{"id":2414,"date":"2012-01-01T13:27:00","date_gmt":"2012-01-01T12:27:00","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/fep-and-databases-policies\/"},"modified":"2012-01-01T13:27:00","modified_gmt":"2012-01-01T12:27:00","slug":"fep-and-databases-policies","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/fep-and-databases-policies\/","title":{"rendered":"Forefront Endpoint Protection (FEP) 2010 and database policies"},"content":{"rendered":"

I have seen at a customer that SQL Server’s policy doesn’t follow Microsoft’s recommendations about antivirus and databases (kb 309422<\/a>), such as excluding *.mdf,*.ndf and *.ldf files. In addition, there is no Oracle policy in case of Forefront Endpoint Protection 2010 (known as FEP 2010).
\nI have decided to create generic databases policies for FEP (optimized by dbi services) adapted for all SQL Server and Oracle environments.<\/p>\n

Why?<\/h3>\n

It’s very simple. On the one hand we know that antiviruses can improve stability and performance like disk latency problems. On the other hand we don’t know how SQL Server FEP policies are optimized for SQL Server databases. Also, we do not know their impact if we don’t apply the antivirus recommendation for databases.
\nAnd, finally what\u2019s appending in a cluster environment?<\/p>\n

Which policies do already exist for FEP?<\/h3>\n

You can download all FEP policies for windows server here<\/a>.
\nThere, you will find 2 policy files for SQL Server (FEP_SQL2005.xml and FEP_SQL2008.xml) and nothing for Oracle.
\nUsing these 2 files, Microsoft excludes 3 processes:
\nSQLServr.exe, ReportingServicesService.exe and MSMDSrv.exe
\nThese 2 policies are for the default instance of SQL Server. If you have multiple instances, it’s very difficult to exclude specifically all processes with their complete path.
\n\"00-SQLServerExt2\"
\nOf course you can also find other policies for DNS, Exchange, or SharePoint, as an example.<\/p>\n

What is Microsoft’s recommendation for SQL Server and Antivirus?<\/h3>\n

In the policy file for SQL Server, you can find this note:
\n\"note\"
\n
\nThis indicates that we do not need to excluded the data file extensions (*.mdf,*.ndf and *.ldf), but I don’t understand why…
\nKB article 309422 extract:
\n<\"kbexctract\"
\nWhy?<\/strong>
\nUnfortunately, I haven’t found anything about it. To be sure, I recommend excluding data files extensions in order to avoid having locked data files during a virus scan.
\nOn its website, Microsoft also recommends to exclude processes and data files.
\nFor more information, see KB309422<\/a>.<\/p>\n

What is Oracle’s recommendation for Oracle and Antivirus?<\/h3>\n

Like for SQL Server, dbi services recommend to exc,ude Oracle processes from the scan.
\nThese processes are oracle.exe (database process) and TNSLSNR.exe (listener process) installed on Windows Server.
\nOf course all data files extensions, such *.ctl,*.dbf and *.rdo or whatever configured on the Oracle level, should be excluded. In addition, archivelog (*.arc) and log files (*.log) can be excluded. It is not mandatory, but it may avoid bad surprises!
\nFor more information, see KB54817<\/a>.
\nNow, we go on to create 3 policies, one for SQL Server, one for Oracle, and one compiling both.<\/p>\n

Creating a new policy for SQL Server<\/h3>\n

Like policies from Microsoft, I have created a XML file named \u201cFEP_dbiServices_SQLServer.xml\u201d.
\nChange Processes key:<\/strong>
\nAs a first step, I have to delete the path from the 3 processes (SQL server Engine, Reporting Services and Analysis Services) to adapte them for multiple instance.
\nThen, I added the other SQL Server processes: Integration Services(MsDtsSrvr.exe), SQL Server Agent(SQLAGENT.exe) and SQL Server Browser(sqlbrowser.exe).
\nThis is a good practice for stability and performances.
\n\"sqlprocess\"
\nChange Extensions key:<\/strong>
\nIn this section, we have to exclude all data files extensions (*.mdf,*.ndf and *.ldf) and backup file (*.bak and *.trn).
\nI have added the log file to complete it. This is normally not critical for the protection strategy.
\n\"sqlextention\"
\nWhat’s the result in FEP?
\n\"00-SQLServerExt\"
\nIf you want, you can see the keys directly in the registry:
\n\"regedit\"
\nComments:
\nI haven’t excluded the full-text catalog files.
\nAs a comment in the file, you can find the directory that holds Analysis Services data (DataDir property of Analysis Services) and the cluster path that must be excluded.
\n\"sqlcluster\"
\nThis must be decommented by you.<\/p>\n

Creating a new policy for Oracle<\/h3>\n

For this policy, I have excluded all data files extensions and the 2 processes (see above).
\nThe XML file is named \u201cFEP_dbiServices_Oracle.xml\u201d.
\nCreate processes key:<\/strong>
\nLike for SQL Server, we exclude oracle.exe and TNSLSNR.exe, but not with the entire path such as C:oracleproduct10.2.0db_1BIN or C:oracleproduct11.2.0dbhome_1BIN – just the executable.<\/p>\n

\"oracleprocess\"
\nCreate Extensions key:<\/strong>
\nOnce again, like for SQL Server, we exclude the data et backup files.
\n\"oracleextention\"<\/p>\n

Creating new policies for both<\/h3>\n

Why a policy for both?
\nIf you have both databases on your IT structure, you have a generic database policy for the whole database servers’ environment.
\nThe XML file is named \u201cFEP_dbiServices_Oracle_SQLServer.xml\u201d and is a compilation of the 2 other files.<\/p>\n

Package “ssisFEP_GetErrorsDuringUpload” failed<\/h3>\n

To finish this posting, I want to give you important information about a problem with a SSIS package.
\nSymptoms:<\/strong>
\nPeriodically, the FEP data collection job (FEP_GetNewData_FEPDW_%) fails.
\nThe failure is in one of the following job steps:<\/p>\n