How to detect when Antivirus is out-of-date with Powershell

Question

Is it possible to use powershell to determine if/when the antivirus was last updated on a Win7 or Win2008 Server machine?

Answer 1

This is dependent on the Anti-Virus software:

• Does it provide logging you could parse?
• Does it provide a programmatic notification of being "out of date"?
• Does it provide an administrative API?

If the software logs definition/engine updates to the Windows event log you could look for the most recent update, and see when that happened. E.g. with Microsoft Security Essentials in Windows 7, this will tell me the date/time of the most recent definition update (Get-EventLog returns events in order from the event log, so the first match is the most recent):

(get-eventlog -LogName system -Source "Microsoft-Windows-WindowsUpdateClient" -InstanceId 19 |
?{$_.Message -match "Microsoft Security Essentials"} | select -first 1).TimeGenerated

Clearly the details will vary by OS and AV package.

Answer 2

To expand on jdiaz's followup above, the following command will get McAfee's current DAT date and version:

Get-ItemProperty HKLM:\SOFTWARE\McAfee\AVEngine | Select-Object AVDatDate,AVDatVersion | Format-List

Answer 3

Symantec logs to Windows Event Logs. You can use Get-EventLog cmdlet.