PowerShell script to detect antivirus product and status

With an antivirus roll-out on the horizon, I was looking into a script that could act independently of the enterprise antivirus consoles of both the old product and the new product to help find any stragglers that did not get updates. This PowerShell script can be used as a startup script to query the Windows Security Center on Windows 7 or newer computers.

It returns the computer name, the security product name, and its file location along with its definition status and real-time protection status.

Unfortunately, the productState field is not publicly documented by Microsoft so the code’s output can differ with different products and statuses. I did some testing with my environment along with some research online to find other entries that others have confirmed. I encourage you to test it out in your environment and add to the switch case list.

In its current state, the script just outputs the information. You could pipe this to a text file or a database to monitor the computers reporting in. I can use this to monitor computers that talk to the domain but fell off the antivirus consoles – perhaps the uninstall of the old AV succeeded but the install of the new met errors. Monitoring this gap will help ensure the endpoints in my environment are not going without an antivirus or if somebody installs a different product.

$computername=$env:computername 

$AntiVirusProduct = Get-WmiObject -Namespace rootSecurityCenter2 -Class AntiVirusProduct  -ComputerName $computername

#Switch to determine the status of antivirus definitions and real-time protection. 
#Write-Output $AntiVirusProduct.productState
switch ($AntiVirusProduct.productState) { 
    "262144" {$defstatus = "Up to date" ;$rtstatus = "Disabled"} 
    "262160" {$defstatus = "Out of date" ;$rtstatus = "Disabled"} 
    "266240" {$defstatus = "Up to date" ;$rtstatus = "Enabled"} 
    "266256" {$defstatus = "Out of date" ;$rtstatus = "Enabled"} 
    "393216" {$defstatus = "Up to date" ;$rtstatus = "Disabled"} 
    "393232" {$defstatus = "Out of date" ;$rtstatus = "Disabled"} 
    "393488" {$defstatus = "Out of date" ;$rtstatus = "Disabled"} 
    "397312" {$defstatus = "Up to date" ;$rtstatus = "Enabled"} 
    "397328" {$defstatus = "Out of date" ;$rtstatus = "Enabled"} 
    "397584" {$defstatus = "Out of date" ;$rtstatus = "Enabled"} 
    "397568" {$defstatus = "Up to date"; $rtstatus = "Enabled"}
    "393472" {$defstatus = "Up to date" ;$rtstatus = "Disabled"}
default {$defstatus = "Unknown" ;$rtstatus = "Unknown"} 
}


Write-Output $computername 
Write-Output $AntiVirusProduct.displayName
Write-Output $AntiVirusProduct.pathToSignedProductExe
Write-Output "Definition status:  $defstatus"
Write-Output "Real-time protection status: $rtstatus"