Support for operating systems:

• Support for Windows 10 Creators Update (Redstone 2)
• Support for Device Guard

Performance: 

• Significant reduction of the application's impact on the system in basic user scenarios.

Manage hard drive encryption with Microsoft BitLocker technology:

• Remotely manage encryption, including FIPS mode.
• Monitor and receive reports on encrypted devices.
• Restore access to encrypted devices.

Application Startup Control:

• Supports server operating systems.
• Controls downloads of DLL modules and drivers.
• Manages the list of inventoried objects (DLL modules and script files).
• Controls objects based on a new criterion - attributes of digital signature certificates.
• Report on test launches of blocked applications.
• Two operating modes for Application Startup Control: allowlist and denylist.
• The hash code for control and inventory of objects was replaced with SHA256.
• Supports startup control of PowerShell scripts in batch (command) mode.

Trusted zone (exclusions): 

• Uses trusted system certificate storage.

Kaspersky Disk Encryption:

• Support for credential input in the preboot environment of Authentication Agent using a virtual keyboard.
• Encryption mode for encrypting only occupied space on a drive (recommended only for use on new devices that were not previously used).
• Support for encryption on tablets running Windows.

Application Privilege Control: 

• It now has the capability to control access of applications to audio- and video recording devices.

Web Control: 

• Extended list of web resource categories.

Device Control:

• Logs events associated with deleting and saving files on USB devices.
• Generates a list of trusted Wi-Fi networks based on the following settings: name, encryption type, and authentication type.
• Manages user access rights for file read and write operations on CD/DVD disks.

Anti-Virus Scan:

• Threat detection events now include the ID of the anti-virus databases used for the detection.
• It now has the capability for deleting and renaming files of specific types within archives for scanning by Mail Anti-Virus.

Kaspersky Security Network:

• A new reason for an object processing result (KSN) was added to reports that are displayed in the Kaspersky Endpoint Security local interface and in the Kaspersky Security Center Administration Console.
• You can now request information about the reputation of a selected file from KSN.
• There is a new availability status of KSN servers for client computers with Kaspersky Endpoint Security installed.

BadUSB Attack Prevention: 

• Prompt for keyboard authorization is performed only when characters are entered from it.

Local administration of the application: 

• You can now allow an end user to temporarily perform actions for managing the application on a host protected by a password policy.

Other changes: 

• Beginning with the Service Pack 2 version, the OpenSSL library used in the application will be updated through the anti-virus database update mechanism.

To install the application locally, run the setup.exe file from the full distribution package and follow the Setup Wizard instructions. See the Administrator's Guide for more details on how to install the application.

During installation, Kaspersky Endpoint Security detects and allows you to uninstall applications that may affect the performance of the user's computer or cause other problems (even to the point of complete inoperability) when running at the same time as the product. The full list of incompatible software is available in this article.

You can upgrade the following applications to Kaspersky Endpoint Security 10 Service Pack 2 for Windows during installation from the full distribution package:

• Kaspersky Endpoint Security 10 Service Pack 1 for Windows (build 10.2.2.10535)
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 1 for Windows (build 10.2.2.10535(MR1)).
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 2 for Windows (build 10.2.4.674).
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 3 for Windows (build 10.2.5.3201).

Upgrading from beta versions to Kaspersky Endpoint Security 10 Service Pack 2 for Windows is not supported.

Starting with Kaspersky Endpoint Security 10 Service Pack 2, the encryption module is included in the application distribution package as a library (cab) and will be automatically installed to your computer in the following cases:

1. During installation of the full disk encryption (FDE) component.
2. During installation of the file level encryption (FLE) component.
3. During installation of an upgrade on a computer with the encryption module installed. 

For automatic upgrade of an installed encryption module, use the appropriate distribution package for Kaspersky Endpoint Security 10 Service Pack 2:

• kes10winsp2_<localization>_aes256 – to upgrade an AES encryption module with a 256-bit effective key length.
• kes10winsp2_<localization>_aes56 – to upgrade an AES encryption module with a 56-bit effective key length.

Automatic upgrade of the encryption module will be performed only for the following configurations:

• Kaspersky Endpoint Security 10 Service Pack 1 (build 10.2.2.10535) and encryption module version 1.0.2.1068.
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 1 (build 10.2.2.10535(MR1)) and encryption module version 1.0.2.1068.
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 2 (build 10.2.4.674) and encryption module version 1.1.0.73.
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 3 (build 10.2.5.3201) and encryption module version 1.1.0.73.

If the conditions described above are met, the application installer automatically removes the installed encryption module and installs all libraries necessary for encryption.

For a description of the methods used for updating configurations different from those listed above, as well as the actions that must be performed if you want to switch from the utilized encryption to encryption with a different effective key length, please refer to Application compatibility with AES modules and details on upgrading encryption to the Service Pack 2 verison.

Starting with Kaspersky Endpoint Security 10 Service Pack 2, the encryption module is included in the application distribution package as a library (cab). Thus, Kaspersky Endpoint Security 10 Service Pack 2 for Windows is incompatible with AES encryption modules released for previous versions of Kaspersky Endpoint Security.

When the application is installed, all libraries required for encryption are installed automatically when the full disk encryption (FDE) or file level encryption (FLE) component is selected.

If you want to switch from the utilized encryption to encryption with a different key length, you must delete the utilized AES encryption module before upgrading the application to the Service Pack 2 version.

Note that you have to decrypt all hard disks that have been encrypted using full disk encryption (FDE), before removing Encryption Module. No access to folder level encryption (FLE) files will be provided after you remove Encryption Module.

When upgrading from the following configurations, the application installer automatically removes the installed encryption module and installs all libraries necessary for encryption:

• Kaspersky Endpoint Security 10 Service Pack 1 (build 10.2.2.10535) and encryption module version 1.0.2.1068.
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 1 (build 10.2.2.10535(MR1)) and encryption module version 1.0.2.1068.
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 2 (build 10.2.4.674) and encryption module version 1.1.0.73.
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 3 (build 10.2.5.3201) and encryption module version 1.1.0.73.

If you are upgrading the application from the Service Pack 1 (build 10.2.2.10535) or Service Pack 1 Maintenance Release 1 (build 10.2.2.10535(MR1)) version and an encryption module of version 1.0.0.724 or 1.0.1.814 is installed on the computer, you have to upgrade the encryption module to version 1.0.2.1068 before upgrading the application.

If you are upgrading the application from the Service Pack 1 Maintenance Release 2 (build 10.2.4.674) or Service Pack 1 Maintenance Release 3 (build 10.2.5.3201) version and an encryption module of version 1.0.0.724, 1.0.1.814 or 1.0.2.1068 is installed on the computer, you have to upgrade the encryption module to version 1.1.0.73 before upgrading the application.

The application is compatible with Kaspersky Security Center 10 Service Pack 2 Maintenance Release 1.

To manage the application remotely via Kaspersky Security Center:

1. Install Network Agent on the computer. For detailed information, refer to the Kaspersky Security Center Administrator's Guide. For detailed information, refer to the Kaspersky Security Center Administrator's Guide. 
2. Install the Administration Plug-in of Kaspersky Endpoint Security for Windows in the Kaspersky Security Center console.

The installation file of the Administration Plug-in is included in the application distribution package. You can also download the appropriate version of the plug-in from the list of Kaspersky Security Center 10 plug-ins.