SEPM registers somewhere when the client deactivates the antivirus.

We need to know if the antivirus console registers those instances in which the client at the workstation level is deactivated through the administration key.
The idea is to have a report with those teams that for some reason their client has been disabled.