HI,

You can found PTP logs

SEP client > View Logs > PTP Logs > System Logs

I just checked that log and it only goes back 2 weeks and doesn't show any config changes just TruScan failures "Whitelist Failure".  I see a new Sylink file back in March but don't think that can change the modules loaded by the sep 11 client.

HI,

If you have apply any policy in SEPM console you can check Policy no in Client site.

Checking the policy serial number on a client

http://www.symantec.com/business/support/index?page=content&id=HOWTO55604

You can compare SEPM group and Client side policy no.

Check if you have scheduled autoupgrade to any group with all feature.

This had to have been done manually. If a component is not available, it won't just show up. You can check the system log but perhaps someone assigned a package using the autoupgrade feature or someone installed an incorrect package?

+1 for Brian.

This had to have been manually.  If the autoupgrade has been added or if, by chance, the package changed.  For example changing SEP(M) version and adding a new package for deployment, with out indicating to keep existing features, the system might have decided to add all components for you.