If we want to detect all Antivirus/Endpoint protection currently installed on a Windows machine?
What is the best approach?
Is there a list of registry locations we can read/iterate? Industry standards?
We see each vendor has its own logic, but maybe there is a unified solution?
We can gather a list of all antivirus and check each on registry, loaded module, folder on program files, etc.. but maybe better approach?
There are two general methods, and I can only suggest you use whichever is within your reach. There is no standard, and some businesses want supported solutions while others prefer their employees to do the work themselves.
The automated solution is the easiest way. Excluding small businesses, many organizations already have reporting infrastructure in place.
You can pull a software inventory or a custom report from your endpoint management application. This could be their own solution, Microsoft Endpoint Configuration Manager (formerly known as SCCM), or a competitor such as Altiris or BigFix.
Manually, you could query WMI using a variety of methods. Command prompt, PowerShell, C++, etc.
You'll want to look at the root\SecurityCenter2 namespace. There is a class where security software is registered. I expect most modern antivirus products will populate here, but there may be exceptions.
You can query WMI using the method of your choice. As an example, in PowerShell:
Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct -ComputerName $computername
In case you are not familiar with PowerShell, the "-Computername $computername" part is optional. You can use it to specify a remote host by replacing the $computername variable with a hostname. It will run against the local host if omitted.
Any objects returned from that query should have a displayName property that identifies the antivirus product. This includes Windows Defender.
In addition, there will be a productState property that indicates its status; a value of 397312 corresponds to "active and up to date" for AV products that follow Microsoft's convention. There is only one third-party AV product I can check at the moment, but it does follow the convention.
