How to deploy Harmony Endpoint

In short: Harmony Endpoint deployment follows seven steps: create the Endpoint Security service in the Check Point Portal, plan policies and groups, build deployment packages, push them with Microsoft Intune, Jamf, Configuration Manager or Group Policy, pilot on a small group, remove or coexist with the old antivirus, then tune policy and move from Detect to Prevent.

Before you start

A smooth Harmony Endpoint roll-out starts with a short inventory:

• Devices and platforms: Windows workstations, Windows Server, macOS, Linux, and any VDI or terminal servers
• Edition: which capabilities you have bought (Advanced, Complete or Elite) and therefore which components to install
• Existing security software: current antivirus or EDR, disk encryption, and any standalone VPN client
• Deployment tools: Microsoft Intune, Jamf Pro, Configuration Manager (SCCM), Group Policy or another software distribution tool
• Data residency: where the management service should be hosted, which is set from the data residency region you choose when the Check Point Portal account is created. Some capabilities are documented only for certain regions (endpoint DLP, for example, is not currently listed for UK-region tenants), so we check this against your edition before the account is created
• Who does what: who approves policy changes, who receives alerts and who acts on them

Two cautions from Check Point's admin guide are worth knowing early. The Endpoint Security client and Check Point's standalone Remote Access VPN client are not supported on the same device, so remove the standalone client first (Harmony Endpoint includes a remote access VPN component). And on Windows Server 2016 and later, Microsoft Defender Antivirus must be turned off before the client is installed.

Step-by-step deployment

1. Set up the tenant. Create or sign in to your account in the Check Point Portal, then create the Endpoint Management Service (one per account). You can manage from the cloud, from an on-premises management server, or through a managed service provider's multi-tenant view.
2. Plan policies. Use virtual groups or directory groups (Active Directory or Microsoft Entra ID) to separate pilots, servers, developers and kiosks. Start threat prevention policies in Detect mode where possible, and agree exclusions for line-of-business applications.
3. Create deployment packages. Either export a package with the components you need, or deploy the lightweight Initial Client (Check Point's Tiny Agent is a small installer for it on Windows, macOS and Linux) and let software deployment rules install the right components on each device. Windows packages download as an installer that you can convert to an MSI for Intune or Configuration Manager; macOS downloads as a zipped package and Linux as an installer script.
4. Roll out with your existing tools. On Windows, distribute the MSI with Microsoft Intune or Configuration Manager (Check Point documents both step by step), Group Policy or another software distribution tool, or share a download link for smaller sites. On macOS, use Microsoft Intune or Jamf, the two UEM integrations Check Point lists, and push the configuration profiles that pre-approve the client's system extensions and privacy permissions first, so users are not asked to approve them by hand.
5. Pilot. Install on a small, representative group, including IT, a few power users and at least one server. Check application compatibility, performance and the alerts generated before widening the roll-out.
6. Deal with the existing antivirus. On Windows clients, Microsoft Defender Antivirus normally switches itself off when another product takes over. Check Point's Windows installer can also remove some third-party antivirus products (by default Symantec, McAfee and Kaspersky, with others added by product code), and anything else can be removed with your deployment tool. Avoid two products both scanning in real time.
7. Tune and enforce. Review detections, refine exclusions, move policies from Detect to Prevent, set up alerting and reports, and schedule a review after the first month.

For a typical small or mid-sized estate the technical work is short; most of the time goes on the pilot and on agreeing change control with your team.

Windows, macOS, Linux and VDI notes

If you are moving from on-premises Endpoint Security management to the cloud service, Check Point documents a migration path from a supported version of the on-premises management server (newer versions use a reconnect tool instead), with prerequisites such as current client versions and removing features the cloud service does not support. We check those before planning dates.

Upgrades and uninstalling

Upgrades. Cloud-managed tenants can use Automatic Client Update in the software deployment policy to keep Windows clients on the latest version silently; it is on by default for new tenants but off for existing rules in older tenants, so check it. It is not available for on-premises management or for macOS and Linux. You can also control installation and upgrade behaviour, for example letting users postpone for a set time before the install is forced, or installing from a local path to save bandwidth. Note that the Full Disk Encryption component cannot be removed during an upgrade, so plan encryption changes separately.

Uninstalling. Use the Uninstall Client push operation from the console. On Windows the device restarts after a successful uninstall; on macOS no restart is needed. Protect the agent with an uninstall password and change the default straight away, so that users or attackers cannot remove it. If you are leaving encryption in place, decrypt or hand over to another tool first, and plan Intune wipe and reset scenarios on encrypted devices with Check Point's guidance.

How Forever Systems deploys Harmony Endpoint

We run every roll-out as a small project with a named engineer:

1. Discovery and inventory: devices, tools, current security and any compliance drivers such as Cyber Essentials
2. Design: groups, policies, exclusions, encryption approach and alerting, agreed with you in writing
3. Pilot: deployment to a pilot group through your Intune, Jamf or Configuration Manager, with daily checks
4. Roll-out: phased deployment, removal of the old antivirus and enforcement in Prevent mode
5. Handover: documentation, a walkthrough of the console and an agreed support model, including optional Check Point MDR for 24/7 monitoring

If you are still choosing a product, see how it compares with Microsoft Defender for Endpoint and CrowdStrike Falcon. Contact us to plan your deployment or a proof of value.

How Forever Systems supplies and supports Check Point Harmony

We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.

• Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
• Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
• Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
• Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
• Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal

Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.

Frequently asked questions

Explore Check Point Harmony

Related from Forever Group

• Endpoint security and XDR explained
• Cyber Essentials requirements
• Microsoft Intune
• Mobile device management
• Cyber security services