Operating systems

Support has been added for:

• Migrating Kaspersky Endpoint Security 11.1 for Windows when upgrading Windows 7 / 8 / 8.1 to Windows 10.
• Integration with Windows Defender Security Center.
• Antimalware Scan Interface (AMSI).
• Windows Subsystem for Linux (WSL).

Application components

The following components have been improved:

• Web Control, Mail Threat Protection, and Web Threat Protection. They now scan network traffic that is transmitted over encrypted connections using the following protocols: SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2.
• Network Threat Protection It now provides protection against attacks that exploit vulnerabilities in the ARP protocol to spoof a device's MAC address.
• Web Control A new Cryptocurrencies and Mining category has been added and the following subcategories have been added to the Regional legal restrictions category:
  • Blocked as required by Belgian law.
  • Blocked as required by Japanese law.

• Application Control
  • You can now create and edit application categories from a Kaspersky Endpoint Security 11.1 for Windows policy.
  • Reports about blocked application startups have been improved.

A new Adaptive Anomaly Control component has been added that monitors and blocks potentially harmful actions that are not typical of the protected computer. 

You can only manage the Adaptive Anomaly Control component in Kaspersky Security Center 11.

New functionality

New capabilities have been added. You can now:

• Manage the application through the Kaspersky Security Center 11 Web Console.
• Update databases from the Kaspersky Lab servers over HTTPS. For  details about using secure protocols, see this article.
• Grant domain users and groups permission to manage the application in the password protection settings.
• Password protect the restoration of objects from Backup.
• Supplement policy-defined lists of trusted zone exclusions by using lists defined in profiles.

Other improvements

• Reduced consumption of operating system resources when the application is operating in the background.
• Reduced scan time and consumption of operating system resources when performing a Background scan task.
  Instead of a scheduled scan, a background scan is used by default in the following cases:
  • During the initial deployment and configuration of Kaspersky Security Center 11. The quick virus scan task is not created.
  • During a new installation of Kaspersky Endpoint Security 11.1 for Windows. A local Full Scan task is created with a “Manually” run schedule.
  • When Kaspersky Endpoint Security 11.1 for Windows is installed over previous versions of the application. The “Manually” run schedule is applied to the local Full Scan task.

• A protection level indicator has been added to the installation package used for remote deployment of the application. The indicator displays the security level when selecting application components to be installed.

The protection level indicator for installation packages is only supported in Kaspersky Security Center 11.

• The mechanism for scan exclusions has been optimized to ensure the operation of critical system processes and services. There is no longer need to create predefined exclusions recommended by Kaspersky Lab experts during the installation stage.
• A report on the state of application components has been added to Kaspersky Security Center.

Installation

For more information about installation, see these Online Help and Knowledge Base articles.

During installation, Kaspersky Endpoint Security 11.1 for Windows detects and prompts you to remove applications that may affect the performance of the user's computer or cause other problems when running at the same time as the product. For the full list of incompatible software, see this article.

Upgrading

You can upgrade the following applications to Kaspersky Endpoint Security 11.1 for Windows when installing from the full distribution package:

• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 2 for Windows (version 10.2.4.674)
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 3 for Windows (version 10.2.5.3201)
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 4 for Windows (version 10.2.6.3733)
• Kaspersky Endpoint Security 10 Service Pack 2 for Windows (version 10.3.0.6294)
• Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 1 for Windows (version 10.3.0.6294)
• Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 2 for Windows (version 10.3.0.6294)
• Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 3 for Windows (version 10.3.3.275)
• Kaspersky Endpoint Security 11 for Windows (version 11.0.0.6499)
• Kaspersky Endpoint Security 11.0.1 for Windows (version 11.0.1.90)

It is not possible to upgrade Kaspersky Endpoint Security 10 for Windows Service Pack 2 (version 10.3.0.6294) or later if the effective key length is different from that of the distribution package originally used to install the application, even if the Full Disk Encryption (FDE) or File Level Encryption (FLE) components are not installed on the computer.

To upgrade applications from version 10 Service Pack 2 and later, use the installer for Kaspersky Endpoint Security 11.1 for Windows:

• keswin_11.1.0.XXXX_<localization>_aes256 — to upgrade application versions installed from an AES distribution package with a 256-bit effective key.
• keswin_11.1.0.XXXX_<localization>_aes56 — to upgrade application versions installed from an AES distribution package with a 56-bit effective key length.

