Symantec Endpoint Protection Manager Console -

Create a dynamic group filter called "Stale Clients" where Last Check-in > 7 days . Export that list weekly. If an endpoint hasn’t talked to the SEPM console in a week, it’s effectively unprotected.

It automates the distribution of the Symantec Endpoint Protection (SEP) client and critical security patches to remote devices. symantec endpoint protection manager console