Manual Device Endpoint Enrollment Architecture In ITarian Endpoint Manager

Manually enrolling a device into ITarian Endpoint Manager requires generating an authenticated client installer package directly from the Endpoint Manager portal, distributing it to the target host, and executing it with elevated administrative privileges. Successful enrollment relies on active user/company token assignment, outbound network clearance on ports 443 and 5222, and the automatic initialization of the ITarian Communication Client service.

Pre-Enrollment Infrastructure Requirements and System Audits

Before initiating a manual device enrollment, network administrators and Managed Service Providers (MSPs) must ensure that target operating systems meet software dependencies and that local security policies do not impede the deployment of the ITarian Communication Client (CC) and ITarian Endpoint Security (CES) modules. Operating system hosts must maintain active, unthrottled outbound internet connectivity to communicate with ITarian management servers.

Essential Tools and Administrative Privileges

• Local Administrator rights on Windows target endpoints, root access on Linux distributions, or Administrator credentials with System Extension approvals on macOS systems.
• Active ITarian portal access with permissions to view, edit, and create tokens inside the Endpoint Manager module.
• Storage device (USB drive) or local network share (SMB/NFS) for offline file transfer, or direct internet access on the target machine to download the generated installer package directly.

Mandatory Prerequisite Standards and System Settings

• Outbound firewall access permitted for destination ports TCP 443 (HTTPS communication) and TCP 5222 (XMPP real-time push notification service).
• Time synchronization enabled via NTP across target devices; time drift exceeding 300 seconds will cause SSL/TLS certificate validation handshakes to fail during token authentication.
• Operating System Baseline: Windows 7 SP1 or higher (Windows Server 2008 R2 or higher), macOS 10.13 High Sierra or higher, or major Enterprise Linux distributions (Ubuntu 16.04+, Debian 8+, RHEL/CentOS 7+).

Deployment Benchmarks and Metrics

• Estimated deployment duration: 3 to 7 minutes per individual device.
• Default enrollment token lifecycle: 30 days (configurable up to 90 days inside Endpoint Manager settings).
• Agent memory footprint post-installation: ~50 MB to 150 MB RAM depending on running security modules.

Step-by-Step ITarian Manual Agent Deployment Workflow

Step 1: Generate the Provisioned Endpoint Installer Package

1. Log in to your ITarian administrative dashboard and navigate to the Endpoint Manager module.
2. Expand the Devices section in the left-hand navigation pane and select Device List.
3. Click the Enroll Device button located on the top action bar to open the enrollment configuration wizard.
4. Select the designated Customer Company from the drop-down menu to which the target device belongs, then select the corresponding User Account who will act as the registered device owner.
5. Choose the target operating system platform corresponding to the machine you intend to enroll (Windows, macOS, or Linux).
6. Under the Enrollment Option menu, select Download Installer to generate a direct executable package, or select Get Option Link to generate a reusable deployment URL.
7. Select the software components to bundle into the payload:
   
   
   • Select ITarian Communication Client (CC) as mandatory for core Remote Monitoring and Management (RMM) functions.
   • Optionally select ITarian Endpoint Security (CES) if central antivirus and host firewall management are required on the target device.
8. Click Next to build the installer. The portal will synthesize an executable or package file containing an embedded dynamic token tied to your specific company ID, user context, and server endpoint hostnames. Save this file to an accessible location.

Pro-Tip: If deploying across multiple non-domain endpoints for a single customer, select a single generic service account user during package generation. The dynamic enrollment token embedded in the file name automatically binds the host to that designated customer organization regardless of local Windows user logins.

Step 2: Transfer and Execute the Installer on the Target Machine

1. Transfer the generated installer file to the target host via secure network share, encrypted flash drive, or direct portal download on the machine.
2. Verify that the installer file name has not been renamed if using Windows binaries. The string of alphanumeric characters at the end of the installer filename contains the dynamic authentication token. Modifying this string strips the authentication payload and causes enrollment to fail.
3. Launch the installer with maximum system privileges:
   
   
   • Windows: Right-click the executable file and select Run as administrator. Alternatively, open an elevated Command Prompt or PowerShell terminal and run the executable using silent switches such as /quiet for unattended installations.
   • macOS: Open the downloaded PKG package. Follow the setup wizard, enter the administrative password when prompted, and proceed through installation.
   • Linux: Open a terminal shell, grant executable permissions using chmod +x, and run the installation script or DEB/RPM package using sudo privileges.

Warning: On macOS High Sierra (10.13) and newer, Apple's Gatekeeper security policy will block the ITarian kernel extensions and System Extensions. You must navigate to System Settings > Privacy & Security on the target Mac immediately after running the installer to click Allow for the ITarian system extension.

Step 3: Verify Client Service Handshake and Gateway Connectivity

1. Following setup completion, observe the host system tray (Windows), menu bar (macOS), or running process list (Linux). The green ITarian Communication Client icon should appear within 30 to 60 seconds.
2. Confirm that the core system services are running:
   
   
   • Windows: Open services.msc and confirm that ITarian Communication Client Service and ITSMAgent are set to Automatic and currently in the Running state.
   • macOS: Check Activity Monitor or run terminal query launchctl list | grep com.itarian to confirm daemon initialization.
   • Linux: Execute systemctl status itsm or check process trees using ps aux | grep itsm to confirm the background daemon is active.
3. Check communication logs if the icon indicates a disconnected status. On Windows hosts, inspect the log files located in C:\Program Files (x86)\ITarian\Endpoint Manager\logs to verify successful REST API registration calls over HTTPS.

