Antivirus Exclusions for StarWind VSAN-based Clusters

Introduction

This article provides guidance on configuring antivirus exclusions for StarWind VSAN-based clusters to ensure stable performance and uninterrupted operation. It explains how non-cluster-aware antivirus software can interfere with critical processes such as synchronization, file access, and snapshot operations. The guide lists recommended exclusions for key services, system directories, and storage paths used by StarWind VSAN to prevent performance degradation and cluster instability.

Problem

Some antivirus and endpoint protection solutions—such as Sophos, CrowdStrike, SentinelOne, and others—may not be cluster-aware, leading to potential issues when used with a StarWind Virtual SAN (VSAN) cluster:

• Cluster communication disruptions

• Performance degradation

• Service instability

• Data inconsistencies when antivirus snapshotting features are enabled

Non-cluster-aware software may block or delay critical service operations, lock or quarantine vital files, and interfere with the snapshotting process. This can lead to synchronization issues and affect the overall reliability of the cluster.

Resolution

To avoid mentioned issues, follow the recommendations below:

1. Contact your antivirus vendor for guidance on configuring the software in a cluster-aware manner. Many vendors offer best practices or advanced settings to avoid interference with high-availability setups.

2. Configure antivirus exclusions for critical paths, services, and files used by StarWind VSAN and the cluster. Add the following to your antivirus exclusions list:

   • StarWind VSAN service: starwindservice.exe

   • C:\Windows\system32\config

   • C:\Windows\Cluster


   • Folder and volume path where StarWind virtual disk files (.img) are stored.

3. Refer to Microsoft’s official guidance on antivirus configuration for clustered environments:

   • Issues with Non-Cluster-Aware Antivirus Software

   • Microsoft Defender Antivirus: Server Exclusions

Conclusion

Proper antivirus configuration is essential for maintaining the reliability of StarWind VSAN clusters. By excluding critical services, system paths, and virtual disk locations from scanning, administrators can prevent conflicts that lead to delays, file locks, or synchronization issues. Following these recommendations ensures consistent cluster performance, protects high availability, and minimizes the risk of disruptions caused by antivirus interference.