WMI安全中心产品状态说明
我正在 SecurityCenter2 上查询 WMI 中的“SELECT * FROM AntivirusProduct”（我目前使用的是 Windows 7）。
我很难找到 productState 上的数字的含义，包括反间谍软件和防火墙。那里有这方面的参考吗？我想确保我可以在任何 Vista 或 7 机器上获得正确的产品状态（以防这些数字因机器而异）。
I'm querying the WMI for "SELECT * FROM AntivirusProduct" on SecurityCenter2 (I'm on Windows 7 at the moment).
I'm having a hard time trying to find what do the numbers on productState mean, including AntiSpyware and Firewall aswell. Is there any reference for this out there? I want to make sure I can get the correct product states on any Vista or 7 machine (In case these numbers vary from machine to machine).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
没有关于
productState值的官方文档。我能找到的唯一信息是 本文根据对值的逐字节分析，对productState值的含义进行了假设。There's no official documentation on the
productStatevalues. The only info I could find is this article which makes assumptions about theproductStatevalue meaning based on the byte-by-byte analysis of the value.productState值似乎是一个位集，除非通过与 Microsoft 签订 NDA，否则不会记录。应该可以映射随安装的产品返回的值及其状态。您可以安装单个 AV 产品，记录其状态，然后使其病毒定义过期，然后检查值如何变化。似乎存在一组有限的典型值。参考： https://bigfix.me/analysis/details/2998358
以下是我从 10000 多个端点的 34 种不同的 AV 产品中找到的
productState值，这些值可以帮助逆向工程其含义：（十进制、十六进制、位集）
A friend of mine took this info much进一步，发现位组的位 3 表示 AV 定义是否过时。
请参见此处：https://www.bigfix.me/analysis/details/2998101?force=true
The
productStatevalues seem to be a bit set that is not documented except through an NDA with Microsoft. It should be possible to map the values returned with the products installed and their state. You could install a single AV product, record its state, then have its virus definitions go out of date, then check how the value changes. There seems to be a limited set of typical values.Reference: https://bigfix.me/analysis/details/2998358
Here are the
productStatevalues I have found from 34 different AV products across over 10000 endpoints which could help reverse engineer the meaning:( Decimal, Hex, Bit Set )
A friend of mine took this info much further and figured out that bit 3 of the bit set represents if the AV Definitions are outdated or not.
See here: https://www.bigfix.me/analysis/details/2998101?force=true
对于其他人来说，我发现当转换为十六进制时，第三个字符非常可靠地指示是否启用了任何特定的防病毒产品。 （1 = 启用，0 = 禁用）
这是我编写的 PowerShell 语句，用于确定 Windows Defender 是否启用。您可以替换该字符串以匹配您想要的任何防病毒产品。
我不能肯定地说每个防病毒产品都正确报告其产品状态，但我想所有主流产品都必须如此。我可以确认这也适用于 Symantec Endpoint Protection。
For anyone else, I've found that when converted to Hex, the third character pretty reliably indicates whether or not any particular antivirus product is enabled. (1 = Enabled, 0 = Disabled)
Here's a PowerShell one-liner I wrote to determine if Windows Defender is Enabled or not. You can replace the string to match whichever antivirus product you want.
I can't say for certain that every antivirus product correctly reports its product state, but I imagine all the mainstream ones must. I can confirm this also works with Symantec Endpoint Protection.