Pester tests for Symantec Endpoint Protection to perform operational validation of configuration and health.

SEP.tests.ps1

Param(
    $SEPLatestVersion = "12.1.7"
)

Describe 'Symantec Endpoint Protection checks' {

    Context 'SEP service checks' {

        $SEPServices = @('SepMasterService','SmcService')

        $SEPServices | ForEach-Object {
            It "The $_ service should be running" {
                (Get-Service $_).Status | Should Be 'Running'
            }
        }
    }

    Context 'SEP process checks' {

        $SEPProcesses = @('smc','ccsvchst')

        $SEPProcesses | ForEach-Object {
            It "The $_ process should be running" {
                Get-Process $_ | Should Be $true
            }
        }
    }

    Context 'SEP version check' {
        
        $key = 'HKLM:\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC'
        $SEPVersion = (Get-ItemProperty -Path $key -Name ProductVersion).ProductVersion

        it "The installed SEP version $SEPVersion is at least $SEPLatestVersion" {
            $SEPVersion | Should BeGreaterThan $SEPLatestVersion
        }
    }

    Context 'SEP health checks' {
        
        $key = 'HKLM:\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\public-opstate'
        $SEPConfig = (Get-ItemProperty -Path $key)
        
        $LastScan = get-date(($SEPConfig).LastSuccessfulScanDateTime)
        
        It "The last successful scan was $LastScan and this should be within the last day" {
            $LastScan | Should BeGreaterThan (get-date).adddays(-1)
        }

        $LatestVirusDefsDate = get-date(($SEPConfig).LatestVirusDefsDate)

        It "The latest Virus Definitions are dated $(($LatestVirusDefsDate).ToString('dd-MM-yyyy')) and this should be within the last 3 days" {
            $LatestVirusDefsDate | Should BeGreaterThan (get-date).adddays(-3)
        }
                
        It "The system should not be flagged as Infected" {
            ($SEPConfig).Infected | Should Be 0
        }

        It "Spyware Protection should be enabled" {
            ($SEPConfig).ASRunningStatus | Should Be 1
        }

        It "Virus Protection should be enabled" {
            ($SEPConfig).AVRunningStatus | Should Be 1
        }

        It "Firewall Protection should be enabled" {
            ($SEPConfig).FWRunningStatus | Should Be 1
        }

        It "System Network Access Control should be enabled" {
            ($SEPConfig).snac_enabled | Should Be 1
        }

        It "The product should not require a system reboot" {
            ($SEPConfig).RebootReason | Should Be 0
        }

        It 'The Quarantine folder should be empty' {
            (Get-ChildItem 'C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine\').count | Should be 0
        }
    }
}