How to search computer [workstation] information from Active Directory to find which ones do not have SEP installed?

[rashid47010]

I want to get all workstations/computers information from active directory and want to know how can I save it OR utilize it [any use case].

My actual requirement is that:
When I have the total number of workstations in Splunk, then I need to match them with the events of Symantec SEP DB table who have the record of all workstations with SEP agent installed.
at the end, I should have the workstations who don't have SEP installed

[sundareshr]

Take a look at the Splunk App for Windows Infrastructure. It has all sorts of reports. You could look at the query for Computer Reports and clone that to build your own lookup table using the outputlookup command

http://docs.splunk.com/Documentation/MSApp/1.2.1/Reference/ActiveDirectoryReports
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

[rashid47010]

I think through
Deploy and Use the Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)

I can achieve as required. Below is the search:

| ldapsearch domain=avc search="(&(objectclass=computer))"

Please advise on my thoughts