Antivirus: Part 1, Meeting customer antivirus policy requirements

Do you ever consider what it takes to meet a customer’s antivirus policy statement before going on-site? You should… and with the number of VARs, network integrators, IT consultants, etc. that have to go on-site to customer locations – especially with large customers, you’d think there would be more conversations surrounding how to meet a customer’s antivirus policy when working at their location.

What do you mean?

Well, consider this. You work for a consulting shop… you have engineers of various types (programmers, netadmins, electrical engineers, etc.). These personnel work on projects for customers. In at least some cases, these personnel will need to go on-site to the customer’s location (either via VPN, or be physically on-site). And of course, they’ll need to bring their laptops with them and connect to the customer’s network. Maybe some customers have guest VLANs configured, but in some cases (and in my experience, most) customers will require that you be connected to a production LAN of some type – either to work on servers, databases, etc. How can you be sure that your employees have antivirus software that is fully up-to-date?

Now, simply telling employees – even very good and technical employees - to make certain their antivirus software is fully up-to-date probably isn’t enough. Maybe infection notifications – pop-ups, emails, etc. might be of some use. But this isn’t necessarily going to give your customer the protection you want to give them!

Considering Risk!

It’s important to consider the potential risks you expose a customer to when someone on your staff takes their laptop on-site. In fact, it’s probably even more important because the scale and scope of the risk is probably greater. For instance, what’s the worst case scenario on your internal network – a massive outbreak that results in downtime and extra work? That’s bad. But what’s the worst-case scenario for your customer – pretty much the same thing – except the customer can choose not to work with you in the future… so it’s not just downtime and soft numbers, but the potential for a material impact to your business.

So having fully patched operating systems and up-to-date antivirus software is even more important. In fact, it should be a given. But how do you validate this? Validation should be accomplished though a combination of good policies, procedures, and tools.

In follow-up posts, I’ll discuss what we're doing to better protect our customers.

WMI: Checking Symantec Antivirus version information and definition dates

Back when I posted the Symantec Antivirus definition date script, I thought it would also be useful to also know the client version information. Useful – but not absolutely necessary for the task at hand. At the time, I recall poking through the registry trying to find a version stamp somewhere, but never really getting exactly what I want.

After posting the script to get a list of installed applications, I recalled my original post, and saw just how easy it was to filter the version information out of the installed applications, and combine the two scripts to print version and definition date information together. So by adding the If-Then statement inside the For Next loop, we get exactly what we need.

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_Product")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objShell = CreateObject("Wscript.Shell")
strCmdRun = "cmd /c"
strRegQ = "reg query "
strRegKey = "\HKLM\SOFTWARE\Symantec\SharedDefs\"
strCmdSw = " /v "
strRegKey2 = "DEFWATCH_10"
Dim objShell,objDef,objDate,objVer,objRev,objOutFile,objFSO,objNDate

Set objExec = objShell.Exec(strCmdRun & strRegQ & "\\" & strcomputer & strRegKey & strCmdSw & strRegKey2)

strExecResults = LCase(objExec.StdOut.ReadAll)
objVer = Right(strExecResults,16)
objRev = Right(objVer,7)
objDate = Left(objVer,8)
objYear = Left(objDate,4)
objMonth = Mid(objDate,5,2)
objDay = Right(objDate,2)
objNDate = CDATE(objMonth &"/"& objDay &"/"& objYear)


For Each objItem in colItems
 If objItem.Description = "Symantec AntiVirus" Then
   wscript.echo objItem.Description &  " (v." & objItem.Version & ")"
 End if
Next

wscript.echo vbCrLf &"Symantec AntiVirus definition date: " & objNDate &" Rev. "& objRev

WMI: Checking Symantec Antivirus definition dates on workstations via a WMI script

Have you ever wanted to be able to check Symantec antivirus definition dates on workstations via WMI, but weren’t sure exactly how to find the date? Well wonder no more, as you can find the date and revision in the following registry location.

HKLM\SOFTWARE\Symantec\SharedDefs\DEFWATCH_10
The value data is in a string that looks like this: “20051123.019” [YearMonthDay.Revision].

With that piece of information, you’re just a few steps from automating this effort.

So the first thing I did was start playing with the “reg query” command under Windows XP/2003. What’s nice about this is that it’s very easy to grab stuff out of remote registries using the tool; just specify the machine name like so:

“reg query \\workstationname\HKLM\SOFTWARE\Symantec\SharedDefs\ /v DEFWATCH_10"”

Go ahead and run this on your machine. Doing so will produce string that you can use (making sure to specify your workstation name where it says “workstationname”).

After you have this, you can load the results into a string, and then use your “Right/Left/Mid” functions to massage the date into something presentable. Just copy and paste the below code into a text file, and save it with a “.vbs” extension.

Oh, wait… you wanted to do this to multiple workstations? Or say, maybe every computer object in Active Directory?

Not a problem. With the code I have on this page, you can copy and paste it directly into my inventory script, and be off and running. Just make sure you put the “Wscript.Echo” line down in the reporting section of the original script.

Let me know what you think.


Set objShell = CreateObject("Wscript.Shell")

strCmdRun = "cmd /c"
strRegQ = "reg query "
strComputer = "workstationname"
strRegKey = "\HKLM\SOFTWARE\Symantec\SharedDefs\"
strCmdSw = " /v "
strRegKey2 = "DEFWATCH_10"

Dim objShell,objDef,objDate,objVer,objRev,objOutFile,objFSO,objNDate

Set objExec = objShell.Exec(strCmdRun & strRegQ & "\\" & strcomputer & strRegKey & strCmdSw & strRegKey2)

strExecResults = LCase(objExec.StdOut.ReadAll)

objVer = Right(strExecResults,16)
objRev = Right(objVer,7)
objDate = Left(objVer,8)
objYear = Left(objDate,4)
objMonth = Mid(objDate,5,2)
objDay = Right(objDate,2)
objNDate = CDATE(objMonth &"/"& objDay &"/"& objYear)

wscript.echo vbCrLf &"Symantec AntiVirus definition date: " & objNDate &" Rev. "& objRev


Symantec Antivirus Corporate/Enterprise: Change the parent server of a client without reinstalling the application

This is one of those posts that could be filed under... "for future reference". It's something that I'm sure I'll come back to and be glad I documented, so why not post it to the blog?

Did you know that you can easily change your Symantec Antivirus parent server, without uninstalling and reinstalling the client?

You can use the Grc.dat file to do useful things like…

• Change the parent server of a managed client without having to uninstall the client
• Rapidly convert unmanaged clients into managed clients

1. Grab a copy of the Grc.dat file from your Symantec Antivirus parent server file:////server/vphome/clt-inst/win32

2. Open the Grc.dat file in notepad. Change the parent server name by editing the following line such that servername is replaced with the name of your new parent server: Parent=servername

3. Copy the file to the client that you want to change, making sure to put it in the right directory... For Windows 2000/xp/2003, place it in c:\documents and settings\all users\application data\symantec\symantec antivirus corporate edition\7.5

4. Either restart the box, or the Symantec Antivirus service.

The next step would probably be to automate this process using script.