There is a default query in epo for agent installs, but it isn't going to differentiate between installing it manually or via epo task.
How to tell if a system is on vpn can be determined by the mac address. VPN users will return the mac address of the vpn concentrator (see kb52949). When you see systems with those mac address or addresses, they are currently using vpn. If not on vpn, they will have mac address of the nic on the system. So that can change, depending on how the system is connected.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?