VSE provides information to the ePolicy Orchestrator (ePO) database that represents the status of the on-access scanner (OAS). This information is considered near live, which means it depends on how must time has passed since the data was collected from the client. This time could be "very recent" if a property collection was just forced to occur on the system.

VSE 8.8 Patch 4 (and later) reports the status of the OAS in the ePO console. Or, you can run the following query to list the systems that have the OAS enabled:

1. Ensure that Hotfix 820636 (or later) has been deployed to the environment. See KB77043 for details about Hotfix 820636.
    
   NOTE: This hotfix improves the reliability of the information that client systems return to ePO.
    
2. Use the following SQL query:
    
   NOTE: When you enter the database name for the USE command, do not include the < > signs. Example: USE [ePO_ePOtestserver].
   
   USE [<database name>]
   GO
   
   SELECT
      [EPOLeafNode].[NodeName] AS ServerName, 
      CASE WHEN rsOASEnabled.value IS NOT NULL THEN rsOASEnabled.value ELSE 'Unknown' END AS OASEnabled
   FROM
      [EPOLeafNode]
      INNER JOIN [EPOProductProperties] ON [EPOLeafNode].[AutoID] = [EPOProductProperties].[ParentID]
      LEFT JOIN [dbo].EPOProductSettings AS rsOASEnabled ON (EPOProductProperties.AutoID = rsOASEnabled.ParentID AND
                                                                                                                     rsOASEnabled.SectionName = N'On-Access General' AND
                                                                                                                     rsOASEnabled.SettingName = N'bEnabled')
   WHERE 
      EPOProductProperties.ProductCode LIKE 'VIRUSCAN%'
   GO
    

Output from the query above looks similar to the following: NOTE: The 1 entry in the OASEnabled column means that the OAS is enabled for that system.
 

	ServerName	OASEnabled
1	SystemName1	1
2	SystemName2	1
3	SystemName3	1