MSFT_MpComputerStatus

$LastFullScanSource_map = @{
      0 = 'Unknown'
      1 = 'User'
      2 = 'System'
      3 = 'Real-time'
      4 = 'IOAV'
}

switch([int]$value)
{
  0          {'Unknown'}
  1          {'User'}
  2          {'System'}
  3          {'Real-time'}
  4          {'IOAV'}
  default    {"$value"}
}

Enum EnumLastFullScanSource
{
  Unknown     = 0
  User        = 1
  System      = 2
  Real_time   = 3
  IOAV        = 4
}

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "LastFullScanSource" to friendly text

  Note: to use other properties than "LastFullScanSource", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "LastFullScanSource" 
# to translate other properties, use their translation table instead
$LastFullScanSource_map = @{
      0 = 'Unknown'
      1 = 'User'
      2 = 'System'
      3 = 'Real-time'
      4 = 'IOAV'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "LastFullScanSource", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$LastFullScanSource = @{
  Name = 'LastFullScanSource'
  Expression = {
    # property is an array, so process all values
    $value = $_.LastFullScanSource
    $LastFullScanSource_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "LastFullScanSource". The latter
# is defined by the hashtable in $LastFullScanSource: 
Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -Property Caption, $LastFullScanSource

# ...or dump content of property LastFullScanSource:
$friendlyValues = Get-CimInstance -Class MSFT_MpComputerStatus | 
    Select-Object -Property $LastFullScanSource |
    Select-Object -ExpandProperty LastFullScanSource

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "MSFT_MpComputerStatus" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "MSFT_MpComputerStatus", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "MSFT_MpComputerStatus" 
# to translate other properties, use their translation table instead
$LastFullScanSource_map = @{
      0 = 'Unknown'
      1 = 'User'
      2 = 'System'
      3 = 'Real-time'
      4 = 'IOAV'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.LastFullScanSource  

# translate raw value to friendly text:
$friendlyName = $LastFullScanSource_map[[int]$rawValue]

# output value
$friendlyName

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "LastFullScanSource" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "LastFullScanSource", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "LastFullScanSource", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$LastFullScanSource = @{
  Name = 'LastFullScanSource'
  Expression = {
    # property is an array, so process all values
    $value = $_.LastFullScanSource
    
    switch([int]$value)
      {
        0          {'Unknown'}
        1          {'User'}
        2          {'System'}
        3          {'Real-time'}
        4          {'IOAV'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | 
  # ...and output properties "Caption" and "LastFullScanSource". The latter is defined
  # by the hashtable in $LastFullScanSource:
  Select-Object -Property Caption, $LastFullScanSource

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "MSFT_MpComputerStatus", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumLastFullScanSource
{
  Unknown     = 0
  User        = 1
  System      = 2
  Real_time   = 3
  IOAV        = 4
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.LastFullScanSource

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **LastFullScanSource** 
[EnumLastFullScanSource]$rawValue 

# get a comma-separated string:
[EnumLastFullScanSource]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumLastFullScanSource]
#endregion

$LastQuickScanSource_map = @{
      0 = 'Unknown'
      1 = 'User'
      2 = 'System'
      3 = 'Real-time'
      4 = 'IOAV'
}

switch([int]$value)
{
  0          {'Unknown'}
  1          {'User'}
  2          {'System'}
  3          {'Real-time'}
  4          {'IOAV'}
  default    {"$value"}
}

Enum EnumLastQuickScanSource
{
  Unknown     = 0
  User        = 1
  System      = 2
  Real_time   = 3
  IOAV        = 4
}

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "LastQuickScanSource" to friendly text

  Note: to use other properties than "LastQuickScanSource", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "LastQuickScanSource" 
# to translate other properties, use their translation table instead
$LastQuickScanSource_map = @{
      0 = 'Unknown'
      1 = 'User'
      2 = 'System'
      3 = 'Real-time'
      4 = 'IOAV'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "LastQuickScanSource", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$LastQuickScanSource = @{
  Name = 'LastQuickScanSource'
  Expression = {
    # property is an array, so process all values
    $value = $_.LastQuickScanSource
    $LastQuickScanSource_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "LastQuickScanSource". The latter
# is defined by the hashtable in $LastQuickScanSource: 
Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -Property Caption, $LastQuickScanSource

# ...or dump content of property LastQuickScanSource:
$friendlyValues = Get-CimInstance -Class MSFT_MpComputerStatus | 
    Select-Object -Property $LastQuickScanSource |
    Select-Object -ExpandProperty LastQuickScanSource

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "MSFT_MpComputerStatus" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "MSFT_MpComputerStatus", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "MSFT_MpComputerStatus" 
# to translate other properties, use their translation table instead
$LastQuickScanSource_map = @{
      0 = 'Unknown'
      1 = 'User'
      2 = 'System'
      3 = 'Real-time'
      4 = 'IOAV'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.LastQuickScanSource  

