Hi Steve,
You may try to look for the following registry key located below.
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\LiveUpdate\
The key to check: UseManagementServer
If the value is 0 then the client involved doesn't get his definitions from the SEPM and GUP (as clients getting definitions from GUP has to get an LU Policy which use the Management Server).
So if this key has the value 0 then you can deduct this client is currently Unmanaged, if it's set to 1 then it's by default managed client ;)
Feel free to test it and let us if it's a reliable work around for you.
Kind regards,
A. Wesker