Package Manager FAQ

The EPM Package Manager is a piece of software that runs as a service on the endpoint, communicating with the EPM Agent Gateway similarly to the EPM Adapter.

Its primary purpose is to facilitate the installation and upgrading of the EPM Adapter and Endpoint Privilege Management software on the endpoint, ensuring it stays in sync with the version configured in EPM.

Once Package Manager is installed on valid clients for a given service (URL) using an installation ID and key, the Package Manager will attempt to activate.

If the installation key is not valid, in that it does not match the one originally provided for installation, then the Package Manager will not activate and will not be usable.

If Package Manager is installed on an endpoint that is not configured to update the latest or a specific version of the EPM Adapter or Endpoint Privilege Management, then it will install successfully, but since the endpoint’s group isn’t assigned a version, it will not upgrade or install Endpoint Privilege Management or the EPM Adapter.

If you try to install Package Manager without a valid group ID, the installation is unsuccessful and you are alerted of the problem. Another installation attempt can take place with a valid group ID.

Rebooting is usually not needed when installing Package Manager; however, a reboot might be necessary if the components managed by Package Manager require it.
For example, a package like Endpoint Privilege Management may require a reboot depending on the state of the operating system. If you experience problems such as policy not being downloaded or applied, try rebooting as part of the troubleshooting steps.

The Package Manager utility installer (MSI) file is approximately 75MB and takes up 75MB of disk space on installation. The installer includes .NET 7.

To prevent the Package Manager service from overloading, a rate limit of 5000 max connections at a time has been implemented. This way, only up to 5000 endpoints can check for updates at any given moment.

The Package Manager Service can handle up to 5000 concurrent requests in a given instance. Before it can check for updates, each endpoint must first be authenticated, however, the authentication service has a rate limit of 50 max connections. This means that not all endpoints may be able to authenticate, thereby limiting the number of concurrent requests that can be made.

Additionally, under Computer Groups > View Group Details > Updates in EPM, users can set how many computers can update within an hour. This gives users real-time control and serves as a throttle control mechanism to protect their estate from getting flooded.

Each EPM endpoint component serves a distinct purpose; Endpoint Privilege Management enforces policy on the endpoint, while the EPM Adapter is tasked with carrying communication between EPM and Endpoint Privilege Management. Furthermore, the EPM Package Manager is critical in managing the installation and upgrading of other components, providing fully automatic management, if desired.

Can I install all 3 components at once instead of having the endpoint reach back to the platform? | All three components required for EPM can be installed manually, allowing the system to function fully; however, we recommend using Package Manager for the installation, as this can help eliminate a large amount of manual effort for updating Endpoint Privilege Management and the EPM Adapter.

If an endpoint is offline or in an archived state, nothing will occur. Once the endpoint is back online, the Package Manager will check with EPM to determine if the group is configured for automatically-applied or specific-version updates, or if updates have been disabled for the group, and will proceed accordingly.

How long does it take for endpoints to start updating and is there a way to change this number?

Generally, once the Package Manager service is initiated, it begins scanning for updates within 3 minutes and continues to scan for updates every 2 hours thereafter.

BeyondTrust Technical Support will have access to change this 2-hour number by running an update query to change the polling increment, however, we don’t recommend changing this unless there’s a tactical reason that addresses a production issue.

On the Package Manager Settings page, you can select a designated group to configure automatic or specific version updates.

You can also switch off the Package Manager for that group. To track the progress of the updates, you can view details such as which endpoints have already been updated and which are pending.

For the first version, errors do not display in EPM; however, you can see how many endpoints have not been updated for a specific group and view a list of those endpoints for further investigation.

If an install fails, the error displays on the Computers page and Group Details page for a computer.

The Package Manager creates an installation log file for each install or upgrade of the component, along with its log file. In the event of a failure during the process, you can easily access the Package Manager log file and the installer log files located in the log folder.

An update may not take place because:

• The client or adapter is already updated to the version configured in EPM.
• The throttling threshold is reached and the endpoint must wait for updates.
• The computer group is not yet configured for updates to take place.
• Package Manager is not enabled for the group.
• Automatic updates or updates to a specific version are not configured for the group.