Do thin-clients need antivirus?

Question

I've just taken over as IT Manager in an environment where most of the end-users are using HP-based Win7 thin clients (approx 50 seats) to access a remote desktop server.

All the servers & fat clients on site are protected with ESET Endpoint Antivirus, however I notice none of the thin clients have any type of AV enabled.

A brief Google search doesn't show much interest in securing these little beasties. Should I look into a lightweigh AV system for these, or are they fine?

UPDATE:

These thin clients are HP T510's, running Windows 7 Standard Embedded. They don't seem to be using PXE Boot - by the look of it, each has its' own Windows OS which presents them with a local desktop on boot. This desktop has a RDP connection, which they use to access the main server.

The Remote Desktop server does have antivirus on it, but there's no indication that the thin client is collecting anything from the server directly.

They don't have any browser available on the local OS, but I would be unsuprised if that's just a result of the previous IT folks simply hiding applications.

These machines aren't joined to the AD domain, and log in automatically, however it seems they aren't logged in with any admin rights.

Answer 1

I presume these are x86 clients that are loading OS from the network? Do these folks have internet access?

If so, it seems there is still an attack vector -- If my memory serves, at least one variant of the cryptolocker type malware attempts encryption of every .doc,spreadsheet, photo, or other user data file (including those found on network shares) it can find, even before a reboot.

With that said, I am one of those that believe that modern anti-virus software provides very little in terms of genuine protection from the type of zero-day exploits that causing the biggest problems.

In that respect, it seems the biggest things would be to ensure that the thin clients are booting from fully updated and patched OS images, that their users aren't running with administrator rights, aren't accessing the internet with an out of date internet explorer, and are not networked to shares or network services they do not need.

Answer 2

It might depend on your definition of "thin client".

The thin clients I know download just enough from the server to do their job, and that includes things like programs. As such, they will download the installed AV package from the server. In this way, the thin client itself doesn't need one, because it "borrows" it from the server.

If the server that serves the thin clients does not have AV, then you've got a problem.

Answer 3

Citrix and virtualization engineer for 23 years. YOU MUST INSTALL ANTIVIRUS AND MALWARE PROTECTION ON ALL END POINTS. Just because that little thin client doesn't save stuff after a restart, doesn't mean that malware and other viruses can infect and live during run time.

Strongly recommend you consult a professional.