ManageEngine Hardening Guide: Endpoint Central and more

A ManageEngine server that manages endpoints, Active Directory passwords or the service desk can push software, open remote sessions, reset passwords and read inventory across the estate, so its own configuration decides how far a single stolen login can reach. This guide covers the customer-side controls in three widely deployed on-premises ManageEngine products: Endpoint Central (formerly Desktop Central), ADSelfService Plus and ServiceDesk Plus. It walks through how administrators authenticate, how roles and scope limit technicians, the API keys and service accounts the products hold, what to log and forward, and a hardening baseline built from ManageEngine's own security recommendations. It is written for endpoint, identity and IT operations teams who run these servers. For governance of remote management tools in general, including blocking unapproved agents, see the RMM Tool Security Guide; this page goes deeper on one product family and does not repeat that material.

This is an independent guide from NHI Mgmt Group, based on ManageEngine's public documentation as of November 2026. It is not sponsored or reviewed by ManageEngine. Product features change, so confirm settings against ManageEngine's current documentation.

Key takeaways

Treat each ManageEngine server as tier 0. Endpoint Central can deploy software and scripts to every agent, and ADSelfService Plus can reset directory passwords, so protect them like domain controllers: internal hosting, restricted admin paths and fast patching.
Remove or change the default admin first. ManageEngine says the Endpoint Central default admin account "should be removed after the first login", and both Endpoint Central and ADSelfService Plus include a check for the default admin password.
Turn on two-factor authentication for every console login. Endpoint Central has an Enforce two-factor authentication setting; where SAML is used, enforce MFA at the identity provider instead.
Scope technicians, not just roles. Endpoint Central combines a role (Read, Write, Full Control per module) with a Scope of Management (all computers, remote offices or custom groups); use both so a help desk technician cannot reach servers.
Forward the Action Log Viewer to your SIEM. Endpoint Central sends its Action Log Viewer data to syslog in RFC 5424 format over TCP, UDP or TLS, which gives you an off-box record of who deployed, connected or changed what.

How identity and access work in ManageEngine

Each on-premises ManageEngine product runs its own web console, user store and database, so hardening is done per product. The three products in scope authenticate users in similar ways but hold very different powers.

Product	What a console admin can do	Console sign-in options	Main hardening location
ADSelfService Plus	Configure self-service password reset, account unlock and MFA for Windows, VPN and RDP logins against Active Directory	Local admin account, with MFA and conditional access for self-service actions	Configuration > Security Center > Security Hardening
Endpoint Central	Deploy patches, software and scripts, run remote control and System Manager tools (Terminal, Registry, File Manager), deploy OS images	Active Directory authentication (on-premises) or local authentication; two-factor authentication; SAML with MFA at the IdP	Admin > Security Settings; Admin > User Administration
ServiceDesk Plus	Manage tickets, assets and integrations; technicians can act on endpoints through the UEM integration	Local or domain authentication, with lockout, password policy and session controls	Admin > General > Security Settings (SDAdmin role)

Three identity facts shape the rest of this guide:

Default admin accounts: each product ships with a built-in admin login. ManageEngine's Endpoint Central guidance is to remove the default admin after first login, and its security notice on unauthenticated access claims lists "publicly accessible, no two-factor authentication, default admin credentials in use" as the combination to fix first.
Directory-backed logins: Endpoint Central on-premises can authenticate technicians against Active Directory, fetching their email from AD. That ties console access to joiner, mover and leaver processes, which local accounts do not.
End users at the edge: ADSelfService Plus is designed to be reached by end users, often from outside the network, and supports phishing-resistant MFA such as FIDO passkeys for self-service actions. Its login page is therefore the most exposed surface in this family.

Admin roles and privileged access

Endpoint Central has the most granular model. Its predefined roles are Administrator (super admin, including Admin tab operations), Guest (read-only), Auditor, Technician, Remote Desktop Viewer, IT Asset Manager, Patch Manager, Mobile Device Manager and OS Deployer. Custom roles are built at Admin > User Administration > Role > Add Role, setting Full Control, Write, Read or No Access per module.

The role defines what a technician can do; the Scope of Management defines where. A user can be scoped to all computers, all remote offices or specific custom groups. ManageEngine's role difference reference shows that scope changes real powers: for example, scope based technicians have no access to OS Deployment, cannot publish Device Control policies at Full Control, and have view-only access to patch approval settings.

