Bug: Windows Server Core does not correctly enumerate EDR and Windows Updates

[agentdr8]

Installed the agent on a CLI-based Windows Server 2022 Datacenter Core edition, which installed fine. But it does not properly detect Microsoft Defender Antivirus (which is installed by default) nor does it enumerate the Windows updates/patches that have been installed, nor does it detect the existing update policy.

Here's a snippet from the agent log file:

openuem-agent: 2026/04/15 04:46:43 [INFO]: agent is running a report...
openuem-agent: 2026/04/15 04:46:43 [INFO]: comshim added
openuem-agent: 2026/04/15 04:46:43 [INFO]: computer system info has been retrieved from WMI Win32_ComputerSystem
openuem-agent: 2026/04/15 04:46:43 [INFO]: serial number info has been retrieved from WMI Win32_Bios
openuem-agent: 2026/04/15 04:46:43 [INFO]: processor info has been retrieved from WMI Win32_Processor
openuem-agent: 2026/04/15 04:46:43 [INFO]: operating system information has been retrieved using WMI Win32_OperatingSystem
openuem-agent: 2026/04/15 04:46:43 [INFO]: current version has been retrieved from Windows Registry
openuem-agent: 2026/04/15 04:46:43 [INFO]: windows arch has been retrieved from Windows Registry
openuem-agent: 2026/04/15 04:46:44 [INFO]: could not get the owner of the explorer.exe process to get the username
openuem-agent: 2026/04/15 04:46:44 [INFO]: windows username has been retrieved from WMI Win32_Computer
openuem-agent: 2026/04/15 04:46:44 [INFO]: monitors information has been retrieved from WMI WmiMonitorID
openuem-agent: 2026/04/15 04:46:44 [INFO]: memory slots information has been retrieved from Win32_PhysicalMemory
openuem-agent: 2026/04/15 04:46:44 [ERROR]: could not run powershell to get printers, reason: There are no more files.
openuem-agent: 2026/04/15 04:46:44 [INFO]: printers information has been retrieved from WMI Win32_Printer
openuem-agent: 2026/04/15 04:46:44 [INFO]: shares information has been retrieved from WMI Win32_Share
openuem-agent: 2026/04/15 04:46:44 [ERROR]: could not get antivirus information from WMI AntiVirusProduct: Exception occurred. (Invalid namespace )
openuem-agent: 2026/04/15 04:46:44 [ERROR]: error retrieving antivirus info
openuem-agent: 2026/04/15 04:46:44 [INFO]: network adapters information has been retrieved from WMI Win32_NetworkAdapter
openuem-agent: 2026/04/15 04:46:44 [INFO]: apps information has been retrieved from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
openuem-agent: 2026/04/15 04:46:44 [INFO]: apps information has been retrieved from HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
openuem-agent: 2026/04/15 04:46:44 [INFO]: RustDesk is not available
openuem-agent: 2026/04/15 04:46:44 [INFO]: Netbird information has been retrieved
openuem-agent: 2026/04/15 04:46:44 [INFO]: could not find a supported VNC service
openuem-agent: 2026/04/15 04:46:44 [INFO]: physical disks information has been retrieved
openuem-agent: 2026/04/15 04:47:14 [ERROR]: could not get windows update status info information from wuapi: context deadline exceeded
openuem-agent: 2026/04/15 04:47:44 [ERROR]: could not get windows update status info information from wuapi: context deadline exceeded
openuem-agent: 2026/04/15 04:47:44 [ERROR]: could not get bitlocker status from WMI Win32_EncryptableVolume: Exception occurred. (Invalid namespace )
openuem-agent: 2026/04/15 04:47:44 [INFO]: logical disks information has been retrieved from WMI Win32_LogicalDisk
openuem-agent: 2026/04/15 04:47:44 [INFO]: comshim done
openuem-agent: 2026/04/15 04:47:44 [INFO]: agent report run took 1m0.9988294s

