Endpoint Protection

I am writing a script to check the status of SEP 12.1.6 on our servers.  One of the items they want in the report is the time the client last connected to the management server.  I can see the time they want under Help > Troublshooting > Last Connected.  Does anyone know where this time is stored on the client computer?  It seems like it should be in the registry but I can not find it.  Any help would be appreciated.

Thanks

Mark

The last heartbeat time is found in the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\HeartbeatComplete

The hex value is in epoch time (# of seconds since Jan. 1 1970) so you'll need to convert it.

I thought the heartbeatcomplete was the registry key I needed but it does not match up with the date in the Last Connected date shown in the Troubleshooting section.  I checked several of my servers and workstations and all of them show different dates.  My registry has the HeartbeatComplete value as 1495487941 which converts to Monday, May 22, 2017 9:19:01 PM.  As you can see below the dates do not match.   Any ideas why?