I'm looking at rolling out agent based AV to around 1000 Windows servers across our estate. This feels like too much of a blanket approach. We have a mixture of services running - the usual things such as Citrix, SQL, AD, Exchange and various other applications.
A lot of our servers do not have any direct user interaction as users do not directly logon, so the risk is somewhat low. Conversely, the risk of a performance hit is significant.
From what I've read the should AV be on servers questions seems to be a matter of opinion. Is there any official guidance from the likes of Microsoft or NIST?
Also, if AV is put on servers, should all the servers have real time scanning enabled? In addition, should scans be set to scan on read & write or just read?