SCCM WQL Query: Machines Without Endpoint Protection Installed

If you need to find machines that have the SCCM client installed but are somehow missing the Endpoint Protection client — a common gap check after enabling Endpoint Protection policies — this WQL query builds a collection based on what’s actually listed in each machine’s installed programs.

The Query

select
SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name,
SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client
from SMS_R_System
inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId
where SMS_G_System_COMPUTER_SYSTEM.Name in
(select distinct SMS_G_System_COMPUTER_SYSTEM.Name
from SMS_R_System
inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId
inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId
where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "System Center 2012 Endpoint Protection")
and SMS_R_System.Client = 1

Adjust the DisplayName string in the subquery if your Endpoint Protection client reports under a different product name in Add/Remove Programs on your version. Note this relies on the Add Remove Programs hardware inventory class being enabled — without it, the subquery will return no results and the collection will wrongly include every client.

A Note on the Product Name for Current Configuration Manager

The DisplayName string above (System Center 2012 Endpoint Protection) reflects the branding used in the 2012-era ConfigMgr releases this site originally covered. If you’re running a current branch of Configuration Manager, the endpoint protection component is the same underlying agent but is generally reported as Endpoint Protection or picked up as part of the built-in Microsoft Defender Antivirus integration rather than as a separately-listed Add/Remove Programs entry, since modern Configuration Manager manages Defender directly through policy rather than installing a distinct legacy client. Before relying on this query against a current environment, check a known-good machine’s hardware inventory (Resource Explorer > Add Remove Programs) to confirm what, if anything, actually appears under that class for Endpoint Protection on your current client version — on many current-branch sites the subquery will need to be dropped entirely in favour of checking the Endpoint Protection agent’s health state directly through Monitoring > Endpoint Protection Status instead, which reflects real-time protection state rather than an installed-programs snapshot.

Troubleshooting False Positives

Because this query depends entirely on hardware inventory data being current, a machine that genuinely has Endpoint Protection installed can still show up in the collection if its last inventory cycle ran before the client was deployed, or if hardware inventory itself is disabled or throttled on that client. Before treating a result as a real gap, check the Last Hardware Scan date on the resource — a stale scan date is the most common cause of false positives with this type of query, not a genuinely missing client.

Resources

• WQL
• query
• our SQL & WQL query library
• Browse our Windows Admin Toolkit picks on Amazon