Deploying Endpoints

The Endpoint is the small program on each machine you look after. Putting it on a station takes a minute.

Get the installer

Two ways to the same file:

• Your account page: Download Installer, beside your organization or your own stations. Its name carries your Installation Code (setupEndpoint_XXX-XXX-XXX.exe), so setup fills the code in.
• The Downloads page, with no sign-in. Setup asks you for the code.

You can also save it from the SupportFlow Client: in the SupportFlow Stations window, right-click your organization's name (or My Private Stations) and choose Download Endpoint installer; or use Download KQS Endpoint installer on the Client's sign-in tab. The Client needs to be connected, because it names the file with your code.

Your organization's own downloads page

Each organization has a page of its own, with its logo and name at the top, offering the Advanced Endpoint and the Standard Endpoint. Find its address on your account page, in your organization's panel: Open it, or Copy link and send it to whoever installs your stations. They need no account, and each download has your Installation Code in its name, so setup fills it in.

Treat the address as you would the code. If it has gone further than it should, your organization's Administrator can press the circular arrows beside it to rotate it: the page moves to a new address and the old one stops working at once. Your Installation Code does not change when you rotate, and the page keeps its address when you Generate New Code, so if both have got out, do both. While New stations is set to Deny, the page says so and offers nothing.

Your Installation Code

A new station joins with your Installation Code, and only with it: a station can no longer join by naming an organization. There is one code for your whole organization, written XXX-XXX-XXX, and your own stations have one of their own. You will find it:

• on your account page, in your organization's panel and on each estate's row, with a Copy button;
• at the foot of the Client's SupportFlow Stations window. Double-click it to copy it or, for an Administrator or a Manager, to change the settings below.

Treat it like a door code: give it to the people installing stations for you. Anybody holding it can add a station to your list, though a station still has to be authorized before it obeys anything. If it has gone further than it should:

• The circular arrows beside the code, Generate New Code, replace it, once you confirm. The old one stops working at once, and an installer already downloaded asks for the new one. Stations already installed are not affected.
• New stations: Deny stops any station joining, even with the code, until you allow them again. See Which new stations may join.

Run it on the station

Run the installer on the station and say yes when Windows asks for an administrator's permission: it installs a Windows service, which starts with Windows and reports whether or not anybody is signed in. The setup screen asks for:

• Installation Code - already filled in if it is in the installer's name. As soon as it is complete, setup shows which organization the station will join, so you can check it before going on. The station needs its network connection for this. It also learns your organization's Administrator's and Managers' keys there, so it accepts its first authorization only from one of them.
• Station Name - what you will call it (“LOBBY-01”, “STORE-12”).

Running it again on a station that is already in your list updates the station. It keeps its place, its keys and its history, and needs no code.

Choose Install. Then accept the station in the SupportFlow Client: Options (the gear) › ControlKey › Pending Station Authorizations - until you do, it takes orders from nobody, and the Support Viewer cannot open it.

A station that already runs the regular KQS Endpoint keeps it, and its setup also asks for the Installation Code. Its folder must be one the Endpoint can write to. Setup tries it before installing anything. Run as administrator, Setup gives the Windows account it runs as the permissions it needs there; otherwise it tells you the folder is not suitable - choose another folder, or give this program full access to that one, and choose Install again.

If your organization is over its plan's station limit, the setup screen warns you that the station may not be available until the organization increases its plan limits: choose OK to install it anyway - it joins as Inaccessible (see Your plan's station limit) - or Cancel to stop, with nothing installed. Once the organization holds 50 stations more than its plan allows, the setup screen tells you the station was not added, and nothing is installed.

Installing on many machines

For a deployment tool or a script, run the installer silently as an administrator, with the code in its name or as a switch:

KQS_AdvEndpoint_setup.exe /SILENT /CODE=XXX-XXX-XXX /STATION=LOBBY-01

/SILENT shows only a progress bar and Installing KQS Endpoint for your organization, then starts the Endpoint. /VERYSILENT shows nothing at all. /CODE is not needed when the code is in the installer's name, and /STATION is optional: without it the station is named after the machine. Each station still has to be accepted in the SupportFlow Client.

No internet yet, as on a factory floor? Setup checks that it can reach our server before it installs anything. If it cannot, nothing is installed and it tries again by itself every 10 minutes for 30 days, as a scheduled task, and removes that task once the Endpoint is installed. The machine gets its identity only then, so machines cloned from an image in the meantime each become a station of their own. A code the server refuses is not retried: nothing is installed, and you run the installer again with the current code.

The installer's exit code says how it went: 0 installed, 2 no code given, 3 refused by the server, 5 no connection, so it will keep trying.

A silent install shows no messages: a station past your plan's limit joins as Inaccessible, and one that would take the organization more than 50 past it joins nothing until there is room.

