Looks to me like the WMI class says it is disabled.
What you can try is run the following command on the local machine in powershell:
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct
Then you can compare the result of productState to the following list:
- "262144" {status = "Up to date" ;status = "Disabled"}
- "262160" {status = "Out of date" ;status = "Disabled"}
- "266240" {status = "Up to date" ;status = "Enabled"}
- "266256" {status = "Out of date" ;status = "Enabled"}
- "393216" {status = "Up to date" ;status = "Disabled"}
- "393232" {status = "Out of date" ;status = "Disabled"}
- "393488" {status = "Out of date" ;status = "Disabled"}
- "397312" {status = "Up to date" ;status = "Enabled"}
- "397328" {status = "Out of date" ;status = "Enabled"}
- "397584" {status = "Out of date" ;status = "Enabled"}