Press CTRL+K to open search

Deploy EDRF using ePO - On-prem

  • Published on Aug 26, 2026
  • 2 minute(s) read
Prev Next

You can deploy the EDRF from ePO - On-prem using Product Deployment or a Client Task.

Product Deployment

Watch this video to understand the steps involved in deploying EDRF using the Product Deployment method.

  1. Log in to ePO - On-prem.

  2. Go to Menu → Product Deployment, then click New Deployment.

  3. Enter a Name and Description for the deployment.

  4. Select the Trellix EDR with Forensics for Windows, macOS, or Linux 50.x.

  5. Select the target endpoints from the System Tree.

    Product_Deployment_On-prem.png

  6. Choose Run Immediately to start the task now.

  7. Click Save.

  8. Monitor the status on the Product Deployment page.

Client Task

Watch this video to understand the steps involved in deploying EDRF using the Client Task method.

  1. Log in to ePO - On-prem.

  2. Go to Menu → Client Tasks → Client Task Catalog.

  3. Click New Task. The Task Type dialog opens.

  4. Select Product Deployment and click OK.

  5. Enter a Name, Description, and select the Target Platform.

  6. In the Products and Components section, select the Trellix EDR with Forensics for Windows, macOS, or Linux 50.x package, the Install Action, and the Current Branch.

    Client_Task_On-prem.png

  7. Click Save.

  8. View the installation status in the Server Task Log.

After creating the product deployment client task, assign it to the target systems in the System Tree to initiate the installation.

  1. Navigate to Menu → Systems → System Tree.

  2. Select the required group or specific systems where you want to deploy the software.

  3. Navigate to the Assigned Client Tasks tab.

  4. Click Actions → New Client task Assignment.

  5. In the Client Task Assignment Builder, configure the following:

    • Product: Select Trellix Agent.

    • Task Type: Select Product Deployment.

    • Task Name: Select the task you created previously.

  6. Configure the Schedule settings to Run Immediately or set a specific schedule, then click Save.

  7. (Optional) To trigger the deployment immediately:

    1. Go to System Tree and select the target systems.

    2. Select Actions → Agent → Wake Up Agents.

    3. Select Force complete policy and task update, then click OK.

    The installation begins on the target endpoints.

Verify the deployment

Once the deployment task is complete, verify that the software is installed and running correctly on the managed endpoints.

  1. In ePO, navigate to Menu → Systems → System Tree.

  2. Select a target system, and navigate to the Products tab.

  3. Confirm that Trellix EDR with Forensics is listed with the correct version.

  4. Verify on the Windows endpoints:

    XClient_Processes.png

    1. Open the Task Manager.

    2. Confirm that the Trellix XClient processes are running.

  5. Verify on the macOS endpoints:

    1. Open Terminal.

    2. Run the following command to check the process status:

      sudo launchctl list | grep -i xclient

      • Confirm that the service is listed with a status code of 0 (running state).

    3. (Optional) Verify that the XClient processes are visible in the process list:

      ps aux | grep -i xclient

  6. Verify on the Linux endpoints:

    1. Open a Terminal window.

    2. Run the following command to check the service status:

      systemctl status xclient

      Confirm the output displays the following status:

      • Loaded: yes

      • Active: active (running)

    3. (Optional) List the running processes directly:

      ps -ef | grep -i xclient

      If the service is not active, run sudo systemctl start xclient or check the installation logs in the /var/log/ directory.

Note

The Malware and ProRem protection services are not enabled by default after deployment. To enable them, edit the Protection policy by navigating to Menu → Policy → Policy Catalog → Trellix EDR with Forensics → Protection.

Related articles