Asset: Antivirus Expired

[jberry]

On our Lansweeper Dashboard we have a "Asset: Antivirus Expired" report. When I click on the report it shows the wrong Antivirus product for most of the endpoints found in the report. It shows Windows Defender when it should say McAfee VirusScan Enterprise. If I click on the summary of the asset it will display the correct Antivirus software and confirm the signature is up to date.

I can confirm that McAfee VirusScan Enterprise is installed and up to date on the endpoints outside of LanSweeper but the Dashboard report is more continent. I am not sure what settings in LanSweeper to check to make the "Asset: Antivirus Expired" report check the correct Antivirus product on the endpoint.

I have tried changing the Antivirus wait time from 1 to 0. I also added McAfee VirusScan Enterprise to the Software list but neither of these changes fixed the problem. I am pretty weak at editing the reports so I am not sure if the solution will require editing the "Asset: Antivirus Expired" report. That said the number of incorrect Antivirus software only makes up about 10% of our total network. So the report is mostly working.

Has anybody seen this before or know of a related knowledgebase article?

[jberry]

That solved it.

Thanks

[Bart_E · Accepted solution]

We recommend reviewing this knowledge base article. It explains how anti-virus scanning works and what you can do if the information reported is incorrect.

The report "Asset: Antivirus Expired" used for the dashboard widget is based on information stored in WMI (Windows Management Instrumentation), a management framework built into Windows operating systems. Even if Windows Defender is disabled, WMI will still have an entree for it. You can easily exclude the Windows defender anti-virus software from the report output by editing the underlying SQL query and using a filter. Below we added some steps on how to do this:

• Hit the 'Edit Report' button in the left column after running the report. (This opens the report builder)
  
• Enter the filter below in the criteria field from tblAntivirus.DisplayName
  
• Not Like '%defender%'
  
• Save&Run the report to view it