Mastering Manual Device Enrollment In ITarian Endpoint Manager

Manually enrolling a device in ITarian requires the local installation of the platform-specific Communication Client using a unique MSI or PKG installer generated from the Endpoint Manager dashboard. This process establishes a secure, persistent connection via Port 443, enabling full administrative oversight, remote monitoring, and security policy enforcement across Windows, macOS, and Linux environments.

Environmental Readiness and Security Perimeter Configurations

Before initiating the manual enrollment of any endpoint into the ITarian ecosystem, an administrator must ensure the target environment meets the stringent architectural requirements for agent communication. The ITarian platform, built upon the foundation of the Comodo ITSM architecture, relies on a two-part agent system: the Communication Client and the Security Client. Manual enrollment specifically focuses on the Communication Client, which serves as the primary bridge between the local machine and the cloud-based Endpoint Manager.

Success in manual deployment is contingent upon the availability of administrative privileges on the target machine. Without elevated rights, the installer cannot register the necessary background services or modify the local registry to maintain persistence. Furthermore, network topology plays a critical role. The endpoint must have outbound access to specific global endpoints. If a corporate firewall or deep packet inspection (DPI) tool is active, it must be configured to allow traffic to the ITarian infrastructure without intercepting the SSL certificates, as certificate pinning is often used to prevent man-in-the-middle attacks.

Mandatory Pre-Enrollment Checklist:

• Administrative Access: Full local administrator rights on Windows or sudo privileges on Linux and macOS.
• Network Accessibility: Outbound access to port 443 (HTTPS) and port 80 (HTTP) for certificate revocation list (CRL) checks.
• Operating System Compatibility: Windows 7 or higher, Windows Server 2008 R2 or higher, macOS 10.12 or higher, and major Linux distributions such as Ubuntu, Debian, or CentOS.
• Hardware Resources: A minimum of 512 MB RAM and 400 MB of free disk space to accommodate the agent and its log rotation.
• Whitelisting: Ensure that existing third-party antivirus solutions are disabled or configured with exclusions for the ITarian installation directories to prevent false-positive file locking.

Comprehensive Manual Installation and Communication Client Provisioning

The manual enrollment process is often preferred in scenarios where Active Directory GPO deployment is unavailable or when onboarding remote machines that are not currently part of a managed network. The following steps outline the precision workflow required to bring a device under management.

Step 1: Generating the Tailored Enrollment Package

The first stage occurs within the ITarian Endpoint Manager console. Unlike generic installers, the manual enrollment package should ideally be pre-configured for a specific user or device group to ensure that the correct security profiles are applied immediately upon connection.

Navigate to the Users section and select User List. From here, identify the user who will be associated with the device. Clicking the Enroll Device button opens a wizard where you specify the operating system. It is critical to select the correct platform here, as the binaries differ significantly between Windows (MSI) and macOS (PKG). Once the settings are confirmed, the system generates a unique download link. For a truly manual approach, you can download the installer directly to your administrative machine and then transfer it to the target endpoint via a secure USB drive or internal file share.

Step 2: Local Execution and Elevated Installation

Once the installer is present on the target machine, it must be executed with high integrity. On a Windows machine, right-click the MSI file and select Run as Administrator. If you are using the command line for a headless installation, you should use the Windows Installer service by typing msiexec, followed by the forward slash i flag and the path to the installer.

During the installation wizard, you will be prompted to accept the End User License Agreement. Following this, the installer will unpack the core binaries into the Program Files (x86) directory under the folder named ITarian. During this phase, the installer registers the ITSM Service and the ITarian Communication Client service. It is vital to monitor the progress bar for any rollbacks, which typically indicate a permission conflict or a pending Windows Update restart that is locking the system registry.

Step 3: Configuring macOS and Linux Persistence

For macOS manual enrollment, the process involves running the PKG file. Due to Apple’s high-security standards, you may need to navigate to System Settings, then Privacy and Security, to allow the installer to run if it is flagged as being from an unidentified developer. Post-installation, macOS will require the granting of Full Disk Access to the ITarian agent to allow for remote file management and scripting.

On Linux systems, the enrollment usually involves a shell script (a .sh file). You must change the permissions of the file to make it executable using the chmod command with the plus x parameter. Following this, execute the script with sudo. The script will download the necessary dependencies and establish a cron job or a systemd service to ensure the agent restarts automatically after a system reboot.

Step 4: Authenticating the Endpoint via Enrollment Tokens

In some manual deployment scenarios, particularly those involving the Bulk Installation Tool, the agent may install but remain in an unconfigured state. To link the agent to your specific portal, you must provide the Host address and the Enrollment Token.