# translate raw value to friendly text:
$friendlyName = $LastQuickScanSource_map[[int]$rawValue]

# output value
$friendlyName

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "LastQuickScanSource" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "LastQuickScanSource", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "LastQuickScanSource", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$LastQuickScanSource = @{
  Name = 'LastQuickScanSource'
  Expression = {
    # property is an array, so process all values
    $value = $_.LastQuickScanSource
    
    switch([int]$value)
      {
        0          {'Unknown'}
        1          {'User'}
        2          {'System'}
        3          {'Real-time'}
        4          {'IOAV'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | 
  # ...and output properties "Caption" and "LastQuickScanSource". The latter is defined
  # by the hashtable in $LastQuickScanSource:
  Select-Object -Property Caption, $LastQuickScanSource

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "MSFT_MpComputerStatus", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumLastQuickScanSource
{
  Unknown     = 0
  User        = 1
  System      = 2
  Real_time   = 3
  IOAV        = 4
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.LastQuickScanSource

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **LastQuickScanSource** 
[EnumLastQuickScanSource]$rawValue 

# get a comma-separated string:
[EnumLastQuickScanSource]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumLastQuickScanSource]
#endregion

$RealTimeScanDirection_map = @{
      0 = 'Both'
      1 = 'Incoming'
      2 = 'Outcoming'
}

switch([int]$value)
{
  0          {'Both'}
  1          {'Incoming'}
  2          {'Outcoming'}
  default    {"$value"}
}

Enum EnumRealTimeScanDirection
{
  Both        = 0
  Incoming    = 1
  Outcoming   = 2
}

<# 
  this example uses a hashtable to translate raw numeric values for 
  property "RealTimeScanDirection" to friendly text

  Note: to use other properties than "RealTimeScanDirection", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "RealTimeScanDirection" 
# to translate other properties, use their translation table instead
$RealTimeScanDirection_map = @{
      0 = 'Both'
      1 = 'Incoming'
      2 = 'Outcoming'
}

#endregion define hashtable

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "RealTimeScanDirection", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$RealTimeScanDirection = @{
  Name = 'RealTimeScanDirection'
  Expression = {
    # property is an array, so process all values
    $value = $_.RealTimeScanDirection
    $RealTimeScanDirection_map[[int]$value]
  }  
}
#endregion define calculated property

# retrieve the instances, and output the properties "Caption" and "RealTimeScanDirection". The latter
# is defined by the hashtable in $RealTimeScanDirection: 
Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -Property Caption, $RealTimeScanDirection

# ...or dump content of property RealTimeScanDirection:
$friendlyValues = Get-CimInstance -Class MSFT_MpComputerStatus | 
    Select-Object -Property $RealTimeScanDirection |
    Select-Object -ExpandProperty RealTimeScanDirection

# output values
$friendlyValues

# output values as comma separated list
$friendlyValues -join ', '

# output values as bullet list
$friendlyValues | ForEach-Object { "- $_" }

<# 
  this example uses a hashtable to manually translate raw numeric values 
  for property "MSFT_MpComputerStatus" to friendly text. This approach is ideal when
  there is just one instance to work with.

  Note: to use other properties than "MSFT_MpComputerStatus", look up the appropriate 
  translation hashtable for the property you would like to use instead.
#>

#region define hashtable to translate raw values to friendly text

# Please note: this hashtable is specific for property "MSFT_MpComputerStatus" 
# to translate other properties, use their translation table instead
$RealTimeScanDirection_map = @{
      0 = 'Both'
      1 = 'Incoming'
      2 = 'Outcoming'
}

#endregion define hashtable

# get one instance:
$instance = Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to illustrate
  the number-to-text translation. To process all instances, replace
  "Select-Object -First 1" with a "Foreach-Object" loop, and use
  the iterator variable $_ instead of $instance
#>

# query the property
$rawValue = $instance.RealTimeScanDirection  

# translate raw value to friendly text:
$friendlyName = $RealTimeScanDirection_map[[int]$rawValue]

# output value
$friendlyName

<# 
  this example uses a switch clause to translate raw numeric 
  values for property "RealTimeScanDirection" to friendly text. The switch
  clause is embedded into a calculated property so there is
  no need to refer to external variables for translation.

