I'm currently reviewing our AV configuration for our environment, and reviewing how the real-time scanner is configured. The options that I have for the real-time configuration is as follows.
On Read On Write On Read and Write
I could not find any specific recommendations from the vendor (TrendMicro OfficeScan) for configuring the real-time scan engine.
I would just like to get some other individuals ideas and thoughts on how they determine the real-time AV config for their environments. Do you use different methodologies for desktops and server systems? Any particular server roles (IIS, DC, SQL) where you would configure one realtime method over another?
I would think that you would want real time scanning active for both Read and Write operations. Make sure to configure the appropriate exclusions for the server roles that you have (DC, IIS, SQL, etc).