Job function	Endpoint Central starting point	Scope	Why
Platform owner (two or three people)	Administrator	All computers	Only role that can change Admin tab settings such as security settings and Scope of Management
Service desk	Custom role: Inventory Read, Tools at RDS level only	Custom groups of user workstations	Remote help without software deployment or server reach
Patch team	Patch Manager	Groups by environment (pilot, production)	Full Patch Management, no OS deployment or configuration modules
Server operations	Technician or custom role	Server custom group only	Keeps workstation technicians off servers and vice versa
Audit and compliance	Auditor or Guest	All computers	Read access to inventory and licence compliance without change rights
Imaging team	OS Deployer	All computers (scope based technicians have no OS Deployment access)	Isolates image capture and deployment, which handle passcodes and images

Privileged access controls that apply across the family:

Remote tool consent: in Endpoint Central, under Admin > Tools Settings, limit end-user File Manager and Command Prompt access to admins, turn on user confirmation for Command Prompt and File Manager, set Idle Session Settings for remote control, and enable User Confirmation with a timeout. Make User Confirmation Permanent cannot be reverted, even by administrators, so decide deliberately.
Agent tamper protection: under Admin > SoM Settings > Agent Settings, turn on Restrict users from Uninstalling the Agent from Control Panel and Restrict users from stopping Agent service.
Linux and Red Hat nominated machines: ManageEngine advises giving root access only to trusted technicians on these, because they relay metadata and package URLs to other agents.
Installation folders: do not grant non-administrative users access to the ManageEngine folder. For ADSelfService Plus, ManageEngine's installation guidance is to disable inheritance on the install directory, remove Authenticated Users and Domain Users, and grant Full Control only to Local System, Domain Admins, Administrators and the service's Log On account (applied automatically from build 6304).
Admin workstations: sign in to these consoles only from hardened admin devices. See the Privileged Access Workstations Guide and the Privileged Access Management Guide.

Integrations, API tokens and service accounts

ManageEngine products hold several non-human credentials. Each one should have an owner, a purpose, an expiry where the product supports it, and an entry in your inventory. See the Service Account Security Guide and the API Key Management Guide.

Credential	Where it lives	Control
Endpoint Central and ServiceDesk Plus integration API key	Generated in Endpoint Central (Admin > Integrations > All Integrations) or ServiceDesk Plus (Admin > Integrations > UEM products) and pasted into the other product	Set an expiry when generating it, record which account the key represents and what it can do, and regenerate on staff changes or suspected exposure
ServiceDesk Plus technician API keys	Per technician	Turn off Allow Technicians to generate their own API keys so only the administrator issues keys
Product service accounts	Windows service Log On account for each product	Dedicated account, no interactive logon, Full Control only on its own install directory; rotate per your runbook (see Rotating a Windows or Linux Service Account Password)
Active Directory accounts used by the products	Domain settings in ADSelfService Plus and Endpoint Central	Grant only the delegated rights each feature needs, and use LDAP over SSL (Enable LDAP SSL in ADSelfService Plus). See Active Directory Delegation
Database and backups	Bundled database or Microsoft SQL Server	Encrypt scheduled backups with a password (Endpoint Central) or Change Password for Database Backups (ADSelfService Plus); remove unused accounts on SQL Server hosts
Deployment passcodes and images	Endpoint Central OS Deployment	Use a MAC address or passcode instead of admin credentials, a 6 character alphanumeric passcode policy and passcode lockout; keep image and driver repositories on password-protected shares
Mail server and syslog connections	Each product's mail and integration settings	Enable TLS/SSL for Mail Server; use TLS for syslog where the receiver supports it

The ServiceDesk Plus to Endpoint Central integration lets technicians manage endpoints from the ticket window. That means a stolen service desk technician session can reach endpoint actions, so align the service desk roles with the Endpoint Central scope behind the integration. The ITSM Platform Security guide covers the service desk side in general.

