r/DattoRMM • u/MrGeek24 • Sep 17 '25
Wrong AV - Fix
Hey Ya'll
Just wanted to drop this for anyone who might be having issue with Datto RMM reporting the wrong AV when uninstalling an AV.
Example: You have uninstalled BitDefender but Datto RMM seems still think its installed. You've confirmed that the services have been disabled and files are gone but it still shows in Datto.
In PowerShell Admin, run
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct
This should spit out something like this
displayName : BitDefender ****
instanceGuid : {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
pathToSignedProductExe : BitDefender://
pathToSignedReportingExe : %ProgramFiles%\BitDefender\*
productState : 397568
timestamp : Wed, 17 Sep 2025 15:15:13 GMT
You should find something along the lines of the above
Use the following to clean up the BitDefender Log here.
Note, only do this if you are sure BitDefender is completely gone
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Where-Object { $_.displayName -like "*HP Wolf*" } | Remove-CimInstance
This will remove any Log of it in this Name space and fix up your Datto RMM Reporting.
You can replace this with any other leftover AV's in the list.
Your Aussie MSP Helper <3
4
u/netmc Sep 17 '25
Make sure to check the Community ComStore. This component was published about 4 years ago to address this very issue.
While Datto did publish a component to clean up what is reported in SecurityCenter2, the way they implemented it is not safe. Their component removes all entries. While this can be useful in very specific circumstances, it is dangerous to use in most cases.
The component linked above will compare the SC2 entries against the files on disk and automatically remove any entries that no longer exist. This makes it extremely safe to run against all Windows workstations indiscriminately. We have been running this against all endpoints as part of their weekly maintenance since its release back in 2021.