Open the Communication Client UI on the local machine. Navigate to the settings or about section where the connection status is displayed. If the device is not yet enrolled, there will be an option to enter the server details. The Host is typically your specific ITarian instance URL, and the Token is a string of alphanumeric characters found in the Endpoint Manager console under the Bulk Installation Tab. Entering these details triggers an immediate handshake. The agent sends the hardware ID and BIOS UUID to the portal, and the portal responds by assigning a unique Device ID.

Step 5: Validating Post-Installation Service Persistence

The final step is to verify that the agent is not only installed but functioning as an active node. On Windows, open the Services Manager (services.msc) and locate the ITarian Communication Client and the Comodo ITSM Service. Both should show a status of Running and a Startup Type of Automatic.

In the ITarian online dashboard, navigate to the Device List. The new device should appear within 60 to 180 seconds. Check the status indicator; a green icon indicates a successful heartbeat. At this stage, you should manually trigger a Sync with Provider action from the portal to force the device to download its assigned security profiles, such as Antivirus settings, Firewall rules, and Patch Management schedules.

System Compatibility and Network Port Matrices

The following table details the technical thresholds and network requirements necessary for a stable manual enrollment and persistent agent communication.

Resolving Handshake Failures and Agent Synchronization Delays

Even with a meticulous manual installation, technical hurdles can prevent a device from appearing in the Endpoint Manager console. These issues are generally categorized into authentication failures or transport layer security (TLS) mismatches.

• Scenario 1: SSL Certificate Trust Errors

  
  
  
  • Root Cause: The target endpoint lacks the updated Root Certificate Authorities (CAs) required to validate the ITarian SSL certificate, or a local proxy is injecting a self-signed certificate into the traffic stream.
  • Actionable Fix: Update the Windows Root Certificates via Windows Update or manual import. If a proxy is present, add an SSL inspection bypass rule for the ITarian domains (*.itarian.com and *.comodo.com).

• Scenario 2: Duplicate Device Identifiers

  
  
  
  • Root Cause: This occurs when a manual installation is performed on a machine cloned from a virtual machine (VM) template where the ITarian agent was already installed, leading to multiple machines reporting the same ID.
  • Actionable Fix: Run the ITarian cleanup tool on the target machine to strip the existing Device ID and registry keys. Re-run the manual installer to generate a unique UUID based on the current hardware profile.

• Scenario 3: Service Startup Timeouts

  
  
  
  • Root Cause: On older hardware or systems with heavy disk I/O, the ITSM Service may fail to start within the default Windows service timeout window (30,000ms).
  • Actionable Fix: Modify the Windows Registry to increase the ServicesPipeTimeout value to 60,000ms or higher. Ensure that no other security software is blocking the service execution via HIPS (Host Intrusion Prevention System).

• Scenario 4: Token Expiration

  
  
  
  • Root Cause: The enrollment token used during the manual setup has surpassed its TTL (Time To Live) duration, which is often set to 24 hours or 30 days.
  • Actionable Fix: Return to the Endpoint Manager console, generate a fresh enrollment link or token, and input the new credentials into the local Communication Client interface.

Frequently Asked Questions

Can I install the ITarian agent without an internet connection?

The initial MSI or PKG execution can be done offline; however, the manual enrollment cannot be completed without an active internet connection. The agent requires an immediate handshake with the ITarian cloud servers to validate the enrollment token and receive its unique device identity and security configuration.

How do I manually remove a previous ITarian installation before re-enrolling?

To ensure a clean manual enrollment, you should use the Add/Remove Programs utility in Windows or the provided uninstaller script in macOS. For persistent issues, ITarian provides a dedicated Force Remove tool that purges all registry keys, drivers, and hidden folders associated with the Communication Client and Security Client.

Does manual enrollment support multi-factor authentication (MFA)?

Manual enrollment is tied to the administrator or user who generated the installer. While the enrollment process itself uses a token rather than a password, the initial access to the ITarian portal to generate that token must be secured with MFA to maintain the integrity of the management environment.

What is the difference between the Communication Client and the Security Client?

The Communication Client is the mandatory agent responsible for enrollment, telemetry, and remote commands. The Security Client is an optional, larger component that provides the actual Antivirus, Firewall, and Containment features. Manual enrollment typically installs the Communication Client first, which then automatically deploys the Security Client based on your assigned profiles.

Optimizing Your IT Management Strategy

Implementing a robust manual enrollment workflow ensures that even the most isolated or problematic endpoints are brought under the safety of your centralized management. By standardizing these deployment procedures, your IT team can maintain total visibility and proactive defense across the entire organizational infrastructure.