Install the SEP Agent on Offline PCs With a Saved Package
Remote Push is the fast road, but it has a hard requirement: the target PC must be on, reachable and manageable across the network right now. Every office has machines that fail that test — a PC being repaired, a laptop at a branch site, a brand-new computer that has not joined the network yet. SEP has a second road built for exactly these: save the install package and carry it to the machine.
🎥 Watch the full deployment in the video — SEPM console, wizard and push, step by step
In the same Client Deployment Wizard where you choose Remote Push, there is a Save Package option. It builds the install files — carrying the client group, feature set and the communication settings that tell the agent which manager to report to — into a package you can copy to a file share, a USB drive or a software deployment tool you already use. The PC installs it locally, and the agent checks in the first time it can reach the manager.
Saved install package — exported from the wizard
SEP_Client_Package\
setup files as exported by the Client Deployment Wizard
carries: client group + feature set + manager settings
Copy to: file share, USB drive, or your deployment tool
The saved package is a normal install folder with the management settings baked in — nothing about the agent is different, only how it travels. (Illustrative panel.)
1
When Remote Push Is the Wrong Tool
Reach for the saved package in these situations instead of fighting the push:
The PC is powered off or being built and is not on the network yet.
The machine sits at a branch site or behind a connection the manager cannot push across.
A laptop is out of the office and will not be back soon.
You already roll out software with another tool (imaging, group policy, a deployment share) and want SEP to ride along.
2
Save the Package in the Client Deployment Wizard
The export takes the same preparation as a push — group and settings are decided here:
In SEPM, start the Client Deployment Wizard from the Home page's Common Tasks menu.
Select the install package (version, feature set, install settings) — or create it now.
Choose the client group these machines should land in; the package carries that choice with it.
Choose Save Package instead of Remote Push, and save the exported files to a folder you control.
3
Run the Installer on the PC
Installation itself is an ordinary local install, with two honest requirements:
You need administrator rights on that PC — a standard user cannot install a security agent.
Run the package's setup and let it complete; restart the PC if it asks.
If the PC still runs a different antivirus, handle that first — the same two-scanner rule applies however the package arrived.
Copy the package over the network share or carry it on USB for a machine that truly has no connection yet.
4
What Happens When the PC Reaches the Network
The agent already knows where home is, because the manager's address travelled inside the package:
On its first connection, the client checks in with SEPM and appears in its group on the Clients page.
It then takes the group's policies and pulls current content and definitions.
Until that moment the PC runs on the definitions baked into the package — which is why you include current content when you build it.
If a PC never appears after joining the network, the problem is the road to the manager (reachability, the client communication port), not the package.
🟡 Keep exports fresh: a saved package freezes the version, group and communication settings of the day you exported it. After a version upgrade, a group reorganisation or a manager change, export a new package — installing last quarter's package creates this quarter's confusion.
🎥 Watch the Full Video
See the complete SEP agent deployment on screen — every wizard screen and the result in the console.
Does the saved package work on a PC with no network at all?
Yes, the installation itself works fully offline. The agent simply cannot report in or fetch new definitions until the PC can reach the manager, so the definitions inside the package are what it runs on until then.
Can I put the saved package on a file share for users to run?
You can distribute it that way, but installation needs administrator rights on the PC, so ordinary users will be stopped by Windows. It works better through an admin-run deployment tool, a login by IT, or a visit from the technician.
How is this different from Remote Push?
Only the delivery differs. Remote Push copies the package across the network and starts it for you; the saved package is installed locally by hand or by another tool. The agent, group and policies that result are the same.
This guide is based on the Technical Anshu video on deploying the SEP agent • Stuck on a step? Ask in the video comments 🙏