Ahhhhhhhhhhhhh.
When sophos downloads the new IDE files, it updates the sav.cfg in the NTInst folder with the new version, it is just an incremented number.

When the clients do a scheduled update from the "distribution" server the value in sav.cfg is written to the registry of the client.

So, if you compare the two values you know the status.

The main reason we have to do this, is 'cos of security on the network I am monitoring, SAVADMIN can not see the clients [Embarrassed]

.