Help with machine is using out of date antimalware client version in the organization script

[AmjadGov]

This is the script provided by Microsoft to know which machine is using out of date antimalware client version in the organization:

//check the antimalware client version
DeviceFileEvents
|where FileName == "MsMpEng.exe"
|where FolderPath contains @"C:\ProgramData\Microsoft\Windows Defender\Platform\"
|extend PlatformVersion=tostring(split(FolderPath, "\\", 5))
//|project DeviceName, PlatformVersion // check which machine is using legacy platformVersion
|summarize dcount(DeviceName) by PlatformVersion // check how many machines are using which platformVersion
|order by PlatformVersion desc

*********************************

I need to fine tune it to users at domain level, ie we have users in DfE from several domains, and I want to filter reporting back on just the one domain, so in the example in BOLD below, I wanted all users for 'contoso' domain, but results are ZERO, any ideas pls as to what I am doing wrong?

//check the antimalware client version
DeviceFileEvents
|where FileName == "MsMpEng.exe"
|where FolderPath contains @"C:\ProgramData\Microsoft\Windows Defender\Platform\"

| where InitiatingProcessAccountDomain == "contoso"

|extend PlatformVersion=tostring(split(FolderPath, "\\", 5))
//|project DeviceName, PlatformVersion // check which machine is using legacy platformVersion
|summarize dcount(DeviceName) by PlatformVersion // check how many machines are using which platformVersion
|order by PlatformVersion desc

[#2]

@AmjadGov

Please see if the below query works:

DeviceProcessEvents
|where FileName == "MsMpEng.exe"
|where FolderPath contains @"C:\ProgramData\Microsoft\Windows Defender\Platform\"
|where AccountDomain contains "contoso"
|extend PlatformVersion=tostring(split(FolderPath, "\\", 5))
|project DeviceName, PlatformVersion // check which machine is using legacy platformVersion
| where AccountDomain contains "bp") on PlatformVersion
|summarize dcount(DeviceName) by PlatformVersion // check how many machines are using which platformVersion
|order by PlatformVersion desc

[#3]

Hi @AnuragSrivastava,
Thanks for this, I noticed the extra line further down "| where AccountDomain contains "bp") on PlatformVersion" was that a typo?
I removed and tried, but no luck, btw the reason I had used 'InitiatingProcessAccountDomain' is because that field in a previous script displayed the domain that I was looking for.
Many Thanks

[#4]

@AmjadGov
That was just a dummy keyword for domain name. Presently I could also "nt authority" in the domain name field and not the actual domain name.

[#5 · Accepted solution]

That didn't work, but thanks for trying. I managed to find another way to fix the issue. As the device name also contains the UPN, I used the follow example to get it to work:
|where FileName == "MsMpEng.exe" and DeviceName contains "contoso"