## Operational state reference

The following table documents the publicly supported registry subkeys that report operational state data on the Symantec Endpoint Protection client.

All registry subkeys are written to the following location: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\Public-Opstate.

Warning: | All registry subkeys and values for Symantec Endpoint Protection should be treated as read-only.

See Registry key location changes as of version 12.1.1 MP1.

Table:

Subkey | Type | Possible values | Used for
--- | --- | --- | ---
ASRunningStatus | REG_DWORD | 1 == running 2 == disabled | Registers whether Virus and Spyware Protection is enabled or disabled.
Note: | This subkey appears to be redundant with the following subkey.
AVRunningStatus | REG_DWORD | 1 == running 2 == disabled | Registers whether Virus and Spyware Protection is enabled or disabled.
ComputerID | REG_SZ | ComputerIDString | The GUID of the client computer.
ContentDownloadHealth | REG_DWORD | 1 == success 2 == failure | The current status of the content download (virus definitions and other content) to the client.
DeployPreviousVersion | REG_SZ | 4-part version string | Registers the four-part version number of the Symantec Endpoint Protection client software that was previously installed on the client computer.
DeployRunningVersion | REG_SZ | 4-part version string | Registers the four-part version number of the Symantec Endpoint Protection client software that is currently installed on the client computer.
DeployStatus | REG_DWORD | See table below | Registers details about the status of client software download, installation, upgrade, or patch.
DeployTargetVersion | REG_SZ | 4-part version string | Registers the four-part version number of the Symantec Endpoint Protection client software that is planned for future installation on the client computer.
FWRunningStatus | REG_DWORD | 1 == running 2 == disabled | Registers whether firewall protection is enabled or disabled.
Infected | REG_DWORD | 0 == clean 1 == infected | Registers whether the client computer is infected with one or more risks that are detected by Virus and Spyware Protection.
LastServerIP | REG_SZ | IP address | Registers the IP address of the most recent Symantec Endpoint Protection management server that the client connected to.
LastSuccessfulScanDateTime | REG_SZ | Most recent successful scan time | The timestamp of the most recent scan that successfully ran on the client.
LatestVirusDefsDate | REG_SZ | Latest content date | The timestamp of the most recent content that was downloaded to the client, in Pacific Standard or Daylight Time.
LatestVirusDefsRevision | REG_DWORD | Latest content revision number | The revision number of the most recent content that was downloaded to the client.
RebootReason | REG_DWORD | 0 == NO_REBOOT 1 == REMEDIATION 2 == PRODUCT_PATCH 3 == CONTENT_UPDATE 4 == INSTALL_COMPLETION 5 == SPC_COMMAND 6 == INSTALL_CATASTROPHIC_FAILURE | Registers the reason for a restart of the client computer.
snac_enabled | REG_DWORD | 0 == disabled 1 == running | Registers whether Symantec Network Access Control is enabled or disabled.

Table: Possible values for DeployStatus registry subkey

Value | Meaning
--- | ---
Client communication codes |
0x12070100 - | SEPM indicated an upgrade package for the client
0x12070101 - | Client decided to accept the upgrade package
0x12070102 | Client decided to reject the upgrade package
0x12070200 | Client has requested package information for the upgrade
0x12070300 | Client hasn't allowed to start the download of upgrade package
0x12070301 | Client has successfully downloaded & verified the upgrade package
0x12070400 | Client failed to apply the upgrade package
0x12070401 | Client failed to patch the delta
0x12070402 | Client failed to launch the upgrade installer
0x12070403 | Client successfully launched the final upgrade installer
0x12070500 | Client requesting Full version of the upgrade package on Delta's failure
Install operation codes |
0x12072000 | General install success
0x12072001 | Files have been copied to the SILO folder; this status is also to be sent on a fresh install before reboot
0x12073000 | General repair success
0x12074000 | General uninstall success
0x12075000 | General install failure
0x12075001 | Not enough space to complete install
0x12075002 | Launch condition not met
0x12075003 | Incompatible consumer version found
0x12075004 | Machine is in a pending reboot state
0x12075005 | Legacy incompatible enterprise product found
0x12075006 | No elevated installation privileges
0x12075007 | Incompatible operating system detected