#https://mcpforlife.com/2020/04/14/how-to-resolve-this-state-value-of-av-providers/
#https://github.com/wortell/PSHelpers/blob/main/src/Public/Add-ProductStates.ps1
#Call with optional paramater "-antivirusName AntivirusNameHere" in order to check for a specific antivirus
#antivirusName must match the "displayName" exactly
#If no antivirusName parameter is specified, the tool returns success if there is any active up to date antivirus on the system


param($antivirusName = "*")


[Flags()] enum ProductState 
{
    Off         = 0x0000
    On          = 0x1000
    Snoozed     = 0x2000
    Expired     = 0x3000
}

[Flags()] enum SignatureStatus
{
    UpToDate     = 0x00
    OutOfDate    = 0x10
}

[Flags()] enum ProductOwner
{
    NonMs        = 0x000
    Windows      = 0x100
}

[Flags()] enum ProductFlags
{
   SignatureStatus = 0x000000F0
   ProductOwner    = 0x00000F00
   ProductState    = 0x0000F000
}

function Add-ProductStates {
    [CmdletBinding()]
    param (
        # This parameter can be passed from pipeline and can contain and array of collections that contain State or productstate members
        [Parameter(ValueFromPipeline)]
        [Microsoft.Management.Infrastructure.CimInstance[]]
        $Products,
        # Product State contains a value (DWORD) that contains multiple bitflags and we use the productState flag (0000F000)
        [Parameter(Position = 0, ValueFromPipelineByPropertyName, ValueFromPipeline, HelpMessage = "The value (DWORD) containing the bitflags.")]
        [Alias("STATE")]
        [UInt32]$ProductState
    )

    begin {
        $results = $null
    }
    
    process {
        If ($Products -is [array]) {
            If ($Products.Count -gt 0) {
                If (Get-Member -inputobject $Products[0] -name "productState" -Membertype Properties) {
                    $results += $Products.PSObject.Copy()
                    foreach ($item in $Products) {
                        If($results.Where({$_.instanceGuid -eq $item.instanceGuid}).Properties.name -notmatch "state") {                       
                            $results.Where({$_.instanceGuid -eq $item.instanceGuid}) | 
                                Add-Member -NotePropertyName state -NotePropertyValue $([ProductState]($item.productState -band [ProductFlags]::ProductState))
                        }
                        else {
                            Write-Error 'Could not add state property it already exists...'
                        }
                        If($results.Where({$_.instanceGuid -eq $item.instanceGuid}).Properties.name -notmatch "signatureStatus") {                       
                            $results.Where({$_.instanceGuid -eq $item.instanceGuid}) | 
                                Add-Member -NotePropertyName signatureStatus -NotePropertyValue $([SignatureStatus]($item.productState -band [ProductFlags]::SignatureStatus))
                        }
                        else {
                            Write-Error 'Could not add signatureStatus property it already exists...'
                        }
                    }
                }
            }
        }
        If ($ProductState -and (-not $Products)) {
            If($results.Properties.name -notmatch "enabled") {
                $results += New-Object PSObject -Property @{
                        state = $([ProductState]($item.productState -band [ProductFlags]::ProductState))
                        signatureStatus = $([SignatureStatus]($item.productState -band [ProductFlags]::SignatureStatus))
                }
            }
        }
    }
    
    end {
        If($results) {
            return $results
        }
    }
}


$return = Get-CimInstance -Namespace root/SecurityCenter2 -className AntivirusProduct | 
     Where-Object { 
         ($_.displayName -like $antivirusName) -and
         (($_.productState -band [ProductFlags]::ProductState) -eq [ProductState]::On) -and 
         (($_.productState -band [ProductFlags]::SignatureStatus) -eq [SignatureStatus]::UpToDate) 
     } 

Write-Host "Antivirus selection: $antivirusName"
if ($return) {
  Write-Host "Antivirus active and up to date"      
  $return
} else { 
  Write-Host "Antivirus issue!"
  Get-CimInstance -Namespace root/SecurityCenter2 -className AntivirusProduct | Add-ProductStates
  exit 1 
}