We are running Symantec Endpoint 11 and 12 and the crawler seems not to see it and reports no antivirus program installed any help would be appreciated
Richard
Shore Thing Computers

if the Symantec Endpoint does not communicate whit the security center the craver cannot get the information.
I have the same issue whit Trendmicro. Officescan is reconiced bud only on x86 operating systems. On the servers what have no security center built in is not possible whit this query to get information about antivirus.
It would be great to have product specific searches to get an alert, so that it will work also on the servers

Hi Richard and Thomas,

We have a customer using the following query to identify the devices where Trend Micro AV is notinstalled. Just replace the app name with the appropriate name from the registry of the AV product you are using to customize it for your environment.

Posted as a Share-It HERE .
___
select /#id as device_id,
coalesce(system/netbios_name, system/dns_name, first(interface/inet/ip_address)) as name,
first(interface/inet/ip_address) as ip_address,
nvl(system/class, system/computed_class, ‘unknown’) as class,
nvl(system/vendor, first(wmi/win32_computersystemproduct/vendor), system/computed_vendor) as vendor,
nvl(system/model, first(wmi/win32_computersystemproduct/name), system/computed_model) as model
from /network/device
where nvl(system/class, system/computed_class, ‘unknown’) in (‘server’, ‘workstation’)
and !(registry/hklm/software/microsoft/windows/currentversion/uninstall/installation/displayname = ‘Trend Micro OfficeScan Client’)
and !(registry/hklm/software/microsoft/windows/currentversion/uninstall/installation/displayname = ‘ServerProtect Normal Server’)
___
What this query does is “Find all devices where the classification is either ‘server’ or ‘workstation’ and there is no software installation where the name is ‘Trend Micro…’ and there is no software installation where the name is ‘ServerProtect…’”

To add more software packages just add more lines like:

and !(registry/hklm/software/microsoft/windows/currentversion/uninstall/installation/displayname = ‘ServerProtect Normal Server’)

Hope that helps!
Bryan

Bryan Barrett
Product Specialist – IT Services
Citrix Online

Hi Bryan,
thanks, i am using this query and works