Anti-Virus Status: Unknown

[mmotti]

Hi,

We seem to have 166 machines reporting an 'unknown' status for Sophos, although virus signatures correctly report as being up-to-date.

Is there any way to resolve this? The newer machine builds that we've done seem to report the status correctly (i.e. Enabled and Up To Date).

Cheers

[mmotti]

EDIT: Don't think the script worked correctly. Manually deleted the WMI reference and now we are golden 🙂 Thanks!!


Hi,

Thanks for this - I've cleared the WMI for the AV and restarted.

At first it was showing as 'Disabled' in Lansweeper, but I've forced an update with LSPUSH and it's back to unknown again.

If I query the WMI with wbemtest I can see Sophos Anti-Virus with a productState of 331776 (0x51000) which is apparently 'Enabled, definitions are current'

Any ideas?

Cheers

Matt

[Daniel_B · Accepted solution]

This KB article explains how Lansweeper scans data about anti-virus software. Status information is pulled from WMI. If the status is not correct, either the software doesn't correctly report it to security center or WMI is defect on the affected computers. The article contains a link to a script which rebuilds the anti-virus WMI class. This might help resolving the issue.