Antivirus Report For systems

[Srikanth08]

Hi,

I need to know what antivirus installed in my systems across the network. whatever may be the antivirus.
please help me query for that

[rader]

Run the built-in Workstation: All workstations with anti-virus software report and add to the unioned.software criteria Like '%Symantec%'.

Save this report out and that should only show the Symantec products. You may have to filter further depending on your needs.

[enzoly]

Hello Team.

On the computers I manage I have Symantec antivirus installed and Windows Defender is additionally installed. How can I make sure that only the Symantec antivirus appears in the report shown in the Workstation thread?

In other words, they are asking me for a Symantec antivirus report for all computers and servers.

Thank you,

Enzo.

[Daniel_B]

As described before, the provided report will list Antivirus statuses for computers which have valid information available in their WMI. If no Antivirus software is installed or the Antivirus software does not generate WMI entries, the computer will not be listed.

The other reports mentioned above ("Workstation: All workstations with Anti-virus software" and "Server: All servers with Anti-virus") are additionally considering the list of installed software (equals Add/Remove programs in Windows). With these reports you can detect Antivirus software if it is visible in this list and you have defined it as Antivirus software under Configuration\Anti-Virus.

[Srikanth08]

This report works like honey..but the client count is showing very less compared to the total number of scanned systems..my scanned systems are 3000+ and the clients are showing is 2500..

[Susan_A]

Use the report below for this. Instructions for running reports can be found here: http://lansweeper.com/Forum/yaf_postst9882_How-to-run-a-report.aspx

Keep in mind that Lansweeper can only detect the status (enabled/disabled) of anti-virus software packages pulled from WMI (Windows Management Instrumentation). Additional anti-virus software is detected by comparing scanned software with a list of known anti-virus software, but Lansweeper cannot detect the status of these anti-virus packages. For a complete list of installed (but not necessarily enabled) anti-virus software, use the built-in reports "Workstation: All workstations with Anti-virus software" and "Server: All servers with Anti-virus".

Select Top 1000000 tsysOS.Image As icon,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.Userdomain,
  tblAssets.IPAddress,
  tsysOS.OSname,
  tblAssets.SP,
  tblAssets.Firstseen,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblAntivirus.DisplayName
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tblAntivirus On tblAssets.AssetID = tblAntivirus.AssetID
  Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Where tblAntivirus.onAccessScanningEnabled <> 0 And tblAssetCustom.State = 1
Order By tblAssets.Domain,
  tblAssets.AssetName,
  tblAntivirus.DisplayName

[Srikanth08]

what iam asking is i need to know what antivirus is enabled in the systems. thats it

[Susan_A]

I'm really not understanding what you are asking. Could you please clarify. Are you saying that Lansweeper has identified Symantec Endpoint Protection as a computer's anti-virus software, but that the computer only has Windows Defender installed?

[Srikanth08]

Hi,

iam not getting the thing, as per your code, in windows security center it is showing windows defender..it means the systems is having only Windows defender not Symantec endpoint protection.

[Susan_A]

It should not be possible for an anti-virus software installation to be listed in "Asset: Antivirus Expired", but not in "Server: All servers with Anti-virus" or "Workstation: All workstations with Anti-virus software", if this is what you're inquiring about. Make sure you are using the default queries. We've pasted them below.

Asset: Antivirus Expired

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tsysAssetTypes.AssetTypename,
  tsysAssetTypes.AssetTypeIcon10 As icon,
  tblAssets.IPAddress,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblAntivirus.DisplayName As Antivirus
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tblAntivirus On tblAssets.AssetID = tblAntivirus.AssetID
Where tblAssetCustom.State = 1 And tblAntivirus.productUpToDate = 0
Order By tblAssets.AssetName

