# Title: Security Software and Configuration Audit Script

Write-Host "Starting Security Audit..." -ForegroundColor Green
Write-Host "-------------------------"

# Check installed antivirus using Get-WMIObject
Write-Host "Installed Antivirus Software:" -ForegroundColor Cyan
Get-WmiObject -Namespace "root\SecurityCenter2" -Query "SELECT * FROM AntiVirusProduct" | Select-Object displayName, productState

# Check Windows Firewall status
Write-Host "`nWindows Firewall Status:" -ForegroundColor Cyan
$firewallState = Get-NetFirewallProfile -Profile Domain,Public,Private | Select-Object Name, Enabled
$firewallState | ForEach-Object {
    Write-Host "Profile: $($_.Name), Enabled: $($_.Enabled)"
}

# Check for installed security software via registry
Write-Host "`nChecking Registry for Security Software:" -ForegroundColor Cyan
$registryPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
)

foreach ($path in $registryPaths) {
    Get-ChildItem $path | ForEach-Object {
        $displayName = (Get-ItemProperty $_.PSPath).DisplayName
        if ($displayName -match "security|antivirus|firewall|malware") {
            Write-Host "Found: $displayName"
        }
    }
}

# Check for running security processes
Write-Host "`nRunning Security Processes:" -ForegroundColor Cyan
$securityProcesses = Get-Process | Where-Object { $_.Path -match "security|antivirus|firewall|malware" }

if ($securityProcesses) {
    $securityProcesses | Select-Object Name, Description, Path | Format-Table -AutoSize
} else {
    Write-Host "No specific security-related processes found."
}

# Check Windows Defender status
Write-Host "`nWindows Defender Status:" -ForegroundColor Cyan
try {
    $defenderStatus = Get-Service -Name "WinDefend"
    Write-Host "Status: $($defenderStatus.Status)"
} catch {
    Write-Host "Windows Defender service not found."
}

Write-Host "`nSecurity Audit Completed!" -ForegroundColor Green

# Check for installed antivirus software
Write-Output "Checking for installed antivirus software..."
Get-CimInstance -Namespace "root\SecurityCenter2" -ClassName AntivirusProduct | ForEach-Object {
    Write-Output "Antivirus Name: $($_.displayName)"
    Write-Output "Path to Executable: $($_.pathToSignedProductExe)"
    Write-Output "State: $($_.productState)"
    Write-Output "----------------------------------------"
}

# Check Windows Firewall status
Write-Output "Checking Windows Firewall status..."
Get-NetFirewallProfile | ForEach-Object {
    Write-Output "$($_.Name) Profile:"
    Write-Output "Enabled: $($_.Enabled)"
    Write-Output "----------------------------------------"
}

# List running processes
Write-Output "Listing running processes potentially related to security software..."
$processes = Get-Process | Where-Object { $_.Description -like "*Security*" -or $_.Name -like "*av*" -or $_.Name -like "*firewall*" }
$processes | ForEach-Object {
    Write-Output "Process Name: $($_.Name)"
    Write-Output "Description: $($_.Description)"
    Write-Output "----------------------------------------"
}

# Search registry for installed security software
Write-Output "Searching the registry for installed security software..."
$securityRelatedKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
)

foreach ($key in $securityRelatedKeys) {
    Get-ChildItem -Path $key | ForEach-Object {
        $displayName = (Get-ItemProperty -Path $_.PSPath).DisplayName
        if ($displayName -and $displayName -match "(?i)security|antivirus|firewall") {
            Write-Output "Software: $displayName"
        }
    }
}

Write-Output "Script execution completed."

# Get installed security software by checking the Uninstall registry keys
function Get-InstalledSecuritySoftware {
    $registryPaths = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
    )
    
    $installedSoftware = @()
    
    foreach ($path in $registryPaths) {
        Get-ItemProperty $path | Where-Object {
            $_.DisplayName -like "*Antivirus*" -or 
            $_.DisplayName -like "*Security*" -or
            $_.DisplayName -like "*Firewall*"
        } | ForEach-Object {
            $installedSoftware += @{
                Name = $_.DisplayName
                Version = $_.DisplayVersion
                Publisher = $_.Publisher
            }
        }
    }
    
    $installedSoftware
}

# Get running security-related processes
function Get-RunningSecurityProcesses {
    $securityProcesses = Get-Process | Where-Object {
        $_.Name -like "*antivirus*" -or 
        $_.Name -like "*security*" -or
        $_.Name -like "*firewall*"
    } | Select-Object Name, Id, Description

