Endpoint Central Server System Requirements and Ports to Open Before Installation
Half of all Endpoint Central problems are born before the installer even runs — an undersized server or one closed port. Use this checklist first and the install becomes boring, in a good way.
✍️ Technical Anshu🪟 Windows Server⏱️ 15 minute checklist
🎥 See the server being installed and configured in the full video
Endpoint Central is a client-server product. The server holds the web console and database, the agent on every PC talks to it, and a handful of TCP ports carry everything. This page gives you ManageEngine's own sizing numbers and the complete port list, so you open the right doors once instead of debugging closed ones for a week.
Windows Defender Firewall — Inbound Rules
TCP 8020 — Endpoint Central console and agentAllow
TCP 8027 — On-demand tasksAllow
TCP 8443 — Remote control (secure)Allow
TCP 8020 — blocked on a second firewall profileCommon miss
The firewall exceptions that must exist on the Endpoint Central server
1
Server Hardware by Endpoint Count
ManageEngine publishes sizing in bands. For 1 to 250 computers, the server baseline is a Core i3 class processor (2 core / 4 thread, around 2.4 GHz), 4 GB RAM and about 10 GB disk kept exclusively for Endpoint Central. The 251 to 500 band keeps similar CPU and RAM figures with the same exclusive-disk condition. Agents are light: Pentium 1 GHz, 512 MB RAM and a few GB of disk. The network card should be 1 Gbps.
Treat the published numbers as a floor, not a target — patch binaries and the database grow every month
For thousands of endpoints, ManageEngine recommends Windows Server OS, enterprise or SSD storage, a distribution server per 1000 computers, and SQL Server on a separate machine above roughly 10,000 endpoints
Put the server on a static IP. A DHCP address change breaks every agent at once
2
Ports to Open on the Server
8020 — agent to server communication and the web console
8027 — on-demand tasks started from the console: inventory scan, patch scan, remote control, remote shutdown, moving agents between remote offices
8383 — secured communication between agent and server
8443 — remote control with secured communication
8444 — remote control feature
389 and 636 — talking to your Active Directory domain controller (LDAP and LDAPS), needed when the server syncs domain computers
Add these as inbound exceptions in the firewall on the server machine itself — and remember a perimeter or cloud firewall in front of it needs the same holes for branch offices.
3
Ports Needed on Client Computers for Agent Push
These are only needed while the server remotely installs the agent; they are not required for day-to-day agent traffic afterwards.
135 — remote administration (RPC) so the server can start the install
139 and 445 — File and Printer Sharing, used to copy the agent files to the client
On Windows clients, enabling the predefined File and Printer Sharing and Remote Administration firewall groups covers these. A GPO is the clean way to do it for the whole domain.
4
Prove Each Port Before You Install ⭐
Do not trust the firewall rule list — test from a real client PC with PowerShell:
On a client computer, open PowerShell and run Test-NetConnection -ComputerName YOURSERVER -Port 8020
You want TcpTestSucceeded : True. Repeat for 8027 and 8443
On the server, run netstat -ano | findstr :8020 after installation to confirm the service is actually listening
True means the agent will be able to reach the server — False means fix the firewall first
⚠️ One silent trap: if the server machine has multiple IP addresses (two NICs or a virtual adapter from Hyper-V or VMware), Endpoint Central scans are known to time out. Disable the unused virtual adapters on the server.
🎥 Watch the Installation With These Ports in Place
The full server installation and first agent push, shown step by step in the video.
Is 4 GB RAM really enough for the Endpoint Central server?
That is ManageEngine's published baseline for up to about 250 endpoints, with the disk and resources reserved exclusively for Endpoint Central. In real offices, 8 GB is a more comfortable starting point once patch storage and reporting grow.
Do I need to open port 8020 to the internet?
No. On a LAN it stays inside your network. It only needs to be reachable from the internet if you manage roaming or branch computers over the WAN — and then ManageEngine recommends a Secure Gateway Server in front of it rather than exposing the main server directly.
Which database does Endpoint Central support?
The bundled PostgreSQL that the installer sets up by default, or Microsoft SQL Server (2016 and later, Standard or Enterprise recommended for the SQL host). Most small and mid-size setups stay on PostgreSQL.
This guide is based on the Technical Anshu video on Endpoint Central installation • Stuck on a step? Ask in the video comments and you will get a reply 🙏