Deploying Endpoints

The Endpoint is the small program on each machine you look after. Putting it on a station takes a minute.

Get the installer

On your account page, download the Endpoint installer for the organization the station should join - or for your own machines. The installer's file name carries the organization - setupEndpoint_ followed by your organization's five-character code - so do not rename it: a renamed installer does not know where the station belongs and puts it in an unsorted list instead. The installer file itself is the same for everyone; only its name differs.

You can also save it from the SupportFlow Client: in the SupportFlow Stations window, right-click your organization's name and choose Download Endpoint installer; or use Download KQS Endpoint installer on the Client's sign-in tab. The installer is named for your organization, so the Client asks you to sign in once on that PC first - after that it remembers your organization, even before you connect.

Run it on the station

Run the installer on the station, signed in to Windows as the account the station normally runs under. The setup screen asks for:

• Station Name - what you will call it (“LOBBY-01”, “STORE-12”).
• Organization - already filled in from the installer, with its organization code so you can check it. An installer named with your organization's code asks our server which organization that is, so the station needs its network connection when you choose Install. It also learns your organization's Administrator's and Managers' keys there, so it accepts its first authorization only from one of them.
• Note (optional) - shown to whoever authorizes the station, so they know which machine it is.
• Installation Code - only if your organization requires one (see Which new stations may join).
• Install to - the folder, C:\Applications unless you choose another.

Choose Install. Then accept the station in the SupportFlow Client: Options (the gear) › ControlKey › Pending Station Authorizations - until you do, it takes orders from nobody, and the Support Viewer cannot open it.

The folder must be one the Endpoint can write to. Setup tries it before installing anything. Run as administrator, Setup gives the Windows account it runs as the permissions it needs there; otherwise it tells you the folder is not suitable - choose another folder, or give this program full access to that one, and choose Install again.

If your organization is over its plan's station limit, the setup screen warns you that the station may not be available until the organization increases its plan limits: choose OK to install it anyway - it joins as Inaccessible (see Your plan's station limit) - or Cancel to stop, with nothing installed. Once the organization holds 50 stations more than its plan allows, the setup screen tells you the station was not added, and nothing is installed.

Installing on many machines

For a deployment tool or a script, run the installer silently, naming the organization:

HOST_Collector.exe -s -group "Your Organization Name" -code 123456

-group takes the organization's name (not its five-character code), and -code is the Installation Code, if your organization uses one. Each station still has to be accepted in the SupportFlow Client.

A silent install shows no messages: a station past your plan's limit joins as Inaccessible, and one that would take the organization more than 50 past it joins nothing until there is room.

Firewalls and proxies

Neither the Endpoint nor the SupportFlow Client opens a port on the machine it runs on. Every connection is made outward, to our servers, so Windows Firewall needs no rule and never asks for one. If your network filters outgoing traffic, these are the connections to allow:

• The Endpoint, on each station: outbound TCP 443 (HTTPS) to *.koquelani.com. It connects directly, not through a web proxy. It also checks the station's clock against time.windows.com, pool.ntp.org and time.nist.gov on UDP 123; if that is blocked, it simply skips the check.
• The SupportFlow Client, on your PC: outbound TCP 9443 to *.koquelani.com, which carries everything it does. It also uses TCP 443 to the same servers in two cases: when 9443 fails, to find out whether your network is blocking it, and when you update your Endpoints, to download the new Endpoint build and check it before signing the update. It connects directly, not through a proxy. If it cannot get through, it says so: port 9443 looks blocked on this network means this is the rule to ask for.
• The portal, this Help and the downloads are ordinary web pages: TCP 443 to www.koquelani.com.

Our servers are sso1.koquelani.com and sso2.koquelani.com today; when neither answers, the SupportFlow Client also tries sso3.koquelani.com and then sf01-east.koquelani.com. More may join under the same domain, so a rule for *.koquelani.com will not need changing later.

The Client also uses two ports that never leave your PC: 9191, where your AI assistant connects to it (http://127.0.0.1:9191/mcp; the port can be changed under Local MCP port in the Client's settings), and 9788, for the browser viewer. Both are bound to 127.0.0.1 only. If your security software asks about them, allow them.

How Endpoints are secured

• It obeys signed commands only. Once accepted, a station carries out a command only if it is signed by a key it trusts, addressed to that station, and still fresh - and each signed command works once. The check happens on the station itself; see ControlKey.
• Nobody is trusted on arrival. A new station waits for your Administrator or a Manager to accept it, and your organization decides whether new stations may join at all. An installer saved from the SupportFlow Client (Save Collector) carries your managers' keys, and a station installed from it accepts its first authorization only from one of them.
• It runs as the signed-in user, as a scheduled task named “SupportFlow Endpoint” that starts at sign-in - not as a background service with full system rights. When that Windows account is an administrator, the Endpoint uses the account's administrator rights too (see Administrator rights).
• It talks to us over encrypted HTTPS. If our main server does not answer, it tries the others on its list, and moves back to the main one as soon as it answers again.
• Whoever is at the machine stays in charge: Reset Authorization in its status window clears every trusted key at once (see Security levels).

The Endpoint on the station

The Endpoint shows an icon by the clock. Show Status opens its window: the station's name (with its number when two of your stations share one), its organization and group, whether it is reaching us, and the Reset Authorization button. There is also a Support button for the person at the station to send us a message.

Watermark: two checkboxes in the same window decide how the station shows who it is, so that anybody looking at the screen - or at a photo or screenshot of it - can tell which station it is:

• Floating name on screen - the station's name, faint, in the top right corner over every window. On unless you turn it off.
• Desktop wallpaper - the station's name and details on the desktop background. On for Windows Server, off on other PCs unless you turn it on. Turning it off puts back the wallpaper the PC had before.

Both change at once and are kept in the station's settings. A renamed station shows its new name straight away.

While someone is viewing (Endpoint 1.0.257 and later): a small white K appears near the bottom-right corner of the screen while someone is viewing the station remotely, and goes away when they stop. It cannot be clicked and never takes the focus, so nothing under it is in the way. Anyone at the station can see when the screen is being viewed.

Reading the station's name from other software (Endpoint 1.0.248 and later): the Endpoint keeps the station's name and identity in the registry, under HKEY_CURRENT_USER\SOFTWARE\KQS\Endpoint of the Windows account it runs as:

• StationID - the station's name, as it appears in SupportFlow. It changes when you rename the station.
• StationGUID - the station's unique identity, which never changes for that installation.

Software of your own running on the station under the same account can read them there - to label a report or a ticket with the station it came from, for example. Read them, never change them: the Endpoint writes them itself.

Administrator rights (Endpoint 1.0.254 and later): when the Windows account the Endpoint runs as is an administrator, the Endpoint uses that account's full administrator rights, so the commands you send it can also manage services, system settings and programs that need them. It takes them only when Windows grants them without asking: where Windows would show a prompt, the Endpoint carries on with ordinary rights and never shows one. For a station that should never have these rights, run it under a Windows account that is not an administrator.

Stations nobody uses

If nobody in an estate on a free plan signs in for 90 days, its stations go to Sleep Mode: they check in every 30 minutes instead of continuously, and wake as soon as someone in the estate signs in again.