Step 4: Validate Registration and Assign Endpoint Profiles in ITarian Portal

1. Return to the web-based ITarian Endpoint Manager administrative portal.
2. Navigate to Devices > Device List.
3. Search for the newly enrolled endpoint using its system hostname, logged-in local user account, or internal IP address.
4. Select the checkbox next to the newly registered device and click Manage Profiles.
5. Assign the appropriate operational profile configurations (e.g., Remote Control settings, Patch Management schedules, Antivirus policies, and Monitoring rules).
6. Click Save and trigger a manual synchronization command from the portal to force the endpoint to immediately apply the assigned profiles without waiting for the default heartbeat cycle.

ITarian Client Installer & OS Deployment Parameters

Endpoint Enrollment Failures & Technical Field Remedies

Issue 1: Device Fails to Appear in Console Due to Renamed Installer File

• Root Cause: The manual executable file was renamed prior to deployment (e.g., ITarian_Installer_v2.exe). ITarian uses a specific filename string parsing methodology to extract the embedded Customer Token, User ID, and Host Domain parameters. Stripping or altering these parameters forces the installer to run without administrative context parameters, causing silent failure during cloud registration.
• Actionable Fix: Re-download the installer package directly from the Endpoint Manager portal. Do not edit, shorten, or rename the downloaded file. Transfer and execute the file using its original, unmodified string structure.

Issue 2: Communication Client Installed but Shows Offline Status Red Icon

• Root Cause: The ITarian Communication Client installed successfully, but outbound firewalls, unified threat management (UTM) appliances, or local security suites are blocking outbound traffic on TCP port 5222 or inspecting SSL traffic on port 443 via deep-packet inspection (DPI).
• Actionable Fix: Configure perimeter firewalls and localized endpoint firewalls to allow unrestricted outbound TCP traffic on ports 443 and 5222 destination-bound for ITarian cloud IP ranges. Disable HTTPS/SSL Deep Packet Inspection on network security gateways for ITarian agent communications to prevent certificate breakage.

Issue 3: macOS Enrollment Package Installs but Remote Operations Fail

• Root Cause: macOS Security framework (Gatekeeper and TCC) is blocking Full Disk Access, Accessibility permissions, and System Extensions for the ITarian binary suite.
• Actionable Fix: On the target Mac, navigate to System Settings > Privacy & Security. Under Full Disk Access and Accessibility, ensure the ITarian Communication Client and ITSM processes are explicitly enabled. If deploying via an MDM prior to manual enrollment, deploy an MDM configuration profile granting Privacy Preferences Policy Control (PPPC) payload permissions for ITarian bundle identifiers.

Issue 4: Legacy Third-Party Antivirus Prevents Agent Service Creation

• Root Cause: Existing third-party Endpoint Detection and Response (EDR) or Antivirus software flags the ITarian setup executable or service creation routines (cmdagent.exe) as suspicious behavior, quarantining installation binaries midway through execution.
• Actionable Fix: Prior to launching the manual ITarian enrollment package, add the ITarian temporary installation directory and program installation folders (C:\Program Files (x86)\ITarian) to the exclusion/allowlist of the active antivirus software. Alternatively, completely uninstall legacy security suites before executing the ITarian Communication Client installer.

Frequently Asked Questions

Can I manually enroll a device without assigning it to a specific user?

No, ITarian Endpoint Manager architecture requires every enrolled endpoint to be bound to a designated User Account and Customer Organization. If a device is unassigned or shared, administrators typically create a default service user (e.g., "Unassigned Devices" or "Generic System User") inside the ITarian console and assign manual enrollments to that baseline account.

How do I check if an ITarian dynamic enrollment token has expired?

Tokens generated inside the ITarian Endpoint Manager have a default lifespan configured during the "Enroll Device" wizard setup (typically 30 days). If you attempt to use an installer package downloaded past this timeframe, the installation script will complete local file placement but fail to register with the portal. To check or reset tokens, open the Endpoint Manager portal, go to Enroll Device, and check the expiration properties or generate a fresh link.

What ports must be open on local firewalls for manual enrollment to succeed?

Target endpoints must be allowed outbound connections over TCP Port 443 (HTTPS) for core data transmission, software updates, and REST API calls, along with TCP Port 5222 for XMPP push notification services. Inbound ports do not need to be opened on the local client firewall because the ITarian agent uses persistent outbound polling connections to communicate with cloud management brokers.

Is a system reboot required after manually installing ITarian on a client device?

Installing the core ITarian Communication Client (CC) module does not require an immediate operating system reboot. However, if you include the ITarian Endpoint Security (CES) bundle containing low-level network filter drivers, host intrusion prevention systems (HIPS), and real-time antivirus hooks, a system reboot is required for full driver injection and active protection enablement.

Streamline Your Managed Infrastructure Operations

Mastering manual endpoint deployment ensures seamless provisioning across non-domain hosts, isolated subnets, and remote endpoints. Integrate your manual workflows into your organization's standard operational procedure to guarantee complete infrastructure visibility and compliance monitoring across every client endpoint.