Windows 8 Defender

[martinwtaylor]

Is there a way to prevent Lansweeper reporting a Windows 8 workstation running Windows Defender as having no anti-virus product?

[Naozumi]

Ah, my bad. Will need to try that out on a test server somewhere. Cheers for update.

[Hemoco · Accepted solution]

Windows Defender detection was actually added to the 5.1 BETA, which was released only recently: http://lansweeper.com/forum/yaf_postst7944_Lansweeper-5-1-beta.aspx
We recommend installing on a test server or backing up your 5.0 database prior to upgrading.

[Naozumi]

In the absence of Lansweeper updating I have written this report SQL which should hopefully help others in the same position as described above. It will show all PCs without AntiVirus and any PCs with Windows Defender with realtime scanning turned off. Please note that I don't know if this definitely works on Vista as I don't currently have a machine to test with but it works perfectly on my Windows 8 boxes and Windows 7 boxes (Mix of defender, Security Essentials and Symantec).

Goto: Configuration > Custom Scanning
Choose Add registry key to scan

Rootkey: HKEY_LOCAL_MACHINE
RegPath: SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
RegValue: DisableRealtimeMonitoring

Then either create a new report or edit the existing AV report with the below SQL.
Reports accessed via Dashboard > All Reports (or report builder)

Select Distinct Top 1000000 tblAssets.AssetID,
  tblAssets.AssetUnique,
  tblAssets.Domain,
  tblAssets.Description,
  tblAssets.Lastseen,
  tblAssets.AssetName,
  tsysOS.Image As icon
From tblAssets
  Inner Join tblComputersystem On tblAssets.AssetID = tblComputersystem.AssetID
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysOS On tblAssets.OScode = tsysOS.OScode
  Inner Join tblRegistry On tblAssets.AssetID = tblRegistry.AssetID
Where (tblAssets.AssetID Not In (Select tblSoftware.AssetID
  From tblSoftware Inner Join tblSoftwareUni On tblSoftwareUni.SoftID =
      tblSoftware.softID Inner Join tsysantivirus On tblSoftwareUni.softwareName
      Like tsysantivirus.Software) And tblAssets.AssetID Not In (Select
    tblRegistry.AssetID From tblRegistry
  Where
    tblRegistry.Regkey =
    'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection' And tblRegistry.Valuename = 'DisableRealtimeMonitoring' And tblRegistry.Value != '1')) And tblComputersystem.Domainrole < 2 And tblAssetCustom.State = 1
Order By tblAssets.AssetName

[Hemoco]

A registry scan will be built-in in a future Lansweeper version and will automatically be taken into account for the anti-virus reports, but we do not yet have a release date for this feature. (You can already manually make this change by editing the existing anti-virus reports.)

Our priority at the moment is developing a help desk to integrate with Lansweeper, which has been much requested as well.

[CHP-Pete]

If the registry scan report is the solution... It's a bad one. You now have a separate report that says the Windows 8 computers have anti-virus installed and active, which they do by default, and they still show up in the list of unprotected computers when they aren't. I'm sorry, but paying for a product that STILL doesn't work with the newest Windows OS that has been out in the public since October of 2012 (7 months ago at this point), and was a public beta long before that, seems ridiculous.

Your fix isn't even a good workaround. The primary anti-virus report shows that all of my Windows 8 machines are open for virus business and they aren't. This thread has been open since Lansweeper 4.2 at least, we are now on 5.0.77 so why isn't this fixed? I understand that it doesn't work the same way the rest of the antivirus products do, but it is a major contender right now and you have a massive lack of true support for it.

It seems like this isn't really being addressed, and it should be. As my number of Windows 8 machines increases, my considerations for using Lansweeper decreases. You added widgets and so many other fancy attachments but haven't fixed a gap in functionality. Reprioritize and fix this please. I hate to harp, but it's been long enough. Stop telling people that they have to do it wrong, and fix it. PLEASE.

[pjbate]

If you need to add the registry key you can find it under here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\ DisableRealtimeMonitoring Reg_DWORD Value

[martinwtaylor]

Ok, I understand what you're saying.

However, you may need to consider what you detect in future as more and more W8 client machines appear and will be reported by Lansweeper as having no anti-virus, which is incorrect.

[Hemoco]

MartinT wrote:
However, you may need to consider what you detect in future as more and more W8 client machines appear and will be reported by Lansweeper as having no anti-virus, which is incorrect.

We have added this request to our customer wish list. We would likely implement a registry scan, which can already be configured manually in 4.2.

[Hemoco]

This package is not listed under Add/Remove Programs (Programs & Features) and is therefore not scanned by default. You can configure a custom registry scan instead to detect this software item.