Jump to main content
Check Point Endpoint Security Administration Guide
Check Point Endpoint Security Administration Guide
Important Information
Revision History
Lists all updates made to the Endpoint Security Administration Guide, grouped by year. The latest change appears at the top.
Introduction to Endpoint Security
Getting Started
Creating an Account in the Check Point Portal
Endpoint Security for Managed Security Service Providers
Accessing the Endpoint Security Administrator Portal
Creating a New Endpoint Management Service
Managing Licenses
Account Trial and Licensing
Extending Trial Period
Amazon Web Services Marketplace
Activating the License
License Violation
Getting Started Walkthrough Wizard
Specific Service Roles
Video Tutorials
How to Add Exclusions using Smart Exclusions in Endpoint Security
How to Deploy Endpoint Security Client Using Microsoft Intune
How to Create a Custom Dashboard
How to Perform the Run Diagnostics Push Operation in Endpoint Security
How to Generate Security Reports in Endpoint Security
How to Create a Threat Prevention Policy Template in Endpoint Security for MSSPs
How to Configure Automatic Patch Updates in Endpoint Security
How to apply Data Loss Prevention (DLP) rule in Endpoint Security
Threat Hunting
Quarantine Management
Reconnect Tool
Windows
macOS
Supported Operating Systems for the Endpoint Security Client
Endpoint Security Client Requirements for Microsoft Windows
Endpoint Security Client Requirements for Microsoft Windows Server
Endpoint Security Client Requirements for macOS
Endpoint Security Client Requirements for Linux
Supported Browsers for the Browser Extension
Migrating an On-premises Security Management Server to Endpoint Security
Infinity AI Copilot
Deploying Endpoint Clients
Installation Token
Automatic Deployment of Endpoint Clients
Describes how to deploy Endpoint Security clients automatically by using deployment rules, the Tiny Agent, the Vanilla Client, and the Endpoint Security Component Package on Windows, macOS, and Linux endpoints.
Manual Deployment of Endpoint Security Clients
Using the Export Package
Using the Offline Installation
Installing the Exported Package or Client
Adding a New VPN Site to an Exported Package
Remote Installation of Initial Client
Setting the Deployment Agent
Setting the Target Devices
Remotely Installing the Initial Client
Anti-Malware Settings
Heartbeat Interval
Configuring Alerts
Advanced Alerts
Configuring Advanced Alerts
Duplicating an Advanced Alert
Editing or Creating a Notification Profile
How to Verify that Endpoint Security can Access Check Point Servers
Uninstalling Third-Party Anti-Virus Software Products
Viewing Operational Overview, Security Overview and Reports
Unified Dashboard
Custom Dashboard
Operational Overview
Security Overview
Reports
Scheduled Reports
Browser Settings
Chrome on Windows
Firefox on Windows
Microsoft Edge on Windows
Brave on Windows
Chrome on macOS
Firefox on macOS
Microsoft Edge on macOS
Enabling the Browser Extension on a Browser with Incognito or InPrivate Mode
Ending the Browser Process Running in the Background
Managing Accounts in Check Point Portal
Managing Browser - Classic
Viewing Computer Information
Viewing Endpoint Posture
Vulnerability Assessment Table
Patch Status Messages
Device Details Widget
CVE Details Widget
Scanning Devices
Mitigating Vulnerable CVEs
Managing Devices
Managing Storage and Peripheral Devices
Managing Storage Device Groups
Using Wild Card Characters
Viewing Events
Configuring Endpoint Policy
Configuring the Threat Prevention Policy
Policy Mode
Web and Files Protection
Behavioral Protection
The Behavioral Guard & Anti-Ransomware Component
Advanced Behavioral Guard & Anti-Ransomware Settings
The Anti-Exploit Component
Automated Attack Analysis (Forensics)
Adding Exclusions to Rules
Legacy Exclusions
Smart Exclusions
Managing Exclusions
Quarantine Management
Managing Quarantined Files
Quarantined file fields
Acting on Quarantined Files and Applications
Endpoint Security Client Device Restart Requirements
Security Policy - Best Practices
Behavioral Protection - Low Memory Mode
Analysis & Remediation - Termination of Trusted Processes (LOLbins)
EndpointFirewall - Deployment for Remote Attack Containment
Endpoint Firewall - Network Micro-Segmentation for Lateral Movement Prevention
Configuring Client Settings
User Interface
Log Upload
Installation and Upgrade Settings
Automatic Client Update
General Settings - Authenticated Proxy
Sharing Data with Check Point
Connection Awareness
Super-Node
Super Node Overview
Configure a Super Node through the Toolbar
Configure a super node proxy for an offline environment
Disable Capabilities
Network Protection
Push Operations
Configuring the Data Protection Policy
Configuring Full Disk Encryption
Policy Rule Components
Check Point Disk Encryption for Windows
Authentication before the Operating System Loads (Pre-boot)
Enable Pre-Boot authentication
Temporary Pre-boot BypassSettings
Advanced Pre-boot Settings
User Authorization before Encryption
