mike1210

Hello all,
In my place we are looking to shift Anti-Virus Suppliers from Symantec to Kaspersky. The Kaspersky console is great as is the Anti-Virus package itself however my problem lies in deployment. Kaspersky recommend the product (Anti-Virus and a Network Agent for central managment) be deployed either by the console or GPO.

I've tried via scripts to uninstall Symantec and then install Kaspersky then reboot after a certain time but these have only worked on occasion, Kaspersky themselves state that scripts are unreliable for deploying KAV.

Onto the group policy method - this works great using the assigned method. Place configs with MSI file - Apply to OU - Reboot machine - message comes up on screen saying av is installing - Job done

This would work great on a clean machine however Symantec is installed on all the machines and installing both on the same machine is not pretty in the slightest........it grinds to a halt

My question is how would you go about this. I would like to involve support staff as little as possible and automate the process (users may be mailed to re-boot thier machine)

I know startup scripts and logoff scripts can be applied via GPO. My latest thinking is a log off script to unistall Symantec and packages applied via GPO. Ideally an if exist goto flag would need to be applied so the package does not install if Symantec exists

mike1210

I think a WMI filter may be able to kind of do this but at the moment I don't understand them fully. When Symantec is uninstalled an enviroment variable is set. The maybe the WMI filter looks for that variable and knows if to run the KAV deployment, anyone done much with WMI filters?

I have found a tool called scriptomatic version 2

using the win32 enviroment template i get this

On Error Resume Next
Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20
arrComputers = Array("%ComputerName%")
For Each strComputer In arrComputers
WScript.Echo
WScript.Echo "=========================================="
WScript.Echo "Computer: " & strComputer
WScript.Echo "=========================================="
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Environment", "WQL", _
wbemFlagReturnImmediately + wbemFlagForwardOnly)
For Each objItem In colItems
WScript.Echo "Caption: " & objItem.Caption
WScript.Echo "Description: " & objItem.Description
WScript.Echo "InstallDate: " & WMIDateStringToDate(objItem.InstallDate)
WScript.Echo "Name: " & objItem.Name
WScript.Echo "Status: " & objItem.Status
WScript.Echo "SystemVariable: " & objItem.AVTEST
WScript.Echo "UserName: " & objItem.UserName
WScript.Echo "VariableValue: " & objItem.KASPERSKYLAB
WScript.Echo
Next
Next

Function WMIDateStringToDate(dtmDate)
WScript.Echo dtm:
WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
& " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function

AVTEST and KASPERSKY lab were added by myself ideally the policy should only run if this condition exists, but I'm no good with VB