    $securityProcesses
}

# Get Windows Defender status (if applicable)
function Get-WindowsDefenderStatus {
    Get-MpComputerStatus | Select-Object AMServiceEnabled, AMServiceVersion, AntispywareEnabled, AntivirusEnabled, NISEnabled, RealTimeProtectionEnabled
}

# Collect all security-related information
function Get-SecuritySummary {
    $result = @{}

    $result.InstalledSoftware = Get-InstalledSecuritySoftware
    $result.RunningProcesses = Get-RunningSecurityProcesses

    # Check if Windows Defender is present
    if (Get-Command "Get-MpComputerStatus" -ErrorAction SilentlyContinue) {
        $result.WindowsDefenderStatus = Get-WindowsDefenderStatus
    }

    return $result
}

# Execute the function to get the security summary and display it
$securitySummary = Get-SecuritySummary

# Display results
"Installed Security Software:"
$securitySummary.InstalledSoftware | Format-Table -AutoSize

"Running Security Processes:"
$securitySummary.RunningProcesses | Format-Table -AutoSize

"Windows Defender Status:"
$securitySummary.WindowsDefenderStatus | Format-List

# Script to gather information about security software on a Windows system

# Function to list installed security software from common registry locations
function Get-InstalledSecuritySoftware {
    Write-Host "Checking for installed security software..."

    $securityProducts = @()

    # Check specific registry keys for common security software installations
    $registryPaths = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
        "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall",
        "HKLM:\SOFTWARE\Microsoft\Windows Defender",
        "HKLM:\SOFTWARE\McAfee",
        "HKLM:\SOFTWARE\Symantec"
        # Add other paths as needed for different security software
    )

    foreach ($regPath in $registryPaths) {
        try {
            $securityProducts += Get-ChildItem -Path $regPath | ForEach-Object {
                $_.GetValue("DisplayName")
            } | Where-Object { $_ -ne $null }
        } catch {
            # Handle access denied or other issues gracefully
            Write-Host "Could not access registry path: $regPath"
        }
    }

    if ($securityProducts.Count -eq 0) {
        Write-Host "No security software found in registry."
    } else {
        Write-Host "Installed security software:"
        $securityProducts | ForEach-Object { Write-Host "`t$_" }
    }
}

# Function to list running processes related to security software
function Get-RunningSecurityProcesses {
    Write-Host "Checking for running security-related processes..."

    $securityProcessNames = @(
        "MsMpEng",  # Windows Defender
        "McAfee",   # McAfee
        "ccSvcHst", # Symantec
        "avp"       # Kaspersky
        # Add other process names as needed for different security software
    )

    $runningProcesses = Get-Process | Where-Object {
        $securityProcessNames -contains $_.Name
    }

    if ($runningProcesses.Count -eq 0) {
        Write-Host "No security-related processes are currently running."
    } else {
        Write-Host "Running security-related processes:"
        $runningProcesses | ForEach-Object {
            Write-Host "`t$($_.Name) - ID: $($_.Id)"
        }
    }
}

# Main execution starts here

Write-Host "Starting security software information check..."

Get-InstalledSecuritySoftware
Get-RunningSecurityProcesses

Write-Host "Security information check completed."

@echo off
echo Security Software and Configurations Check
echo ==========================================
echo.

rem Check installed security software via WMI
echo Installed Security Software:
wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /format:list
wmic /namespace:\\root\SecurityCenter2 path FirewallProduct get displayName /format:list
wmic /namespace:\\root\SecurityCenter2 path AntiSpywareProduct get displayName /format:list
echo.

rem Check common security software paths (customize paths as necessary)
echo Security Software in Common Directories:
dir "C:\Program Files" /b | findstr /I "antivirus firewall security"
dir "C:\Program Files (x86)" /b | findstr /I "antivirus firewall security"
echo.

rem Check relevant Registry paths for installed software
echo Registry Installed Security Software:
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /I "DisplayName" | findstr /I "antivirus firewall security"
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr /I "DisplayName" | findstr /I "antivirus firewall security"
echo.

rem List running antivirus/processes (requires Tasklist)
echo Running Security Processes:
tasklist /v | findstr /I "antivirus firewall security"
echo.

rem Check Windows Defender status (might require admin privileges)
echo Windows Defender Status:
sc query windefend
echo.

echo Check Complete!
pause