Verify which Endpoint Protection client type is installed

Products

• Endpoint Protection

Issue/Introduction

Steps to identify which type of Symantec Endpoint Protection (SEP) client is installed on a particular machine. 

Resolution

There are three types of clients in SEP 14.x.

1. Standard Client
2. Embedded/VDI Client
3. Dark network Client 

• On the Client side:

SEP UI --> Help --> Troubleshooting --> Install Settings

If you want to perfom a registry query, please find below the corresponding registry keys:
[HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection]

Standard client
"ReducedSize"=dword:00000000
"DarkNetwork"=dword:00000000

Dark Network Client
"ReducedSize"=dword:00000000
"DarkNetwork"=dword:00000001

Embedded / VDI Clients
"ReducedSize"=dword:00000001
"DarkNetwork"=dword:00000000

• On the SEPM side:

a. SEPM --> Clients Tab --> Group name --> Clients --> Right click the Client entry --> Edit Properties --> Install Type

 

b. To filter multiple managed clients installed type, we can use [Search clients]

SEPM --> Clients --> Group name --> Tasks --> Search clients --> Search Field:Install Type

c. By running a database query.

The following example displays the client name, SEP version, client install type, operating system, user name, etc :

Query:

SELECT DISTINCT
    "SEM_CLIENT"."COMPUTER_NAME" "Computer Name"
  , "SEM_AGENT"."AGENT_VERSION" "SEP Version"
  , "SEM_AGENT"."INSTALL_TYPE" "Client Install Type"
  , "SEM_COMPUTER"."OPERATION_SYSTEM" "Operation System"
  , "SEM_CLIENT"."USER_NAME" "User Name"
  , "IP_ADDR1_TEXT" "IP Address"
  , "IDENTITY_MAP"."NAME" "Group Name"
  , "PATTERN"."VERSION" "AV Revision"
  , dateadd(s,convert(bigint,"SEM_AGENT"."CREATION_TIME")/1000,'01-01-1970 00:00:00') CREATION_DTTM
  , dateadd(s,convert(bigint,"SEM_AGENT"."LAST_UPDATE_TIME")/1000,'01-01-1970 00:00:00') "Last Update Time"
  , "SEM_AGENT"."DELETED" "Marked for deletion"
FROM (((("SEM_AGENT" "SEM_AGENT" INNER JOIN "SEM_CLIENT" "SEM_CLIENT"
  ON (("SEM_AGENT"."COMPUTER_ID"="SEM_CLIENT"."COMPUTER_ID")
  AND ("SEM_AGENT"."DOMAIN_ID"="SEM_CLIENT"."DOMAIN_ID"))
  AND ("SEM_AGENT"."GROUP_ID"="SEM_CLIENT"."GROUP_ID")) INNER JOIN "SEM_COMPUTER" "SEM_COMPUTER"
  ON (("SEM_AGENT"."COMPUTER_ID"="SEM_COMPUTER"."COMPUTER_ID")
  AND ("SEM_AGENT"."DOMAIN_ID"="SEM_COMPUTER"."DOMAIN_ID"))
  AND ("SEM_AGENT"."DELETED"="SEM_COMPUTER"."DELETED")) INNER JOIN "PATTERN" "PATTERN"
  ON "SEM_AGENT"."PATTERN_IDX"="PATTERN"."PATTERN_IDX") INNER JOIN "IDENTITY_MAP" "IDENTITY_MAP"
  ON "SEM_CLIENT"."GROUP_ID"="IDENTITY_MAP"."ID") INNER JOIN "V_SEM_COMPUTER" "V_SEM_COMPUTER"
  ON "SEM_COMPUTER"."COMPUTER_ID"="V_SEM_COMPUTER"."COMPUTER_ID"
  AND "SEM_AGENT"."DELETED"=0
ORDER BY "Computer Name"

 

Output :

Client Install Types:

0 – Standard Client
1 – Embedded Client
2 – Dark Network Client