Determining the antivirus software on a Windows system from the command line

You can determine the antivirus software present on a system, if the antivirus software is registered with the Windows Security Center, using Windows Management Instrumentation Command-line (WMIC). E.g., for a Windows 10 system using Microsoft Windows Defender:

C:\>WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
displayName
Windows Defender


C:\>

Or, for another system that has McAfee Total Protection installed as its antivirus software.

C:\Users\Sharon>WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
displayName
Windows Defender
McAfee VirusScan


C:\Users\Sharon>

You can get additional information by omitting the Get displayName , which results in only the display name being shown in the output.

C:\Users\Sharon>WMIC /Node:localhost /Namespa
ce:\\root\SecurityCenter2 Path AntiVirusProduct
displayName       instanceGuid                            pathToSignedProductExe
                          pathToSignedReportingExe                              
                productState
Windows Defender  {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}  %ProgramFiles%\Windows
 Defender\MSASCui.exe     %ProgramFiles%\Windows Defender\MsMpeng.exe           
                393472
McAfee VirusScan  {8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC}  C:\Program Files\McAfe
e.com\Agent\mcupdate.exe  C:\Program Files\Common Files\McAfee\Platform\McSvcHos
t\McSvHost.exe  331776


C:\Users\Sharon>

To make the output more readable, you can put get * /value at the end of the command. E.g.:

C:\>wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value


displayName=Windows Defender
instanceGuid={D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
pathToSignedProductExe=%ProgramFiles%\Windows Defender\MSASCui.exe
pathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
productState=393472


displayName=McAfee VirusScan
instanceGuid={8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC}
pathToSignedProductExe=C:\Program Files\McAfee.com\Agent\mcupdate.exe
pathToSignedReportingExe=C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
productState=331776




C:\>