Symantec Endpoint Protection Agent upgrade using SCCM

I have worked on a upgrade of Symantec Endpoint Protection Agent on 60000 devices including server and workstations.
The upgrade was having several challenges and issues but here are some scripts that will help in upgrading with ease.
--------------------------------------------------------------------------------------------------------------------
Installation Script ( Verbose Logging Enabled) :
This script can be use to install SEP agent (if SEP is provided by the SEPMC) silently.

'-------------------------------Start of Script-----------------------------------------
'------------Install 32 bit Symantec Endpoint Protection12.1.5337.5000------------------

On error resume next

dim fso, wshll, Dir, Path, key, installdir, uname, ttime, loc, sloc, Exepath, cmdline, cm, SCPath

Set fso = createobject("Scripting.Filesystemobject")

Set wshll = createobject("wscript.shell")

PRODATA = wshll.expandenvironmentstrings("%ProgramData%")

SCPath=PRODATA&"\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection\Symantec Endpoint Protection Help.lnk"

installdir = wshll.expandenvironmentstrings("%systemdrive%")  & "\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000"

uname = wshll.expandenvironmentstrings("%Username%")

ddate = date

ttime=time

'----------- ---------Installation of the application -----------------------------------------

Path=wshll.ExpandEnvironmentStrings("%SystemRoot%")

Dir=left(WScript.ScriptFullName,(Len(WScript.ScriptFullName))-(len(WScript.ScriptName)))

Exepath = chr(34) &Dir & "setup32.exe"&chr(34)

cmdline = "/s /v"&chr(34)&"/qn REBOOT=REALLYSUPPRESS /L*v %SystemDrive%\SEPInstall.log"&chr(34)

'MsgBox Exepath &" " & cmdline

wshll.run Exepath &" " & cmdline, 0, true

'---------------------------Installation Ends-----------------------------------------

'-------------------------- Audit Registries -----------------------------------------

fso.DeleteFile SCPath, 1

wshll.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ {0E251D4D-316C-4F8B-A4C5-2722000764BE} \NoModify","1","REG_DWORD"

wshll.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ {0E251D4D-316C-4F8B-A4C5-2722000764BE} \NoRemove","1","REG_DWORD"

'-----------------------------End of Script---------------------------------------------

-------------------------------------------------------------------------------------------------------------------

Above mentioned script can be call by following script.

The Script can be call through the following batch script :

@echo off
PUSHD "%~dp0"
reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set OS=32BIT || set OS=64BIT
if %OS%==32BIT goto Win32
if %OS%==64BIT goto Win64
:Win32
cscript Install32.vbs
goto end
:Win64
cscript Install64.vbs
goto end
:END

-----------------------------------------------------------------------------------------------------------------------

Uninstall Script :
If on-top upgrade fails on then below script can be used to uninstall SEP if password and Tamper Protection is disabled from SEPM Console. Task Sequence can be used for this Uninstall> Reboot> Install> Reboot.

This script can be used to uninstall 21 Flavor of SEP.

Uninstall Script :

@echo off

PUSHD "%~dp0"

REM Created By Arif Hussain

REM This Script will uninstall the Symantec Endpoint Protection

smc –stop

net stop SepMasterService

net stop SmcService

net stop Smcinst

net stop SNAC

TIMEOUT /T 30

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06B594A0-2D2B-4376-94E4-13A0BD4A88F8}

IF %errorlevel%==0 GOTO UNINSTALL-1

IF %errorlevel%==1 GOTO Step-1

:UNINSTALL-1

msiexec.exe /x {06B594A0-2D2B-4376-94E4-13A0BD4A88F8} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-1

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D689B418-235A-4290-A0A5-A75E490E0351}

IF %errorlevel%==0 GOTO UNINSTALL-2

IF %errorlevel%==1 GOTO Step-2

:UNINSTALL-2

msiexec.exe /x {D689B418-235A-4290-A0A5-A75E490E0351} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-2

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FF9F3663-0357-4132-AD8C-2BC1397D88AF}

IF %errorlevel%==0 GOTO UNINSTALL-3

IF %errorlevel%==1 GOTO Step-3

:UNINSTALL-3

msiexec.exe /x {FF9F3663-0357-4132-AD8C-2BC1397D88AF} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-3

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2EFCC193-D915-4CCB-9201-31773A27BC06}

IF %errorlevel%==0 GOTO UNINSTALL-4

IF %errorlevel%==1 GOTO Step-4

:UNINSTALL-4

msiexec.exe /x {2EFCC193-D915-4CCB-9201-31773A27BC06} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-4

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{530992D4-DDBA-4F68-8B0D-FF50AC57531B}

IF %errorlevel%==0 GOTO UNINSTALL-5

IF %errorlevel%==1 GOTO Step-5

:UNINSTALL-5

msiexec.exe /x {530992D4-DDBA-4F68-8B0D-FF50AC57531B} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-5

