Security tools can have very different purposes even when both are associated with malware protection and endpoint security. OnGuard and TDSSKiller are a good example. OnGuard, in the ClearPass context, is primarily an endpoint health and compliance agent that checks device security posture and communicates with a central ClearPass environment. It is not designed to function as a conventional antivirus application.

TDSSKiller, by contrast, is a specialized Kaspersky utility designed to detect and remove certain rootkits and related malware threats. Because the two tools address different security requirements, comparing them is more useful when their features, operating models, performance characteristics, compatibility, and intended use cases are examined separately.

OnGuard vs TDSSKiller at a Glance

Feature	OnGuard	TDSSKiller
Primary purpose	Endpoint health, compliance, and network access control	Specialized rootkit and malware detection/removal
Main security role	Checks endpoint security posture	Scans for specific malware/rootkit threats
Conventional antivirus	No	No, it is a specialized remediation utility
Central management	Yes, through ClearPass Policy Manager	Primarily an endpoint utility
Real time protection	Not designed as a traditional real time antivirus	Not intended as continuous antivirus protection
Malware removal	Can support remediation workflows	Designed for detection and removal of supported threats
Network access control	Yes	No
Supported environments	Windows, macOS, and Linux environments depending on ClearPass release and agent	Primarily Windows environments
Best suited for	Organizations managing endpoint compliance	Targeted malware and rootkit investigation
Enterprise management	Strong when used with ClearPass	Limited compared with enterprise endpoint platforms
Standalone use	Generally depends on ClearPass infrastructure	More suitable as a standalone scanning utility

The key difference is therefore purpose rather than simply detection capability. ClearPass OnGuard checks whether an endpoint meets defined security and compliance requirements, while TDSSKiller focuses on a narrower malware-removal task.

OnGuard Features and Capabilities

ClearPass OnGuard is an endpoint agent associated with HPE Aruba Networking ClearPass. Its role is to collect endpoint health information and help organizations enforce network-access policies. HPE documentation states that the agent is not antivirus software, although it can check security-related conditions such as antivirus, antispyware, and firewall status.

OnGuard can also work with persistent and agentless deployment models. Depending on the ClearPass version and operating system, supported platforms include Windows, macOS, and several Linux distributions. Current ClearPass 6.11 documentation lists Windows 10 and 11, Windows Server 2016 through 2022, macOS 10.15 through 26.x, and multiple Linux distributions among supported environments.

Main OnGuard strengths

• Endpoint health and compliance assessment
• Integration with ClearPass Policy Manager
• Network access control support
• Antivirus, antispyware, firewall, and security-state checks
• Auto-remediation capabilities in supported configurations
• Centralized endpoint visibility
• Persistent and agentless deployment options
• Support for multiple operating-system families

Its major limitation is that OnGuard should not be treated as a replacement for a dedicated antivirus or malware-removal program. HPE specifically describes it as an endpoint health-checking component rather than an antivirus solution.

TDSSKiller Features and Capabilities

TDSSKiller is a specialized Kaspersky security utility intended to identify and remove particular rootkits and other malicious programs associated with system compromise. Its focused design makes it different from a full endpoint security suite.

Rather than providing broad network-access control or centralized compliance management, TDSSKiller is oriented toward examining a system for supported threats and helping users address detected infections. This makes it more closely associated with malware investigation and remediation than with enterprise network policy enforcement.

Main TDSSKiller strengths

• Focused malware and rootkit scanning
• Designed for targeted threat investigation
• Malware-removal functionality
• Useful as a specialized troubleshooting utility
• Simpler operational model than a centralized NAC platform
• Appropriate for targeted endpoint checks

Its narrow scope is also its primary limitation. A specialized rootkit scanner should not be considered equivalent to a complete antivirus, EDR, or enterprise network-access-control platform.

Performance Comparison

Performance depends heavily on what each product is being asked to do. OnGuard operates as part of an endpoint compliance and access-control framework, so its workload can include collecting endpoint information, checking security conditions, and communicating with ClearPass infrastructure. Its purpose is not to perform continuous deep malware analysis of every file on a device.

TDSSKiller has a different workload because its purpose is targeted malware and rootkit investigation. Scan duration can vary according to system size, storage speed, running processes, and the amount of data requiring examination. A direct performance ranking would therefore be misleading because the tools perform fundamentally different jobs.

Compatibility and System Requirements

OnGuard compatibility is closely connected to the ClearPass version being deployed. For ClearPass 6.11, HPE lists support for Windows 11 and Windows 10, Windows Server 2016, 2019, and 2022, macOS versions from 10.15 through 26.x, and several Linux distributions. HPE also documents ARM support for Windows OnGuard agents while noting different architecture support for Linux.

