Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Pester tests for Symantec Endpoint Protection to perform operational validation of configuration and health.
Param(
$SEPLatestVersion = "12.1.7"
)
Describe 'Symantec Endpoint Protection checks' {
Context 'SEP service checks' {
$SEPServices = @('SepMasterService','SmcService')
$SEPServices | ForEach-Object {
It "The $_ service should be running" {
(Get-Service $_).Status | Should Be 'Running'
}
}
}
Context 'SEP process checks' {
$SEPProcesses = @('smc','ccsvchst')
$SEPProcesses | ForEach-Object {
It "The $_ process should be running" {
Get-Process $_ | Should Be $true
}
}
}
Context 'SEP version check' {
$key = 'HKLM:\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC'
$SEPVersion = (Get-ItemProperty -Path $key -Name ProductVersion).ProductVersion
it "The installed SEP version $SEPVersion is at least $SEPLatestVersion" {
$SEPVersion | Should BeGreaterThan $SEPLatestVersion
}
}
Context 'SEP health checks' {
$key = 'HKLM:\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\public-opstate'
$SEPConfig = (Get-ItemProperty -Path $key)
$LastScan = get-date(($SEPConfig).LastSuccessfulScanDateTime)
It "The last successful scan was $LastScan and this should be within the last day" {
$LastScan | Should BeGreaterThan (get-date).adddays(-1)
}
$LatestVirusDefsDate = get-date(($SEPConfig).LatestVirusDefsDate)
It "The latest Virus Definitions are dated $(($LatestVirusDefsDate).ToString('dd-MM-yyyy')) and this should be within the last 3 days" {
$LatestVirusDefsDate | Should BeGreaterThan (get-date).adddays(-3)
}
It "The system should not be flagged as Infected" {
($SEPConfig).Infected | Should Be 0
}
It "Spyware Protection should be enabled" {
($SEPConfig).ASRunningStatus | Should Be 1
}
It "Virus Protection should be enabled" {
($SEPConfig).AVRunningStatus | Should Be 1
}
It "Firewall Protection should be enabled" {
($SEPConfig).FWRunningStatus | Should Be 1
}
It "System Network Access Control should be enabled" {
($SEPConfig).snac_enabled | Should Be 1
}
It "The product should not require a system reboot" {
($SEPConfig).RebootReason | Should Be 0
}
It 'The Quarantine folder should be empty' {
(Get-ChildItem 'C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine\').count | Should be 0
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment