All the servers & fat clients on site are protected with ESET Endpoint Antivirus, however I notice none of the thin clients have any type of AV enabled.

A brief Google search doesn't show much interest in securing these little beasties. Should I look into a lightweigh AV system for these, or are they fine?

Running Windows 8 and 10 iot embedded.

The point is that if an end-user plugs in een USB it can infect devices on the network.

  • Some thinclient use a flashbased OS and the OS is proprietary, thus you just cant install an AV on those. please edit your question with the OS (windows embeded, thinos, linux, zero client, etc..)
    – yagmoth555
    Sep 7, 2017 at 16:34
  • if rebooting is quicker than scanning, what's the point?
    – dandavis
    Sep 7, 2017 at 18:54
  • The point is that if a end user plugs in een USB it can infect devices on the network
    – Ruben.w
    Sep 8, 2017 at 6:37

2 Answers 2


This depends on quite a few factors. A few points for and against AV in thin clients. What is the thin client actually used for? Is it normal users workstations or or a specific app?

  • What connectivity do they have? Access to network shares? This could allow malware to spread across the infrastructure via shares, this could include ransomware.

  • Are the the clients sessions destroyed and reverted when they log out? This would clear any existing malware on the system. However, depending on the connectivity as above movement to another server may have already taken place if the connection allows it.

  • If you have connectivity to the web, and nothing else, if malware gets onto that machine data from that session and users profile could be exfiltrated via the internet.

  • Does the host the clients are running on have AV? And are the shares scanned on a regular basis? This could be a good halfway house, but won't be able to detect in memory malware, but to be persistent, malware must write to a file "at some point" and when this happens if you are scanning all the mount points used within the thin client, then you should be able to detect it.

In my view, as a someone in the security field, I'd say yes, run AV. It's potentially a point of exposure for malware to enter your network and you want to stop that asap.

  • Thank you! Do you know a good AV for windows 8/10 embedded?
    – Ruben.w
    Sep 7, 2017 at 13:58
  • To be honest, Windows defender is one of the better AVs out there at the moment! Free too...
    – geekscrap
    Sep 8, 2017 at 15:28

In case of Windows-based HP thin clients (Windows Embedded Standard 7 either Windows 10 IoT Enterprise based) Windows Defender is included and enabled by default: Windows-based HP thin clients - Antivirus Software Support. http://h10032.www1.hp.com/ctg/Manual/c05316314

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .