Third-party antivirus reporting and remote removal
P
Pawel Bryndza
Would it be possible to bring the antivirus information currently available on individual device pages into the main endpoint table and reports?
During antivirus migrations, it would be really helpful to see which devices still have another antivirus installed alongside Microsoft Defender, what the product is, and whether it is active, inactive or disabled. Being able to filter and export this information across organisations would make it much easier to identify incomplete removals and preinstalled antivirus products that need attention.
Could the table and reports also include the device’s last operating system restart time, ideally with uptime? This would help us identify computers that have not restarted since an antivirus was removed and understand whether remaining components are waiting for a restart.
Another useful addition would be the ability to remotely uninstall supported third-party antivirus products through the Huntress agent, either on individual devices or in bulk, without automatically restarting them.
It would help if the results could distinguish between a completed removal, a restart being required, further cleanup being needed after restart, and an actual failure. Where supported, could that follow-up cleanup resume silently after the user restarts the computer?
Would it also be possible to make the inventory, antivirus status, last restart information and removal results available through the Huntress API? We would like to connect this to our reporting tools, potentially through an MCP server, to generate reports and track migration progress. API access to supported removal actions would also be useful, with appropriate permissions and audit logging.