Monitoring with PowerShell Chapter 2: Monitoring Anti-virus installation status

Hi All,
Today we will be focusing on monitoring the anti-virus status of computers or servers that communicate with the Microsoft Security Center, The Security Center WMI Namespace actually has a lot of information about the current state of all security products, as long as they integrate and communicate with WMI.

Requirements:

Security Center Compatible Anti-virus
PowerShell v3 or higher

First, we’re going to get a list of the currently installed AV products by running a WMI query with the Get-WMIObject cmdlet:

1
2

$AV = Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct

Now when we query the $AV variable we get a large list of information, which contains exactly what we need to check the status, the list of status codes has been found on StackOverflow, unfortunately the URL no longer works so I cannot put the URL for credit.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22



$AV = Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct

switch ($AV.productState) {
    "262144" {$UpdateStatus = "Up to date" ;$RealTimeProtectionStatus = "Disabled"}
    "262160" {$UpdateStatus = "Out of date" ;$RealTimeProtectionStatus = "Disabled"}
    "266240" {$UpdateStatus = "Up to date" ;$RealTimeProtectionStatus = "Enabled"}
    "266256" {$UpdateStatus = "Out of date" ;$RealTimeProtectionStatus = "Enabled"}
    "393216" {$UpdateStatus = "Up to date" ;$RealTimeProtectionStatus = "Disabled"}
    "393232" {$UpdateStatus = "Out of date" ;$RealTimeProtectionStatus = "Disabled"}
    "393488" {$UpdateStatus = "Out of date" ;$RealTimeProtectionStatus = "Disabled"}
    "397312" {$UpdateStatus = "Up to date" ;$RealTimeProtectionStatus = "Enabled"}
    "397328" {$UpdateStatus = "Out of date" ;$RealTimeProtectionStatus = "Enabled"}
    "397584" {$UpdateStatus = "Out of date" ;$RealTimeProtectionStatus = "Enabled"}
    "397568" {$UpdateStatus = "Up to date"; $RealTimeProtectionStatus = "Enabled"}
    "393472" {$UpdateStatus = "Up to date" ;$RealTimeProtectionStatus = "Disabled"}
default {$UpdateStatus = "Unknown" ;$RealTimeProtectionStatus = "Unknown"}
}

$AVName = $AV.displayname
$AVUpdateStatus = $UpdateStatus
$AVProtection = $RealTimeProtectionStatus

And that’s it, by running $AV.Displayname we return the display name, and the status can be checked with $AVUpdateStatus and $AVProtection – By checking against the contents of these variables in your RMM you can easily set-up alerting.