The documented OnGuard requirements include approximately 512 MB of minimum RAM, 1 GB recommended RAM, and about 300 MB of disk space, although actual requirements depend on the deployment model and ClearPass environment.

TDSSKiller has historically been associated primarily with Windows systems and is designed as a focused security utility rather than a cross-platform endpoint-compliance agent. Its system requirements and supported versions should be checked against the particular TDSSKiller release being used because Kaspersky can change supported environments over time.

Ease of Use

OnGuard is most useful in environments where administrators already operate ClearPass Policy Manager. Its value comes from integration, centralized policy, endpoint visibility, and compliance enforcement rather than from being a simple standalone scanner. Organizations therefore need more infrastructure and configuration knowledge to use it effectively.

TDSSKiller generally has a more focused workflow. A user investigating a potentially compromised Windows system can use a specialized scanner without establishing an enterprise network-access-control architecture. However, its simpler scope also means that it does not provide the centralized endpoint-policy functions associated with OnGuard.

Security and Compliance Use Cases

OnGuard is particularly relevant to organizations that need to determine whether devices satisfy security requirements before granting or maintaining network access. ClearPass documentation describes capabilities involving endpoint compliance, antivirus and antispyware checks, firewall checks, remediation, messaging, and centralized device status.

TDSSKiller serves a different scenario. It is better understood as a targeted diagnostic and remediation utility for supported rootkits and malware. It can be useful when a system requires specialized investigation, but it does not provide the broader compliance and network-access functions of OnGuard.

OnGuard Pros and Limitations

Pros

• Strong integration with ClearPass Policy Manager
• Designed for endpoint compliance and health assessment
• Supports centralized visibility and policy enforcement
• Can work with multiple operating-system environments
• Supports remediation capabilities in appropriate deployments

Limitations

• Not a conventional antivirus product
• Depends heavily on the ClearPass environment for its primary enterprise role
• More complex to deploy than a standalone malware scanner
• Its effectiveness depends on supported endpoint checks and integrations
• Not designed specifically as a rootkit-removal utility

TDSSKiller Pros and Limitations

Pros

• Focused on specialized malware and rootkit detection
• Useful for targeted system investigations
• Designed for remediation of supported threats
• More focused than a full endpoint-management platform
• Can complement broader antivirus protection during troubleshooting

Limitations

• Narrower security scope
• Not a complete antivirus or EDR platform
• Does not provide network-access-control capabilities
• Does not replace centralized endpoint compliance management
• Detection and remediation capabilities depend on the supported threat categories and software version

OnGuard vs TDSSKiller for Different Users

For enterprise environments that need endpoint health checks, compliance policies, and network-access decisions, OnGuard fits into a substantially different workflow. It is designed to work with ClearPass and can help administrators assess whether endpoints meet defined security requirements before or during network access.

For a security technician investigating a suspected rootkit or another supported malware threat on a Windows computer, TDSSKiller represents a more specialized approach. Its purpose is focused on identifying and addressing certain threats rather than managing an organization’s overall endpoint compliance posture.

Important Differences to Consider

The most important difference between OnGuard and TDSSKiller is that they should not normally be viewed as direct substitutes. OnGuard is an endpoint compliance and network-access-control component, whereas TDSSKiller is a specialized malware investigation and removal utility.

Their management models also differ. OnGuard is built around centralized ClearPass infrastructure, policies, and endpoint status, while TDSSKiller is centered on targeted scanning of an individual system. This difference affects deployment, administration, performance expectations, and suitable use cases.

It is also important to distinguish both products from comprehensive endpoint security suites. Neither comparison should be interpreted as meaning that one tool provides all the functions of modern antivirus, EDR, firewall, identity, and network-security technologies.

Final Comparison

OnGuard and TDSSKiller occupy different positions within the security-tool landscape. OnGuard focuses on endpoint health, compliance, remediation, and network-access decisions through the ClearPass ecosystem. TDSSKiller focuses more narrowly on detecting and removing certain malware and rootkit threats.

The choice between them therefore depends on the security task being addressed rather than on a simple feature score. Organizations concerned with centralized endpoint compliance may evaluate OnGuard within a ClearPass deployment, while targeted malware investigations may call for a specialized utility such as TDSSKiller. Neither tool should automatically be treated as a replacement for the other because their objectives, architectures, and operational roles are fundamentally different.