cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 7
Report Inappropriate Content
Message 1 of 2

Why does WMI show duplicate entries for the same A/V product in \\root\SecurityCenter2?

I have been using WMI to retrieve the antivirus/antispyware/firewall products registered in the Windows Security Center. Since last month duplicate entries for ESET Internet Security started showing up (since v12.2.29). Somebody else said it also happened with McAfee.

ESET said that since Windows 8, WMI should not be used to check this as there is new API made specifically for this. Apparently this iswhich indeed does not seem to report the duplicates.

But I want to know if WMI can still be used as well, as this is required for pre-Win8 and I have not seen any reports that it shouldn't be used in Win8+ anymore.

To test, use this command line to check the installed antivirus products: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get /Format:List

And this is what it outputs on my computer:

displayName=Windows Defender
instanceGuid={D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
pathToSignedProductExe=windowsdefender://
pathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
productState=393472
timestamp=Fri, 11 Oct 2019 16:09:34 GMT

displayName=ESET Security
instanceGuid={885D845F-AF19-0124-FECE-FFF49D00F440}
pathToSignedProductExe=C:\Program Files\ESET\ESET Security\ecmds.exe
pathToSignedReportingExe=C:\Program Files\ESET\ESET Security\ekrn.exe
productState=266240
timestamp=Mon, 11 Nov 2019 08:20:20 GMT

displayName=ESET Security
instanceGuid={EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
pathToSignedProductExe=C:\Program Files\ESET\ESET Security\ecmds.exe
pathToSignedReportingExe=C:\Program Files\ESET\ESET Security\ekrn.exe
productState=266240
timestamp=Wed, 02 Oct 2019 07:08:22 GMT

Windows Defender is disabled and as you can see, the second ESET entry has not been touched for over a month now.

Now my questions are:

  1. Can WMI(C) still be used to query the Windows Security Center in Win8+?
  2. If not, has anybody seen any reports/warnings about this?
  3. Or is this a Microsoft bug?
  4. Or is ESET (and McAfee?) doing something wrong (registering a new version without deregistering the old one)?

Any help is much appreciated.

McDVoice Survey

1 Reply
Highlighted
Moderator
Moderator
Report Inappropriate Content
Message 2 of 2

Re: Why does WMI show duplicate entries for the same A/V product in \\root\SecurityCenter2?

Hello @Hart29 

We kindly request you to contact ESET Support for the query you've raised and they will help you.

Regards,
Madhan M

How Many Badges Can You Collect?
Ready for a little competition? Members like you are earning badges and unlocking perks for their helpful answers. Are you? Click here to find out.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community