I'm a few months into cleaning up a mess.
Basically, when we moved from XP to Win7, the desktop group doing to deployment didn't remove the 2 agent registry keys soo all the agents broke and stopped talking...To add to my fun, all those images had VSE 8.8 with the hotfix, which had the oh-so-wonderful bug that prevented the agent from installing...(If only I could push a policy to them..), and because of Access Protection, we couldn't delete the keys...
Anyway, using Symantec Altiris, we pulled off VSE from most boxes, deleted the agent keys, and restarted the agent and over the last 2 months, I'd say 95% of machines are back into ePO.
I suspect there are still a few hundred machines out there, but I need to fish them out, which brings me to my question..
In the registry, in HKLM\Software\Wow6432Node\Network Associates\Epolicy Orchestrator\Agent\, there is a key called "LastASCTime", which would be great to querty against to find out which machines haven't talked in months...but the number isn't a date...either in HEX or decimal, the value doesnt' resemble a date/time value by any means...
Does anyone know the structure of this value?
If I knew hwo that value is counted, then I could create an Altiris task to look in the registry and find those remaining machines.
As far as I can recall, LastASCTime is a Unix epoch value - there should be loads of tools that can convert this into something friendlier