I am trying to get Domain pc's Antimalware status remotely, using powershell script. The following code works as expected, except I do not know how to pass the -computername parameter to the Get-MpComputerStatus command. It will return the Malware status of the local pc, that is running the script, but not the AD pc's. The rest of the variables, such as Location, Device Name, Serial Number are returned correctly:
import-module ActiveDirectory
Get-ADComputer -filter "name -like '*'" |
Select -expandproperty name |
ForEach {
$results = % { Get-ADComputer -Identity $_ -Properties Description }
$cs = gwmi win32_bios -ComputerName $_ -ErrorAction SilentlyContinue
$os = Get-Wmiobject -class Win32_operatingsystem -computername $_ -ErrorAction SilentlyContinue
$bios = Get-WmiObject Win32_ComputerSystem -ComputerName $_ -ErrorAction SilentlyContinue
$rs = Get-MpComputerStatus
#$rs = Get-WmiObject Win32_ComputerSystem -ComputerName $_ -ErrorAction SilentlyContinue | Get-MpComputerStatus
$Object = New-Object PSObject -Property @{
"Device Name" = $results.name
"Physical Location" = $results.description
"Employee" = $bios.UserName
"Last Logon Date" = $results.LastLogonDate
"Category" = $bios.ChassisSKUNumber
"Vendor" = $bios.Manufacturer
"Make/Model" = $bios.Model
"Serial Number" = $cs.SerialNumber
'OS' = $os.caption
'Malware Updated' = $rs.AntivirusSignatureLastUpdated
'AntiSpyware Status' = $rs.AntispywareEnabled
'AntiMalware Version' = $rs.AMServiceVersion
}
$Object |
Select-Object "Physical Location", "Employee", "Device Name", "Malware Updated",'AntiSpyware Status','AntiMalware Version', "Serial Number", "Vendor", "Make/Model", "OS"|
Export-Csv -Append -Force -NoTypeInformation "$($env:USERPROFILE)\documents\WinDef.csv" #"c:\data\asset_inventory2.csv
}
You can either use -CimSession
as explained in MS Docs:
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer
Or you can $rs=Invoke-Command RemoteComputer {Get-MpComputerStatus}