Server: All servers with Anti-virus

Select Top 1000000 unioned.assetid,
  tblAssets.AssetUnique,
  tblAssets.Domain,
  tblAssets.Lastseen,
  tsysOS.Image As icon,
  unioned.software,
  unioned.version,
  unioned.security_center As [Windows security center]
From ((Select a.assetid As assetid,
    a.software As software,
    a.version As version,
    b.software As security_center
  From (Select tblSoftware.AssetID As assetid,
      tblSoftwareUni.softwareName As software,
      tblSoftware.softwareVersion As version,
      tsysantivirus.Software As pattern
    From tblSoftware
      Inner Join tblSoftwareUni On tblSoftware.softID = tblSoftwareUni.SoftID
      Inner Join tsysantivirus On tblSoftwareUni.softwareName Like
        tsysantivirus.Software) a
    Left Join (Select tblAntivirus.AssetID As assetid,
      tblAntivirus.DisplayName As software,
      Null As version,
      tsysantivirus.Software As pattern
    From tblAntivirus
      Inner Join tsysantivirus
        On tblAntivirus.DisplayName Like tsysantivirus.Software) b
      On a.assetid = b.assetid And a.pattern Like b.pattern)
  Union
  (Select tblAntivirus.AssetID As assetid,
    Null software,
    Null As version,
    tblAntivirus.DisplayName As security_center
  From tblAntivirus
  Where tblAntivirus.AntivirusId Not In (Select tblAntivirus.AntivirusId
    From tblAntivirus Join tsysantivirus On tblAntivirus.DisplayName Like
        tsysantivirus.Software))) unioned
  Inner Join tblAssetCustom On unioned.assetid = tblAssetCustom.AssetID
  Inner Join tblAssets On tblAssets.AssetID = unioned.assetid
  Inner Join tsysOS On tblAssets.OScode = tsysOS.OScode
  Inner Join tblComputersystem On tblAssets.AssetID = tblComputersystem.AssetID
Where tblComputersystem.Domainrole >= 2 And tblAssetCustom.State = 1

Workstation: All workstations with Anti-virus software

Select Top 1000000 unioned.assetid,
  tblAssets.AssetUnique,
  tblAssets.Domain,
  tblAssets.Lastseen,
  tsysOS.Image As icon,
  unioned.software,
  unioned.version,
  unioned.security_center As [Windows security center]
From ((Select a.assetid As assetid,
    a.software As software,
    a.version As version,
    b.software As security_center
  From (Select tblSoftware.AssetID As assetid,
      tblSoftwareUni.softwareName As software,
      tblSoftware.softwareVersion As version,
      tsysantivirus.Software As pattern
    From tblSoftware
      Inner Join tblSoftwareUni On tblSoftware.softID = tblSoftwareUni.SoftID
      Inner Join tsysantivirus On tblSoftwareUni.softwareName Like
        tsysantivirus.Software) a
    Left Join (Select tblAntivirus.AssetID As assetid,
      tblAntivirus.DisplayName As software,
      Null As version,
      tsysantivirus.Software As pattern
    From tblAntivirus
      Inner Join tsysantivirus
        On tblAntivirus.DisplayName Like tsysantivirus.Software) b
      On a.assetid = b.assetid And a.pattern Like b.pattern)
  Union
  (Select tblAntivirus.AssetID As assetid,
    Null software,
    Null As version,
    tblAntivirus.DisplayName As security_center
  From tblAntivirus
  Where tblAntivirus.AntivirusId Not In (Select tblAntivirus.AntivirusId
    From tblAntivirus Join tsysantivirus On tblAntivirus.DisplayName Like
        tsysantivirus.Software))) unioned
  Inner Join tblAssetCustom On unioned.assetid = tblAssetCustom.AssetID
  Inner Join tblAssets On tblAssets.AssetID = unioned.assetid
  Inner Join tsysOS On tblAssets.OScode = tsysOS.OScode
  Inner Join tblComputersystem On tblAssets.AssetID = tblComputersystem.AssetID
Where tblComputersystem.Domainrole <= 1 And tblAssetCustom.State = 1