Updating the operating system

There are a number of special considerations for updating the operating system of a computer that is protected by Full Disk Encryption (FDE). Update the operating system as follows: first update the OS on one computer → update the OS on a small portion of the computers → update the OS on all computers of the network.

If you are using Kaspersky encryption technology, Authentication Agent is loaded before the operating system is started. Using Authentication Agent, the user can sign in to the system and receive access to encrypted drives. Then the operating system begins loading.

If you start an update of the operating system on a computer that is protected using Kaspersky encryption technology, the OS Update Wizard will remove Authentication Agent. As a result, the computer can be locked because the OS loader will not be able to access the encrypted drive.

A safe update of the operating system consists of the following steps:

1. Hard drive decryption.
2. Operating system update.
3. Encryption of hard drives.

Automatic updating of the operating system is available under the following conditions:

1. The operating system is updated through WSUS (Windows Server Update Services).
2. Windows 10 version 1607 (RS1) or later is installed on the computer.
3. Kaspersky Endpoint Security version 11.2.0 or later is installed on the computer.

If all the conditions are met, you can update the operating system in the usual way.

If you are using BitLocker disk encryption technology, you do not need to decrypt the hard drives to update Windows 10. For more details on BitLocker, please visit the Microsoft website.

Page top