Symantec Endpoint Protection Manager ersetzen durch Windows Defender

<?xml version="1.0" encoding="UTF-16"?>  
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">  
  <RegistrationInfo>
    <Author>yourdom\you</Author>
    <Description>Schickt Mails and die Admins, wenn Viren gefunden werden</Description>
    <URI>\Virus_Alert</URI>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-Windows Defender/Operational"&gt;&lt;Select Path="Microsoft-Windows-Windows Defender/Operational"&gt;*[System[Provider[@Name='Microsoft-Windows-Windows Defender'] and EventID=1116]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>  
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">  
      <UserId>S-1-5-18</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <Duration>PT10M</Duration>
      <WaitTimeout>PT1H</WaitTimeout>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">  
    <Exec>
      <Command>msg</Command>
      <Arguments>* Virenfund auf Ihrem PC! Bitte Admins informieren</Arguments>
    </Exec>
    <Exec>
      <Command>\\server\share\Blat\Blat.exe</Command>
      <Arguments>-install deinpc.deinedom deinpc$.deinedom</Arguments>
    </Exec>
    <Exec>
      <Command>powershell</Command>
      <Arguments>\\server\share\Defender\Virusevent.ps1</Arguments>
    </Exec>
    <Exec>
      <Command>\\server\share\Blat\Blat.exe</Command>
      <Arguments>"c:\windows\temp\virus.txt" -to virusalert@deine.dom -server deinmailserver -debug -timestamp -log blatSMTPlog.txt -subject "Virenfund"</Arguments>  
    </Exec>
  </Actions>
</Task>

$Event = Get-winevent -logname "Microsoft-Windows-Windows Defender/Operational"  
		    $Event | Where-Object {$_.id -eq 1116 -and $_.Timecreated -gt (Get-date).AddHours(-24)} |fl |findstr /v "ProviderName" | sls Name, Path, Pfad -context 0,1 | Out-File c:\windows\temp\virus.txt  
$Event = Get-winevent -logname "System"  
		    $Event | Where-Object {$_.id -eq 1116 -and $_.Timecreated -gt (Get-date).AddHours(-24)} |fl |findstr /v "ProviderName" | sls Name, Path, Pfad -context 0,1 | Out-File -append c:\windows\temp\virus.txt