You cannot upgrade a beta version of the application to Kaspersky Endpoint Security 11.1 for Windows. Policies and tasks that were created or modified using the beta version of the plug-in are not applied to Kaspersky Endpoint Security 11.1 for Windows.

Starting with Kaspersky Endpoint Security 10 Service Pack 2 for Windows (version 10.3.0.6294), the encryption module is included in the application installation package. You do not need to install the encryption module separately.

To automatically install the encryption libraries:

• Select the Full Disk Encryption (FDE) or File Level Encryption (FLE) components when installing the application.
• When upgrading the application from Kaspersky Endpoint Security 10 for Windows Service Pack 2 (version 10.3.0.6294) or later, use the installer for Kaspersky Endpoint Security 11.1 for Windows with a corresponding key length.
• When upgrading the application from Kaspersky Endpoint Security 10 for Windows Service Pack 2 (version 10.3.0.6294) or earlier and the AES Encryption module installed, use the installer for Kaspersky Endpoint Security 11.1 for Windows with a corresponding key length and a supported installer and encryption module configurations.

To automatically update an installed AES encryption module:

• The appropriate Kaspersky Endpoint Security 11.1 installer:
  • keswin_11.1.0.XXXX_<localization>_aes256 – to update an AES encryption module with a 256-bit effective key length
  • keswin_11.1.0.XXXX_<localization>_aes56 – to update an AES encryption module with a 56-bit effective key length
• Supported configurations:
  • Kaspersky Endpoint Security 10 for Windows Service Pack 1 Maintenance Release 2 (version 10.2.4.674) and encryption module version 1.1.0.73.
  • Kaspersky Endpoint Security 10 for Windows Service Pack 1 Maintenance Release 3 (version 10.2.5.3201) and encryption module version 1.1.0.73.
  • Kaspersky Endpoint Security 10 for Windows Service Pack 1 Maintenance Release 4 (version 10.2.6.3733) and encryption module version 1.1.0.73.

Other configurations of Kaspersky Endpoint Security and AES encryption modules are not supported. You must either delete the Encryption Module or update it to version 1.1.0.73 prior to upgrading Kaspersky Endpoint Security.

Before removing or upgrading the encryption module, decrypt all hard drives that have been encrypted using Full Disk Encryption (FDE). You will not be able to access encrypted files (FLE) after you remove the encryption module.

If you want to install an encryption module with a different key length, decrypt all encrypted objects and remove the AES Encryption Module that was used prior to upgrading the application to version 11.1. After switching to encryption with a different key length, you will no longer be able to access objects that were encrypted prior to switching.

Kaspersky Endpoint Security 11.1 for Windows is compatible with Kaspersky Security Center 11 and Kaspersky Security Center 10 Service Pack 3.

Management of the Adaptive Anomaly Control component, support of the protection level indicator for installation packages, reports on the new components (Adaptive Anomaly Control and AMSI Protection Provider), and reports on the status of the running or paused components are only available in Kaspersky Security Center 11.

To manage the application remotely via Kaspersky Security Center:

1. Install Network Agent on the computer. See the Online Help page for instructions.
2. Install the Kaspersky Endpoint Security for Windows management plug-in in Kaspersky Security Center Administration Console or in Kaspersky Security Center 11 Web Console.
   The management plug-in installer is included in the application installation package. You can download the required plug-in version from the list of Kaspersky Security Center plug-ins.

For more details about using the Kaspersky Endpoint Security 11.1 Management plug-in with policies and tasks that were created using the Kaspersky Endpoint Security 11 or 11.0.1 Management plug-in, see the Online Help page. 

The Kaspersky Endpoint Security 11.1 for Windows plug-in is installed on top of the Kaspersky Endpoint Security 11.0 for Windows plug-in. To continue using version 11.0 of the plug-in, you must first remove version 11.1.

For more details about bug fixes and private patches, see this article.

Full Disk Encryption is now supported on the following devices:

• Lenovo Yoga 500-14ISK (80R5) (Legacy BIOS mode)
• Lenovo Miix 700-12ISK (80QL) (Legacy BIOS mode)
• HP Z200 Workstation (Legacy BIOS mode)