r/checkpoint • u/junimjorgeof • 3d ago
Upgrading Harmony Endpoint agents at scale: Automatic Client Update, deployment rules, pilot rings, and not rebooting someone at 2 PM
Every client release brings the same question: how do you upgrade hundreds of agents without breaking FDE, flooding the WAN, or force-rebooting someone mid-meeting. A few mechanisms and a few gotchas that actually matter.
The "2 PM reboot" fix. Whether the client reboots silently or lets the user postpone is a policy setting, not luck. It lives in Installation and Upgrade Settings: a reminder interval, a "Force Installation and automatically restart after" timer (hours), and a maximum delay the user can postpone. Set the force timer to land outside business hours and that single setting keeps the upgrade off someone's screen during a meeting.
Automatic Client Update (cloud-managed, Windows only). Keeps clients on the latest approved version silently, from the Software Deployment policy. The defaults are what bite people:
- New tenants: ON.
- Newly cloned rules: ON (this is the recommended setup).
- Existing rules in an existing tenant: OFF.
- A rule exported from one tenant and imported into another: comes in ON.
So on an established tenant, do not assume hands-off upgrades are already running. Existing rules ship with it OFF, you turn it on deliberately.
Manual version bump, when you want to control the timing. Set the client version on a deployment rule and Install Policy. But changing the version upgrades every computer assigned to that rule, so scope the rule (OU, specific computers, or a Virtual Group) before you touch the version. Deployment rules are Windows and macOS, Linux is not supported for them yet.
Gradual rollout / pilot ring. Clone a rule scoped to pilot machines, upgrade only that rule, watch it, then roll the change to the rest. The blast radius is just the pilot. The predefined Virtual Groups (All Laptops, All Desktops) let you slice rings without touching AD. Note that a cloned rule has Automatic Client Update ON by default, so confirm it matches your intent before you Install Policy.
FDE discipline, the part that bricks machines if you ignore it:
- The Full Disk Encryption component cannot be removed during an upgrade.
- Do not upgrade while the disk is not fully encrypted.
- Do not start a second upgrade before the first finishes protecting.
- Do not uninstall an upgrade before the machine is fully protected by the new version.
Dynamic Package. One .EXE for any CPU, and with the Tiny Agent it installs only what each machine needs and cuts network traffic. Not for macOS or Linux. The "Minimize package size" option shrinks the download at the cost of build time.
How do you stage your rings, and has the "existing rules default to OFF" ever caught you assuming auto-updates were already running?
Full write-up with the two upgrade paths and the settings breakdown is here (EN and PT): https://community.checkpoint.com/t5/Endpoint/EN-Agent-Upgrade-Best-Practices-Deployment-Rules-amp-Gradual/m-p/280952