SEP Antivirus Inventory
We use Symantec AntiVirus. We have an inventory which collects antivirus information including filename, file version, path, and definition date among other things. The definition information used to be housed in the registry in an easy to read string. Then we upgraded to SEP. My initial thought was that we could use the connector with NS 6 and presto chango we would be all done. The connector merely created duplicates every time it ran which was disappointing. So we abandoned the connector and set about trying to just fix the inventory we had created. The nice string value has been changed to a binary key now which made life very difficult. Suffice to say I figured out how to change the binary value into something useable as a date again, and no it is NOT as easy as just converting binary to decimal, and wanted to save anyone else who might be struggling with the some time. Attached are the cit, ini, and vbs files we use for our inventory.
32 bit inventory
campbell_sym32.ini - fed to aexinvsoln.exe
campbellsymantec32.cit - main 32 bit inventory
campbell_sym.vbs - gets definitiondate from registry
64 bit inventory
campbell_sym64.ini - fed to aexinvsoln.exe
campbellsymantec64.cit - main 64 bit inventory
campbell_sym.vbs - gets definition date from registry
Process:
Separate inventory tasks need to be setup for 32 and 64 bit computers using the campbell_symantec%.ini file. The ini file calls the appropriate cit file to create the nsi. This is done b/c the inventory agent does a better job of reading file information than I can do with vbscript. Next the vbscript runs. The vbscript directly edits the nsi, created in the step before, adding in the data retrieved from the registry. The last step is submitting the NSI to the NS for processing.
I hope someone else finds this helpful.