Logging and detection

Endpoint Central records console activity in the Action Log Viewer (Admin > Audit > Action Log Viewer). From version 11.4.2524.01 it can forward that data to a syslog server: Admin > Integrations > All Integrations, search for Syslog, then set the server, TCP or UDP, optional TLS and port. Messages use RFC 5424, and when FIPS Compliance is enabled only TLS is permitted. Configure failure notifications so a broken feed is noticed. ManageEngine's guidance after reports of unauthenticated access claims is to review the Action Log Viewer and network event logs for suspicious activity, which is only reliable if a copy sits outside the server.

What to watch	Source	Why it matters
Console logins from new source addresses or outside working hours	Action Log Viewer via syslog; reverse proxy logs	Stolen technician credentials (ATT&CK T1078 Valid Accounts)
New users, role changes or Scope of Management changes	Action Log Viewer; Admin > User Administration review	Persistence through a new or widened admin account
Software or script deployments to large groups, especially new scripts in the Script Repository	Action Log Viewer; EDR process trees on endpoints	Abuse of the deployment tool for execution and lateral movement (ATT&CK T1072 Software Deployment Tools)
Remote control, Command Prompt or File Manager sessions to servers	Action Log Viewer; endpoint process creation	Interactive hands-on-keyboard access through the approved tool
Security setting changes: two-factor authentication disabled, HTTPS or TLS settings changed, user confirmation removed	Action Log Viewer	Defence changes that often precede misuse
Integration and API key generation	Product audit logs in Endpoint Central and ServiceDesk Plus	New non-human credential with endpoint reach
Agent uninstall or service stop attempts	Endpoint telemetry, Windows service events	Tampering when agent protection is off

Keep the forwarded logs for at least your incident look-back period; see the Log Management and Retention Guide and the SIEM Guide. Useful measures of whether hardening is holding:

MFA coverage: percentage of console accounts with two-factor authentication or IdP MFA, target 100%.
Default admin status: default admin removed or password changed on every ManageEngine server, checked each quarter.
Scoped technicians: share of non-administrator users with a Scope of Management narrower than all computers.
Patch lag: days from a ManageEngine security update to installation on each server, against your emergency patch target.
Log feed health: hours without Action Log Viewer events at the SIEM, alerting above a threshold.
Security score: ADSelfService Plus Security Hardening score, which reaches 100 when every applicable setting is configured.

Hardening baseline

The baseline below is drawn from ManageEngine's Endpoint Central security recommendations, the ADSelfService Plus Security Hardening page and the ServiceDesk Plus Security Settings page. Apply it in the order shown, testing each step in a non-production instance or a small agent group first.

Placement: host the servers inside the corporate network behind firewall restrictions. ManageEngine advises against hosting the Endpoint Central server or a Distribution Server as an edge device; use the Secure Gateway Server as a reverse proxy for roaming and remote office agents. Install Distribution Servers on dedicated machines with no other third-party software.
Admin accounts: remove or rename the default admin, review Admin > User Administration for unknown or modified users, and delete unused accounts in the console, on the server and on SQL Server hosts. Change the ADSelfService Plus default admin password before moving from evaluation to production.
Authentication: in Endpoint Central enable Secure Login and Enforce two-factor authentication (Security Settings > Basic). Where SAML is used, enforce MFA in the IdP; see the Phishing-Resistant MFA Guide. In ServiceDesk Plus, enable password policy (off by default, minimum length 8 to 99), account lockout and an inactive session timeout. Set the shortest workable Session Expiration in Endpoint Central (profile picture > Personalize).
Transport: in Endpoint Central set Communication to HTTPS (Admin > Tools Settings > Port Settings), enable HTTPS for the Central Server and then close port 8020 at the firewall, and enable secured communication for LAN and WAN agents. Disable older TLS versions; ManageEngine notes this stops management of Windows XP, Vista, Server 2003 and Server 2008. In ADSelfService Plus enable HTTPS, Enable Secure TLS Version, Enable Secure Cipher Suites and Configure Password Encryption for SSL Keystore.
Agent trust: replace the bundled certificate with a trusted third-party certificate, then enable agent-server trusted communication and certificate-based authentication for agent-server communication. Update agents first, because older agents cannot connect afterwards. See the mTLS Guide.
Exposure on login pages: in ADSelfService Plus use Hide Employee Search/Organization Chart From Login Page, Enable SSL Pinning for Mobile App and Restrict User Access to Agent If SSL Certificate Is Invalid. In ServiceDesk Plus, add security response headers, register reverse proxies as trusted edge devices so X-Forwarded-For is only honoured from them, and keep the domain drop-down off unless needed.
Content safety: scan patches, software packages and scripts before upload in Endpoint Central; keep the HTTP repository and software repository on credentialed local shares. In ServiceDesk Plus enable antivirus scanning for file uploads through an ICAP-compatible scanner.
Data protection: schedule daily database backups with password encryption and failure notifications; under Security Settings > Export Settings choose Remove Personal Information for exports and scheduled reports.
Patch and subscribe: keep each server on the latest build, subscribe to ManageEngine security advisories and enable in-product security notifications. Apply vendor security updates promptly, on an emergency cycle for any internet-reachable component. See the Patch Management Guide.
Logging: enable syslog forwarding of the Action Log Viewer over TLS and confirm events arrive.

