Interesting - I'm troubleshooting why my predefined check for Symantec Endpoint Protection 11 is not working, too. My test case is not working (maybe his machine is the 1 in 40). For the moment, I'll probably implement a process check, if there is a unique process name.