The analysis Symantec Endpoint Protection Client Version is returning a version for the property in the console when SEP is not installed. When I run the relevance for the property in the fixlet debugger, it evaluates correctly as <not installed>. This is happening on more than one client. We have tried send refresh, and even uninstalling and re-installing the Bigfix client. We still see the SEP version number in the console.
Bigfix version 9.5.13.
The property relevance is the following from the analysis “Symantec Endpoint protection 12.x/14.x - Client Information - Windows 2008/2008R2/8/8.1/10/2012/2012 R2/2016” in the external site "Client Manager for Endpoint Protection.
if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps" of registry) then ((if (exists value "SAVCE" of it AND exists file "rtvscan.exe" of (value "SAVCE" of it as folder)) then (version of file "rtvscan.exe" of (value "SAVCE" of it as folder) as string) else (if (exists value "SAVCE" of it AND exists file "rtvstart.exe" of (value "SAVCE" of it as folder)) then (version of file "rtvstart.exe" of (value "SAVCE" of it as folder) as string) else "<Not Installed>")) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps" of registry) else (if (exists key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion" whose (exists value "PRODUCTVERSION" of it) of registry) then (value "PRODUCTVERSION" of key "HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion" of native registry as string) else "<Not Installed>")