PortGuard deployment checklist

Console installers by platform · Linux Agent installation · License operator guide

Use the current Stable Console installer in the matching platform tab. Prepare a dedicated license for each Console instance. Agent and Console versions are independent.

Step	Action	Expected result
1. License	Licensing admin signs in, issues the organization license and seat count, copies the one-time code.	License is issued; code is privately available to the Console administrator.
2. Console	Install the matching platform package. Create the local admin account and activate in Settings → License.	Organization and seat capacity appear; License Server shows the bound Console instance.
3. Deployment	Access Console by its reachable LAN URL. Endpoints → Enroll agents → select allowed operating systems (include Linux for a Linux deployment) → download deployment file.	One reusable private rollout file; no per-device code.
4. Agent	Install Linux Agent with that file; inspect both service statuses.	Authenticated heartbeat, endpoint online, one seat allocated.
5. USB	Connect a USB drive, check status, safely unmount, Block, then Allow.	Command results report verified native evidence. Mounted/in-use devices are refused; with no device, the saved block policy is Protected and Allow is Unprotected.
6. Persistence	Restart Agent and verify heartbeat.	Same identity and seat; no duplicate registration.
7. Capacity	With a dedicated small license, try enrolling beyond capacity.	Enrollment rejects the extra identity. Offline identities still occupy seats.

Additional checks

Replace a license in Console Settings → License with a larger total capacity and confirm the same Agent IDs remain. Change a Linux Agent URL using the address-change workflow and verify the same seat is retained. Save Block/Allow without a USB drive and verify Protected/Unprotected, then attach a safe test device.

Troubleshooting

404 on Agent protocol: an older Console or wrong URL is running.
410 on legacy API: migrate the Agent to the current contract.
403 OS mismatch: create a deployment profile for the endpoint OS.
No available seat: check the activated license and active enrolled identities.
License key mismatch: use the packaged pinned cloud key; do not replace it with a different signing key.
Agent cannot reach Console: use its LAN IP and selected port, not localhost; check the firewall.

Record the Console build, Agent version, operating system, command ID and sanitized error. Keep activation codes, deployment files and tokens private. License revocation does not remotely invalidate an already-issued entitlement; revoke an Agent in Console separately to release its seat.

Use a trusted network for the default HTTP connection. HTTP traffic is not encrypted.