Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 1 subscriber
  • Views 3971 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Clients OS showing not found

TechnicaSols

Many of our clients (businesss) are ringing us saying their computers are reporting no antivirus (The windows security center.)

We have seen this before and the issue just vanishs after a day, we have put it down to a Sophos update which doesn't seem to be detected by the OS

Anyone else experiencing this issue

:24315


This thread was automatically locked due to age.
Parents
  • 0

    On these machines. do you have anything in the event log from "Source": "WMI" or "SecurityCenter" that suggests a inconsistent state or that Security Center is unable to monitor security problems?

    SAV just calls into the Windows Security Center interface to set the state of SAV for Windows to display, if that fails becasue WMI isn't operational then that would be the place to start digging.

    The following command will test if the data has been passed to Security Center:

    WMIC /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct GET /value

    In this case it should return something like:

    displayName=Sophos Anti-Virus

    instanceGuid={65FBD860-96D8-75EF-C7ED-7BE27E6C498A}

    pathToSignedProductExe=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\WSCClient.exe

    pathToSignedReportingExe=C:\PROGRA~2\Sophos\SOPHOS~1\WSCClient.exe

    productState=327680

    Regards,

    Jak

    :24379
Reply
  • 0

    On these machines. do you have anything in the event log from "Source": "WMI" or "SecurityCenter" that suggests a inconsistent state or that Security Center is unable to monitor security problems?

    SAV just calls into the Windows Security Center interface to set the state of SAV for Windows to display, if that fails becasue WMI isn't operational then that would be the place to start digging.

    The following command will test if the data has been passed to Security Center:

    WMIC /namespace:\\root\SecurityCenter2 PATH AntiVirusProduct GET /value

    In this case it should return something like:

    displayName=Sophos Anti-Virus

    instanceGuid={65FBD860-96D8-75EF-C7ED-7BE27E6C498A}

    pathToSignedProductExe=C:\Program Files (x86)\Sophos\Sophos Anti-Virus\WSCClient.exe

    pathToSignedReportingExe=C:\PROGRA~2\Sophos\SOPHOS~1\WSCClient.exe

    productState=327680

    Regards,

    Jak

    :24379
Children
No Data