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0A2163CB-4F47-44AA-A219-36133260CF17}

IF %errorlevel%==0 GOTO UNINSTALL-6

IF %errorlevel%==1 GOTO Step-6

:UNINSTALL-6

msiexec.exe /x {0A2163CB-4F47-44AA-A219-36133260CF17} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-6

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0A2163CB-4F47-44AA-A219-36133260CF17}

IF %errorlevel%==0 GOTO UNINSTALL-7

IF %errorlevel%==1 GOTO Step-7

:UNINSTALL-7

msiexec.exe /x {0A2163CB-4F47-44AA-A219-36133260CF17} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-7

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3C1AE512-3C37-44FA-BA42-ABB721EC5B1D}

IF %errorlevel%==0 GOTO UNINSTALL-8

IF %errorlevel%==1 GOTO Step-8

:UNINSTALL-8

msiexec.exe /x {3C1AE512-3C37-44FA-BA42-ABB721EC5B1D} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-8

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{84B70C16-7032-41EE-965C-3C8D9D566CBB}

IF %errorlevel%==0 GOTO UNINSTALL-9

IF %errorlevel%==1 GOTO Step-9

:UNINSTALL-9

msiexec.exe  /x {84B70C16-7032-41EE-965C-3C8D9D566CBB} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-9

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5C75DA6D-F5E3-4D4B-A381-B52B8CA5B1CF}

IF %errorlevel%==0 GOTO UNINSTALL-10

IF %errorlevel%==1 GOTO Step-10

:UNINSTALL-10

msiexec.exe /x {5C75DA6D-F5E3-4D4B-A381-B52B8CA5B1CF} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

goto END

TIMEOUT /T 30

:Step-10

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5E2E4797-502A-4FFD-81EC-F9BA8BF0C581}

IF %errorlevel%==0 GOTO UNINSTALL-11

IF %errorlevel%==1 GOTO Step-11

:UNINSTALL-11

msiexec.exe /x {5E2E4797-502A-4FFD-81EC-F9BA8BF0C581} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-11

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FA689023-0B72-4771-98A6-A1C927E58207}

IF %errorlevel%==0 GOTO UNINSTALL-12

IF %errorlevel%==1 GOTO Step-12

:UNINSTALL-12

msiexec.exe /x {FA689023-0B72-4771-98A6-A1C927E58207} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-12

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19B62EDC-C108-4393-B3F1-8A813096CC8E}

IF %errorlevel%==0 GOTO UNINSTALL-13

IF %errorlevel%==1 GOTO Step-13

:UNINSTALL-13

msiexec.exe /x  {19B62EDC-C108-4393-B3F1-8A813096CC8E} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-13

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C335C87B-2D3E-4CCC-BB4B-CE60617B1A51}

IF %errorlevel%==0 GOTO UNINSTALL-14

IF %errorlevel%==1 GOTO Step-14

:UNINSTALL-14

msiexec.exe /x {C335C87B-2D3E-4CCC-BB4B-CE60617B1A51}  REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-14

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2103AF2-E66C-446B-9791-9207840EC821}

IF %errorlevel%==0 GOTO UNINSTALL-15

IF %errorlevel%==1 GOTO Step-15

:UNINSTALL-15

msiexec.exe /x {C2103AF2-E66C-446B-9791-9207840EC821} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-15

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1FDE5016-DDB2-44CC-B998-0929A41CD595}

IF %errorlevel%==0 GOTO UNINSTALL-16

IF %errorlevel%==1 GOTO Step-16

:UNINSTALL-16

msiexec.exe /x {1FDE5016-DDB2-44CC-B998-0929A41CD595} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-16

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60171618-BEB9-4E89-AA7B-43AD32A3EC05}

IF %errorlevel%==0 GOTO UNINSTALL-17

IF %errorlevel%==1 GOTO Step-17

:UNINSTALL-17

msiexec.exe /x {60171618-BEB9-4E89-AA7B-43AD32A3EC05} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-17

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DD481201-4E11-42B2-B391-A5EAB2D55F70}

IF %errorlevel%==0 GOTO UNINSTALL-18

IF %errorlevel%==1 GOTO Step-18

:UNINSTALL-18

msiexec.exe /x {DD481201-4E11-42B2-B391-A5EAB2D55F70}  REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-18

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5DCF955-5D4A-471D-8CB3-DCFDF5C5DEE7}

IF %errorlevel%==0 GOTO UNINSTALL-19

IF %errorlevel%==1 GOTO Step-19

:UNINSTALL-19

msiexec.exe /x {A5DCF955-5D4A-471D-8CB3-DCFDF5C5DEE7} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-19

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B53661DC-CD94-4B14-B15F-D9DDCFF72558}

