Checking VM Guests for AV

[Dlouw]

Hi,

Is there a script that I can run that can check all VM guests for Forefront Antivirus. (Want to know if installed or not)

Thanks

Deon

[fabiendibot]

You should use Invoke-VMScript associated with something like Get-WMIObject Win32-Product | ? { $_.Name -like "Forefront" }

[Dlouw]

Thanks fabiendibot, could you give me more details as I am new to scripting.

[fabiendibot]

Hello,

You can try something like this .. At first try Get-WmiObject Win32_Product | ? { $_.Name -like "*Forefront*" } locally, i don't have forefront here so i don't know how it's named in Win32_Product list

$GuestUser = "Administrator"

$Password = "PutYourPasswordHere"

$Script = '

if (Get-WmiObject Win32_Product | ? { $_.Name -like "*Forefront*" }) {

    Write-Host "Forefront installed"

}

'

Get-VM | % {

     $VM = $_

         Get-View $_  | % {

        if ( $_.Summary.Guest.GuestFullName -contains "Windows" ) {

            Invoke-VMScript -VM $VM -ScriptText $script -ScriptType Powershell -GuestUser $GuestUser -GuestPassword $Password

        }

    }

[Dlouw]

Hi,

I tried the script and at first it gave me the error, "Missing closing '}' in statement block." I then added "}" at the end.  The script then ran but returned no value?

Not sure what I am doing wrong.

Once again thanks for the help.

Cheers

[fabiendibot]

You can try something like this .. At first try Get-WmiObject Win32_Product | ? { $_.Name -like "*Forefront*" } locally, i don't have forefront here so i don't know how it's named in Win32_Product list

You first have to find what is the fore front name in WIN32_Product class...

You will have to laucnh a powershell console and put your hands on it :smileygrin:

[Dlouw]

IdentifyingNumber : {XXXXXXXXXXXXXX}

Name              : Microsoft Forefront Endpoint Protection 2010 Server Managem

                    ent

Vendor            : Microsoft Corporation

Version           : 2.1.1116.0

Caption           : Microsoft Forefront Endpoint Protection 2010 Server Managem

                    ent

This is what I get when I run the Get-WmiObject Win32_Product | ? { $_.Name -like "*Forefront*" } locally