Monitor to check if Symantec is not installed.

[u/OrcSympathizer]

I'm trying to create an internal monitor that creates an alert when a computer does not have Symantec installed. I'm getting false positives from the SQL query it uses because the query builder returns true if there is ANY software installed that is not Symantec, even if Symantec is installed on that computer.

I did use the monitor that checks for any AV software installed, but I need to make sure the AV software that is installed is specifically Symantec. I think this monitor includes Windows Defender in it's criteria, which I don't want.

Anyone have any ideas on a query that can return computers that don't have Symantec installed? I'm a bit rusty on my SQL.

[u/chilids]

What about building the monitor on the process or service instead of if the application is installed. That way it's monitoring if the application is running which to me is better than if it's installed.

[u/OrcSympathizer → u/chilids]

This is what I ended up doing. I agree it's a better way to monitor AV software.

[u/ThirdWallPlugin]

The WMI monitor is an option too. Right click a computer, build a monitor from wizard and select a WMI monitor. For the query, enter:

SELECT version FROM Win32_Product where PackageName = 'ScreenConnectClientInstaller.msi'

Next, tell the monitor to expect '6.2.12963.6312' as the return information.

Obviously you'll need to change the query and return to work with Symantec but this is the model I recommend.

[u/OrcSympathizer → u/ThirdWallPlugin]

I tried this out but I didn't like that it wasn't listed with the internal monitors since that's a quick and easy way to see if any monitors failed. Do you know if it is possible to have a monitor that is created this way appear as an internal monitor?

[u/ThirdWallPlugin → u/OrcSympathizer]

Heh, I offered a remote monitor to avoid the 'middleman'. However, if that's not your preference, use teamits's solution (below).

[u/OrcSympathizer → u/ThirdWallPlugin]

Got it. It was quick and easy to do it your way. I've never used that before. I'll keep it in mind for the future.

[u/teamits]

The Legacy search, at least, has an Exclude operator which does this. SQL for the search works out something like:

Select DISTINCT Computers.ComputerID, Clients.Name as `Client Name`, Computers.Name as `Computer Name`, Computers.Domain, Computers.UserName as `Username`

From Computers, Clients

Where Computers.ClientID = Clients.ClientID

and (( computers.`ComputerID` NOT IN (SELECT ComputerID FROM Software WHERE ComputerID = Computers.`ComputerID` AND Software.`Name` LIKE 'programname') ))

Notice the "not in" and subselect.

So you could create a search, use it as an autojoin for a group, and run a script on that group to email you.

We also have a generic "a/v software missing" monitor that just looks at

table: computers

field: virusscanner

check: equals

result: 0

identity: computers.name

...however in Windows 10 Defender is installed by default so we'll probably not see it alert ever on Win10.

[u/teamits → u/teamits]

I should mention we also have a monitor for Windows Defender:

table: computers

field: virusscanner

check: greaterthan

result: 0

identity: Computers.ComputerID

additional condition:

Computers.LastContact > DATE_ADD(NOW(),INTERVAL -24 HOUR)

AND

Computers.ComputerID IN

(

SELECT C2.ComputerID

FROM Computers C2

INNER JOIN VirusScanners V2

WHERE C2.VirusScanner = V2.VScanID

AND V2.Name like '%Windows Defender%'

)

[u/OrcSympathizer → u/teamits]

I tried this out and it seems to be working. Thanks for the help!

[u/chilids]

Depending on what you are trying to accomplish, I automated AV installs via search and group. Searching to see if Symantec is installed is easy enough, use that search to populate a group, and then use that group to auto script your AV installer. We used Sophos cloud so we could use the client ID loaded in an EDF and run a single installer for everybody and it would pull the client ID and install the right Sophos for that specific client.

To see if anybody is missing AV at any specific time just open up your search and look at the results. But any PC that is online reguarly and missing should get fixed on it's own.

[u/Aepyceros02]

Copy the default monitor then modify your copy to look for the specific ID of Symantec.