Installing ManageEngine Endpoint Central is only half the job. Until the server identity, ports, scope, agents and backup are configured properly, the console manages nothing. Here is the full post-install configuration, in the order that actually works.
Most Endpoint Central problems that admins meet in the first month — agents that never appear, patch scans that fail, reports that never arrive — are not software bugs. They are configuration steps done in the wrong order, or skipped completely. This guide walks through the complete post-install configuration the calm way: first fix the server’s identity so it never has to change, then open the right ports, define what you will manage, deploy agents, and only then switch on patching, software deployment and reports. Do it in this order and the product feels simple. Do it randomly and you will spend weeks chasing your own settings.
On the client side, pushing the agent also needs 135 and 445 reachable. If any one of these is blocked, one feature silently fails while the rest look fine.
The five server ports behind almost every Endpoint Central feature — check them before you configure anything else.
Computers managed: 0 • Agents installed: 0 • Patches scanned: never
An empty console after installation is normal. Endpoint Central manages nothing until you define the Scope of Management and deploy the agent. Installation finished the product — configuration is what turns it on.
Zero managed computers on day one is not an error. It simply means the configuration steps on this page have not been done yet.
Every agent you deploy will remember one server name and one IP address and will keep contacting exactly that address. If the server’s IP changes later — because it was on DHCP, or the PC got renamed — every agent goes silent at once. So before deploying a single agent:
ping <server-name> from any workstation and confirm the reply comes from the right IP.Five minutes here saves the single most common Endpoint Central disaster: a healthy server that no agent can find.
On the server, allow these ports inbound in Windows Firewall (or your network firewall): 8020 for the web console and agent communication over HTTP, 8383 for agent communication over HTTPS, 8027 for the notification server that pushes on-demand tasks like patch scans, inventory scans and remote control, and 8443 / 8444 for remote desktop sharing and remote control.
Do not trust the firewall rule — test it. From a client PC, run Test-NetConnection <server-name> -Port 8020 and the same for 8383 and 8027. TcpTestSucceeded : True on all three means agent traffic will flow. ManageEngine’s own patch knowledge base lists exactly these ports as the first thing to check when scans fail, and it is right — blocked 8027 is why scans and remote sessions quietly do nothing while the console looks healthy.
Decide now whether agents will talk to the server over HTTP or HTTPS, because changing it later means touching every agent again. For a small office LAN on the free edition, many admins start with the default setup. The moment the server must be reachable from outside the office — home users, branch offices — switch agent communication to HTTPS on port 8383 and secure the remote control channel as well, exactly as ManageEngine recommends for WAN agents. Never expose the plain HTTP console to the internet.
The Scope of Management is the list of computers Endpoint Central is allowed to manage. Go to the Admin tab, open Scope of Management under Global Settings, and add computers in a controlled way: connect your Active Directory or workgroup, then add one department or one OU at a time — not the entire company on day one.
Start with your own PC and two or three friendly users as a pilot group. Every later feature — patching, software deployment, reports — gets tested on this pilot before it touches everyone. Adding everything at once is how a small mistake becomes a company-wide incident.
From the same Scope of Management screen, select the pilot computers and click Install Agent. The push installation needs ports 135 and 445 open on the clients and an admin credential the server can use on those PCs. For domain networks, the GPO routes (startup script, scheduler, or the lightweight GPO tool) scale far better than pushing — there is a dedicated page in this series comparing all the deployment methods.
Wait for the agent’s refresh cycle — by default an agent contacts the server every 90 minutes — and confirm the pilot PCs show as managed with a recent last-contact time. Only then widen the scope.
Resist the habit of giving every technician the full administrator login. Open the user management settings and define roles first: who may deploy software, who may only view reports, who may take remote control. Then create individual technician accounts under those roles. The free edition supports one technician, which makes this step feel optional — it is not. The day a second person gets access, shared passwords and full rights are already a habit. Set the pattern while the setup is small.
Reports, alerts and notifications all leave through one mail server setting. Configure it now, with a real mailbox, and send the test mail the settings page offers. A surprising number of admins discover a broken mail configuration months later — on the day an auditor asks for the patch reports that were never delivered. Five minutes today, proof in your inbox today.
The Endpoint Central database holds your inventory, configurations, deployment history and audit trail. Enable the scheduled database backup from the Admin settings, point it at a folder that is not on the server itself — a NAS share or another machine — and note the backup in your calendar to verify once a month. A backup that sits on the same disk as the server is not a backup; it is a second copy of the same accident.
Now, and only now, configure the working features in a safe order: patch scanning first (scan-only, no deployment) so you can see the real patch status of the pilot group; then an automatic deployment rule limited to that pilot; then one simple software package; then remote control with user consent enabled. Each feature gets a day of observation on the pilot group before it goes company-wide. This patience is the entire difference between a configuration guide and a collection of emergency fixes.
Every setting on this page is shown live in the ManageEngine configuration video — watch it once and your own setup becomes easy.
▶️ Watch Full VideoServer name and static IP first, then firewall ports 8020, 8383 and 8027, then the agent communication protocol, then Scope of Management with a small pilot group, agent deployment, roles and technicians, mail server settings, scheduled database backup, and only then patching and software deployment — one feature at a time.
On the server: 8020 for the web console and agent communication over HTTP, 8383 for agent communication over HTTPS, 8027 for the notification server that pushes on-demand tasks such as patch scans and remote control, plus 8443 and 8444 for remote desktop sharing and remote control. Pushing the agent to clients also needs ports 135 and 445 reachable on the client side.
That is normal. Endpoint Central manages nothing until you define the Scope of Management under the Admin tab and deploy the agent to those computers. An empty console simply means the configuration steps have not been done yet.