Firewalls and proxies

Neither the Endpoint nor the SupportFlow Client opens a port on the machine it runs on. Every connection is made outward, to our servers, so Windows Firewall needs no rule and never asks for one. If your network filters outgoing traffic, these are the connections to allow:

• The Endpoint, on each station: outbound TCP 443 (HTTPS) to *.koquelani.com. It connects directly, not through a web proxy. It also checks the station's clock against time.windows.com, pool.ntp.org and time.nist.gov on UDP 123; if that is blocked, it simply skips the check.
• The SupportFlow Client, on your PC: outbound TCP 9443 to *.koquelani.com, which carries everything it does. It also uses TCP 443 to the same servers in two cases: when 9443 fails, to find out whether your network is blocking it, and when you update your Endpoints, to download the new Endpoint build and check it before signing the update. It connects directly, not through a proxy. If it cannot get through, it says so: port 9443 looks blocked on this network means this is the rule to ask for.
• The portal, this Help and the downloads are ordinary web pages: TCP 443 to www.koquelani.com.

Our servers are sso1.koquelani.com and sso2.koquelani.com today; when neither answers, the SupportFlow Client and KQS Endpoint 1.0.265 or later also try sso3.koquelani.com and then sf01-east.koquelani.com. More may join under the same domain, so a rule for *.koquelani.com will not need changing later.

The Client also uses two ports that never leave your PC: 9191, where your AI assistant connects to it (http://127.0.0.1:9191/mcp; the port can be changed under Local MCP port in the Client's settings), and 9788, for the browser viewer. Both are bound to 127.0.0.1 only. If your security software asks about them, allow them.

How Endpoints are secured

• It obeys signed commands only. Once accepted, a station carries out a command only if it is signed by a key it trusts, addressed to that station, and still fresh - and each signed command works once. The check happens on the station itself; see ControlKey.
• Nobody is trusted on arrival. A new station waits for your Administrator or a Manager to accept it, and your organization decides whether new stations may join at all. Setup asks our server for your managers' keys, and a new station accepts its first authorization only from one of them.
• It runs as the signed-in user, as a scheduled task named “SupportFlow Endpoint” that starts at sign-in - not as a background service with full system rights. When that Windows account is an administrator, the Endpoint uses the account's administrator rights too (see Administrator rights).
• It talks to us over encrypted HTTPS. If our main server does not answer, it tries the others on its list, and moves back to the main one as soon as it answers again.
• Whoever is at the machine stays in charge: Reset Authorization in its status window clears every trusted key at once (see Security levels).

The Endpoint on the station

The Endpoint shows an icon by the clock. Show Status opens its window: the station's name (with its number when two of your stations share one), its organization and group, whether it is reaching us, and the Reset Authorization button. There is also a Support button for the person at the station to send us a message.

Watermark: two checkboxes in the same window decide how the station shows who it is, so that anybody looking at the screen - or at a photo or screenshot of it - can tell which station it is:

• Floating name on screen - the station's name, faint, in the top right corner over every window. On unless you turn it off.
• Desktop wallpaper - the station's name and details on the desktop background. On for Windows Server, off on other PCs unless you turn it on. Turning it off puts back the wallpaper the PC had before.

Both change at once and are kept in the station's settings. A renamed station shows its new name straight away.

While someone is viewing (Endpoint 1.0.257 and later): a small white K appears near the bottom-right corner of the screen while someone is viewing the station remotely, and goes away when they stop. It cannot be clicked and never takes the focus, so nothing under it is in the way. Anyone at the station can see when the screen is being viewed.

Reading the station's name from other software (Endpoint 1.0.248 and later): the Endpoint keeps the station's name and identity in the registry, under HKEY_CURRENT_USER\SOFTWARE\KQS\Endpoint of the Windows account it runs as:

• StationID - the station's name, as it appears in SupportFlow. It changes when you rename the station.
• StationGUID - the station's unique identity, which never changes for that installation.

Software of your own running on the station under the same account can read them there - to label a report or a ticket with the station it came from, for example. Read them, never change them: the Endpoint writes them itself.

Administrator rights (Endpoint 1.0.254 and later): when the Windows account the Endpoint runs as is an administrator, the Endpoint uses that account's full administrator rights, so the commands you send it can also manage services, system settings and programs that need them. It takes them only when Windows grants them without asking: where Windows would show a prompt, the Endpoint carries on with ordinary rights and never shows one. For a station that should never have these rights, run it under a Windows account that is not an administrator.

Stations nobody uses

If nobody in an estate on a free plan signs in for 90 days, its stations go to Sleep Mode: they check in every 30 minutes instead of continuously, and wake as soon as someone in the estate signs in again.