Count of Computers with/without Anti-virus Software report missing newer McAfee versions

[Migration User]

We run McAfee 8.5 and are in process of upgrading to 8.6.  The report "Count of Computers with/without Anti-virus Software" shows all computers without antivirus software.  Running SMP 7.1 SP1.

[Migration User]

since the early days. What I recommend is cloning the report, so you can edit it. When you edit or view the .xml you will find the query it is using. I suspect that the values you are seeking are either missing or the remainders are hardcoded, which would lead to your systems version of AV being tagged as 'without av".

If you do the above, post the query here and we should be able to help.

[Migration User]

Here is the query of the report:

DECLARE @v1_TrusteeScope nvarchar(max)
SET @v1_TrusteeScope = N'%TrusteeScope%'
SELECT COUNT(DISTINCT CAST(i.[Guid] as varchar(40))) [Number of Computers],  
 a1.[Name] [Product Name],    
 --mkd.[KnownAs] [Manufacturer],
 a1.Version [Product Version]  
FROM dbo.vComputer i 
JOIN dbo.ScopeMembership sm
 ON sm.[ResourceGuid] = i.Guid
 AND sm.[ScopeCollectionGuid] IN (SELECT * FROM dbo.fnGetTrusteeScopeCollections (@v1_TrusteeScope))
JOIN dbo.vSWAntivirusWindows a1  
 ON a1.[_ResourceGuid] = i.Guid  
--JOIN dbo.ManufacturerKnownAsDefault mkd
 --ON a1.[Name] LIKE mkd.[KnownAs] + '%'
JOIN dbo.CollectionMembership cm 
 ON cm.ResourceGuid = i.[Guid] 
JOIN dbo.vCollection it 
 ON it.Guid = cm.CollectionGuid 
WHERE 1 = 1 
AND i.[System Type] LIKE 'Win%' 
AND LOWER (i.[Name]) LIKE LOWER ('%Computer Name%') 
AND i.Domain LIKE '%Domain%' 
AND LOWER (it.[Guid]) LIKE LOWER ('%Filter%') 
GROUP BY 
 a1.[Name], 
 --mkd.[KnownAs], 
 a1.Version
   
UNION ALL 
  
SELECT COUNT(DISTINCT CAST(i.[Guid] as varchar(40))) [Number of Computers],  
 ISNULL (dbo.fnLocalizeString ('No Virus Protection','21086963-e60d-4386-8343-b1c6c9d2be2e','%_culture%'),
dbo.fnLocalizeString ('No Virus Protection','21086963-e60d-4386-8343-b1c6c9d2be2e','en')) [Product Name],
 --NULL [Manufacturer],  
 NULL [Product Version]  
FROM dbo.vComputer i 
JOIN dbo.ScopeMembership sm
 ON sm.[ResourceGuid] = i.Guid
 AND sm.[ScopeCollectionGuid] IN (SELECT * FROM dbo.fnGetTrusteeScopeCollections (@v1_TrusteeScope))
JOIN dbo.CollectionMembership cm 
 ON cm.ResourceGuid = i.[Guid] 
JOIN dbo.vCollection it 
 ON it.Guid = cm.CollectionGuid 
WHERE 1 = 1 
AND i.Guid NOT IN
(
 SELECT a1._ResourceGuid
 FROM dbo.vSWAntivirusWindows a1  
)  
AND i.[System Type] LIKE 'Win%' 
AND LOWER (i.[Name]) LIKE LOWER ('%Computer Name%') 
AND i.Domain LIKE '%Domain%' 
AND LOWER (it.[Guid]) LIKE LOWER ('%Filter%')   
HAVING COUNT(DISTINCT CAST(i.[Guid] as varchar(40))) > 0
ORDER BY 
 COUNT(DISTINCT CAST(i.[Guid] as varchar(40))) DESC
     

[Migration User]

The table "Inv_SW_Antivirus " is empty in my database.  Ideas?

[Migration User]

so an inventory scan should populate it. I would check out the dbo.vSWAntivirusWindows table as well. In any case, updating a view with new SQL should be done carefully. It might be worth a support call if an inventory scan doesn't start showing data in that table.

[Migration User]

vSWAntivirusWindows is a View which includes elements of the table Inv_SW_Antivirus.  I've run a full inventory on a single client machine and no data populated in that table (otherwise, full inventory has populated other elements, e.g. full hardware/software inventories).

[Migration User]

Click on the full inventory policy and select the Advanced button.  If you drill down into the Software Inventory dataclasses, you will notice that AntiVirus is not selected by default.

[Migration User]

is this because of past issues with the Symantec EP intergration component?

[Migration User]

That's what I've been told, but I'll let Andrew confirm.

[Migration User]

I've done that, so far no results, but we are only running a full inventory once per week.  I'll update this thread in the next few days if I do or don't see any data in that table.

[Migration User]

With antivirus checked, you can run a task to force a SW inventory.  This may be worthwhile if you want to test outside of the weekly schedule on a single client.

[Migration User]

Forced a full inventory (a custom task), the table is still not populated with a machine running McAfee 8.8.

[Migration User]

And the full inventory task specifically had the Antivirus checkbox checked?

[Migration User]

That is correct.

[Migration User]

Are you running the task as a user who has rights to execute the task (an administrator)?  Is the task status successful?  You could try a specific inventory that only targets antivirus if you wanted to reduce the gathering and processing time as you test.

[Migration User]

To answer your questions, yes and yes.  I will retry with just an AV inventory.

[Migration User]

Do you have SEP Integration Component installed?  If so, I believe it comes with an Antivirus Inventory task that "overrides" the SW inventory.  If you have an Antivirus Inventory task, you should use this instead.  Do you have such a task on your NS?

[Migration User]

Retried with just an AV inventory and no dice.

[Migration User]

No, we only have McAfee.

[Migration User]

Values are now appearing!  Woohoo!  I now have 7 machines reporting data.  They do show information in Count of Computers by Anti-virus Signature Version report as well, however they are only showing the Product ("McAfee Virusscan Enterprise") and not Signature version, last checked, or definition file version.  I don't know if that information is going to be exclusive to SEP, or if I can somehow manipulate SMP into gathering that information as well (or do I just need to wait?).

[Migration User]

I think this is program specific -- some apps report it, some do not.  I imagine you could create a custom inventory if you're strictly a McAfee VirusScan Enterprise shop and value the signature/last checked/definition file version information.

[Migration User]

Do you have any instructions on custom inventories?  McAfee does report the signature versions to the registry (HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine).

EDIT: Disregard, I found where to make the custom inventories, etc., but does anyone know the data class GUID for the Antivirus information, as well as what objects I need to use to populate the rest of the info (Last Scan Time, Centrally Managed, Last Virus Definition Check, Server Name, Version, Virus Definition File Date, Virus Definition File Version)?

[Migration User]

Samples

Introduction