You need to do this via SQL query
Here is a query you can run on your SEPM DB (both SQL Server or Internal Sygate DB users) that will return a list of all your endpoints that are loading the ADC (sysplant) driver when the SEP Agent starts.
select distinct EVENT_ID, EVENT_TIME, HARDWARE_KEY, HOST_NAME, DESCRIPTION, CALLER_PROCESS_NAME, CALLER_RETURN_MODULE_NAME from V_AGENT_BEHAVIOR_LOG where event_id in ('501', '502')
https://www.symantec.com/connect/forums/zero-day-flaws-found-symantecs-endpoint-protection-computerworld-article-73014-629am-et#comment-10365321