Question

我们有超过1500台服务器。 Windows 2003,2008和2012.我必须在这些服务器上收集防病毒（产品名称和版本）的详细信息。可能有多个防病毒产品。我不确定powershell脚本是否适用于2003服务器。

所以，我尝试了下面的脚本，但没有得到有用的信息。

$av = get-wmiobject -class "Win32_Product" -namespace "root\cimv2" `
              -computername "." -filter "Name like '%antivirus%'"

以下脚本在客户端操作系统上正常运行。

$wmiQuery = "SELECT * FROM AntiVirusProduct"
$AntivirusProduct = Get-WmiObject -Namespace "root\SecurityCenter2" -Query $wmiQuery  @psboundparameters # -ErrorVariable myError -ErrorAction 'SilentlyContinue'             
            Write-host $AntivirusProduct.displayName

有人可以就此提出建议吗？我正在尝试获取防病毒的详细信息（产品和版本）我需要为win server 2003做些什么？

Answer 1

Instead of relying on running processes, you could query the registry :

$computerList = "localhost", "localhost"
$filter = "antivirus"

$results = @()
foreach($computerName in $computerList) {

    $hive = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $computerName)
    $regPathList = "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall",
                   "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

    foreach($regPath in $regPathList) {
        if($key = $hive.OpenSubKey($regPath)) {
            if($subkeyNames = $key.GetSubKeyNames()) {
                foreach($subkeyName in $subkeyNames) {
                    $productKey = $key.OpenSubKey($subkeyName)
                    $productName = $productKey.GetValue("DisplayName")
                    $productVersion = $productKey.GetValue("DisplayVersion")
                    $productComments = $productKey.GetValue("Comments")
                    if(($productName -match $filter) -or ($productComments -match $filter)) {
                        $resultObj = [PSCustomObject]@{
                            Host = $computerName
                            Product = $productName
                            Version = $productVersion
                            Comments = $productComments
                        }
                        $results += $resultObj
                    }
                }
            }
        }
        $key.Close()
    }
}

$results | ft -au

Example output :

Host      Product              Version   Comments
----      -------              -------   --------
localhost Avast Free Antivirus 10.4.2233         
localhost Avast Free Antivirus 10.4.2233

Answer 2

您走在正确的道路上，以下Powershell脚本正常运作。

    function Get-AntiVirusProduct {
    [CmdletBinding()]
    param (
    [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
    [Alias('name')]
    $computername=$env:computername


    )

    #$AntivirusProducts = Get-WmiObject -Namespace "root\SecurityCenter2" -Query $wmiQuery  @psboundparameters # -ErrorVariable myError -ErrorAction 'SilentlyContinue' # did not work            
     $AntiVirusProducts = Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct  -ComputerName $computername

    $ret = @()
    foreach($AntiVirusProduct in $AntiVirusProducts){
        #Switch to determine the status of antivirus definitions and real-time protection.
        #The values in this switch-statement are retrieved from the following website: http://community.kaseya.com/resources/m/knowexch/1020.aspx
        switch ($AntiVirusProduct.productState) {
        "262144" {$defstatus = "Up to date" ;$rtstatus = "Disabled"}
            "262160" {$defstatus = "Out of date" ;$rtstatus = "Disabled"}
            "266240" {$defstatus = "Up to date" ;$rtstatus = "Enabled"}
            "266256" {$defstatus = "Out of date" ;$rtstatus = "Enabled"}
            "393216" {$defstatus = "Up to date" ;$rtstatus = "Disabled"}
            "393232" {$defstatus = "Out of date" ;$rtstatus = "Disabled"}
            "393488" {$defstatus = "Out of date" ;$rtstatus = "Disabled"}
            "397312" {$defstatus = "Up to date" ;$rtstatus = "Enabled"}
            "397328" {$defstatus = "Out of date" ;$rtstatus = "Enabled"}
            "397584" {$defstatus = "Out of date" ;$rtstatus = "Enabled"}
        default {$defstatus = "Unknown" ;$rtstatus = "Unknown"}
            }

        #Create hash-table for each computer
        $ht = @{}
        $ht.Computername = $computername
        $ht.Name = $AntiVirusProduct.displayName
        $ht.'Product GUID' = $AntiVirusProduct.instanceGuid
        $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe
        $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe
        $ht.'Definition Status' = $defstatus
        $ht.'Real-time Protection Status' = $rtstatus


        #Create a new object for each computer
        $ret += New-Object -TypeName PSObject -Property $ht 
    }
    Return $ret
} 
Get-AntiVirusProduct

输出：

Product GUID                : {B0D0C4F4-7F0B-0434-B825-1213C45DAE01}
Name                        : CylancePROTECT
Real-time Protection Status : Enabled
Computername                : HOSTNAME
Product Executable          : C:\Program Files\Cylance\Desktop\CylanceSvc.exe
Reporting Exe               : C:\Program Files\Cylance\Desktop\CylanceSvc.exe
Definition Status           : Up to date

Product GUID                : {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
Name                        : Windows Defender
Real-time Protection Status : Unknown
Computername                : HOSTNAME
Product Executable          : windowsdefender://
Reporting Exe               : %ProgramFiles%\Windows Defender\MsMpeng.exe
Definition Status           : Unknown

Answer 3

这对你有用吗？它是用PowerShell v2编写的，所以如果你在2003服务器上安装了它，它将在所有服务器上运行。此代码将为您提供此数据的CSV，这些数据来自运行脚本的任何机器，这些机器具有包含单词＆＃34; virus＆＃34; （我认为比＃34;防病毒和＃34更好;因为有些服务使用＆＃34;反病毒＆＃34;相反）。如果他们都可以访问共享资源，您可以将该共享资源目录添加到$Filename变量中，并将每个报告命名为以该计算机的名称开头，并将报告转储到那里。

invoke-command -computername Server01, Server02 -filepath c:\Scripts\get_av_info.ps1

假设脚本保存为c:\Scripts\get_av_info.ps1，它应该在您指定的任何计算机上运行，或者如果您拥有要运行脚本的所有计算机的CSV，ForEach它。我没有试过这个，所以我无法验证远程调用。

$Date = (Get-Date).ToString('yyyy-MM-dd')
$localhost = $env:computername
$Filename = "C:\" + $localhost + "_" + $Date + "_AV_FileInfo.csv"
$AV = get-process | ?{$_.Description -like "*virus*"}
$Process = ForEach($a in $AV){
$ID = $($a.Id)
get-process -Id $ID -FileVersionInfo
}
$Process | select "CompanyName","FileBuildPart","FileDescription","FileName","FileVersion","ProductName","ProductPrivatePart","ProductVersion","SpecialBuild" | Export-Csv $Filename -NoTypeInformation

有很多选择，我只选择了我认为你想要的选项。您也可以通过向Filename添加共享资源并将其-Append组合来将报告合并为一个，但是您可能会冒多个服务器同时尝试写入文件的风险，没有报到。

当然，您需要优化结果。如果您没有更改任何内容，则运行此操作的任何计算机都将删除一个名为＆＃34; COMPUTERNAME_DATE_AV_FileInfo.csv＆＃34;在它的C：\驱动器的根源。

Powershell：如何获取防病毒产品详细信息

3 个答案: