Kaspersky Security Center 15.1 Help

	What's new Find out what's new in the latest application release.		Configuring network protection Manage the security of the organization.
	Hardware and software requirements Check which operating systems and application versions are supported.		Kaspersky applications. Updating databases and software modules Maintain the reliability of the protection system.
	Deployment and initial setup Plan the use of resources, install the Administration Server, install Network Agent and security applications on client devices, and consolidate devices into administration groups.		Monitoring and reporting View your infrastructure, protection statuses, and statistics. Manage access to cloud services using Cloud Discovery.
	Discovering networked devices Discover existing and new devices on your organization's network.		Replacing third-party security applications Learn methods for uninstalling incompatible applications.
	Kaspersky applications. Centralized deployment Deploy Kaspersky applications.		Adjustment of distribution points and connection gateways Configure distribution points.
	Upgrading Kaspersky Security Center from a previous version Upgrade Kaspersky Security Center 15.1 from a previous version.		Best Practices for Service Providers (Online Help only) Learn recommendations on how to deploy, configure, and use the application, as well as ways to resolve typical issues in the application operation.
	Kaspersky applications. Licensing and activation Activate Kaspersky applications in a few steps.		Sizing Guide (Online Help only) For optimal performance under varying conditions, take into account the number of networked devices, network topology, and set of Kaspersky Security Center features that you require.
	Exporting events to SIEM systems Configure exporting events to SIEM systems for analysis.		Vulnerability and patch management Find and fix vulnerabilities in third-party software.
	Working in a cloud environment Deploy Kaspersky Security Center in cloud environments: Amazon Web Services, Microsoft Azure, Google Cloud Platform.		Frequently Asked Questions (English only) Find instructions on how to resolve common issues.
	Kaspersky Endpoint Security for Business Quick Start Guide Get started with Kaspersky Endpoint Security for Business: install and configure this solution. You can also examine the feature comparison of Kaspersky Security Center, to choose the most appropriate way of managing the network security.

Page top

[Topic 12521]

What's new

Kaspersky Security Center 15.1

Kaspersky Security Center 15.1 has several new features and improvements:

Cloud Discovery. This is a new feature that allows you to monitor attempts to use cloud services on managed devices running Windows, and to block access to cloud services that you consider unwanted. This feature is only available in Kaspersky Security Center Web Console.
Domain controller polling now allows you to poll a Samba domain controller through a Linux-based distribution point. Additional improvements were made to support polling of large domains.
Enhanced remote diagnostics of Linux-based managed devices.
Extended hardware inventory of macOS devices. Network Agent on a macOS device sends the MAC address and device serial number to Administration Server.
You can now check the connection to a SIEM system.
The maximum password length for an internal user was increased to 256 characters.
When you migrate from Kaspersky Security Center Windows to Kaspersky Security Center Linux, you can now switch the managed devices to be under management of Kaspersky Security Center Linux through restoring the certificate and private key of Administration Server from a backup copy.
When you run the Cleaner tool or the klmover utility to remove a password-protected Network Agent, you are prompted to enter the uninstallation password.
Upgrade from Kaspersky Security for Windows Server to Kaspersky Endpoint Security for Windows no longer requires the target device to restart.
A user can be assigned as a device owner during or after installation of Network Agent on a client device on Linux.
You can now receive a report on remote installation when you install software on the managed devices through custom scripts.
When you execute several custom scripts on a managed device, you can set a priority for each script to define the execution order. The scripts will be executed from the one with the highest priority to the one with the lowest priority.
Extended policy audit. You can now view the contents of a policy revision and save a policy revision to a file. Currently, these features are only available for the Administration Server policy and Network Agent policy.
User experience improvements, including:
- Main menu personalization by pinning sections of Kaspersky Security Center Web Console for quick access from the Pinned section.
- Optimized work with tables. The default view of each table now contains the most frequently used columns. Also, you can now select all items on the current page or in the entire table, as well as sort items in the entire table.
- Improved report delivery configuration. You can now specify up to 20 email addresses to send the report to, and the report delivery schedule.
You can revoke local administrator rights from accounts on Linux-based managed devices. This provides you with an extra layer of control of user accounts. For example, you can revoke local administrator rights after a one-time assignment is complete.
You can change the local account password on Linux-based managed devices, for example, when a user forgets the local account password or to perform a scheduled password change.
In the User certificates management subsection, you can specify which root certificates to install. These certificates can be used, for example, to verify the authenticity of websites or web servers.
Report on network attacks now includes the MAC address and port of the attacking device.
A new option to force an internal user to change a password at the next attempt to sign in to Kaspersky Security Center Web Console.
A commercial license is not checked anymore when you export events to a SIEM system in the CEF or LEEF formats.
When you migrate from one Kaspersky application to another and your current application is password-protected, you can now specify the uninstallation password in the remote installation task.
Exchange ActiveSync is no longer supported.

