HI,

Check this artical

https://www-secure.symantec.com/connect/articles/u...

Unmanaged Detector in SEP 12.1

https://www-secure.symantec.com/connect/articles/unmanaged-detector-sep-121

SEP 12.1 - What does it mean to set a client as an Unmanaged Detector?

http://www.symantec.com/business/support/index?page=content&id=TECH183746

Check this thread

How to Find SEP Clients that are designated as Unmanaged Detectors

https://www-secure.symantec.com/connect/forums/how-find-sep-clients-are-designated-unmanaged-detectors

https://www-secure.symantec.com/connect/forums/symantec-endpoint-protection-121-and-find-unmanaged-computers

Make sure NTP is installed on the client. In the SEPM, just right click and select "Enable as Unmanaged Detector"

One needs to be on every subnet though. It captures ARP packets and sends that info to the SEPM, the SEPM than looks thru its database and if it can't find that IP/MAC address it will mark it as unmanaged.

It will also pick up every device without SEP. This includes routers, switches, printers, etc.

You can add exceptions but it can be a time consuming process depending on the size of your network.

To get alerts, go to Monitors >> Notifications tab >> Notifications Conditions >> click Edit and add the alert for unmanaged computers and fill in the info you need. Click OK