or check with the manufacturer of the software to determine whether the antivirus software works with Cluster services. Just disabling the antivirus software is insufficient in most cases. Even if you disable the antivirus software, the filter driver is still loaded when you restart the computer.
Even if you are not monitoring the shared disk, the filter drivers are still loaded and may affect the operation of the cluster.
You can run antivirus software on a SQL Server cluster. However, you must make sure that the antivirus software is cluster-aware. Contact your antivirus software vendor about cluster-aware versions and interoperability.
Additionally, you should exclude the following file system locations from virus scanning on a server that is running Cluster Services:
- The path of the
\mscsfolder on the quorum hard disk. For example, exclude the
Q:\mscsfolder from virus scanning.
- The temp folder for the Cluster Service account. For example, exclude the
\clusterserviceaccount\Local Settings\Tempfolder from virus scanning.
For more information about running antivirus software on servers that are running SQL Server, see How to choose antivirus software to run on computers that are running SQL Server.