Endpoint Protection

 View Only

  • 1.  How to find pc with SEP Outlook Plugin installed

    Posted Sep 16, 2013 10:52 AM

    Is it possible to perform a report, monitor or so on in order to find PCs with Outlook Plugin installed (I'm not talking about the policy, just the component).

    I've only access to SEP Manager, no other rights to PCs (I cannot browse their registry and similar).



  • 2.  RE: How to find pc with SEP Outlook Plugin installed

    Posted Sep 16, 2013 10:56 AM

    There is no report/monitor which shows if the plugin is installed



  • 3.  RE: How to find pc with SEP Outlook Plugin installed

    Posted Sep 16, 2013 10:58 AM

    Really really bad (at least for me).



  • 4.  RE: How to find pc with SEP Outlook Plugin installed

    Posted Sep 16, 2013 11:56 AM
    I'm afraid there's no record of this (by default) as as Brian has mentioned.
     
    That said, you could probably force such a detection if you use Application and Device Control in your environment.  All you'd be looking for are "File and Folder Access Attempts" to read the below file:
     
    C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.3001.165.105\Bin\SEPOutlookAddin.dll
     
    Or just SEPOutlookAddin.dll on its own will also work.  The A&DC rule should get triggered everytime Outlook is started (and loads the dll). Unfortunately, it does require you configure your AV policy to enable the Outlook Plug-in though.
     
    As it's just informational, I'd just leave the rule in Test Mode.  Look for the logs on the SEPM Console afterwards for which machines are using it (MONITORS -> Logs -> Log Type: Application and Device Control -> Log Content: Application Control).
     
    This file does not exist on machines without the Outlook bit installed, and this is for SEP12.1 (might be a different dll in SEP11).
     
    #EDIT#
    Oh yeah, this is all working under the assumption you only have access to the SEPM.  A logon script with a "IF EXIST" check for the above file is going to be easier if you can create a GPO or something, and make the machine(s) write their hostname(s) to a share.