And some output from Powershell showing things are installed and running:

PS C:\> Get-WindowsFeature | Where-Object {$_.Name -like "*defender*"}

Display Name                                            Name                       Install State
------------                                            ----                       -------------
[X] Microsoft Defender Antivirus                        Windows-Defender               Installed

PS C:> get-mpcomputerstatus

AMEngineVersion                  : 1.1.26030.3008
AMProductVersion                 : 4.18.26030.3011
AMRunningMode                    : Normal
AMServiceEnabled                 : True
AMServiceVersion                 : 4.18.26030.3011
AntispywareEnabled               : True
AntispywareSignatureAge          : 1
AntispywareSignatureLastUpdated  : 4/14/2026 8:36:30 AM
AntispywareSignatureVersion      : 1.449.106.0
AntivirusEnabled                 : True
AntivirusSignatureAge            : 1
AntivirusSignatureLastUpdated    : 4/14/2026 8:36:30 AM
AntivirusSignatureVersion        : 1.449.106.0
BehaviorMonitorEnabled           : True
ComputerID                       : 8--------3--4-4--F-A--9-8---------5
ComputerState                    : 0
ControlledConfigurationState     : 0
DefenderSignaturesOutOfDate      : False
DeviceControlDefaultEnforcement  :
DeviceControlPoliciesLastUpdated : 12/31/1600 4:00:00 PM
DeviceControlState               : Disabled
FullScanAge                      : 4294967295
FullScanEndTime                  :
FullScanOverdue                  : False
FullScanRequired                 : False
FullScanSignatureVersion         :
FullScanStartTime                :
InitializationProgress           : ServiceStartedSuccessfully
IoavProtectionEnabled            : True
IsTamperProtected                : False
IsVirtualMachine                 : True
LastFullScanSource               : 0
LastQuickScanSource              : 2
NISEnabled                       : True
NISEngineVersion                 : 1.1.26030.3008
NISSignatureAge                  : 1
NISSignatureLastUpdated          : 4/14/2026 8:36:30 AM
NISSignatureVersion              : 1.449.106.0
OnAccessProtectionEnabled        : True
ProductStatus                    : 524288
QuickScanAge                     : 0
QuickScanEndTime                 : 4/15/2026 4:10:04 AM
QuickScanOverdue                 : False
QuickScanSignatureVersion        : 1.449.106.0
QuickScanStartTime               : 4/15/2026 4:08:47 AM
RealTimeProtectionEnabled        : True
RealTimeScanDirection            : 0
RebootRequired                   : False
SmartAppControlExpiration        :
SmartAppControlState             : Off
TamperProtectionSource           : Signatures
TroubleShootingDailyMaxQuota     :
TroubleShootingDailyQuotaLeft    :
TroubleShootingEndTime           :
TroubleShootingExpirationLeft    :
TroubleShootingMode              :
TroubleShootingModeSource        :
TroubleShootingQuotaResetTime    :
TroubleShootingStartTime         :
PSComputerName                   :

Installed hotfixes:

PS C:\> get-hotfix | Sort-Object InstalledOn

Source        Description      HotFixID      InstalledBy          InstalledOn
------        -----------      --------      -----------          -----------
W-----------2 Security Update  KB5078763     NT AUTHORITY\SYSTEM  4/11/2026 12:00:00 AM
W-----------2 Security Update  KB5078766     NT AUTHORITY\SYSTEM  4/11/2026 12:00:00 AM
W-----------2 Update           KB5066139     L------\------       4/11/2026 12:00:00 AM

[doncicuto]

Thank you @agentdr8, I haven't tested OpenUEM against Windows Server Core, so this report is helpful and full of detail.

As the log shows it seems that the WMI queries used by the agent for antivirus and updates are not supported by Windows Server. I'll try to add a fallback that uses PowerShell to get that information and reports it back to the agent

I'll ping you as soon as I get a working agent that fixes this issue so you can test it