How to prevent ‘Real-Time Protection’ auto disabling on FortiClient Endpoint Machine due to third party antivirus conflict

This article describes that when another antivirus (apart from Windows Defender) is registered in the Windows Security Center, during uninstallation, antiviruses should deregister themselves from the Windows Security Center, but some of them do not do it and this makes Windows and other antiviruses think that there is antivirus is already installed on the machine.

To avoid potential issues, when another antivirus is registered in the Windows Security Center, the FortiClient real-time scan is disabled automatically.

Scope

FortiClient, Windows.

Solution

To check the antiviruses registered in the Windows Security Center, run this command on PowerShell:

Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct

To deregister a third-party antivirus from Windows Security Center, follow one of these options (the third-party antivirus must have been uninstalled before:

Step 1: Get the instanceGUID of the third-party antivirus:

'Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct'.

Deregister the third-party antivirus:

Get-WmiObject -ClassName 'AntivirusProduct' -NameSpace 'root\securityCenter2' | Where-Object {$_.instanceGuid -Match '{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}' | Remove-WmiObject <----- Where {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} is the instanceGuid of the third-party antivirus.

Step 2: WBEMTest:

1. Open WBEMTEST.
2. Connect to root\SecurityCenter2.
3. Remove the instanceGuid of the third-party antivirus as shown in the attached screenshot.