Windows Defender AV

[Mikey_]

I have looked this up and have not seen any good answers on it. LANSweeper sees Defender AV on Windows 10 machines, but not Server 2016.

If I missed something, please point me in the right direction. I am confused why this has not been addressed. Or at least an option in the software to "allow defender as AV", that would trigger a correct scan would be cool.

Thanks!

Mike

[Nathaniel]

sunshine wrote:
Have you come across a custom report, to report on the feature being enabled? I'm surprised that Lansweeper is taking so long to provide a solution, for us, the customers.

I created custom report that combines the information from WMI and Server features.

Maybe it will help you.

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetUnique,
  tblAssets.Domain,
  tblAssets.Description,
  tblAssets.Lastseen,
  tsysOS.Image As icon
From tblAssets
  Inner Join tblComputersystem On tblAssets.AssetID = tblComputersystem.AssetID
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysOS On tblAssets.OScode = tsysOS.OScode
Where tblAssets.AssetID Not In (Select tblSoftware.AssetID
      From tblSoftware Inner Join tblSoftwareUni On tblSoftwareUni.SoftID =
          tblSoftware.softID Inner Join tsysantivirus On
          tblSoftwareUni.softwareName Like tsysantivirus.Software) And
  tblAssets.AssetID Not In (Select tblAntivirus.AssetID
      From tblAntivirus) And tblAssets.AssetUnique Not In (Select
        tblAssets.AssetUnique From ((Select a.assetid As assetid,
              a.software As software,
              a.version As version,
              'software comparison' As RetrievedFrom,
              '' As Enabled,
              '' As Uptodate
            From (Select tblSoftware.AssetID As assetid,
                    tblSoftwareUni.softwareName As software,
                    tblSoftware.softwareVersion As version
                  From tblSoftware
                    Inner Join tblSoftwareUni On tblSoftware.softID =
                      tblSoftwareUni.SoftID
                    Inner Join tsysantivirus On tblSoftwareUni.softwareName Like
                      tsysantivirus.Software) a)
            Union
            (Select tblAntivirus.AssetID As assetid,
              tblAntivirus.DisplayName As software,
              Null As version,
              'WMI' As RetrievedFrom,
              Case
                When tblAntivirus.onAccessScanningEnabled = 1 Then 'Yes'
                Else 'No'
              End As Enabled,
              Case
                When tblAntivirus.productUpToDate = 1 Then 'Yes'
                Else 'No'
              End As Uptodate
            From tblAntivirus)
            Union
            (Select tblFeature.AssetId As AssetID,
              tblFeatureUni.featureName As Software,
              Null As version,
              'Features' As RetrievedFrom,
              '' As Enabled,
              '' As Uptodate
            From tblFeature
              Inner Join tblFeatureUni On tblFeature.featUniId =
                tblFeatureUni.featUniID And tblFeatureUni.featureCaption =
                'Windows Defender')) As unioned Inner Join tblAssetCustom On
          unioned.assetid = tblAssetCustom.AssetID Inner Join tblAssets On
          tblAssets.AssetID = unioned.assetid Inner Join tsysOS On
          tblAssets.OScode = tsysOS.OScode Left Join tsysIPLocations On
          tblAssets.LocationID = tsysIPLocations.LocationID
      Where tblAssetCustom.State = 1) And tblComputersystem.Domainrole >= 2 And
  tblAssetCustom.State = 1

[Rob_B]

It appears the report has out-lived its usefulness. I've removed it from the main page default dynamic reports.

[cscherrey]

I know lansweeper supports powershell, right? That is how they are connecting to Office 365. So for Server 2016 and up, they need to use powershell and query Get-MpComputerStatus. Then they can easily update the AV info when Defender is used.

[Mikey_]

Is this something that can be added to LanSweeper? Maybe a Boolean switch for people that use Defender on Servers?

Thank you for the reply!

Mike

[NicholeKaligian]

Anti-virus information is retrieved from either the wmi or comparing the installed software with known anti-virus software.

In Windows servers, the anti-virus wmi class does not exist, so this option is not available. For some builds, Windows defender is a feature and not actual software, meaning it's not necessarily picked up by Lansweeper. In this case, the assets will indeed show up in the 'no anti-virus' list.

[grimstar]

Ryan.G wrote:
Anti-virus information is retrieved from either the wmi or comparing the installed software with known anti-virus software.

In Windows servers, the anti-virus wmi class does not exist, so this option is not available. For some builds, Windows defender is a feature and not actual software, meaning it's not necessarily picked up by Lansweeper. In this case, the assets will indeed show up in the 'no anti-virus' list.

Taught me something here about the class not existing on servers.

[Mikey_]

RKCar wrote:

Ryan.G wrote:
Anti-virus information is retrieved from either the wmi or comparing the installed software with known anti-virus software.

In Windows servers, the anti-virus wmi class does not exist, so this option is not available. For some builds, Windows defender is a feature and not actual software, meaning it's not necessarily picked up by Lansweeper. In this case, the assets will indeed show up in the 'no anti-virus' list.

Taught me something here about the class not existing on servers.

Right. I hear ya. I guess we have to get "The Man" to fix that then.... Thanks! 🙂

[Mikey_]

Anyone???

[Mikey_]

Why does this subject get crickets?