Kaspersky Security Center 15.1 Windows

Remote removal of applications

Kaspersky Security Center allows you to uninstall applications from devices remotely through remote uninstallation tasks. Those tasks are created and assigned to devices through a dedicated wizard. To assign a task to devices more quickly and easily, you can specify devices in the wizard window in one of the following ways:

• Select networked devices detected by Administration Server. In this case, the task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
• Specify device addresses manually or import addresses from a list. You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
• Assign task to a device selection. In this case, the task is assigned to devices included in a selection created earlier. You can specify the predefined selection or a custom one that you created.
• Assign task to an administration group. In this case, the task is assigned to devices included in an administration group created earlier.

Remote removal issues

When performing remote removal of third-party applications, administrators may encounter a warning stating, "Remote uninstallation has finished on this device with warnings: Application for removal is not installed." This issue typically arises when the application to be removed is installed only for the individual user who is currently logged in. If the user is not logged in, such an application becomes invisible and cannot be targeted for remote removal.

This behavior differs with applications intended for use by multiple users on the same device, where applications are globally visible and accessible by all users of the device.

Within Kaspersky Security Center, the application registry algorithm handles applications for individual users and applications for multiple users differently:

• Applications for multiple users are maintained in a real-time, up-to-date list of installed applications.
• Applications for individual users are monitored using a caching mechanism.

  If a user was logged in at the time of application detection, Kaspersky Security Center caches information about that user's applications. Even if the user subsequently logs out, Kaspersky Security Center continues to display these applications as installed based on the cached data, although they are no longer visible or accessible on the device.

This discrepancy can result in situations where Kaspersky Security Center identifies an application as installed based on cached data, but the application removal task fails because the application is not accessible when the user is logged out.

By default, the lifetime of cached application data is set to 30 days. Administrators can modify this setting to reduce the cache duration, thereby minimizing discrepancies between the displayed data and actual application visibility on devices.

To adjust the cache lifetime to 1 hour (3600 seconds), run the following command on the Administration Server:

klscflag -fset -pv klserver -n KLNAG_INV_PERUSER_APPS_CACHE_NONACTIVE_SIDS_LIFETIME_SEC -t d -v 3600

After running this command, restart the Administration Server for the changes to take effect.

Source of information about installed applications

The Network Agent retrieves information about software installed on Windows devices from the following registry keys:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

  Contains information about applications installed for all users.

• HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

  Contains information about applications installed for all users.

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall

  Contains information about applications installed for the current user.

• HKEY_USER<...>\Software\Microsoft\Windows\CurrentVersion\Uninstall

  Contains information about applications installed for specific users.