The setup wizard finished and the console opened. Before you invite a single computer into management, run this checklist — every item on it prevents a specific, well-known first-month failure.
Endpoint Central installs in minutes, which creates a dangerous feeling that the work is done. It is not. The installation only places the software; the first configuration decides whether the server will still be reachable, correctly named and properly backed up six months from now. Work through this checklist in order — each item takes minutes, and each one closes a door through which a very common problem walks in.
If this service is stopped, the console, the agents and every scheduled task stop with it. Confirm it is set to start automatically so a server reboot never becomes a support call.
One service runs the whole product. Check it first whenever the console does not open.
Agents remember the name and IP they were deployed with. A DHCP address that changes next month takes every agent offline at once.
Example values. The lesson is real: freeze the server’s name and IP before the first agent goes out.
Open the network adapter settings on the server machine and assign a fixed IP outside your DHCP pool (or create a DHCP reservation). Then confirm the computer name is the name you want permanently — renaming the server later forces a correction script onto every agent. Test from any client PC with ping <server-name> and make sure DNS answers with the static IP you just set.
Create inbound firewall rules on the server for 8020, 8383, 8027, 8443 and 8444. Then prove each one from a workstation, not from the server itself: Test-NetConnection <server-name> -Port 8027 should return TcpTestSucceeded : True. The notification port 8027 is the one admins forget, and its absence looks exactly like broken patch scanning and dead remote control.
Run services.msc, find ManageEngine UEMS - Server, and confirm it is Running with startup type Automatic. If you ever change ports in the server configuration files, this is the service you restart to apply them — and every port change must then be pushed to the agents, which is one more reason to choose ports once and leave them alone.
Agent push installation needs a credential with local admin rights on every client. Decide deliberately: in a domain, use a dedicated service account created for Endpoint Central — not your personal admin account, and never the domain Administrator. In a workgroup, know that you will be typing a local admin credential per machine. Write down which account the product uses, where its password lives, and who else knows it. Future-you, debugging a failed push at midnight, will be grateful.
In the console, open Admin → Scope of Management and add just three to five computers: your own machine plus a few cooperative users. Everything — agent push, patch scan, first deployment — gets proven on this group first. A pilot group feels slow on day one and feels like genius on the day a bad configuration would otherwise have hit two hundred PCs.
While the console is open: set the correct time zone, configure the mail server and send a test mail, and enable the scheduled database backup to a folder on another machine. None of these takes five minutes. All three are miserable to retrofit after the first incident.
Every setting on this page is shown live in the ManageEngine configuration video — watch it once and your own setup becomes easy.
▶️ Watch Full VideoThe server’s static IP and final name, because every agent remembers them. Then the firewall ports (8020, 8383, 8027, 8443, 8444), the server service startup type, the admin credential used for agent pushes, and a small pilot group in the Scope of Management.
Usually one of three things: ports 135 or 445 are blocked on the client, the credential used for the push has no local admin rights on that PC, or the client cannot resolve the server name. All three are checklist items, not product defects.
Yes, but every agent must then be told the new address — with a script pushed to each machine or a GPO. It is far easier to freeze the address before the first agent is deployed.