You would to create a script to audit AV installs that can determine whether a client is managed or unmanaged, Primary Server or Secondary Server, for SAV and SEP environments.
There is no one key check you can use, but this can be done by combing the results of the initial key check into a logic statement to continue if needed to check for Primary or Secondary Server.
Checking SAV installs Step 1- To check if Client is Managed, Unmanaged, or a Server Install- HKLM\Software\Intel\Landesk\VirusProtect6\CurrentVersion\[ClientType]
Value=1 then the client is Managed Value=2 then the client is Unmanaged Value=4 then this is a server install.
Step 2- Based on the Value above- check what type of server install Registry results for Primary or Secondary Server: a. Primary Server key HKLM\software\intel\landesk\virusprotect6\currentversion\ [Parent] (The Parent key will be blank)
b. Secondary Server key: HKLM\software\intel\landesk\virusprotect6\currentversion\ [Parent] (The Parent key will have the name of it’s Primary server)
SEP Managed and Unmanaged- To verify a SEP client is managed via script: a. If you can check for a value associated with a reg location, you could check for: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\Sylink\HostGUID
b. If you can't check for a value, then this reg key should still be present only on a managed client, and not an unmanaged: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\Sylink\TechExtensions
Imported Document ID: TECH145807
Subscribing will provide email updates when this Article is updated. Login is required.