The Symantec Endpoint Protection Manager (SEPM) console displays Symantec Endpoint Protection (SEP) clients in user mode.  These clients had previously been in Computer Mode.

The Symantec Endpoint Protection client uses user mode when either of the following is true:

• The SEP client, upon registering with the Symantec Endpoint Protection Manager (SEPM), is not already listed within the SEPM's database and the client's Preferred Mode is set to user mode (see below). The client will then register in user mode and will remain in user mode unless changed by the SEPM administrator.
  • Note: Conversely, once the client is a computer mode client in the SEPM, it will always be a computer mode client unless the client is removed from SEPM or the administrator manually switches the client from computer mode to user mode using the SEPM's user interface.
• There is already a user mode entry for this client in SEPM when the SEP clients registers with the SEPM. In this situation, the client will ignore what its Preferred Mode is set to and will use what the SEPM tells it to use.

"Preferred Mode" is represented by the following registry value “PreferredMode” located in the following registry KEY on a SEP client machine:

•  HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink