You can determine the antivirus software present on a system, if the antivirus software is registered with the Windows Security Center, using Windows Management Instrumentation Command-line (WMIC). E.g., for a Windows 10 system using Microsoft Windows Defender:
C:\>WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName displayName Windows Defender C:\>
Or, for another system that has McAfee Total Protection installed as its antivirus software.
C:\Users\Sharon>WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName displayName Windows Defender McAfee VirusScan C:\Users\Sharon>
You can get additional information by omitting the Get displayName
, which results in only the display name being shown in the output.
C:\Users\Sharon>WMIC /Node:localhost /Namespa
ce:\\root\SecurityCenter2 Path AntiVirusProduct
displayName instanceGuid pathToSignedProductExe
pathToSignedReportingExe
productState
Windows Defender {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} %ProgramFiles%\Windows
Defender\MSASCui.exe %ProgramFiles%\Windows Defender\MsMpeng.exe
393472
McAfee VirusScan {8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC} C:\Program Files\McAfe
e.com\Agent\mcupdate.exe C:\Program Files\Common Files\McAfee\Platform\McSvcHos
t\McSvHost.exe 331776
C:\Users\Sharon>To make the output more readable, you can put get * /value at
the end of the command. E.g.:
C:\>wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value
displayName=Windows Defender
instanceGuid={D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
pathToSignedProductExe=%ProgramFiles%\Windows Defender\MSASCui.exe
pathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
productState=393472
displayName=McAfee VirusScan
instanceGuid={8BCDACFA-D264-3528-5EF8-E94FD0BC1FBC}
pathToSignedProductExe=C:\Program Files\McAfee.com\Agent\mcupdate.exe
pathToSignedReportingExe=C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
productState=331776
C:\>