Comments on: Ensuring all Windows clients have updated antivirus http://itknowledgeexchange.techtarget.com/itanswers/ensuring-all-windows-clients-have-updated-antivirus/ Tue, 21 May 2013 06:03:52 +0000 hourly 1 By: The Most-Watched IT Questions: August 24, 2010 - ITKE Community Blog http://itknowledgeexchange.techtarget.com/itanswers/ensuring-all-windows-clients-have-updated-antivirus/#comment-80704 The Most-Watched IT Questions: August 24, 2010 - ITKE Community Blog Tue, 24 Aug 2010 06:59:47 +0000 #comment-80704 [...] When looking for a method to ensure all Windows clients have updated antivirus, we received both a scripting method and a third party software method. Which ones have you tried [...]

]]> By: carlosdl http://itknowledgeexchange.techtarget.com/itanswers/ensuring-all-windows-clients-have-updated-antivirus/#comment-80188 carlosdl Wed, 11 Aug 2010 13:59:41 +0000 #comment-80188 Yes, Spiceworks can monitor the age of virus definitions on client machines.
I have tested it with McAfee 8.7 and it works very well. It uses WMI to get this information from client machines, so a script could produce similar results and it could be a better option if you don’t want to install the whole monitoring program just to check virus definitions.

]]> By: mitrum http://itknowledgeexchange.techtarget.com/itanswers/ensuring-all-windows-clients-have-updated-antivirus/#comment-80180 mitrum Wed, 11 Aug 2010 06:22:52 +0000 #comment-80180 try SpiceWorks and let it scan your network with domain poweruser / administrator account regularly . you can download it from

http://www.spiceworks.com/referrer/mitrum

]]> By: the geek http://itknowledgeexchange.techtarget.com/itanswers/ensuring-all-windows-clients-have-updated-antivirus/#comment-80161 the geek Tue, 10 Aug 2010 18:53:52 +0000 #comment-80161 My solution would be a script that first checks the version of the AV then either exits, or configures the proxy to deny Internet access. Here are two code snippets that could be used to create a custom script (these aren’t my creation–found them in forums):

(Note that you would need to add the conditionals that would execute the proxy config script)

Option Explicit

Const strOU = "OU=MySubOU,OU=MyOU,DC=mydomain,DC=com"

Const HKLM = &H80000002
Dim objFSO, objFile
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.CreateTextFile(objFSO.GetParentFolderName(Wscript.ScriptFullname) & "McAfee_versions.txt", True)

Dim objConnection
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject"

Dim objCommand
Set objCommand = CreateObject("ADODB.Command") 
objCommand.ActiveConnection = objConnection 
objCommand.Properties("Page Size") = 1000


' Get all names of all computer accounts
objCommand.CommandText = "SELECT name FROM 'LDAP://" & strOU & "' WHERE objectCategory='computer'" 
Dim objRS
Set objRS = objCommand.Execute 

' Loop through computer names and check McAfee definition versions
Dim objReg, strDAT, strMajor, strMinor
On Error Resume Next
WriteOut "Hostname" & vbTab & "Engine version" & vbTab & "DAT version"
Do Until objRS.EOF
	Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!" & objRS("name") & "rootdefault:StdRegProv")
	If Err.Number = 0 Then
	
		objReg.GetDWORDValue HKLM, "SOFTWAREMcAfeeAVEngine", "EngineVersionMajor", strMajor
		objReg.GetDWORDValue HKLM, "SOFTWAREMcAfeeAVEngine", "EngineVersionMinor", strMinor
		objReg.GetDWORDValue HKLM, "SOFTWAREMcAfeeAVEngine", "AVDatVersion", strDAT
		WriteOut objRS("name") & vbTab & vbTab & strMajor & "." & strMinor & vbTab & strDAT
	Else
		WriteOut objRS("name")
	End If
	Set objReg = nothing
	objRS.MoveNext
Loop



Sub WriteOut(strText)
	'Write text to file
	objFile.WriteLine strText

	' Write text to screen if running under cscript
	If Instr(1, Wscript.FullName, "cscript",1) Then
		Wscript.Echo strText
	End If
End Sub

This one would be executed if the version test fails:

Const HKEY_CURRENT_USER = &H80000001

strComputer = "."
 
Set ScriptMe=GetObject("winmgmts:{impersonationLevel=impersonate}!" & _ 
    strComputer & "rootdefault:StdRegProv")
 
strKeyPath = "SoftwareMicrosoftWindowsCurrentVersionInternet Settings"
 
strValueName = "ProxyEnable"
dwValue = 1
ScriptMe.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName,dwValue

strValueName = "ProxyServer"
stValue = "http=192.168.1.1:8080;https=192.168.1.1:8080"
ScriptMe.SetStringValue HKEY_CURRENT_USER,strKeyPath,strValueName,stValue

That should be enough to get started and someone could provide an actual solution.

]]>