I've just taken over as IT Manager in an environment where most of the end-users are using HP-based Win7 thin clients (approx 50 seats) to access a remote desktop server.

All the servers & fat clients on site are protected with ESET Endpoint Antivirus, however I notice none of the thin clients have any type of AV enabled.

A brief Google search doesn't show much interest in securing these little beasties. Should I look into a lightweigh AV system for these, or are they fine?


These thin clients are HP T510's, running Windows 7 Standard Embedded. They don't seem to be using PXE Boot - by the look of it, each has its' own Windows OS which presents them with a local desktop on boot. This desktop has a RDP connection, which they use to access the main server.

The Remote Desktop server does have antivirus on it, but there's no indication that the thin client is collecting anything from the server directly.

They don't have any browser available on the local OS, but I would be unsuprised if that's just a result of the previous IT folks simply hiding applications.

These machines aren't joined to the AD domain, and log in automatically, however it seems they aren't logged in with any admin rights.

  • I have the distinct feeling that this is about to turn into a Large Important Project(tm). :-(
    – Rhyven
    Feb 4, 2015 at 0:25

3 Answers 3


I presume these are x86 clients that are loading OS from the network? Do these folks have internet access?

If so, it seems there is still an attack vector -- If my memory serves, at least one variant of the cryptolocker type malware attempts encryption of every .doc,spreadsheet, photo, or other user data file (including those found on network shares) it can find, even before a reboot.

With that said, I am one of those that believe that modern anti-virus software provides very little in terms of genuine protection from the type of zero-day exploits that causing the biggest problems.

In that respect, it seems the biggest things would be to ensure that the thin clients are booting from fully updated and patched OS images, that their users aren't running with administrator rights, aren't accessing the internet with an out of date internet explorer, and are not networked to shares or network services they do not need.

  • I'm unclear if you are answering "yes" or "no" to the question.
    – schroeder
    Feb 3, 2015 at 22:07
  • 1
    AV never does do any protection against 0-day vulnerabilities, that's why they are called 0-days. But that does NOT mean that they have no use. They are wonderful "background radiation" protection. You still need them, but they are not a complete solution.
    – schroeder
    Feb 3, 2015 at 22:08
  • "Background Radiation" is about the best way I've heard it put in some time. But none of the last dozen fire drills I've had to deal with were background incidents. They were nukes.
    – boggart
    Feb 3, 2015 at 22:52
  • AV falls in the crack between "it's bad if you don't have it" and "it's not necessarily good that you do have it"
    – schroeder
    Feb 3, 2015 at 22:54
  • Cannot disagree with that. Great comment.
    – boggart
    Feb 3, 2015 at 22:55

It might depend on your definition of "thin client".

The thin clients I know download just enough from the server to do their job, and that includes things like programs. As such, they will download the installed AV package from the server. In this way, the thin client itself doesn't need one, because it "borrows" it from the server.

If the server that serves the thin clients does not have AV, then you've got a problem.

  • Just added a bit of information on the boot process - it's definitely not PXE boot; just embedded Win7 which they then use to RDP out to the terminal server.
    – Rhyven
    Feb 4, 2015 at 0:23
  • What I might call "thinner" clients. Because they run an OS locally, they need protection. The chance for rootkits becomes high.
    – schroeder
    Feb 4, 2015 at 0:27

Citrix and virtualization engineer for 23 years. YOU MUST INSTALL ANTIVIRUS AND MALWARE PROTECTION ON ALL END POINTS. Just because that little thin client doesn't save stuff after a restart, doesn't mean that malware and other viruses can infect and live during run time.

Strongly recommend you consult a professional.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .