SCCM – WQL Query for machines without Endpoint Protection installed

microsoft windows white logo

Table of Contents

Estimated reading time: 2 minutes

If you need to identify machines that have the Configuration Manager client installed but do not have the System Center Endpoint Protection client installed, then you can use the following WQL query.

select 
    SMS_R_SYSTEM.ResourceID,
    SMS_R_SYSTEM.ResourceType,
    SMS_R_SYSTEM.Name,
    SMS_R_SYSTEM.SMSUniqueIdentifier,
    SMS_R_SYSTEM.ResourceDomainORWorkgroup,
    SMS_R_SYSTEM.Client
 from SMS_R_System
    inner join SMS_G_System_COMPUTER_SYSTEM
       on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId
    where SMS_G_System_COMPUTER_SYSTEM.Name in
       (select distinct
        SMS_G_System_COMPUTER_SYSTEM.Name
    from  SMS_R_System
        inner join SMS_G_System_COMPUTER_SYSTEM
    on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId
        inner join SMS_G_System_ADD_REMOVE_PROGRAMS
    on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId
        where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "System Center 2012 Endpoint Protection" )
    and SMS_R_System.Client = 1

More Queries

Our full range of SQL and WQL Collection queries are available here.

Feedback

If you have any questions or feedback about this post, or if you would like us to create any queries for you, please go ahead and leave us a message below in the comments section and we will get back to you as quick as we can.

Share this content:

Click to rate this post!

[Total: 2 Average: 3]

Post Views: 3

About Andrew Armstrong

Founder of TechyGeeksHome and Head Editor for over 15 years! IT expert in multiple areas for over 26 years. Sharing experience and knowledge whenever possible! Making IT Happen.

View all posts by Andrew Armstrong →

9 Comments on “SCCM – WQL Query for machines without Endpoint Protection installed”

askshivi says:

15 June 2017 at 06:29

I want to look for a particular version which is not installed . like check collections for workstations with system center endpoint protection where version is not 4.10.209.0

Reply
askshivi says:

19 August 2018 at 14:53

I want to look for a particular version which is not installed . like check collections for workstations with system center endpoint protection where version is not 4.10.209.0

Reply
askshivi says:

4 August 2019 at 15:10

I want to look for a particular version which is not installed . like check collections for workstations with system center endpoint protection where version is not 4.10.209.0

Reply
Jose J.R. Esposito (@JoseEsposito_IT) says:

28 March 2017 at 15:10

Pretty sure your query shouldn’t have breaks all in it 🙂

Reply
1. tghadmin says:
  
  28 March 2017 at 17:27
  
  Thanks for letting us know – some of our formatting on the older posts went a bit crazy when we migrated to WordPress from Blogger. Updated now…
  
  Reply
Jose J.R. Esposito (@JoseEspos says:

19 August 2018 at 14:53

Pretty sure your query shouldn’t have breaks all in it 🙂

Reply
1. tghadmin says:
  
  19 August 2018 at 14:53
  
  Thanks for letting us know – some of our formatting on the older posts went a bit crazy when we migrated to WordPress from Blogger. Updated now…
  
  Reply
Jose J.R. Esposito (@JoseEspos says:

4 August 2019 at 16:24

Pretty sure your query shouldn’t have breaks all in it 🙂

Reply
1. tghadmin says:
  
  4 August 2019 at 17:30
  
  Thanks for letting us know – some of our formatting on the older posts went a bit crazy when we migrated to WordPress from Blogger. Updated now…
  
  Reply