Antivirus Exclusions for StarWind VSAN-based Clusters

Problem

Some antivirus and endpoint protection solutions—such as Sophos, CrowdStrike, SentinelOne, and others—may not be cluster-aware, leading to potential issues when used with a StarWind Virtual SAN (VSAN) cluster:

• Cluster communication disruptions

• Performance degradation

• Service instability

• Data inconsistencies when antivirus snapshotting features are enabled

Non-cluster-aware software may block or delay critical service operations, lock or quarantine vital files, and interfere with the snapshotting process. This can lead to synchronization issues and affect the overall reliability of the cluster.

Resolution

To avoid mentioned issues, follow the recommendations below:

1. Contact your antivirus vendor for guidance on configuring the software in a cluster-aware manner. Many vendors offer best practices or advanced settings to avoid interference with high-availability setups.

2. Configure antivirus exclusions for critical paths, services, and files used by StarWind VSAN and the cluster. Add the following to your antivirus exclusions list:

   • StarWind VSAN service: starwindservice.exe

   • C:\Windows\system32\config

   • C:\Windows\Cluster


   • Folder and volume path where StarWind virtual disk files (.img) are stored.

3. Refer to Microsoft’s official guidance on antivirus configuration for clustered environments:

   • Issues with Non-Cluster-Aware Antivirus Software

   • Microsoft Defender Antivirus: Server Exclusions

Request a Product Feature

To request a new product feature or to provide feedback on a StarWind product, please email to our support at support@starwind.com and put “Request a Product Feature” as the subject.