EN - What Changed in Harmony Endpoint E89.x: Automatic Client Updates & Conflict Guard

jorgeluiznim — Tue, 15 Sep 2026 10:07:56 GMT

Extra guide from the Harmony Endpoint Deep Dives series · A roundup of what the E89.x Windows client line actually brings, based on the official release notes. This is recent, shipped functionality, not a roadmap of future features.

Purpose

The E89.x line moved fast, and some of it changes how you operate the fleet, not just what a blade detects. This guide summarizes the operationally relevant changes across E89.00 to E89.25, plus the upgrade deadline Check Point published for older clients. Every item cites the release-note SK it comes from.

Audience

[x] Endpoint Administrators
[x] Security Engineers
[x] IT Operations
[ ] Beginners

First, the deadline you cannot ignore

Upgrade notice (02 Aug 2026): starting September 1, 2026, Windows Endpoint clients running versions earlier than E88.70 (excluding E88.32) get limited functionality, which impacts their security posture. The recommendation is to upgrade those machines to the latest version, E89.25.

If you still have a tail of old clients, this is the first thing to check. The current Recommended version is E89.10; the current Latest is E89.25.

Automatic Client Updates (E89.21)

This is the headline change. Automatic Client Updates keeps endpoints up to date on their own, delivering the latest protections, critical fixes, and new features without a manual upgrade cycle.

Available only for cloud-managed Endpoint Security environments. It is not supported for clients managed by an on-premises Endpoint Security Management Server.
To join, upgrade the Windows devices to E89.21 and follow the feature's video or admin guide.
Rollout is gradual, so the option may take a while to appear in your console.

Conflict Guard (E89.25)

A new capability that monitors for high resource usage and starts automated, targeted optimization. It uses scanner.exe through the File Protection component (CPFileAnlyz.exe). In practice this is Check Point reacting to the classic complaint of an endpoint agent fighting other software for CPU and disk.

Blocking SMB attacks without the Firewall blade (E89.25)

Blocking attacks over SMB is now possible without the Endpoint Firewall blade, using the Windows Defender Firewall. When an attack is identified, inbound SMB (TCP 445) and NetBIOS (TCP 139, UDP 137/138) traffic is automatically blocked. Outbound traffic stays allowed, and the containment is time limited. A log is sent to the Management Server.

This matters for shops that run Harmony Endpoint without the Firewall blade and rely on Windows Defender Firewall.

Smart Pre-boot is GA (E89.05)

Smart Pre-boot went from Early Availability to GA. It adds Self-Unlock and Mobile Login using simple MFA through a smartphone, plus clearer mobile login instructions and Wi-Fi setup guidance at pre-boot. This is the modern replacement for the classic FDE pre-boot experience.

Quarantine Management and Remote Memory Dump (E89.05)

Quarantine Management: a central way to analyze, restore, or delete quarantined files across the organization. Available for Early Availability customers and requires the Server on a supported version. Quarantined files are auto-deleted after 30 days by default.
Remote Memory Dump: collect process, kernel, or full memory dumps remotely. Kernel dumps do not require a reboot (not supported on Windows 7). Full memory dumps trigger a BSOD and need prior configuration. All dumps are zipped, segmented if needed, and uploaded to Check Point FTP, Amazon S3, or a custom FTP server.

SHA256 hashing for IoC (E89.00 / E89.10)

The File Protection component now computes SHA256 hashes for supported file types, which enables compatibility with SHA256-based indicators in Infinity IoC Management. If you drive blocks from threat-intel hashes, this closes the gap left by MD5/SHA1-only matching.

Housekeeping you should plan for

Capsule Docs reached End of Support (E89.00). To upgrade a machine that has managed Capsule Docs to E89.x, you must uninstall Capsule Docs first.
Legacy Windows end of the line: E89.10 is the last version supported on Windows 7, Windows 8, Windows Server 2008, and Windows Server 2012 (see sk183765).
FDE firmware compatibility (E89.25): FDE now supports only devices that boot Windows through the standard UEFI boot order; devices that load Windows Boot Manager directly are blocked until the manufacturer ships a BIOS update, and the policy can be switched to BitLocker Management with admin consent. This one has real deployment impact and gets its own treatment in the upcoming Full Disk Encryption Deep Dive. Verify devices with BootModeReport.ps1 (sk185123) before upgrading.

E89.x at a glance

Version	Status	Headline
E89.00	GA	SHA256 for IoC; Smart Pre-boot EA; Capsule Docs End of Support; hardened TLS
E89.05	GA	Smart Pre-boot GA (Self-Unlock, Mobile Login); Quarantine Management; Remote Memory Dump; Windows 11 25H2 GA
E89.10	Recommended	SHA256 for IoC in the standard flow; Super Node upstream proxy; broad performance/stability; last version for Windows 7/8/2008/2012
E89.21	GA	Automatic Client Updates (cloud-only)
E89.25	Latest	Conflict Guard; SMB blocking via Windows Defender Firewall; FDE firmware compatibility gate

Best Practices

Best Practice: treat the September deadline as real. Inventory any clients below E88.70 and schedule them first.

Best Practice: standardize on the Recommended version (E89.10) for the fleet, and use the Latest (E89.25) where you need a specific new capability.

Best Practice: if you are cloud-managed, evaluate Automatic Client Updates on a pilot group before turning it loose on production, so you see the rollout behavior in your own environment.

References

Check Point SecureKnowledge sk182722, Enterprise Endpoint Security E89.00 Windows Clients
Check Point SecureKnowledge sk183617, Enterprise Endpoint Security E89.05 Windows Clients
Check Point SecureKnowledge sk183132, Enterprise Endpoint Security E89.10 Windows Clients (Recommended)
Check Point SecureKnowledge sk185038, Enterprise Endpoint Security E89.21 Windows Clients (Automatic Client Updates)
Check Point SecureKnowledge sk184929, Enterprise Endpoint Security E89.25 Windows Clients (Latest)
Check Point SecureKnowledge sk185123 (BootModeReport), sk183765 (legacy Microsoft OS support)

Revision History

Date	Version	Author	Changes
2026-09-08	1.0	Jorge Luiz	Initial version. Roundup of E89.00 to E89.25 from the official release-note SKs, plus the September 2026 upgrade deadline

Supported Versions: Harmony Endpoint Windows clients E89.00 to E89.25; Recommended E89.10, Latest E89.25 Last Updated: 2026-09-08

topic EN - What Changed in Harmony Endpoint E89.x: Automatic Client Updates & Conflict Guard in Endpoint