Supported operating systems for antivirus and antimalware protection

For endpoints running on Intel or AMD CPUs, this functionality is supported only on processors that include the SSE4.2 instruction set, as follows:

  • Intel CPUs released after 2011

  • AMD CPUs released after 2012

For Windows on ARM, antivirus and antimalware protection is supported via Agent for Windows on ARM. For more information, see Agent for Windows on ARM.
Protected Process Light (PPL) is a Windows security feature that ensures anti-tampering of antivirus and antimalware and Active Protection processes. Windows legacy operating systems block the usage of the PPL feature. As a result, we cannot guarantee that antimalware and antivirus protection can fully protect workloads running on these operating systems.

For a list of legacy operating systems, see Agent for Windows (Legacy).

Active protection, antivirus and antimalware features are supported on the following platforms.

Operating system Version/Distribution
Windows
  • Windows 7 Service Pack 1 and later
  • Windows Server 2008 R2 Service Pack 1 and later

For Windows 7, you must install the following updates from Microsoft before installing the protection agent:

For more information on the required updates, see this knowledge base article.
Linux

  • AlmaLinux 8.x, 9.x, 10.x
  • Red Hat Linux 7.x, 8.x, 9.x
  • Rocky Linux 8.x, 9.x, 10.x
  • CloudLinux 6.10, 7.x, 8.x
  • CentOS 6.5 and later 6.x versions, 7.x, 8.x
  • Ubuntu 16.04, 18.04, 20.04, 22.04, 22.10, 24.04
  • Debian 8.x, 9.x, 10.x, 11.x
  • Oracle Linux 7.x, 8.x, 9.x
  • SUSE Enterprise Linux 15.x
  • openSUSE Leap 15.x

The Behavioral analysis engine supports the following Linux versions:

  • CentOS 7.x
  • Debian 10.x, 11.x
  • CloudLinux 7.x, 8.x
  • Ubuntu 16.04, 18.04, 20.04, 22.04, and 24.04
  • AlmaLinux 8.x, 9.x, 10.x
  • Rocky Linux 8.x, 9.x, 10.x
macOS
  • macOS 13.x – macOS 26

Antivirus and Antimalware protection

Feature Windows Windows on ARM Linux macOS
Fully-integrated Active Protection functionality Yes Yes No No
Real-time antimalware protection Yes Yes

Yes

Yes
Advanced real-time antimalware protection with local signature-based detection Yes Yes

Yes

Yes
Static analysis for portable executable files Yes Yes No

Yes1
On-demand antimalware scanning Yes Yes

Yes2

Yes
Potentially unwanted application detection Yes Yes Yes Yes
Network folder protection Yes Yes

No3

 No
Server-side protection Yes Yes No No
Scan of archive files Yes Yes No

Yes
Scan of removable drives Yes Yes No

Yes
Scan of new and changed files only Yes Yes No

Yes
File/folder exclusions Yes Yes

Yes

Yes4
Processes exclusions Yes Yes No Yes
Behavioral analysis engine Yes Yes Yes5

Yes
Exploit prevention Yes Yes No No
Quarantine Yes Yes Yes Yes
Quarantine auto clean-up Yes Yes Yes Yes
URL filtering (http/https) Yes Yes No Yes8
Corporate-wide whitelist Yes Yes No

Yes
Firewall management6 Yes Yes No No
Microsoft Defender Antivirus management7 Yes Yes No No
Microsoft Security Essentials management Yes Yes No No
Registering and managing Antivirus and Antimalware protection via Windows Security Center Yes Yes No No

1 Static analysis for portable executable files is supported only for scheduled scans on macOS.

2 Start conditions are not supported for on-demand scanning on Linux.

3 Network folders in Linux are treated as local folders, hence Active Protection will automatically protect network folders in Linux OS, as if they are local folders.

4 File/folder exclusions are only supported for the case when you specify files and folders that will not be scanned by real-time protection or scheduled scans on macOS.

5 The Behavioral analysis engine supports the following Linux versions:

  • CentOS 7.x
  • Debian 10.x, 11.x
  • CloudLinux 7.x, 8.x
  • Ubuntu 16.04, 18.04, 20.04, 22.04, and 24.04
  • AlmaLinux 8.x, 9.x, 10.x
  • Rocky Linux 8.x, 9.x, 10.x

6 Firewall management is supported on Windows 8 and later. Windows Server is not supported.

7 Microsoft Defender Antivirus management is supported on Windows 8.1 and later.

8 URL filtering is supported on macOS 13 and later.

9 Removable drives are treated as local drives in Linux.

For more information about the supported operating systems and their versions, see Supported operating systems for antivirus and antimalware protection.

Active Protection

Feature Windows Windows on ARM Linux macOS
Process Injects detection Yes Yes No No
Automatic recovery of affected files from the local cache Yes Yes Yes Yes
Self-defense for Acronis backup files Yes Yes No No
Self-defense for Acronis software Yes Yes No

Yes

(Only Active Protection and antimalware components)
Trusted/blocked process management Yes Yes No Yes
Processes/folders exclusions Yes Yes Yes Yes
Ransomware detection based on a process behavior (AI-based) Yes Yes Yes Yes
Cryptomining process detection based on process behavior Yes Yes No No
External drives protection (HDD, flash drives, SD cards) Yes Yes No Yes
Network folder protection Yes Yes No* Yes
Server-side protection Yes Yes No No
Zoom, Cisco Webex, Citrix Workspace, and Microsoft Teams protection Yes Yes No No

*Network folders in Linux are treated as local folders, hence Active Protection will automatically protect network folders in Linux OS, as if they are local folders.

For more information about the supported operating systems and their versions, see Supported operating systems for antivirus and antimalware protection.