Automatic Deployment of Endpoint Clients

The Tiny Agent functionality introduces a few major improvements to the current Initial Client package (which is a very thin client, without any blade, used for software deployment purposes).

The Initial Client is the Endpoint Agent that communicates with the Endpoint Security Management Server A Security Management Server that manages your Endpoint Security environment. Includes the Endpoint Security policy management and databases. It communicates with endpoint clients to update their components, policies, and protection data..

You can extract the Initial Client from the Tiny Agent.

The improvements include:

• The Tiny Agent has a very small executable (smaller than 1MB)

• It can be shared in various forms, enabling fast, easy and seamless first-time deployment.

• Once combined with the Dynamic Package, it installs only what is necessary for each machine.

• It is agnostic to the client version.

• It passes Smart Screen validation - no more download warnings

• It reduces network traffic for installing selected blades.

It is available for cloud deployments and for on-premises deployments running Endpoint Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. R81 or higher.

To download the Tiny Agent:

1. Do one of these:

   • Click Overview, and then click Download Endpoint on the top banner.

   • Click Policy > Deployment Policy > Software Deployment, and then click Download Endpoint on the top banner.

   The Download Harmony Endpoint window appears.

2. Select a Download version and a Virtual group, and then click Download for an OS.

3. For Windows OS, the system downloads the EndpointSetup.exe file. Run the .exe file on the endpoint to install the Harmony Endpoint Security client.

   Note - To extract the MSI file, run: EndpointSetup.exe /CreateMSI

4. For macOS, the system downloads the EPS_TINY.zip file. Transfer the zip file to the endpoint.

   Caution - Do not change the EPS_TINY.zip file name.

   1. Unzip the file and open the EPS_TINY folder.

   2. To install the Harmony Endpoint Security client, do one of these:

      • Run the EPNano.app file.

      • In the terminal window, run:

        ./EPNano.app/Contents/MacOS/EPNano

5. For Linux OS, the system downloads the installScript.sh file. Run the installScript.sh file on the endpoint to install the Harmony Endpoint Security client.

Troubleshooting Issues with the Tiny Agent on Windows OS

The Tiny Agent shows simple error messages in cases of network issues (connectivity problems, proxy issue, and so on).

Error messages and Remediation

Console Error	Description	Remediation
Endpoint Setup failed!	Exception occurred (either allocation failed on any internal component, or another type of abnormal termination)	Download the file again and check its signature (it could be corrupted), and make sure you have enough free RAM.
Failed to initialize Endpoint Setup!	Either we cannot verify our own signature, or map the installer in the memory.	Make sure you have enough memory.
Failed to parse internal data!	Failed to parse the URL for downloading eps.msi from CDN	File downloaded from the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. is corrupted. Contact Check Point Support.
Failed to download or verify Windows Installer package (EPS.msi)!	Failed to verify downloaded EPS.msi	Make sure that your Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources., or any network security component, does not corrupt the installer.
Failed to find program files folder	Failed to get program files from Microsoft.	Make sure your OS is updated.
Failed to create our program files folder for config.dat	Either there is some Check Point product installed, or the Administrator cannot create folders in the Program Files folder	Make sure that the Endpoint Security Client is not already installed.
Failed to save config.dat	Either there is some Check Point product installed, or the Administrator cannot create folders in program files folder	Make sure that the Endpoint Security Client Application installed on end-user computers to monitor security status and enforce security policies. is not already installed.
Failed to install the product	Cannot run Windows Installer to install EPS.msi	Make sure Windows Installer is enabled.
Failed to download Windows Installer package (EPS.msi)!	Failed to download eps.msi	Make sure you have access to CDN: sc1.checkpoint.com
Failed to authenticate EndpointSetup!	Data corruption occurred, or data added to the file is corrupted	Make sure the file is not corrupted, and/or that you downloaded it from the correct location.
Failed to parse configuration data	Failed to find the server config information.	Make sure you downloaded the file from the portal.
Setup failed another installation is currently in progress	Another installation is stuck, or has not finished.	Reboot the machine, or fix/complete any pending installation.

Log File Location

The log file is located here:

C:\Windows\System32\LogFiles\WMI\EndpointSetup.etl

Silent Installation

Run:

PsExec.exe -accepteula -nobanner -s "C:\Users\<Administrator Username>\Desktop\EndpointSecurity.exe"

This package includes the specified components to be installed on the endpoint device.

You can distribute it automatically with deployment rules.

You can configure the policies for the components before or after you deploy the component package.

Deploy the Endpoint Security component package with deployment rules.