SCCM WQL Query: Machines Without Endpoint Protection Installed

If you need to find machines that have the SCCM client installed but are somehow missing the Endpoint Protection client: a common gap check after enabling Endpoint Protection policies: this WQL query builds a collection based on what’s actually listed in each machine’s installed programs.

The Query (Updated for Current Configuration Manager)

select
SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name,
SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client
from SMS_R_System
inner join SMS_G_System_EndpointProtectionStatus on SMS_G_System_EndpointProtectionStatus.ResourceID = SMS_R_System.ResourceId
where SMS_G_System_EndpointProtectionStatus.NotYetInstalled = 1
and SMS_R_System.Client = 1

This version drops the old Add/Remove Programs based subquery entirely and instead uses the built-in SMS_G_System_EndpointProtectionStatus class, the same data source behind Monitoring > Endpoint Protection Status in the console. Its NotYetInstalled flag is set when the Endpoint Protection client has not yet been installed on a machine, so there is no product-name string to keep in sync with your ConfigMgr version.

A Note on the Product Name for Current Configuration Manager

The original version of this query (System Center 2012 Endpoint Protection in an Add/Remove Programs subquery) reflected the branding used in the 2012-era ConfigMgr releases this site originally covered. That approach was fragile on current branch, since the product name string could vary and modern Configuration Manager manages Defender directly through policy rather than installing a distinct, separately-listed legacy client. The query above replaces that approach with the SMS_G_System_EndpointProtectionStatus class instead, which reflects real-time protection state rather than an installed-programs snapshot.

Troubleshooting False Positives

Because this query depends entirely on hardware inventory data being current, a machine that genuinely has Endpoint Protection installed can still show up in the collection if its last inventory cycle ran before the client was deployed, or if hardware inventory itself is disabled or throttled on that client. Before treating a result as a real gap, check the Last Hardware Scan date on the resource: a stale scan date is the most common cause of false positives with this type of query, not a genuinely missing client.

Resources

• WQL
• query
• our SQL & WQL query library
• Browse our Windows Admin Toolkit picks on Amazon