WIN-007 · Script
Antivirus and Defender Status
Reports which antivirus is active and whether Microsoft Defender is healthy and current.
Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing
What it does
Lists antivirus products registered with Windows Security Center (workstations), then checks Microsoft Defender: running mode, real-time protection, and how old its security intelligence is. If another antivirus is active and Defender is in passive mode, that is reported as expected rather than as a problem. Read-only.
Requirements
Windows PowerShell 5.1+, run as SYSTEM or local admin
How to run it
- Run as: SYSTEM or a local administrator
- Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
- Script type: PowerShell, 64-bit
- User interaction: none; the script never prompts
- Timeout: 10 minutes (30 for Windows Update installs)
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| MaxSignatureAgeDays | Alert when Defender signatures are older than this many days. Default 3. | 3 |
Exit codes
- 0 = protected, 1 = attention needed, 2 = script error
Testing steps
- Run it on one test device and check the output and log.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report only. Nothing is changed, so nothing needs to be rolled back.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |