How does Symantec check SEP version?

[Hogan Chen]

I installed SEP 11.0 MR4 MP2 on the machine, from the SEPM console, all the clients showing have SEP 11.0.4202.75 version installed, In the past I always use the main process of AV product "rtvscan.exe" to check the client version installed on the machine, however, when I check the version of rtvscan in "C:\Program Files\Symantec\Symantec Endpoint Protection", it displays version 11.0.4202.48. does anyone know where Symantec console get that version ( 11.0.4202.75 ) from?

[Migration User]

I don't think I am getting what you mean by "in the past I always use the main process of AV product rtvscan.exe to check the client version". To check the client version click on the SEP shield in the system tray. Then when the client gui comes up click the Help and Support button and then about. It tells you the client version number right there. If that number is different from 11.0.4202.75 you should post back. If not the product is working and fully up to date. Thanks.

Grant-

[Hogan Chen]

I have been using my own script to check client production version and latest definition date, then upload those infomation to a web site, I usually check rtvscan.exe version when we used SAV product.
I know I can manually check help and support to get the product version, I even can do this with my script to check the registry. I was wondering where this version number from. I did some version check on almost all the files on the machine, none of SEP file tells me this version, rtvscan.exe and smc.exe either displayed version 11.0.4202.48 or 11.04202.51. where is the version 11.04202.75 from?

[Migration User]

Hi,

what I can tell you is that only the third group is relevant to know the release of your SEP:
11.0.4202.48, 11.0.4202.51 or 75 are always 11.0.4202 = 11.0 MR4 MP2

Here's the full list of SEP releases:

11.0.780   RTM
11.0.1000 MR1
11.0.1006 MR1 MP1
11.0.2000 MR2
11.0.2010 MR2 MP1
11.0.2020 MR2 MP2
11.0.3001 MR3
11.0.4000 MR4
11.0.4014 MR4 MP1a
11.0.4202 MR4 MP2

as you can see the other digits are not relevant to determine your SEP 11 release.

[Migration User]

why not use the report to check all SEPM clients connected to your reporting server...
do "Computer Status"...or do it the hard and manual way like what Grant_Hall had instructed.
thanks...

[Migration User]

by the way.. how many months before a new version is out again..
newest is 11.0.4202 MR4 MP2...
thanks...

[Hogan Chen]

I have mixed enviornment with different versions of SAV and SEP installed on our client machines, I ma in the mid of migration. I need to get all those clients AV informaiton load to in centralized repository so that everyone can find out any machine status, cients could have SAV, SEP or even other av product installed, so I can not use Symantec console report to get this done. what I need to get is what product, what version and dfinition date.

We all know SEP latest version is 11.0 MR4 MP2. and product version is 11.0.4202.75, where is this version number from? I think Symantec need to be more clear why this is 11.0.4202.75 and I do not find any executible or dll reflect this version number, all i can see is rtvscan is 11.0.4202.48 and smc.exe is 11.0.4202.51.

Very simple, I do not want to explain to people 11.0.4202.51 is equal to 11.0.4202.75.

[Benjamin John]

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC
ProductVersion = 11.0.4202.75

[Hogan Chen]

I know that registry key location, I have changed my script to use that key for reference. my question is where the version is from, based on what? executible or dll?

[Benjamin John]

Well, I guess obviously symantec doesn't have good versioning control with SEP.
According to the release notes, http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216360648, 11.0.4202 is MR4-MP2, AKA 11.0.4202.75. So as long you are able to get 11.0.4202 from the executables, you can assume you have the latest version.

[Migration User]

You do not have to explain to people 11.0.4202.51 is equal to 11.0.4202.75. Just cut it at 4202.
I guess the forth group of digits is the single file version and obviously some files are updated faster than other. I don't know how at the end they selected 11.0.4202.75 as a final version for a release and maybe they just write it in the registry during the installation... I am not directly in touch with the devs but I don't see a reason to be so worried. Just use the registry key you already know.

[Migration User]

11.0.4202.51 is equal to 11.0.4202.75, is last decimal values differs according to updates