IF %errorlevel%==0 GOTO UNINSTALL-20

IF %errorlevel%==1 GOTO Step-20

:UNINSTALL-20

msiexec.exe /x {B53661DC-CD94-4B14-B15F-D9DDCFF72558} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-20

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A84E6630-FE81-4D1F-BBA0-4BFBCC1D9493}

IF %errorlevel%==0 GOTO UNINSTALL-21

IF %errorlevel%==1 GOTO Step-21

:UNINSTALL-21

msiexec.exe /x {A84E6630-FE81-4D1F-BBA0-4BFBCC1D9493} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-21

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5DCF955-5D4A-471D-8CB3-DCFDF5C5DEE7}

IF %errorlevel%==0 GOTO UNINSTALL-22

IF %errorlevel%==1 GOTO Step-22

:UNINSTALL-22

msiexec.exe /x {A5DCF955-5D4A-471D-8CB3-DCFDF5C5DEE7} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:Step-22

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0E251D4D-316C-4F8B-A4C5-2722000764BE}

IF %errorlevel%==0 GOTO UNINSTALL-23

IF %errorlevel%==1 GOTO End

:UNINSTALL-24

msiexec.exe /x {0E251D4D-316C-4F8B-A4C5-2722000764BE} REMOVE=ALL REBOOT=ReallySuppress /qn /l*v c:\SEPUninstall.log

TIMEOUT /T 30

goto END

:END 

-------------------------------------------------------------------------------------------
SQL to find Machines without Antivirus :

This can be used to find the list of devices which is not having AV, once list is validate from the SEPMC, this can be sorted for the immediate remediation. 


-----------------------------------------------------------------------------------------------------------------------

/* Created by Arif Hussain for the list of devices without AV */

select distinct x.Device_Name,x.AD_Site,x.Full_Domain

from (SELECT DISTINCT

                        V_R_system.Name0 as Device_Name, v_R_System.AD_Site_Name0 as AD_Site,v_R_System.Full_Domain_Name0 as Full_Domain, user_name0, v_R_System.operatingSystem0 as OPeratingSystem,v_R_System.Last_Logon_Timestamp0,

CASE v_GS_SYSTEM_ENCLOSURE.ChassisTypes0 WHEN '1' THEN 'Desktop' WHEN '2' THEN 'Virtual' WHEN '3' THEN 'Desktop' WHEN '4' THEN 'Desktop' WHEN '5'THEN 'Desktop' WHEN '6' THEN 'Desktop' WHEN '7' THEN 'Desktop' WHEN '8' THEN 'Laptop' WHEN '9' THEN 'Laptop' WHEN '10' THEN 'Laptop' WHEN '11' THEN 'Hand Held'WHEN '12' THEN 'Laptop' WHEN '13' THEN 'Desktop' WHEN '14' THEN 'Laptop' WHEN '15' THEN 'Desktop' WHEN '16' THEN 'Desktop' WHEN '17' THEN 'Server' WHEN '18' THEN 'Server' WHEN '19' THEN 'Server' WHEN '20' THEN 'Server' WHEN '21' THEN 'Server' WHEN '22' THEN 'Server' WHEN '23' THEN 'Server' WHEN '24' THEN 'Desktop' ELSE 'Undefinded' END AS Type, COUNT(v_GS_SYSTEM_ENCLOSURE.ChassisTypes0) AS Total

FROM         v_R_System INNER JOIN

                      v_GS_SYSTEM_ENCLOSURE ON v_R_System.ResourceID = v_GS_SYSTEM_ENCLOSURE.ResourceID INNER JOIN

                      v_GS_COMPUTER_SYSTEM ON v_R_System.ResourceID = v_GS_COMPUTER_SYSTEM.ResourceID

                      inner join v_GS_OPERATING_SYSTEM on v_R_System.ResourceID = v_GS_OPERATING_SYSTEM.ResourceID

WHERE     (v_GS_OPERATING_SYSTEM.Name0 LIKE 'Microsoft Windows%' and v_R_System.Operating_System_Name_and0 like '%works%')

GROUP BY v_R_System.Name0, v_R_System.AD_Site_Name0,user_name0, v_R_System.Last_Logon_Timestamp0,v_R_System.Full_Domain_Name0,v_R_System.operatingSystem0,

