Antivirus - Windows Defender

[clarke1]

We have several windows 8 and windows 10 machines where we have disabled Microsoft’s window defender antivirus via group policy and windows registry. Lansweeper is showing that several machines have both windows defender and our third party antivirus installed and configured. Our company standard is to have only one antivirus installed on client machines which isn't windows defender.

The report “Workstation: All workstations with Anti-virus software” shows that many machines (not all) have both antivirus installed. This gives the wrong impression both antivirus are configured on the machine.

Have you ever faced this?
How do I fix this concern?

[Bruce_B · Accepted solution]

Anti-Virus information is scanned by Lansweeper through two methods:

• From WMI, Windows Management Instrumentation, a management framework built into Windows operating systems, more specifically from the WMI class SecurityCenter and/or SecurityCenter2. Anti-virus programs scanned by Lansweeper will have a little green bug icon in front of them, which is the case for Windows Defender in your screenshot.
  
• Through normal software scanning (from the registry, mimicking Add/Remove Programs), and then compared with the list of antivirus programs setup under Software\Anti-Virus Settings.

If the computer in question has been scanned recently and Windows Defender is still showing up as in your screenshot, this means that the program is still listed in WMI on the local computer as installed. This is either because the program is disabled but still installed, or uninstalled, but stored incorrectly in the local WMI. If the program has been fully removed, rebuilding the local antivirus WMI classes may do the trick, which is explained in this post. In any case the issue will be caused by the local WMI, Lansweeper only reports what it finds unfortunately.