Windows Monitor - AV Script

Problem overview

Many organizations struggle to ensure reliable, ongoing antivirus protection on Windows systems, including those running third-party security tools. This script taps into Windows Security Center to confirm whether an AV product—be it Windows Defender or a properly registered third-party solution—is active, helping IT professionals and MSPs maintain a consistent layer of endpoint security.

PowerShell 100s timeout Runs as Local system Windows

<#
This resource is provided as a convenience for Level users. We cannot 
guarantee it will work in all environments. Please test before deploying 
to your production environment. We welcome contributions to our community 
library

Level Library
https://level.io/library/script-windows-monitor-av
#>

# Initialize a variable to track if antivirus protection is active
$antivirusActive = $false

# Function to check the status of Windows Defender Antivirus
function Check-AntivirusStatus {
    $status = Get-MpComputerStatus
    $antivirusEnabled = $status.AntivirusEnabled
    $realTimeProtection = $status.RealTimeProtectionEnabled

    if ($antivirusEnabled -eq $true -and $realTimeProtection -eq $true) {
        Write-Host "Antivirus and real-time protection are ENABLED."
        $global:antivirusActive = $true
    }
    elseif ($antivirusEnabled -eq $true) {
        Write-Host "Antivirus is ENABLED, but real-time protection is DISABLED."
    }
    else {
        Write-Host "Antivirus is DISABLED."
    }
}

# Check antivirus status
Check-AntivirusStatus

# Determine script exit code based on antivirus status
if ($antivirusActive) {
    Write-Host "SUCCESS: Antivirus protection is active."
    exit 0
}
else {
    Write-Host "ALERT: Antivirus protection is not fully active."
    exit 1
}

It queries Windows Security Center for any recognized antivirus product status, including real-time protection. If antivirus coverage is confirmed as active, the script returns a success. If not, or if real-time scanning is disabled, it exits with an alert code, enabling Level to trigger a notification or remediation task. By leveraging system-level permissions, it works seamlessly under the hood without additional user intervention, ensuring straightforward monitoring and compliance checks.

Use cases

Checking if a third-party antivirus solution is active in Windows Security Center
Verifying whether real-time scanning is disabled or bypassed
Triggering alerts when no valid AV is found on endpoints
Integrating into automated workflows to re-enable or install the correct antivirus

Recommendations

Configure a script-based monitor in Level to run regularly, allowing immediate detection if antivirus coverage lapses
Pair with an automation that attempts to re-enable or deploy the proper antivirus solution upon alert
Validate in a test environment to confirm that third-party AVs register correctly with Windows Security Center
Review additional logs if coverage isn’t recognized, as some AV vendors may require extra steps to appear in Security Center

Frequently asked questions.

Will this script detect antivirus solutions other than Windows Defender?

Yes, it checks Windows Security Center, which typically displays any properly registered antivirus product.

Does it require elevated permissions to run?

No, Level handles system-level permissions, so you don’t need to elevate privileges manually.

What if a vendor’s antivirus doesn’t show in Windows Security Center?

Some third-party AVs may not fully register. Ensure the product integrates with Windows Security Center or consult the vendor’s documentation.

Can I add more robust checks for specific AV vendors?

Absolutely. You can modify or extend the PowerShell commands to retrieve product-specific details if needed.

Ready when you are.

No credit card. No sales call. Just sign up and start managing.

Start for free Talk to us