Rollback: most settings can be reversed in the same screen, but two cannot. Make User Confirmation Permanent is irreversible, and enabling certificate-based agent authentication strands agents that have not been updated. Take a database backup before each phase and stage agent-facing changes on a pilot group.

Small versus large estates: a single-site organisation may run one Endpoint Central server with two administrators and no Secure Gateway. Larger estates should add Distribution Servers and a Secure Gateway Server, split technicians by Scope of Management, use AD authentication for every console user, and route all console access through a privileged access solution.

Common misconfigurations

Console reachable from the internet: exposing the Endpoint Central server itself instead of a Secure Gateway Server places a tier 0 console at the edge. Publish only what agents need, through the gateway.
Default admin still active: ManageEngine's own notice singles out default admin credentials combined with public access and no two-factor authentication. The fix takes minutes and should be checked after every upgrade or restore.
Every technician scoped to all computers: roles alone do not stop a help desk account deploying to servers. Use Scope of Management custom groups.
Integration keys without expiry or owner: a long-lived ServiceDesk Plus to Endpoint Central key, or technician-generated API keys, become forgotten machine credentials with endpoint reach. See the NHI Inventory Reconciliation guide.
Install folders open to Authenticated Users: broad folder ACLs expose configuration and database files. Apply ManageEngine's folder permission steps on older builds.
Audit trail only on the server: if the Action Log Viewer is not forwarded, an attacker with admin access can work without an independent record.

Framework mapping

Control area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	ATT&CK technique addressed
Default admin removal, account reviews, technician lifecycle	AC-2 Account Management	PR.AA-05	T1078 Valid Accounts
Roles plus Scope of Management	AC-6 Least Privilege	PR.AA-05	T1072 Software Deployment Tools
Two-factor authentication and IdP MFA	IA-2 Identification and Authentication (Organizational Users)	PR.AA-05	T1078 Valid Accounts
HTTPS, TLS versions, agent certificates	SC-8 Transmission Confidentiality and Integrity	PR.PS-01	T1219 Remote Access Tools
Security settings baseline, port 8020 closure, remote tool limits	CM-6 Configuration Settings; CM-7 Least Functionality	PR.PS-01	T1219 Remote Access Tools
Security updates and advisories	SI-2 Flaw Remediation	PR.PS-01	T1199 Trusted Relationship (where an MSP runs the server)
Action Log Viewer and syslog forwarding	AU-2 Event Logging; AU-6 Audit Record Review, Analysis, and Reporting	PR.PS-04; DE.CM-09	T1072 Software Deployment Tools

Practitioner checklist

List every ManageEngine server, its version, owner and whether any part is reachable from the internet.
Remove or change the default admin on each product and review all console users for unknown or modified accounts.
Enforce two-factor authentication, or IdP MFA under SAML, for every console login.
Rebuild Endpoint Central access as roles plus Scope of Management, with no more than a handful of Administrator accounts.
Switch Endpoint Central to HTTPS, close port 8020, disable old TLS and enable certificate-based agent authentication after updating agents.
Run the ADSelfService Plus Security Hardening page to a score of 100 and harden the install directory ACLs.
In ServiceDesk Plus, enable password policy, lockout, session timeout and admin-only API key generation.
Inventory integration API keys, service accounts and AD delegated rights, with owners and expiry.
Forward the Action Log Viewer to the SIEM over TLS and alert on role, scope, security setting and mass deployment changes.
Subscribe to ManageEngine security advisories and track patch lag per server.

ManageEngine Hardening Guide