{"id":5187,"date":"2016-07-22T09:39:39","date_gmt":"2016-07-22T13:39:39","guid":{"rendered":"http:\/\/jdhitsolutions.com\/blog\/?p=5187"},"modified":"2021-02-09T17:06:54","modified_gmt":"2021-02-09T22:06:54","slug":"get-antivirus-product-status-with-powershell","status":"publish","type":"post","link":"https:\/\/jdhitsolutions.com\/blog\/powershell\/5187\/get-antivirus-product-status-with-powershell\/","title":{"rendered":"Get Antivirus Product Status with PowerShell"},"content":{"rendered":"

I expect that most of you with enterprise-wide antivirus installations probably have vendor tools for managing all of your clients. If so, don't go away just yet. Even though I'm going to demonstrate how to get antivirus product status with PowerShell, the scripting techniques might still be useful. Or you might learn a bit more about WMI and the CIM cmdlets. Let me start with a simple command to get antivirus information from your local computer, assuming you are running PowerShell 3.0 or later.<\/p>\n

<\/p>\n

Try this command:<\/p>\n

Get-CimInstance -Namespace root\/SecurityCenter2 -ClassName AntivirusProduct\n<\/pre>\n
In earlier versions of Windows, this information was stored in the SecurityCenter namespace. I don't recall exactly which version of Windows where this changed to SecurityCenter2 but hopefully this works for you and you see something like this:<\/p>\n
\"antivirus<\/a><\/p>\n
On my computer, which is running Windows 8.1, you can see two products. What you can't tell is the status of each product. Well, actually you can but you need to decode the product state property. The first step to decode it is to convert it to hex.<\/p>\n
'0x{0:x}' -f 393472\n<\/pre>\n
I converted the Windows Defender status for a value of 0x60100.<\/p>\n
Next, we can look at the middle two parts of this value, 01. If this matches '10' then the product is enabled. Anything else and it is not. With this, I can see that Windows Defender is not enabled. The last 2 parts, 00, will indicate if the product is up to date or not. A value of 00 means it is up to date. However, in this case, I think this means that the last time this product was enabled it was up to date. That's where I think the TimeStamp property comes in handy. Converting the status on the ESET product gives me a value of 0x41000 which decodes as enabled and up to date.<\/p>\n
Once I have a basic command I can build a PowerShell function to turn it into a reusable tool.<\/p>\n