Yes there is a fuctionality called Unmanged Detector.

Title: 'Best Practices: When to use the "Find Unmanaged Computers" or "Unmanaged Detector" features in Symantec Endpoint Protection 11.0'
 http://service1.symantec.com/support/ent-security.nsf/docid/2008030514404548?Open&seg=ent

Title: 'Setting notifications when using the "Unmanaged Detector" feature in the SEPM'
 http://service1.symantec.com/support/ent-security.nsf/docid/2008050813205048?Open&seg=ent

Title: 'What does it mean to set a client as an Unmanaged Detector?'
http://service1.symantec.com/support/ent-security.nsf/docid/2008082614485548?Open&seg=ent

1. I heard we need to have at least 1 SEP11 client on each subnet, and norminate that as an agent to do the scanning. Is that correct? Yes

2. I heard the SEP11 server does not do the actual scanning, but the norminated agent (in 1) does the actual scanning. Is that correct? Yes

3. Can the scan be configured to run at a scheduled time? Or we need someone to push the button at the time of the scan? Can be done from the SEPM automatically