User Assignment
Smart Pre-Boot
Enabling Smart Pre-boot
Easy Unlock
Responding to a request
Self Unlock
BitLocker Encryption for Windows Clients
Taking Control of Unmanaged BitLocker Devices
FileVault Encryption for macOS
Pre-boot Authentication Methods
Configure the authentication method for Password or SmartCard
Before You Configure Smart Card
Password Complexity and Security
Passwordless Pre-boot Authentication
Enable Passwordless Pre-boot authentication
User Account Lockout Settings
Remote Help Permissions
Logon Settings
Installing and Deploying Full Disk Encryption
Viewing Full Disk Encryption (FDE) Status of an endpoint Device
Output Parameters
Configuring Media Encryption & Port Protection
Configuring the Read Action
Configuring the Write Action
Configuring Business-Related File Types
Creating User Overrides (UserCheck)
Configuring Authorization Settings
Managing Devices
Managing Storage and Peripheral Devices
Managing Storage Device Groups
Using Wild Card Characters
Viewing Events
Advanced Settings for Media Encryption
UserCheck Messages
Media Log
Site Configuration
Lockout Settings
Offline Access
Media Encryption Remote Help​
Port Protection
Media Encryption Access Rules
Configuring Access and Compliance Policy
Firewall
Configuring Inbound/Outbound Rules
Managing Firewall Objects and Groups
Configuring Firewall Rule Advanced Settings
Configuring Security Zones
Application Control
Creating the List of Applications on the Reference Device
Configure Terminate Settings
Custom Rules for Windows
Custom Rules for macOS
Disabling or Enabling Windows Subsystem for Linux (WSL)
Developer Protection
Compliance
Planning for Compliance Rules
Configuring Compliance Policy Rules
Remote Access Compliance Status
Compliance Action Rules
Check Objects
Remediation Objects
Ensuring that Windows Server Updates Compliance Check
Detecting Common Vulnerabilities and Exposures
Monitoring Compliance States
IoC Management
Connected, Disconnected and Restricted Rules
Policy Operation
Data Loss Prevention (DLP)
Sample Data Type
Creating a DLP Rule and Associating with an Event
Creating a Custom Data Type Group
Adding an Existing Data Type to a Group
Editing a Data Type or GroupData Type or Group
Duplicating a Data Type or a Group
Deleting a Data Type or a Group
Managing Microsoft Sensitivity Labels for DLP
Creating a DLP Rule and Associating with an Event
Rule Configuration Logic
Context Objects
Enabling GenAI Protect
Import or Export Policies
Capabilities of Offline Endpoint Security Client
Performing Data Recovery
BitLocker Recovery
FileVault Recovery
Managing Virtual Groups
Managing Active Directory Scanners
Managing Microsoft Active Directory Scanner
Managing Microsoft Entra ID Scanners
Configuring the Settings in the Microsoft Entra ID Portal
Importing Objects from Microsoft Entra ID
Giving Remote Help to Full Disk Encryption Users
Active Directory Authentication
Endpoint Security Logs
Query Language Overview
Exporting Logs
Sending Security Reports
Push Operations
Push Operations Dashboard Widgets
Push Operations Table
Available Actions from Push Operations
Creating a Push Operation
Create a push operation to run a predefined task remotely on the managed endpoint devices.
Affected Devices Table
Filtering the Push Operations
Certificate Management
Forensics Data
Threat Hunting
Using Threat Hunting
Downloading Forensics Reports
Endpoint Security for Linux
Key Threat Prevention Technologies
Supported Linux Versions
Installation on Semi-Isolated Environments with Super Node Proxy
Deploying Endpoint Security for Linux
Endpoint Security for Linux Runtime Configurations
Endpoint Security for Linux CLI Commands
Endpoint Security for Linux Additional Information
Endpoint Security for Windows Virtual Desktop Infrastructure (VDI)
​Configuring Clients for Persistent Desktops
Configuring Clients for Non-Persistent Desktops
Basic Golden Image Settings
Assigning Policies to VDI Pools
Limitations
Appendix
Endpoint Security for Terminal Server/ Remote Desktop Services
Deploying the Endpoint Security Client on a Terminal Server / Remote Desktop Service
Configuring Threat Emulation (TE) Appliance for Endpoint Security
Step 1 - Configure the Threat Emulation Appliance on SmartConsole
Step 2 - Create a Threat Emulation Appliance Object in the SmartConsole
Step 3 - Enable Threat Prevention API
Step 4 - Threat Emulation Configuration in Check Point Portal
Managed Security Service Providers (MSSP)
MSSP Essentials
MSSP Custom Dashboard
MSSP Dashboard
Account Dashboard
Managing a Custom Dashboard
Optional Widgets
Service Management
Reports for MSSP
Global Exclusions
Templates for Child Accounts
Threat Prevention Policy Template
Software Deployment Policy Template
Smart App Control
Recent Tasks
Known Limitations
Appendix A - Deploying Endpoint Security Client using SCCM
Appendix B - Uninstalling the Client (For macOS and Windows)
Appendix C - Deploying Endpoint Security Client Using Microsoft Intune
Appendix D - Microsoft Intune Wipe and Windows Reset with Full Disk Encryption