Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

PowerShell Scanner Leaving Behind Old Data

We are in the middle of a migration from our old endpoint security solution (ESET) to our new one (FortiClient). I discovered that ESET does not properly clean up its WMI entries when you uninstall it, which can be seen with this WMI query:

Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct"

This is an issue because FortiClient intelligently detects other installed AV solutions and turns off its own antivirus protection if it discovers any. I think it's just checking for this WMI entry to determine that. To help me track these down I created a new PowerShell scanner using the code above and added it to my "Applications" scan profile. This works fine and properly detects these entries.

I have another PowerShell command that I put into a custom tool in PDQ Inventory that will clean up these entries:

Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" | Where-Object {$_.displayName -like 'ESET*'} | Remove-CimInstance

This also works fine. My issue is that, after running this command, a re-scan using the Applications scan profile does not remove the old data from the PDQ Inventory database. It keeps the data for the old WMI entries that no longer exist. I have verified that they no longer exist by manually running the PS code from the scanner. Those entries are gone but PDQ does not remove them from the database after a re-scan.

How do I solve this? It seems like I am not the first one to encounter this issue based on running some searches on similar issues and it was identified as a bug in PDQ months ago but as far as I can tell it hasn't been fixed.

We are on PDQ Inventory Enterprise version 19.3.48.0.

0

Comments

1 comment
Date Votes