Home / server / Questions / 129611
Accepted
jdiaz
Asked: 2010-04-06 20:08:37 +0800 CST

How to detect when Antivirus is out-of-date with Powershell

  • 772

Is it possible to use powershell to determine if/when the antivirus was last updated on a Win7 or Win2008 Server machine?

powershell

3 Answers

  1. Best Answer

    This is dependent on the Anti-Virus software:

    • Does it provide logging you could parse?
    • Does it provide a programmatic notification of being "out of date"?
    • Does it provide an administrative API?

    If the software logs definition/engine updates to the Windows event log you could look for the most recent update, and see when that happened. E.g. with Microsoft Security Essentials in Windows 7, this will tell me the date/time of the most recent definition update (Get-EventLog returns events in order from the event log, so the first match is the most recent):

    (get-eventlog -LogName system -Source "Microsoft-Windows-WindowsUpdateClient" -InstanceId 19 |
?{$_.Message -match "Microsoft Security Essentials"} | select -first 1).TimeGenerated

    Clearly the details will vary by OS and AV package.

    • 4

  2. To expand on jdiaz's followup above, the following command will get McAfee's current DAT date and version:

    Get-ItemProperty HKLM:\SOFTWARE\McAfee\AVEngine | Select-Object AVDatDate,AVDatVersion | Format-List
    • 2

  3. Symantec logs to Windows Event Logs. You can use Get-EventLog cmdlet.

    • 1