The registry key of Security Center\Monitoring has been removed.

Mitsuhiro · Dec 28, 2010

In XP or earlier, I remember that we can detect the presense of security softwares with the registry values under the key HKLM\SOFTWARE\Microsoft\Security Center\Monitoring.
Now Windows Vista or later, those keys and values are missing.
I am a developer of windows software. Some security softwares sometimes disturbs the installation of user software.
So, I have to impliment some codes which detects the installation of security software.
But now, nobody can avoid such troublesome troubles....
If somebody knows this matter, please help me.

Lorien · Dec 29, 2010

Hi Mitsuhiro,

Welcome to Vista Forums!

I am not aware of any registry location for this information. That doesn't mean it doesn't exist (though that may be true), but merely that after two hours of searching I could find nothing.

If someone is having trouble with incorrect information in Security Center, the following article can sometimes help: http://www.vistax64.com/tutorials/195736-security-center-not-reporting-correct-information.html. This suggests that the location being rebuilt possibly contains the information you are seeking (though there's no gurarantees and I do not know how to directly access it) since repairing it makes Security Center report accurately (so it seems likely that the repair corrected the information from which Security Center obtains its data). I can find no registry location for this - but I admit I didn't do a complete search and wasn't sure what exactly to search for in the registry (there were three likely criteria, but no knowing if any was the correct location or it was called something else like the full name of MSI) - and I'm not even sure if this information is stored under such names or other names. I also don't know where the procedure gets the information to rebuild the repository (which likely is the source of the information you're seeking - but it shouldn't matter where you get it if you can find it somewhere). Perhaps more research on that location will provide additional information which might help.

I realize this doesn't answer your question, but hopefully will give you an idea of where you might search.

Perhaps someone with more knowledge will post and be able to provide better information.

If not, I recommend trying The Official Scripting Guys Forum! Forum where people who specialize in scripts (which may need the same information) may be able to assist you.

I hope this helps.

Good luck!

Mitsuhiro · Jan 4, 2011

Dear Lorien.
I greatly appreciate your kindly help.
Definitely, which I would like to know was how my program can detect the installation of security software, by your help, I assumed it to be impossible in Vista.
Moreover, in XP , which signifies the installation of each security software was not only that key. Other keys and values seems to be defined in any other confidential location.
I appreciated that such keys are completely confidential in Vista or later.

Sincerely

niemiro · Jan 5, 2011

Hello!

I know there is a way. I know of a Vista compatible program which uses it. I think you just need to tap into WMI \root\SecurityCenter2

Otherwise, I think you can also do it using System.Management Namespace ()

I don't know what language you are using, but I am adament that there still is a way, by tapping into WMI.

Good luck!

Richard

Mitsuhiro · Jan 5, 2011

Thank you very much Richard.
But my PC seems not to have such registry key.
It may not be a registry key. Could you please tell me where it is ?

niemiro · Jan 6, 2011

Hello!

What language are you using? Is this from the installer? C++? That makes it slightly harder. I can tell you if there is a registry key this evening, but tapping into the registry is never the way intended by
Microsoft anyway. You need to tap into WMI. I am very bad with WMI, but is it not a SelectFrom case? Then you select from root\SecurityCenter2. Be aware that XP taps into root\SecurityCenter, and they give the results in a subtly different format. I will see if I can find some links and stuff later today

Mitsuhiro · Jan 6, 2011

Dear Richard.
Thank you very much for many times.
Yes. I hope to access this registry key from Installer which is made by InstallShield.
Unfortunately, InstallShield can not treat WMI.
So, I hope this registry key to be accessible from Windows's registry editor.

But, by your help, I appreciated that I can access those information via WMI.
I will try to imprement such logic in other way.

Sincerely.

niemiro · Jan 6, 2011

Hello!

I am not actually at a computer with access to the registry. Earlier, I was travelling with an iPhone, now at a workplace computer. Neither are ideal. I can check this this evening, but have a look around [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] That is the only place that I know of off hand which may have what you need. I see your predicament. WMI is nice, but not feasable. Here is what comes out of WMI, see if you can get what you need from that registy key:

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
AV: AVG *On-access scanning disabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

Good luck!

Richard

Mitsuhiro · Jan 6, 2011

Thank you Richard.
I greatly appreciate your kindly help.

Yes. The key [HKLM\...\Security Center\Monitoring] is just the location I posted first time. In XP, it had much information, but now in Vista no longer has any information.

I will try to tap into WMI.

Regards.

niemiro · Jan 6, 2011

Hello!

Oh, you did find that key. Hmmm. I guess you have to tap into WMI, or via System.Management in that case.

Sorry that I couldn't be of more help, but that key only contains half of WMI anyway, so is being phased out, I guess. Difficult question in install sheild.

Sorry again,

Richard

Mitsuhiro · Jan 6, 2011

Hello Richard.
Thank you as usual.
I tried WMI from VBScript.
But, the key [root\SecurityCenter2] may be wrong.
I tried the script below. It does work in XP (root\SecurityCenter).
Of course, I am searching the answer solory, but I am not familiar with WMI yet.
I you have any information, I hope your help.

---------
Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2")
Set colItems = oWMI.ExecQuery("Select * from AntiVirusProduct")
For Each objAntiVirusProduct In colItems
msg = msg & "companyName: " & objAntiVirusProduct.companyName & vbCrLf
msg = msg & "displayName: " & objAntiVirusProduct.displayName & vbCrLf
msg = msg & "instanceGuid: " & objAntiVirusProduct.instanceGuid & vbCrLf
msg = msg & "onAccessScanningEnabled: " & objAntiVirusProduct.onAccessScanningEnabled & vbCrLf
msg = msg & "productUptoDate: " & objAntiVirusProduct.productUptoDate & vbCrLf
msg = msg & "versionNumber: " & objAntiVirusProduct.versionNumber & vbCrLf
msg = msg & vbCrLf
Next
WScript.Echo msg
----------

This script is described in : http://social.msdn.microsoft.com/Fo...y/thread/bd97d9e6-75c1-4f58-9573-9009df5de19b

Mitsuhiro · Jan 7, 2011

Sorry.
It was merely some properties are also phased out.
companyName, onAccess.., productUptoDate, versionNumber are phased out.
After commented out some codes accessing those properties, it did work correctly.

Thanks.

The registry key of Security Center\Monitoring has been removed.

My Computer

Account Suspended

My Computer

My Computer

Banned

My Computer

My Computer

Banned

My Computer

My Computer

Banned

My Computer

My Computer

Banned

My Computer

My Computer

My Computer