In SCCM 2012 R2, you can use following class.
Use SMS_CombinedDeviceResources.EPAntivirusSignatureLastVersion in WMI
E.g.
select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_CombinedDeviceResources on SMS_CombinedDeviceResources.ResourceID = SMS_R_System.ResourceID WHERE SMS_CombinedDeviceResources.EPAntivirusSignatureLastVersion = "1.175.841.0"
You can also build a query based on CI:
Note: you should create a CI and evaluted it first.
E.g.
select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_CI_ComplianceState on SMS_G_System_CI_ComplianceState.ResourceID = SMS_R_System.ResourceID WHERE SMS_G_System_CI_ComplianceState.CI_UniqueID = "518e5e65-06df-4662-b918-a604828c634f" AND SMS_G_System_CI_ComplianceState.IsDetected = 1
In SCCM 2007 SP2, you can use: SMS_G_System_PatchStatusEx class
select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_PatchStatusEx on SMS_G_System_PatchStatusEx.ResourceId = SMS_R_System.ResourceId where SMS_G_System_PatchStatusEx.Title = "Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.169.2635.0)" and LastStateName = "Install Verified"
原创： How to build a query based on Definition Updates installed,布布扣,bubuko.com
原创： How to build a query based on Definition Updates installed
原文：http://www.cnblogs.com/windbg/p/3761101.html