PowerShell Script to Enumerate AV, Malware & Security Settings on Windows Client & Server Platforms

Question

I wrote a PowerShell script to grab Antivirus Product Status drawing inspiration from this online resource: Get Antivirus Product Status with PowerShell, posted February 22, 2016. Cut down and modified the logic to run against a single system and was quite pleased with the results when run on my personal Windows 11 Pro 10.0.22631 N/A Build 22631 system:

Display Name : Windows Defender
Enabled      : True
Updated      : True
Time Stamp   : Sun, 11 Aug 2024 11:25:42 GMT
Path         : %ProgramFiles%\Windows Defender\MsMpeng.exe
Computer     : WHAMILL-W10

Then I read the author's follow-up Searching for a CIM/WMI Class with PowerShell, posted a couple years later on September 18, 2018. Turns out the PowerShell code while completely functional on Windows 10\11 client systems was failing on Windows 2016 and later server platforms.

The WMI namespace the older function was querying does not exist on Windows Server 2016 and later. So I got inspired and modified my original function to use the updated CIM/WMI class data elements referred to in Update #2 on Searching for a CIM/WMI Class with PowerShell.

And now the amended results, once again from my personal system:

Installed Platform         : Windows Defender
Install Path               : %ProgramFiles%\Windows Defender\MsMpeng.exe
Computer                   : WHAMILL-W10
Version                    : 4.18.24070.5
AV\Spyware Signature       : 1.417.71.0
Latest Definitions Update  : Sunday, 11-Aug-2024 10:36:39 AM
Most Recent Scan           : Monday, 12-Aug-2024 07:30:32 AM
AntiVirus Enabled          : True
AntiSpyware Enabled        : True
Behavior Monitor           : True
IE/Outlook AV Protection   : True
Network Inspection Service : True
URL On Access Protection   : True
Realtime Protection        : True

Well now ain't this cool? So, here's the updated code:

function Get-SecurityPosture {
    try {
        # Extract data from AntiVirusProduct class
        # Source\Inspiration:  https://jdhitsolutions.com/blog/powershell/5187/get-antivirus-product-status-with-powershell/
        $ProtectionLegacy = Get-CimInstance -Namespace "root\SecurityCenter2" -ClassName "AntiVirusProduct" -ErrorAction Stop
    }
    catch {
        Write-Error "Failed to retrieve data from AntiVirusProduct class: $_"
        return
    }

    try {
        # Extract data from ProtectionTechnologyStatus class
        # Source\Inspiration:  https://jdhitsolutions.com/blog/powershell/6082/searching-for-a-cim-wmi-class-with-powershell/
        $ProtectionCurrent = Get-CimInstance -Namespace "root\Microsoft\SecurityClient" -ClassName "ProtectionTechnologyStatus" -ErrorAction Stop
    }
    catch {
        Write-Error "Failed to retrieve data from ProtectionTechnologyStatus class: $($_.Exception.Message)"
        return
    }

    # Combine and format the data into a single array
    $Results = @()
    foreach ($LegacyObject in $ProtectionLegacy) {
        try {
            $AVMostRecentScan = Get-Date -Date $LegacyObject.timestamp -Format "dddd, dd-MMM-yyyy hh:mm:ss tt"
        }
        catch {
            Write-Error "Failed to parse timestamp for $($LegacyObject.displayName): $($_.Exception.Message)"
            continue
        }

        foreach ($CurrentObject in $ProtectionCurrent) {
            try {
                $AVDefSigTimeStamp = Get-Date -Date $CurrentObject.AntispywareSignatureUpdateDateTime -Format "dddd, dd-MMM-yyyy hh:mm:ss tt"
            }
            catch {
                Write-Error "Failed to parse AntispywareSignatureUpdateDateTime for $($CurrentObject.Version): $($_.Exception.Message)"
                continue
            }

            $Results += [PSCustomObject]@{
                "Installed Platform"         = $LegacyObject.displayName
                "Install Path"               = $LegacyObject.pathToSignedReportingExe
                "Computer"                   = $Env:COMPUTERNAME
                Version                      = $CurrentObject.Version
                "AV\Spyware Signature"       = $CurrentObject.AntispywareSignatureVersion              
                "Latest Definitions Update"  = $AVDefSigTimeStamp
                "Most Recent Scan"           = $AVMostRecentScan
                "AntiVirus Enabled"          = $CurrentObject.AntiVirusEnabled
                "AntiSpyware Enabled"        = $CurrentObject.AntiSpywareEnabled
                "Behavior Monitor"           = $CurrentObject.BehaviorMonitorEnabled
                "IE/Outlook AV Protection"   = $CurrentObject.IoavProtectionEnabled
                "Network Inspection Service" = $CurrentObject.NisEnabled
                "URL On Access Protection"   = $CurrentObject.OnAccessProtectionEnabled
                "Realtime Protection"        = $CurrentObject.RtpEnabled
            }
        }
    }
    return $Results
}

I haven't been able to test this function on a server platform or any other system but my own. I'm very interested in knowing the community's thoughts.