The agent installed without a single error — and the console has never heard from it. Before you reinstall anything, run three tests that split the fault cleanly: DNS, ports, and the agent itself.
An agent that does not check in is the most common Endpoint Central complaint, and reinstalling is the most common wrong response. The agent is a small service with a simple job: resolve the server’s name, open a connection to it, and report in — by default on a 90-minute refresh cycle. When that fails, exactly one of three layers is broken: the PC cannot find the server (DNS), cannot reach it (ports and firewall), or the agent itself is stopped or damaged. Test them in that order and the culprit names itself.
Test-NetConnection EC-SERVER -Port 8020
This PC can reach the console port but not the notification port — on-demand tasks will fail even though the agent looks alive. That one red line explains the whole complaint.
Example output. Run the test for 8020, 8383 and 8027 — partial success is the clue most people miss.
A PC that was just switched on may legitimately show an old last-contact time. Judge “not checking in” only after the machine has been on and connected for a full refresh cycle.
The agent’s whole world: one name, three ports, one rhythm. Test exactly those.
Agents are deployed with a server name, not just an IP. On the affected PC, run ping <server-name> and nslookup <server-name>. If the name does not resolve, or resolves to an old IP, nothing else matters — fix DNS (or the stale record) first. This is the classic failure after a server IP change: the agents are faithfully contacting an address where the server no longer lives.
From the same PC, run all three checks: Test-NetConnection <server-name> -Port 8020, then -Port 8383, then -Port 8027. All three should show TcpTestSucceeded : True. Any False points at a firewall — on the server, on the client, or a network firewall between VLANs. Remember that partial success is meaningful: 8020 open with 8027 blocked gives an agent that reports inventory but never accepts a scan, a deployment or a remote session when you ask for one.
Open services.msc on the client and confirm the Endpoint Central agent service is Running and set to start automatically. If it is stopped, start it and watch whether it stays up. A service that stops again within minutes is being killed — most often by an antivirus quarantine (add an exclusion for the agent folder) or by a corrupted installation. Check the Windows Event Viewer on that PC before reinstalling; it usually names what stopped the service.
If the PC was imaged from another office’s build, or the server was renamed or re-IP’d after deployment, the agent may be healthy and simply aimed at the wrong address. ManageEngine provides a correction script for exactly this: run cscript configureDCAgentServerCommunication.vbs <ServerName> <ServerIP> 8020 8383 https on the client with your real server values. One run re-points the agent — no reinstall, no data loss.
Before declaring a fault, eliminate behaviour that only looks like one. The PC was off, asleep, on home Wi-Fi without VPN, or simply has not completed a refresh cycle since boot. Laptops are serial offenders: a machine that checks in every office day and goes quiet on work-from-home days is usually healthy. Look at the pattern of last-contact times across a week, not a single red row.
Every setting on this page is shown live in the ManageEngine configuration video — watch it once and your own setup becomes easy.
▶️ Watch Full VideoBy default the agent refresh cycle is 90 minutes. A computer that has been on and connected for less than one cycle may simply not have reported yet — judge a missing check-in only after a full cycle on a connected machine.
That pattern points at port 8027, the notification server port used for on-demand tasks like patch scans, inventory scans and remote control. Test it from the client with Test-NetConnection; a blocked 8027 leaves the agent visible but unreachable for tasks.
Every agent must be told the new address. ManageEngine’s configureDCAgentServerCommunication script re-points agents to the new server name and IP, and it can be pushed through a GPO so you do not visit each PC.