PowerShell get information about AntiVirus

Question

Hello
I found command in PowerShell in Windows 10 "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct". It returns to me infomation about all antiviruses, but it doesn`t works in Windows Server 2019.

could you help me to get this same informatnio by PowerShell in Windows Server 2019 ???

Answer 1

The Get-CimInstance command for querying the Security Center namespace is specific to consumer versions of Windows and generally isn't applicable to server versions like Windows Server 2019. However, you can still gather information about antivirus products on Windows Server 2019 by querying the WMI

Something like this might work:

Get-WmiObject -Namespace "root\SecurityCenter2" -Query "SELECT * FROM AntivirusProduct"

Answer 2

It doesn`t woks

Get-WmiObject : Invalid namespace "root\SecurityCenter2"

At line:1 char:1

• Get-WmiObject -Namespace "root\SecurityCenter2" -Query "SELECT * FROM ...

• 
      + CategoryInfo          : InvalidArgument: (:) [Get-WmiObject], ManagementException 
  
      + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
  

Answer 3

I thought that it might not be there, you could try looking through all the namespaces to see if there's an alternative you could use:

Get-WmiObject -Namespace "root" -Class "__Namespace"

Answer 4

I used it and got these namespaces, but I still don't know how to get information about antiviruses.

__GENUS : 2

__CLASS : __NAMESPACE

__SUPERCLASS : __SystemClass

__DYNASTY : __SystemClass

__RELPATH : __NAMESPACE.Name="aspnet"

__PROPERTY_COUNT : 1

__DERIVATION : {__SystemClass}

__SERVER : idmachine

__NAMESPACE : ROOT

__PATH : \idmachine\ROOT:__NAMESPACE.Name="aspnet"

Name : aspnet

PSComputerName : idmachine

Name : subscription

Name : DEFAULT

Name : CIMV2

Name : msdtc

Name : Cli

Name : SECURITY

Name : RSOP

Name : PEH

Name : WebAdministration

Name : StandardCimv2

Name : WMI

Name : AccessLogging

Name : directory

Name : Policy

Name : InventoryLogging

Name : Interop

Name : Hardware

Name : ServiceModel

Name : Microsoft

Name : aspnet

Name : Appv

Do you have any suggestions?

Answer 5

Unless you're using defender I'm not sure where it would be, My only other suggestion would be to detect the known service or process itself, could use this as an example:

Get-Service | Where-Object { $_.DisplayName -like "*McAfee*" -or $_.DisplayName -like "*Symantec*" -or $_.DisplayName -like "*Kaspersky*" }

or

Get-Process | Where-Object { $_.ProcessName -like "*McShield*" -or $_.ProcessName -like "*avp*" }