  Note: to use other properties than "RealTimeScanDirection", look up the appropriate 
  translation switch clause for the property you would like to use instead.
#>

#region define calculated property (to be used with Select-Object)

<#
  a calculated property is defined by a hashtable with keys "Name" and "Expression"
  "Name" defines the name of the property (in this example, it is "RealTimeScanDirection", but you can rename it to anything else)
  "Expression" defines a scriptblock that calculates the content of this property
  in this example, the scriptblock uses the hashtable defined earlier to translate each numeric
  value to its friendly text counterpart:
#>
 
$RealTimeScanDirection = @{
  Name = 'RealTimeScanDirection'
  Expression = {
    # property is an array, so process all values
    $value = $_.RealTimeScanDirection
    
    switch([int]$value)
      {
        0          {'Both'}
        1          {'Incoming'}
        2          {'Outcoming'}
        default    {"$value"}
      }
      
  }  
}
#endregion define calculated property

# retrieve all instances...
Get-CimInstance -ClassName MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | 
  # ...and output properties "Caption" and "RealTimeScanDirection". The latter is defined
  # by the hashtable in $RealTimeScanDirection:
  Select-Object -Property Caption, $RealTimeScanDirection

<# 
  this example translates raw values by means of type conversion
  the friendly names are defined as enumeration using the
  keyword "enum" (PowerShell 5 or better)
  
  The raw value(s) are translated to friendly text by 
  simply converting them into the enum type.
  
  Note: to use other properties than "MSFT_MpComputerStatus", look up the appropriate 
  enum definition for the property you would like to use instead.
#>


#region define enum with value-to-text translation:
Enum EnumRealTimeScanDirection
{
  Both        = 0
  Incoming    = 1
  Outcoming   = 2
}

#endregion define enum

# get one instance:
$instance = Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -First 1

<#
  IMPORTANT: this example processes only one instance to focus on
  the number-to-text type conversion. 
  
  To process all instances, replace   "Select-Object -First 1" 
  with a "Foreach-Object" loop, and use the iterator variable 
  $_ instead of $instance
#>

# query the property:
$rawValue = $instance.RealTimeScanDirection

#region using strict type conversion

<#
  Note: strict type conversion fails if the raw value is 
  not defined by the enum. So if the list of allowable values
  was extended and the enum does not match the value,
  an exception is thrown
#>

# convert the property to the enum **RealTimeScanDirection** 
[EnumRealTimeScanDirection]$rawValue 

# get a comma-separated string:
[EnumRealTimeScanDirection]$rawValue -join ',' 
#endregion

#region using operator "-as"

<#
  Note: the operator "-as" accepts values not defined
  by the enum and returns $null instead of throwing
  an exception
#>

$rawValue -as [EnumRealTimeScanDirection]
#endregion

Get-CimInstance -ClassName MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender

Get-CimInstance -ClassName MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender -Property *

Get-CimInstance -ClassName MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender -KeyOnly

$properties = 'AMEngineVersion',
              'AMProductVersion',
              'AMServiceEnabled',
              'AMServiceVersion',
              'AntispywareEnabled',
              'AntispywareSignatureAge',
              'AntispywareSignatureLastUpdated',
              'AntispywareSignatureVersion',
              'AntivirusEnabled',
              'AntivirusSignatureAge',
              'AntivirusSignatureLastUpdated',
              'AntivirusSignatureVersion',
              'BehaviorMonitorEnabled',
              'ComputerID',
              'ComputerState',
              'FullScanAge',
              'FullScanEndTime',
              'FullScanStartTime',
              'IoavProtectionEnabled',
              'LastFullScanSource',
              'LastQuickScanSource',
              'NISEnabled',
              'NISEngineVersion',
              'NISSignatureAge',
              'NISSignatureLastUpdated',
              'NISSignatureVersion',
              'OnAccessProtectionEnabled',
              'QuickScanAge',
              'QuickScanEndTime',
              'QuickScanStartTime',
              'RealTimeProtectionEnabled',
              'RealTimeScanDirection'
Get-CimInstance -ClassName MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender | Select-Object -Property $properties

Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender -Property $property | 
Select-Object -Property $property

Get-CimInstance -Class MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender -Filter 'Caption LIKE "a%"' 

Get-CimInstance -Query "SELECT ComputerID, NISSignatureAge, QuickScanAge, NISEngineVersion FROM MSFT_MpComputerStatus WHERE Caption LIKE 'a%'" -Namespace root/microsoft/windows/defender

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with your current identity:
$result = Get-CimInstance -ClassName MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender -ComputerName $list 
$result

# one or more computer names or IP addresses:
$list = 'server1', 'server2'

# authenticate with a different identity:
$cred = Get-Credential -Message 'Authenticate to retrieve WMI information:'
$session = New-CimSession -ComputerName $list -Credential $cred

$result = Get-CimInstance MSFT_MpComputerStatus -Namespace root/microsoft/windows/defender -CimSession $session

# remove the session after use (if you do not plan to re-use it later)
Remove-CimSession -CimSession $session

$result