Kaspersky Administration Kit 8.0

	Useful references
	Reasons to create a hierarchy of servers How to configure updates for slave Servers and their client PCs

Kaspersky Administration Kit allows an administrator to organize networked Administration servers into a hierarchy. Administration servers are united into a master server – slave server hierarchy. Each Administration server can have more than one slave server within a hierarchy.

In order to subordinate one Server to another:

1. Choose which Server will be the master, and which slave.
   
   
2. Open Administration console on the master Server and select an administration group to house the slave Server. Right-click Administration servers node. Choose New > Administration Server. Add Administration Server Wizard will require the following data needed for connection:
• slave Server address. You can use IP address, Server name (NetBios name) or absolute server domain name (FQDN).
  
  
  It is recommended to set this parameter to decrease slave Server connection time by skipping stage 3 of the connection process. But it requires placing the account running the Console into KLAdmins group on the slave Server. Otherwise you will be prompted to enter credentials of an account having such permissions.
  If you do not have such permissions, the slave Server administrator will have to fulfill stage 3 of the connection process.
  
  
• slave Server name to display in the administration group Administration servers node.
  
  
• master Server name and its connection settings. You can use IP address, Server name (NetBios name) or absolute server domain name (FQDN). This stage applies if you were entering the slave Server name in previous connection stages.
  
  
• slave Server certificate. The certificate will be used to authenticate the slave Server when connecting the two Servers. This certificate is not saved on a disk in some obvious form, but is placed into the Settings Storage. This stage applies if you were entering the slave Server name in previous connection stages.
3. If you did not enter a slave Server name into the connection Wizard (or did not have slave Server administrator permissions), please do the following:
• open Console on the slave Server;
• open its properties and click Advanced on the tab General;
• click Settings in the section Administration Server hierarchy;
• check the box This Administration Server is a slave server in the server hierarchy and specify:
• address of the master Server. You can use IP address, Server name (NetBios name) or absolute server domain name (FQDN).
• master Server certificate path. The certificate will be used to authenticate the master Server when connecting the two Servers. This certificate is not saved on a disk in some obvious form, but is placed into the Settings Storage.
• proxy server settings – if there is a proxy server between the two Servers.
  
4. Open a Master Server console, expand the administration group housing the slave Server, and click on it to connect. It might take some time to connect to the Server depending on network configuration.
   
   In order to be able to view subordinate servers in the Administration console, open the menu View (in MMC console), click Configuring interface and check the box Display slave Administration Servers.

If an attempt to establish connection fails, make sure that master Server credentials are configured correctly on the slave Server and that the box This Administration Server is a slave server in the server hierarchy is checked.

Permissions to connect a slave Server and its permissions to access logical network depend on the permissions for the master Server administration group to which this slave Server connects / is connected.

To be able to connect a slave Server, an account needs to have Reading and Modify access privileges permissions.

To be able to view the logical network of a connected slave Server an account needs to have Reading permission.

To be able to work with the logical network of a connected slave Server an account needs to have Writing and Execution permissions.

Kaspersky Administration Kit 8.0 allows each group task created on the master Server to be inherited by the slave Server. To enable such inheritance, go to the task settings tab General and check the box Send to slave Administration Servers. Master server does not transmit Kaspersky Administration Kit tasks and Computer selection tasks to slave Servers.

You can remove a slave Server from an administration group by clicking Delete in its right-click menu. If you delete a Server, the box This Administration Server is a slave server in the server hierarchy automatically becomes unchecked, and all policies and tasks assigned to it from the master Server will be deleted.