Endpoint enrollment and health
Enroll device identities, verify platform capabilities, handle offline agents, and retire a device.
An endpoint is a managed device associated with an asset and a revocable agent identity. Its health combines connectivity, supported controls, current policy adoption, and telemetry freshness.
Enroll a pilot device
You need Administrator authority for the target group and local installation privileges on the pilot device. Check the package catalog at Endpoints → Enrollment → Packages for its OS and architecture before creating a token.
- At Endpoints → Enrollment → Create token, select an explicit group, platform, expiry, and enrollment limit. Use a one-use token for an individual device; distribute broader tokens only through an approved device-management system.
- At Enrollment → Packages, download the signed package matching the device's OS and architecture. Verify its signature before installation.
- On the pilot device, run the installation command displayed for that package with the required local privileges. Provide the token through the installer's protected input. Do not paste enrollment secrets into shared shell history or tickets.
- Open Endpoints → Endpoint → Identity after the device reports. Compare hardware and OS details with inventory before approving a proposed association.
Tokens expire after the selected interval and cannot authorize management API calls. If enrollment fails, inspect the installer's error and the token's expiry and remaining enrollment count before creating a replacement.
A reinstall creates a new agent identity. Hostname equality alone does not authorize merging two devices or inheriting a previous device's trusted posture.
Verify capabilities and adoption
Endpoint → Capabilities lists the controls supported by its current platform and agent version, including telemetry, isolation, quarantine, DLP channels, USB control, and posture checks. A control absent from that list is unavailable; Guard does not silently emulate it. The self-hosted server's Linux requirements do not define endpoint OS support.
At Endpoint → Policy, compare assigned and applied revisions. At Endpoint → Health, inspect last contact, last telemetry, clock health, local queue status, and update state. A missing heartbeat means unknown current state; it does not prove the process stopped or the device is safe.
Offline operation and updates
While offline, an agent continues its last applied policy and buffers telemetry up to its local queue limit. When that queue fills, records can be lost. After reconnect, inspect Endpoint → Health for dropped-record counts and the affected reporting period.
Response requests have separate execution-start deadlines. An expired request does not run on reconnect, while an isolation action already applied remains in force. Use Release isolation after recovery; restoring connectivity does not release it automatically.
Stage updates under Endpoints → Updates → Create rollout for a pilot group before broad adoption. Required capabilities can change by platform and release. Read the release's compatibility report before assigning a newer policy family.
Retire and uninstall
Use Endpoint → Retire to stop new assignments and issue the approved uninstall workflow. Tamper-protected agents require a device-bound uninstall authorization under Endpoint → Maintenance → Authorize uninstall. Verify local removal and revoke the old agent identity. Retiring an offline record alone does not prove uninstall occurred. Reconcile quarantine and retained evidence before deleting the associated asset. See Endpoint API.