The installer finished. The endpoint still is not connected.

1. Define exactly what failed

Record the last stage you can prove, the first stage you cannot prove, the endpoint name, operating system build, architecture, installer version, local time and UTC time. A dashboard with no endpoint does not prove that the installer never ran; an installed service does not prove enrollment.

2. Verify the test is authorized and supported

• Use a designated test endpoint with an owner and rollback plan.
• Confirm the operating system, edition, architecture, and required runtime match the vendor's current support documentation.
• Verify the installer is current and came from the intended workspace or customer.
• Check file integrity or signature when the vendor publishes a signature or checksum.
• Run with the documented elevation level. Capture the exit code rather than assuming a quiet installer succeeded.

3. Verify local agent state

• Locate the documented service, process, installation directory, and log path.
• Record whether the service is missing, stopped, repeatedly restarting, or stable.
• Review the newest relevant log lines around the attempted installation and first start.
• Check endpoint-security, application-control, quarantine, and operating-system event logs for a matching block.

Do not disable endpoint protection as a diagnostic shortcut. If evidence shows a block, use a narrow, time-bounded exception approved through your normal change process, then remove it after the test.

4. Verify identity and enrollment data

• Confirm the workspace, tenant, customer, site, token, or enrollment code belongs to the intended destination.
• Check whether the enrollment credential expired, was revoked, or was copied with extra characters.
• Search for a stale or duplicate endpoint identity before creating another record.
• Do not delete an existing record until you know what audit history, policy assignment, or billing data deletion would remove.

5. Verify DNS, time, TLS, proxy, and egress

• Resolve only the vendor-documented hostnames from the endpoint's actual network.
• Confirm system time and time zone are accurate enough for certificate and token validation.
• Test the documented outbound ports—commonly HTTPS on TCP 443—without inventing broad firewall rules.
• Check whether a proxy requires authentication or whether TLS inspection substitutes a certificate the agent rejects.
• Capture the hostname, timestamp, result, and applicable proxy or firewall log. Do not paste enrollment tokens or private keys into a ticket.

6. Restart or reinstall only after the evidence points there

Restart the documented service once and observe whether the failure changes. Reinstall only when the installed files, service registration, or package state is demonstrably incomplete. Repeated reinstall attempts can erase the first useful log, create duplicate identities, and hide the original cause.

7. Prove activation in the dashboard

• Verify the endpoint appears in the intended tenant and site with one stable identity.
• Confirm the dashboard timestamp advances after the local service starts.
• Compare a harmless property—such as OS build or hostname—between the endpoint and dashboard.
• Wait for the documented initial check-in interval; record the actual interval instead of relying on a page refresh.
• Continue to the first-endpoint acceptance checklist only after fresh telemetry is proven.

8. Escalate with a reproducible evidence pack

Send the vendor a concise packet: account or tenant identifier, endpoint ID if present, OS and architecture, installer and agent versions, UTC timestamps, exact failed stage, exit code, sanitized log excerpt, DNS/TLS/proxy result, security-control event, and every reversible change already tested. Redact secrets, tokens, user data, internal IPs, and unrelated log content.