Antivirus Status Check Reference

Configuration options for the antivirus status check

Written By Erdinc Akay

Last updated About 2 months ago

Antivirus Status Check Reference

Configuration options for the antivirus status check

The antivirus status check queries the Windows Security Center to verify that a recognised antivirus product is installed, active, and up to date.

Configuration fields

All four threshold fields (definition age and scan age) are hidden by default. Enable the Show advanced options toggle in the check configuration to reveal them.

FieldTypeRequiredDefaultDescription
Warning after (days) — under Definition age thresholdsNumber (days)No3Days since last definition update before a warning is raised
Critical after (days) — under Definition age thresholdsNumber (days)No7Days since last definition update before a critical result
Require real-time protectionbooleanNoYesFail the check if real-time protection is disabled
Scan warning after (days) — under Scan age thresholdsNumber (days)No14Days since last quick scan before a warning is raised
Scan critical after (days) — under Scan age thresholdsNumber (days)No30Days since last quick scan before a critical result

Metrics collected

  • Antivirus product name
  • Enabled state and real-time protection status
  • Last definition update (ISO timestamp) and definition age in days
  • Quick scan age in days
  • Full scan age in days

Supported antivirus products

The following five vendors are first-class: they are enriched with vendor-specific metrics (exact definition update timestamps and scan ages) and are the only vendors probed by the direct-detection fallback on Windows Server.

  • Microsoft Defender
  • Sophos
  • ESET
  • SentinelOne
  • CrowdStrike Falcon

On Windows client editions the product name shown is the one the installed product registers with the Security Center, so it can differ slightly from the names above (for example "Sophos Endpoint Protection").

Any other product that registers with the Windows Security Center (WMI SecurityCenter2 namespace) is detected baseline-only — enabled state and real-time protection are reported, but vendor-specific metrics are not collected, and the product is not detected on Windows Server. If a product is installed but not detected, verify that its WMI provider is enabled.

Platform support

PlatformSupported
WindowsYes
LinuxNo
macOSNo

Notes

  • If multiple antivirus products are installed, each is evaluated separately. The check reports the worst result across the enabled products when at least one product is enabled — so Windows Defender running in passive mode under a third-party AV is ignored. If no product is enabled, the check falls back to the worst result across all detected products.
  • On Windows Server, the Security Center (SecurityCenter2) is typically unavailable. The check falls back to a direct-detection path that probes each supported vendor independently — this is the primary code path on Windows Server and a safety net elsewhere. If no products are detected at all, the check returns a Critical result.
  • For baseline-only products (anything outside the five first-class vendors), no exact definition age is available. If the Security Center reports their definitions as outdated, the check raises a Warning regardless of the definition age threshold fields — the thresholds only apply to products with an exact definition timestamp.
  • If the warning threshold is set higher than the critical threshold, the check silently swaps the two values.

See also: Configure an Antivirus Status Check