Smart Computer Group: Detect is SEP 12.1.6 is actively running

[josh_goldberg]

I am trying to create a smart group to detect if SEP 12.1.6 is NOT running on clients machines... though the criteria I find available for Symantec "processes" is only:

com.symantec.liveupdate.daemon com.symantec.liveupdate.daemon.ondemand com.symantec.sharedsettings com.symantec.symdaemon

I have a test machine in front of me and have SEP running, but can't find any of these 4 processes even running.. anyone have any suggestions? Only thing I can find actively running after login is:

Symantec Endpoint Protection
SymUIAgent.app

[alexjdale]

A process named SymDaemon should be running. That is what we key off of.

pgrep SymDaemon

...should return an integer if it's running.