CASE v_GS_SYSTEM_ENCLOSURE.ChassisTypes0 WHEN '1' THEN 'Desktop' WHEN '2' THEN 'Virtual' WHEN '3' THEN 'Desktop' WHEN '4' THEN 'Desktop' WHEN '5’ THEN 'Desktop' WHEN '6' THEN 'Desktop' WHEN '7' THEN 'Desktop' WHEN '8' THEN 'Laptop' WHEN '9' THEN 'Laptop' WHEN '10' THEN 'Laptop' WHEN '11' THEN 'Hand Held'WHEN '12' THEN 'Laptop' WHEN '13' THEN 'Desktop' WHEN '14' THEN 'Laptop' WHEN '15' THEN 'Desktop' WHEN '16' THEN 'Desktop' WHEN '17' THEN 'Server' WHEN '18' THEN 'Server' WHEN '19' THEN 'Server' WHEN '20' THEN 'Server' WHEN '21' THEN 'Server' WHEN '22' THEN 'Server' WHEN '23' THEN 'Server' WHEN '24' THEN 'Desktop' ELSE 'Undefinded' END

) x

Except

select distinct y.Device_Name,y.AD_Site,y.Full_Domain from (

SELECT DISTINCT

V_R_system.Name0 as Device_Name, v_R_System.AD_Site_Name0 as AD_Site,v_R_System.Full_Domain_Name0 as Full_Domain, user_name0, v_GS_OPERATING_SYSTEM.Caption0 as OPeratingSystem,v_R_System.Last_Logon_Timestamp0,

CASE v_GS_SYSTEM_ENCLOSURE.ChassisTypes0 WHEN '1' THEN 'Desktop' WHEN '2' THEN 'Virtual' WHEN '3' THEN 'Desktop' WHEN '4' THEN 'Desktop' WHEN '5'

THEN 'Desktop' WHEN '6' THEN 'Desktop' WHEN '7' THEN 'Desktop' WHEN '8' THEN 'Laptop' WHEN '9' THEN 'Laptop' WHEN '10' THEN 'Laptop' WHEN '11' THEN 'Hand Held' WHEN '12' THEN 'Laptop' WHEN '13' THEN 'Desktop' WHEN '14' THEN 'Laptop' WHEN '15' THEN 'Desktop' WHEN '16' THEN 'Desktop' WHEN '17' THEN 'Server' WHEN '18' THEN 'Server' WHEN '19' THEN 'Server' WHEN '20' THEN 'Server' WHEN '21' THEN 'Server' WHEN '22' THEN 'Server' WHEN '23' THEN 'Server' WHEN '24' THEN 'Desktop' ELSE 'Undefinded' END AS Type, COUNT(v_GS_SYSTEM_ENCLOSURE.ChassisTypes0) AS Total

FROM  v_R_System INNER JOIN

                      v_GS_SYSTEM_ENCLOSURE ON v_R_System.ResourceID = v_GS_SYSTEM_ENCLOSURE.ResourceID INNER JOIN

                      v_GS_COMPUTER_SYSTEM ON v_R_System.ResourceID = v_GS_COMPUTER_SYSTEM.ResourceID

                      inner join v_GS_OPERATING_SYSTEM on v_R_System.ResourceID = v_GS_OPERATING_SYSTEM.ResourceID

                      inner join v_GS_INSTALLED_SOFTWARE s on v_R_System.ResourceID = s.ResourceID

WHERE     (v_GS_OPERATING_SYSTEM.Name0 LIKE 'Microsoft Windows%' and v_R_System.Operating_System_Name_and0 like '%works%')and (s.ProductName0 like 'Symantec Endpoint protection' or s.ProductName0 like 'Symantec AntiVirus' or s.ProductName0 like '%Mcafee%')

GROUP BY v_R_System.Name0, v_R_System.AD_Site_Name0,user_name0, v_R_System.Last_Logon_Timestamp0,v_R_System.Full_Domain_Name0,v_GS_OPERATING_SYSTEM.Caption0,s.ARPDisplayName0,

                      CASE v_GS_SYSTEM_ENCLOSURE.ChassisTypes0 WHEN '1' THEN 'Desktop' WHEN '2' THEN 'Virtual' WHEN '3' THEN 'Desktop' WHEN '4' THEN 'Desktop' WHEN '5' THEN 'Desktop' WHEN '6' THEN 'Desktop' WHEN '7' THEN 'Desktop' WHEN '8' THEN 'Laptop' WHEN '9' THEN 'Laptop' WHEN '10' THEN 'Laptop' WHEN '11' THEN 'Hand Held'WHEN '12' THEN 'Laptop' WHEN '13' THEN 'Desktop' WHEN '14' THEN 'Laptop' WHEN '15' THEN 'Desktop' WHEN '16' THEN 'Desktop' WHEN '17' THEN 'Server' WHEN'18' THEN 'Server' WHEN '19' THEN 'Server' WHEN '20' THEN 'Server' WHEN '21' THEN 'Server' WHEN '22' THEN 'Server' WHEN '23' THEN 'Server' WHEN '24' THEN 'Desktop' ELSE 'Undefinded' END

) y

---------------------------------------------------------------------------------------------------------------------------

Let me know if this helps or need to tweak for more effective.

* All these scripts are tested and result may vary case to case.