Kaspersky Security Center 14.2

Kaspersky Security Center 14.2 has several new features and improvements:

A new Hardening Guide was released. We highly recommend that you carefully read the guide and follow the security recommendations to configure Kaspersky Security Center and your network infrastructure.
Also, please install the latest update to Kaspersky Security Center. This update includes infrastructure protection features such as two-step verification of user accounts and other improvements.
Access to Kaspersky servers is now verified automatically. If access to the servers by using the system DNS is not possible, the application uses the public DNS.
User rights on a virtual Administration Server are available for configuration any time, independently from the primary Administration Server. Also, you can assign primary Server users the rights to manage a virtual Server.
Kaspersky Security Center now supports work with the following DBMSs:
- PostgreSQL 13.x
- PostgreSQL 14.x
- Postgres Pro 13.x (all editions)
- Postgres Pro 14.x (all editions)
- MariaDB 10.1, 10.4, 10.5
You can use Kaspersky Security Center Web Console to export policies and tasks to a file, and then import the policies and tasks to Kaspersky Security Center Windows or Kaspersky Security Center Linux.
The Do not use proxy server option has been removed from the following tasks:
- Download updates to the Administration Server repository
- Download updates to the repositories of distribution points
To protect client devices in a cloud environment, you can deploy Kaspersky Endpoint Security for Windows instead of Kaspersky Security for Windows Server. This feature is now available after the release of Kaspersky Endpoint Security 12.0 for Windows.
Work with the encryption keys is now limited by the access rights for the General features: Encryption Key Management functional area. Users of Kaspersky Security Center can now export encryption keys if they have the Read right, and can import encryption keys if they have the Write right.

Kaspersky Security Center 14

Kaspersky Security Center 14 has several new features and improvements:

You can install updates and fix vulnerabilities of third-party software (excluding Microsoft software) in an isolated network. Such networks include Administration Servers and managed devices that have no internet access. To fix vulnerabilities in this kind of network, you need to download required updates by using an Administration Server with internet access, and then transmit the patches to the isolated Administration Servers.
Connection profiles for out-of-office users have been added for macOS devices. By using connection profiles, you can configure the rules for Network Agents on macOS devices to connect to the same or different Administration Servers, depending on the device location.
Network Agent can now be installed on devices running Microsoft Windows 10 IoT Enterprise.
In the Report on threats, you can now filter the threat list to view only those threats that were detected by Cloud Sandbox.
Kaspersky Security Center now supports Kaspersky Industrial CyberSecurity for Linux Nodes 1.3 as a managed application.

Kaspersky Security Center Web Console has several new features and improvements:

You can configure the Dashboard-only mode for employees who do not manage the network but who want to view the network protection statistics in Kaspersky Security Center (for example, a top manager). When a user has this mode enabled, only a dashboard with a predefined set of widgets is displayed. Thus, he or she can monitor the statistics specified in the widgets, for example, the protection status of all managed devices, the number of recently detected threats, or the list of the most frequent threats in the network.
Kaspersky Security Center Web Console now supports Kaspersky Security for iOS as a security application.
In the task properties, you can specify whether or not you want to apply the task to subgroups and secondary Administration Servers (including virtual ones).
Kaspersky Security Center now supports Kaspersky Industrial CyberSecurity for Linux Nodes 1.3 as a managed application.

