> We used the old-fashion style 
> checks to construct a rule to make sure the service is 
> running (we just lower the priority of that one such that 
> none could fail it without having av software installed). 

Ok, but how about an AV-package like Grisoft (An example, there are 17
AV vendors supported now, but only 4 AV running rules) that is allowed
by both the installation and the Definitions rules, but does not have a
rule pre-built that checks if it's running?


> On the issue of subscriptions reporting that the software is 
> current, we view that as a "bug" with some av product 
> vendors. 

I'd very much agree with you their, I would consider this a bug.  I have
only tested the scenario with one vendor, McAfee, which I believe has
one of poorer implementations of AV.  (Any product that can be disabled
by breaking Internet Explorer does not seem very robust to me, but this
is my personal opinion)  I believe from memory that Symantec tells you
your subscription has expired at every liveupdate session.

One further Caveat I've noticed, the win98/ME support is almost
nonexistent, you might want to construct your rules accordingly on those
platforms. (I.E. not even check)