Users report abnormal behavior on systems where Symantec Endpoint Protection is installed.

Which tool can an administrator run on the problematic systems to identify the likely cause of the abnormal behavior?