Workstation: Antivirus Expired Report

[CVannest]

I'm using the built in Workstation: Antivirus Expired Report but getting some invalid returned data. I've removed other AV solutions from the system under Software/Anti-Virus Software and left our AV solutions in there. PCs are being scanned and returning on the report because Windows Defender is Disabled/Outdated but Sophos is fully enabled and up to date. I've done a full database cleanup and removed all the devices from the report from the system and rescanned them back in, still getting the same issue. Anyone else experiencing this?

[CVannest]

Thank you for the report. Its a much better view for Sophos!

[Hendrik_VE]

Defender shows up because it is scanned through WMI. So even when you remove Defender from Software/Anti-Virus Settings, Lansweeper will still discover it as disabled and outdated.

Best you can do I think is exclude Defender from the report:

Select Top 1000000 tsysAssetTypes.AssetTypeIcon10 As icon,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tblAntivirus.DisplayName As Antivirus,
  tblAssets.Domain,
  tsysAssetTypes.AssetTypename As Type,
  tblAssets.IPAddress As [IP Address],
  tblAssets.Description,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tblAssetCustom.Location,
  tsysIPLocations.IPLocation,
  tblAssets.Lasttried,
  tblAssets.Firstseen,
  tblAssets.Lastseen
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tblAntivirus On tblAssets.AssetID = tblAntivirus.AssetID
  Left Join tsysIPLocations On tblAssets.LocationID = tsysIPLocations.LocationID
Where tblAntivirus.DisplayName Not Like '%Defender%' And tblAssetCustom.State =
  1 And tblAntivirus.productUpToDate = 0
Order By tblAssets.AssetName

[ErikT]

Hi CVannest,

When Lansweeper scans an asset, it will not always retrieve all information. As not all computer information changes often, Lansweeper uses scanned item intervals to determine which information needs to be refreshed at which time. I'd recommend checking the interval for Anti-virus scanning.

More information on how to configure scanned item intervals can be found in the below article.
https://www.lansweeper.com/knowledgebase/managing-how-often-specific-data-is-scanned/

[CVannest]

Erik.T wrote:
Hi CVannest,

When Lansweeper scans an asset, it will not always retrieve all information. As not all computer information changes often, Lansweeper uses scanned item intervals to determine which information needs to be refreshed at which time. I'd recommend checking the interval for Anti-virus scanning.

More information on how to configure scanned item intervals can be found in the below article.
https://www.lansweeper.com/knowledgebase/managing-how-often-specific-data-is-scanned/

I have ANtiVirus Scanning interval set to 1.
Even if I manually rescan an item on the report, it still shows that our primary AV (Sophos) is enabled and up to date and the Windows Defender is Disabled and Outdated. Since Windows Defender is NOT in the list of AVs under Software/Anti-Virus Settings it SHOULD NOT be hitting on that. I deleted every device on the report earlier this week, and now I have 113 devices in there again. I have over 7000 PCs in the system, so why are 113 showing up on this report when they have fully updated and active Sophos AV?