SCCM – WQL Query for machines without Endpoint Protection installed

microsoft windows white logo

Table of Contents

Last updated on July 15th, 2023 at 07:41 pm

Read Time:1 Minute, 6 Second

If you need to identify machines that have the Configuration Manager client installed but do not have the System Center Endpoint Protection client installed, then you can use the following WQL query.

select 
    SMS_R_SYSTEM.ResourceID,
    SMS_R_SYSTEM.ResourceType,
    SMS_R_SYSTEM.Name,
    SMS_R_SYSTEM.SMSUniqueIdentifier,
    SMS_R_SYSTEM.ResourceDomainORWorkgroup,
    SMS_R_SYSTEM.Client
 from SMS_R_System
    inner join SMS_G_System_COMPUTER_SYSTEM
       on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId
    where SMS_G_System_COMPUTER_SYSTEM.Name in
       (select distinct
        SMS_G_System_COMPUTER_SYSTEM.Name
    from  SMS_R_System
        inner join SMS_G_System_COMPUTER_SYSTEM
    on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId
        inner join SMS_G_System_ADD_REMOVE_PROGRAMS
    on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId
        where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "System Center 2012 Endpoint Protection" )
    and SMS_R_System.Client = 1

More Queries

Our full range of SQL and WQL Collection queries are available here.

Feedback

If you have any questions or feedback about this post, or if you would like us to create any queries for you, please go ahead and leave us a message below in the comments section and we will get back to you as quick as we can.

Click to rate this post!
[Total: 2 Average: 3]

Free Subscription

If you want to be notified when we post more quality guides like this one, sign up to our free subscription service and you will receive an email when a new post is live.

Join 441 other subscribers.

No need to worry, we will not be filling your inbox with spam and you can unsubscribe anytime you like.


9 thoughts on “SCCM – WQL Query for machines without Endpoint Protection installed

  1. I want to look for a particular version which is not installed . like check collections for workstations with system center endpoint protection where version is not 4.10.209.0

  2. I want to look for a particular version which is not installed . like check collections for workstations with system center endpoint protection where version is not 4.10.209.0

  3. I want to look for a particular version which is not installed . like check collections for workstations with system center endpoint protection where version is not 4.10.209.0

  4. Pretty sure your query shouldn’t have breaks all in it 🙂

    1. Thanks for letting us know – some of our formatting on the older posts went a bit crazy when we migrated to WordPress from Blogger. Updated now…

    1. Thanks for letting us know – some of our formatting on the older posts went a bit crazy when we migrated to WordPress from Blogger. Updated now…

    1. Thanks for letting us know – some of our formatting on the older posts went a bit crazy when we migrated to WordPress from Blogger. Updated now…

Leave us a message...

This site uses Akismet to reduce spam. Learn how your comment data is processed.