Did anyone manage to figure out a simple powershell-incantation to figure out if a system is properly patched/secure? https://technet.microsoft.com/en-us/libra

Did anyone manage to figure out a simple powershell-incantation to figure out if a system is properly patched/secure? https://technet.microsoft.com/en-us/library/security/4022344 https://technet.microsoft.com/en-us/library/security/4022344 Simply lists: "Verify that the update is installed Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products. For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in Microsoft Knowledge Base Article 2510781. For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.10701.0 or later." As far as I can figure out, if: Get-MpComputerStatus|where -Property AMEngineVersion -ge [version]1.1.10701.0|select AMEngineVersion prints something like: AMEngineVersion --------------- 1.1.13704.0 according to MS one should be patched-up and good to go? (The command should print nothing on vulnerable systems). However a hyper-vm last patched before Christmas (it's not networked), lists it's version as: 1.1.12805.0 -- which certainly seems to be a higher version than 1.1.10701.0? I'll also note that using "[version]x.y.z.a" apparently does not force some kind of magic "version compare"-predicate, based on some simple tests. Any powershell gurus that'd care to share a one-liner to check if one has the relevant patches installed? Am I looking at the wrong property?