1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Problem Software to detect AV + FW status of domain machines/Servers

Discussion in 'Software' started by Asterix, Dec 8, 2011.

  1. Asterix

    Asterix Megabyte Poster

    512
    9
    52
    Hi Guys,
    I'm looking for an application to help me determine the AV and FW status of domain machines/Servers, I have used something previously although i cant remember what it was, I'm not sure whether there is any of this functionality in NMap or MBSA.

    Any info would be appreciated!
     
  2. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319
    Network Access Protection with Server 2008 may be of some help.

    Network Access Protection

    For Windows firewall can you not just enable it through GPO for all machines on the domain?
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  3. Asterix

    Asterix Megabyte Poster

    512
    9
    52
    Great thinking Sparky, i dont need to report on whether they have a Fw on their client machine if i enforce this using a GPO, I have now done this! Thanks

    I just had a brief look into NAP and it looks a little tricky and possibly not necessary for this small requirement, surely there is a simpler way of determining client AV programs that have been locally installed, i think we have AVG Free and MS Security Essentials for all users.

    Kind regards,
    Asterix
     
  4. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319
    In most cases I have used a third party product to audit PC\Laptops in terms of what software.

    Also the AV product may be installed but not configured correctly. Most business AV products have a centralised management console so you can push config changes and make sure each client has the latest AV definitions.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  5. wagnerk
    Highly Decorated Member Award

    wagnerk aka kitkatninja Moderator

    10,831
    357
    341
    Just watch out for licensing, as I recall AVG free is only for personnal use (not for business, even if it is not-profit) and MS Security Essentials are free for organisations with 10 or less PC's.
     
    Certifications: CITP, PGCert, BSc, HNC, LCGI, PTLLS, MCT, MCITP, MCTS, MCSE, MCSA:M, MCSA, MCDST, MCP, MTA, MCAS, MOS (Master), A+, N+, S+, ACA, VCA, etc... & 2nd Degree Black Belt
    WIP: PGDip
  6. supernova

    supernova Gigabyte Poster

    1,422
    21
    80

    Depends on what your using, many enterprise and SME packages have network admin tools available.

    Otherwise, you could look at Spiceworks
     
    Last edited: Dec 9, 2011
    Certifications: Loads
    WIP: Lots
  7. ThomasMc

    ThomasMc Gigabyte Poster

    1,507
    49
    111
    Or just run a simple Powershell script
     
    Certifications: MCDST|FtOCC
    WIP: MCSA(70-270|70-290|70-291)
  8. Asterix

    Asterix Megabyte Poster

    512
    9
    52
    I did look into this option before, but i have no experience of powershell and from previous investigation i didn't see anything too "simple" about Powershell.

    Does anyone have any examples of simple Powershell scripts i could modify, and how i would use the script to obtain the required information?

    Kind regards,
    Asterix
     
  9. supernova

    supernova Gigabyte Poster

    1,422
    21
    80
    You can use it to query WMI loads of stuff online and books on Amazon
     
    Certifications: Loads
    WIP: Lots
  10. ThomasMc

    ThomasMc Gigabyte Poster

    1,507
    49
    111
    The easiest way(since you know the AV that should be installed on your clients) would be to just check for the service

    Code:
    Get-Service -DisplayName "*comodo*"
    
    or check the Security Center

    Code:
    $computername=$env:computername
    $AV = Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct  -ComputerName $computername
    
    $AV.DisplayName
    
     
    Last edited: Dec 9, 2011
    Certifications: MCDST|FtOCC
    WIP: MCSA(70-270|70-290|70-291)
  11. Asterix

    Asterix Megabyte Poster

    512
    9
    52
    I knew it was gonna be a little out of my scope but your simple breakdown raises so many questions I don't know where to start.
    :S
     
  12. Gav

    Gav Kilobyte Poster

    447
    14
    27
    What about Forefront Endpoint Protection? It's the business version of MS Security Essentials and can, as far as I'm aware, be centrally managed.

    I remember reading somewhere that certain licensing agreements allow you to install this for free? Microsoft licensing is hardly straight forward, so you'll have to seek clarification on this!

    There's also Windows Intune (PC Management and Security Software in the Cloud - Windows Intune). I've read a whitepaper on it, but have never seen it deployed.

    Alternatively, most Anti-Virus software comes with a tool that can be installed on the servers which allows you to push out updates, check client status etc.
     
  13. Asterix

    Asterix Megabyte Poster

    512
    9
    52
    Well i did look at some of the more enterprise AV solutions and for a company of 10 (handy ay it enables us to use MS Security essentials without breaching licencing), but we are mostly external sales and technical guys and there is nobody to deal with the day to day config, who would be tasked with anything centrally managed, therefore we are really looking for a standalone AV soloution, and a method of ensuring/detecting this is on all company Laptops.
     
  14. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319
    Regardless if it is installed AV software needs to be configured correctly to be effective.

    You may want to look at a product that offers password protection on the config, this means the user can configure the software to an extent but let’s say the user try’s to switch off the AV then they will be prompted for a password.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  15. BB88

    BB88 Kilobyte Poster Gold Member

    370
    11
    76
    Spiceworks, "The software discovers Windows, Unix, Linux and Mac OS X machines along with other IP-addressable devices such as routers, VOIP phones, printers, etc."

    We have used it at work before, and from memory, you can see which AV is installed/running - versions, how up-to-date they are as well.
     
    Certifications: AS Computing, A+, Network+, 70-680, 70-410
    WIP: MCSA: Server 2012
  16. Asterix

    Asterix Megabyte Poster

    512
    9
    52
    I thought Spicework was call logging software, Ill have to check it out!

    Kind regards,
    Asterix
     
  17. BB88

    BB88 Kilobyte Poster Gold Member

    370
    11
    76
    Yes, it has quite a few features, Helpdesk, Inventory, Network Scanner. It has a series of plugins/addons for it to, one being the Monitoring Software.
     
    Certifications: AS Computing, A+, Network+, 70-680, 70-410
    WIP: MCSA: Server 2012
  18. Asterix

    Asterix Megabyte Poster

    512
    9
    52
    Thanks for the info, although it may be a little bit heavy weight for this requirement!
     
  19. ThomasMc

    ThomasMc Gigabyte Poster

    1,507
    49
    111
    What questions do you have on the powershell example, at the end of the day all you had to do was paste it into a PS console and it would have displayed the AV name

    View attachment 2538

    I can finish it off so it either adds the Computer Name and AV info to a file or even email it to you
     
    Certifications: MCDST|FtOCC
    WIP: MCSA(70-270|70-290|70-291)
  20. kevicho

    kevicho Gigabyte Poster

    1,219
    58
    116
    +1 for Spiceworks, although we dont use it for this purpose it is useful for auditing PCs as well as the call logging and so on, plus its free

    You can get it to email reports on a frequent basis as well so you can keep up to date
     
    Certifications: A+, Net+, MCSA Server 2003, 2008, Windows XP & 7 , ITIL V3 Foundation
    WIP: CCNA Renewal

Share This Page

Loading...