How to verify an Endpoint Protection client's last heartbeat time via the registry
Last Updated June 27, 2017
How can one determine the last time a Symantec Endpoint Protection (SEP) client checked into the manager in the client's registry?
Typically this information can be found by viewing the Client tab through SEPM and viewing the properties for a client, or by viewing the data in the columns, or by running a report. However, in some circumstances, the manager is not always available to everyone and you need to gather this information from the client's registry.
The last heart beat time is found in the following registry key:
The hex value is in epoch time (# of seconds since Jan. 1 1970).
Note: The value in the registry key is stored in hexadecimal format. If you use an epoch converter that requires a decimal value, use the Windows calculator in Scientific mode to convert the hex value to decimal format, and then the decimal result for the epoch time conversion.
References More information on epoch time can be found at the following website: