What are the default ports used by GFI EndPointSecurity?

When the agent is installed, the GFI EndPointSecurity Agent Service communicates back to port 1116 on the GFI EndPointSecurity Console server.  This can be changed in Configuration > Advanced Options > Communication.

When the GFI EndPointSecurity Console machine installs or updates agents, it communicates from a random port to port 139 & 445 on the target agent machine. These are the standard SMB /RPC ports enabled on the clients by Microsoft File and Folder Sharing.

The GFI EndPointSecurity Console server connects to the Microsoft SQL Server service instance on the SQL Server machine. This is normally TCP 1433, but may be configured differently on the SQL Server (it can be a dynamically assigned port or statically defined).