topic Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA in Endpoint

Harmony Endpoint Security Client E89.10 for Windows is now available as GA

BarYassure — Mon, 22 Dec 2025 14:53:28 GMT

Hi,

Check Point Harmony Endpoint Security Client E89.10 for Windows is now available as GA (General Availability).

Main Enhancements:

Performance & Stability:

General performance and stability improvements across Anti-Bot, URL Filtering, Anti-Malware, and Threat Emulation Blades for a faster and more efficient user experience.
Semi-Isolated Environments:

Super Node Server now supports upstream proxy configuration.
TE Appliance Load Balancing:

When multiple Threat Emulation appliances are configured, the Endpoint client now intelligently distributes file emulation tasks across all available appliances.

This ensures optimal utilization and prevents load concentration on individual appliances.
Threat Hunting:
Threat Hunting data is now enriched with additional informationץ
Troubleshooting Tool:
“hepctrl.exe", the debugging utility, now includes a new Interactive Mode that helps find the root cause faster and also includes automatic log collection.

End of Support:

Capsule Docs:
Capsule Docs reached its End of Support.
To upgrade to E89.10 Windows with managed Capsule Docs, you must first uninstall Capsule Docs from the machine.
Legacy Operating Systems:

E89.10 is the last version to support the following Legacy Microsoft Operating Systems:

Windows 7
Windows 8
Windows Server 2008
Windows Server 2012.

Please see sk183132 for the complete list of enhancements and resolved issues in this release.

Please feel free to reach out with any questions!

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

the_rock — Wed, 24 Dec 2025 03:37:51 GMT

Will install it tomorrow in the lab and update.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

the_rock — Wed, 24 Dec 2025 14:05:09 GMT

Just installed it in the lab, so far, all good!

Hey @BarYassure Happy holidays to you and family, be well.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

Alex- — Wed, 24 Dec 2025 16:16:42 GMT

One of our customers experienced complete disconnection of all clients to the Infinity EDR service, regardless of location, behind a firewall or not.

For those facing the issue, consider sk183612 - Hardening certificate validation in Harmony Endpoint for Windows E89.10, which immediately solved the issue.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

the_rock — Wed, 24 Dec 2025 16:18:28 GMT

Goot to know Alex!

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

lluner — Wed, 24 Dec 2025 19:06:46 GMT

@BarYassure @the_rock @Alex-

We have a problem here. Regarding the environment that uses WSUS, I don't know if Windows Update updates certificates. I believe we can use PowerShell to include this certificate chain in the clients. I'll test it and let you know here in the group.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

the_rock — Wed, 24 Dec 2025 19:12:17 GMT

Might be worth TAC case to verify. I tested in the lab, connected to client's site, worked fine.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

joesternna — Mon, 05 Jan 2026 21:15:23 GMT

All our pilot users upgraded to 89.10 have experienced the same issue: definition updates fail following the update until a manual "update now" from the HEP client followed by a reboot.

Until both those things (and not just a reboot) malware definition updates don't happen. The log doesn't show any failures, just an absence of Update events.

I'm stopping the rollout of 89.10 until we can figure out a way to correct this issue.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

lluner — Mon, 05 Jan 2026 23:04:05 GMT

@joesternna

I believe this problem is related to a version of Windows that lacks the certificate chain.

https://support.checkpoint.com/results/sk/sk183612

Which version of Windows are you using?

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

joesternna — Tue, 06 Jan 2026 13:28:04 GMT

All the computers in my pilot group are running Windows 11 25H2, and are fully up-to-date with Microsoft updates.

Unlike the SK description, these computers are not cut off from other Check Point services.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

Alex- — Tue, 06 Jan 2026 15:36:53 GMT

The SK has nothing to do with access to Check Point services, but instead installing a certificate in the trusted store.

In our case, this fixed the issues on all computers.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

joesternna — Fri, 22 May 2026 13:21:12 GMT

The issue turned out to be correlated with Harmony SASE. When the SASE connection was on, laptops could not retrieve malware updates.

This explains why updates might have succeeded right after a reboot -- the SASE connection is the last to load.

SASE comes with a default bypass rule for Check Point Harmony domains, but it needs to be updated to include teadv.checkpoint.com

After adding that domain, 89.10 updates are working correctly for us.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

ccsjnw — Sat, 23 May 2026 09:04:41 GMT

I was disappointed to find that it is still necessary to use a Registry Hack to force the Windows Remote Access VPN Client to use IKEv2, rather than IKEv1.

The Capsule Connect for iOS client has no such restrictions and can use IKEv2 if it is available on the Security Gateway and falls back to IKEv1 if it’s not. Why can’t the Windows client work in exactly the same way?

Also, the setting is misleading because if IKEv2 is enabled, a fallback connection using IKEv1 is not possible. It’s not clear from the SK article that enabling IKEv2 support, disables IKEv1.

At CPX 2025 (Vienna) in February 2025, I discussed this issue and I was told the Registry Hack requirement would be removed ‘soon’. But it’s still a requirement in the latest, recommended release.

Is there in timeline on this - is it definitely on the roadmap to make this behave transparent in the Windows Client as it is in Capsule Connect?

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

PhoneBoy — Sun, 24 May 2026 22:20:43 GMT

The SK should definitely note this fact about IKEv2 disabling IKEv1...I'll ask that it be updated.

Re: Harmony Endpoint Security Client E89.10 for Windows is now available as GA

ccsjnw — Sun, 24 May 2026 23:05:22 GMT

Thanks - but when will the requirement to use this Registry hack to enable IKEv2 be removed?