Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to use powershell to determine if/when the antivirus was last updated on a Win7 or Win2008 Server machine?

share|improve this question
up vote 3 down vote accepted

This is dependent on the Anti-Virus software:

  • Does it provide logging you could parse?
  • Does it provide a programmatic notification of being "out of date"?
  • Does it provide an administrative API?

If the software logs definition/engine updates to the Windows event log you could look for the most recent update, and see when that happened. E.g. with Microsoft Security Essentials in Windows 7, this will tell me the date/time of the most recent definition update (Get-EventLog returns events in order from the event log, so the first match is the most recent):

(get-eventlog -LogName system -Source "Microsoft-Windows-WindowsUpdateClient" -InstanceId 19 |
?{$_.Message -match "Microsoft Security Essentials"} | select -first 1).TimeGenerated

Clearly the details will vary by OS and AV package.

share|improve this answer
interesting..hadn't thought of using the event log. Found out that McAfee stores the info in the registry so I used a simple get-itemproperty -path HKLM:\<path to McAfee> – jdiaz Apr 6 '10 at 19:43

To expand on jdiaz's followup above, the following command will get McAfee's current DAT date and version:

Get-ItemProperty HKLM:\SOFTWARE\McAfee\AVEngine | Select-Object AVDatDate,AVDatVersion | Format-List
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.