AntiVirus info on Asset Page

[Tomas]

We have many assets with Windows Defender and McAfee running.
On many of these, the summary page virus information shows "enabled and outdated" although one of the 2 will be up to date! This obviously also falsifies any report including these tables.

Is there a way to have the value with the latest AV enabled timestamp count?
As i think this should be the default behaviour.

Or could you please clarify the current behaviour?
I know how you get the information but not how you prioritize!

[Tomas]

No, I meant the "Asset Page" as stated in the title.

the summary page virus information shows "enabled and outdated" although one of the 2 will be up to date!

I know how to write a report to show the info i want, i need the info on the "Asset Page" to be accurate!

[Bruce_B]

For more information regarding how anti-virus information is scanned I recommend checking out this article. Antivirus programs are scanned both through WMI and through Windows software scanning, though only the ones retrieved through WMI will list status information.

[Bruce_B]

I assume you're making use of the built-in report "Workstation: Anti-virus Expired". This report will indeed list assets that have any antivirus not up date, regardless of whether another anti-virus program is fully up to date on the same computer. I've added an adjusted version of the report below, that will exclude computers that have one or more up to date AV products found.

Workstation: Antivirus Expired (exclude partial match)

Select Top 1000000 tsysAssetTypes.AssetTypeIcon10 As icon,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tblAntivirus.DisplayName As Antivirus,
  tblAssets.Domain,
  tsysAssetTypes.AssetTypename As Type,
  tblAssets.IPAddress As [IP Address],
  tblAssets.Description,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tblAssetCustom.Location,
  tsysIPLocations.IPLocation,
  tblAssets.Lasttried,
  tblAssets.Firstseen,
  tblAssets.Lastseen
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tblAntivirus On tblAssets.AssetID = tblAntivirus.AssetID
  Left Join tsysIPLocations On tblAssets.LocationID = tsysIPLocations.LocationID
Where tblAssets.AssetID Not In (Select Top 1000000 tblAssets.AssetID
  From tblAssets Inner Join tblAntivirus On tblAssets.AssetID =
      tblAntivirus.AssetID
  Where tblAntivirus.productUpToDate = 1) And tblAssetCustom.State = 1
  And tblAntivirus.productUpToDate = 0
Order By tblAssets.AssetName

[brians]

Hi Tomas
I also have a similar issue. We use MicroTrend which is kept up to date and some PCs also run Windows Defender which is not kept up to date as it is secondary and not required. I get false reporting as well.

I am hoping they will provide instruction on how to either omit any reporting of WD or as you say, allow the prioritization of which AV is important to flag on.