PowerShell Scanner Leaving Behind Old Data
We are in the middle of a migration from our old endpoint security solution (ESET) to our new one (FortiClient). I discovered that ESET does not properly clean up its WMI entries when you uninstall it, which can be seen with this WMI query:
Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct"
This is an issue because FortiClient intelligently detects other installed AV solutions and turns off its own antivirus protection if it discovers any. I think it's just checking for this WMI entry to determine that. To help me track these down I created a new PowerShell scanner using the code above and added it to my "Applications" scan profile. This works fine and properly detects these entries.
I have another PowerShell command that I put into a custom tool in PDQ Inventory that will clean up these entries:
Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" | Where-Object {$_.displayName -like 'ESET*'} | Remove-CimInstance
This also works fine. My issue is that, after running this command, a re-scan using the Applications scan profile does not remove the old data from the PDQ Inventory database. It keeps the data for the old WMI entries that no longer exist. I have verified that they no longer exist by manually running the PS code from the scanner. Those entries are gone but PDQ does not remove them from the database after a re-scan.
How do I solve this? It seems like I am not the first one to encounter this issue based on running some searches on similar issues and it was identified as a bug in PDQ months ago but as far as I can tell it hasn't been fixed.
We are on PDQ Inventory Enterprise version 19.3.48.0.
-
I recommend reaching out to support@pdq.com to let them know you have encountered this bug.
To work around it, you have to return an object with empty properties, like this: https://github.com/pdq/PowerShell-Scanners/blob/master/PowerShell%20Scanners/Get%20Available%20Windows%20Updates/Get%20Available%20Windows%20Updates.ps1
Please sign in to leave a comment.
Comments
1 comment