Jesh,

There is an argument for not putting AV on a server, and that hinges heavily on whether anyone uses the server for anything other than serving. [e.g. NO regular or desktop usage]

Because AC requires(by default) sharing a directory with EVERYONE, and some of the more virulent attacks spread based on shared directory propagation, there is definitely an arugment in favor of server AV in a client-server envrinment.

Here is a summary diagram from the latest Gartner report. For context, Gartner reports typically run $2000-$10000 depending on the subject, and most of the F1000 use them as a baseline for determining what vendors to consider.

[Linked Image from sophos.com]

You'll note that Sophos scores well, and in the enterprise space is considered a leading vendor for their integration of security along with AV. Disclaimer - we sell Sophos, but that began years ago when had regular problems with McAfee and Symantec in the SMB market.

Two things to keep in mind; <1> the single greatest thing you can do to protect your network and hardware is to NOT allow users to run as Administrators - save you hundreds of dollars a year and costs you nothing. <2> The AV software is only as good as the configuration of the install. We had a client come to us after their previous vendor installed new equipment that left their network exposed and they only found out after they were contacted about one of their servers being used to host and serve P0rn - not the way a CEO wants to learn about a large breach.


Indy
"Boss"

Indy's Blog

www.BestForYourPractice.com
Our Name is Our Creed