Managing policies

A policy is a collection of application settings that are defined for an administration group. You can configure multiple policies with different values for one application. An application can run under different settings for different administration groups. Each administration group can have its own policy for an application.

Policy settings are sent to client computers by Network Agent during synchronization. By default, the Administration Server performs synchronization immediately after policy settings are changed. UDP port 15000 on the client computer is used for synchronization. The Administration Server performs synchronization every 15 minutes by default. If synchronization fails after policy settings were changed, the next synchronization attempt will be performed according to the configured schedule.

Active and inactive policy

A policy is intended for a group of managed computers and can be active or inactive. The settings of an active policy are saved on client computers during synchronization. You cannot simultaneously apply multiple policies to one computer, therefore only one policy may be active in each group.

You can create an unlimited number of inactive policies. An inactive policy does not affect application settings on computers in the network. Inactive policies are intended as preparations for emergency situations, such as a virus attack. If there is an attack via flash drives, you can activate a policy that blocks access to flash drives. In this case, the active policy automatically becomes inactive.

Out-of-office policy

An out-of-office policy is activated when a computer leaves the organization network perimeter.

Settings inheritance

Each policy setting has the attribute, which indicates if the settings can be modified in the child policies or in the local application settings. Child policy is a policy for nested hierarchy levels, that is a policy for nested administration groups and slave Administration Servers. The attribute is applicable only if inheritance of parent policy settings is enabled for the child policy. Out-of-office policies do not affect other policies through the hierarchy of administration groups.

Settings inheritance

Creating a policy

To create a policy:

1. In the main window of Web Console, select Devices → Policies and policy profiles.
2. Click the Add button.

   The Policy Wizard starts.

3. Select Kaspersky Endpoint Security and click Next.
4. Please read and accept the terms of the Kaspersky Security Network (KSN) Statement and click Next.
5. On the General tab, you can perform the following actions:
   • Change the policy name.
   • Select the policy status:
     • Active. After the next synchronization, the policy will be used as the active policy on the computer.
     • Inactive. Backup policy. If necessary, an inactive policy can be switched to active status.
     • Out-of-office. The policy is activated when a computer leaves the organization network perimeter.
   • Configure the inheritance of settings:
     • Inherit settings from parent policy. If this toggle button is switched on, the policy setting values are inherited from the top-level policy. Policy settings cannot be edited if is set for the parent policy.
     • Force inheritance of settings for child policies. If the toggle button is on, the values of the policy settings are propagated to the child policies. In the properties of the child policy, the Inherit parent policy settings toggle button will be automatically switched on and cannot be switched off. Child policy settings are inherited from the parent policy, except for the settings marked with . Child policy settings cannot be edited if is set for the parent policy.
6. On the Application settings tab, you can configure the Kaspersky Endpoint Security policy settings.
7. Click the Save button.

As a result, Kaspersky Endpoint Security settings will be configured on client computers during the next synchronization. You can view information about the policy that is being applied to the computer in the Kaspersky Endpoint Security interface by clicking the Support button on the main screen (for example, the policy name). To do so, in the settings of the Network Agent policy, you need to enable the receipt of extended policy data. For more details about a Network Agent policy, please refer to the Kaspersky Security Center Help.

Page top