Get-InstalledAntivirus

<#
.SYNOPSIS
    Reports registered antivirus product and protection status per device.

.DESCRIPTION
    Queries the Windows Security Center provider for every managed
    Windows device to report which antivirus product is registered,
    whether real time protection is on, and whether definitions are up
    to date, the same data source Windows Security itself reads from.

.EXAMPLE
    .\Get-InstalledAntivirus.ps1

.NOTES
    Run locally on each device, or wrap with Invoke-Command / an Intune
    remediation script for fleet wide collection. Requires local admin
    rights to query the SecurityCenter2 WMI namespace.

.AUTHOR
    Shehryar Hassan
#>

[Flags()] enum ProductState {
    Off      = 0x0000
    On       = 0x1000
    Snoozed  = 0x2000
    Expired  = 0x3000
}

$products = Get-CimInstance -Namespace "root\SecurityCenter2" -ClassName AntiVirusProduct -ErrorAction SilentlyContinue

if (-not $products) {
    Write-Warning "No antivirus product registered with Windows Security Center on this machine."
    return
}

foreach ($product in $products) {
    $state = [int]$product.productState
    $realTimeOn = ($state -band 0x1000) -eq 0x1000
    $upToDate = ($state -band 0x10) -ne 0x10

    [pscustomobject]@{
        ProductName      = $product.displayName
        RealTimeProtection = $realTimeOn
        DefinitionsUpToDate = $upToDate
    } | Format-List
}