Kaspersky Security Center 13.2

Kaspersky Security Center 13.2 has several new features and improvements:

You can now install Administration Server, Administration Console, Kaspersky Security Center 13.2 Web Console, and Network Agent on the following new operation systems (see the software requirements for details):
- Microsoft Windows 11
- Microsoft Windows 10 21H2 (October 2021 Update)
- Windows Server 2022
You can use MySQL 8.0 as the database.
You can deploy Kaspersky Security Center on a Kaspersky Security Center failover cluster, to provide high availability of Kaspersky Security Center.
Kaspersky Security Center now works with IPv6 addresses, as well as IPv4 addresses. Administration Server can poll networks that have devices with IPv6 addresses.

Kaspersky Security Center 13.2 Web Console has several new features and improvements:

You can now manage mobile devices running Android via Kaspersky Security Center 13.2 Web Console.
Kaspersky marketplace is available as a new menu section: you can search for a Kaspersky application via Kaspersky Security Center 13.2 Web Console.
Kaspersky Security Center now supports the following Kaspersky applications:
- Kaspersky Endpoint Detection and Response Optimum 2.0
- Kaspersky Sandbox 2.0
- Kaspersky Industrial CyberSecurity for Networks 3.1

Kaspersky Security Center 13.1

Kaspersky Security Center 13.1 has several new features and improvements:

The integration with SIEM systems has been improved. You can now export events to SIEM systems via the encrypted channel (TLS). The feature is available for Kaspersky Security Center Web Console and MMC-based Administration Console.
You can now receive patches for the Administration Server as a distribution package, which you can use for future updates to later versions.
A new section, Alerts, has been added for Kaspersky Endpoint Detection and Response Optimum to Kaspersky Security Center 13.1 Web Console. Several new widgets are also added for working with the threats detected by Kaspersky Endpoint Detection and Response Optimum.
In Kaspersky Security Center 13.1 Web Console, you can now receive notifications about expiring licenses for Kaspersky applications.
The response time for Kaspersky Security Center 13.1 Web Console has been decreased.

Kaspersky Security Center 13

The following features are added to Kaspersky Security Center 13 Web Console:

Implemented two-step verification. You can enable two-step verification to reduce the risk of unauthorized access to Kaspersky Security Center 13 Web Console.
Implemented domain authentication by using the NTLM and Kerberos protocols (single sign-on). The single sign-on feature allows a Windows user to enable secure authentication in Kaspersky Security Center 13 Web Console without having to re-enter the password on the corporate network.
You can now configure a plug-in to work with Kaspersky Managed Detection and Response. You can use this integration to view incidents and manage workstations.
You can now specify settings for Kaspersky Security Center 13 Web Console in the installation wizard of Administration Server.
Notifications are displayed about new releases of updates and patches. You can install an update immediately or later at any time. You can now install patches for Administration Server via Kaspersky Security Center 13 Web Console.
When working with tables, you can now specify the order and the width of columns, sort data, and specify the page size.
You can now open any report by clicking its name.
Kaspersky Security Center 13 Web Console is now available in the Korean language.
A new section, Kaspersky announcements, is available in the Monitoring & reporting menu. This section keeps you informed by providing information related to your version of Kaspersky Security Center and the managed applications installed on the managed devices. Kaspersky Security Center periodically updates the information in this section by removing outdated announcements and adding new information. However, you can disable Kaspersky announcements if you want.
Implemented additional authentication after changing the settings of a user account. You can enable protecting a user account from unauthorized modification. If this option is enabled, modifying user account settings requires authorization by a user with modification rights.

The following features are added to Kaspersky Security Center 13:

Implemented two-step verification. You can enable two-step verification to reduce the risk of unauthorized access to the Administration Console. If this option is enabled, modifying user account settings requires authorization of the user with the rights for modification. You can now enable or disable two-step verification for KES devices.
You can send messages to Administration Server over HTTP. A reference guide and a Python library for working with the OpenAPI of Administration Server are now available.
You can issue a reserve certificate for use in iOS MDM profiles, to ensure seamless switching of managed iOS devices after the iOS MDM Server certificate expires.
The multi-tenancy applications folder is no longer displayed in Administration Console.

Page top

[Topic 3396]

About Kaspersky Security Center

The section contains information about the purpose of Kaspersky Security Center, its main features and components, and ways to purchase Kaspersky Security Center.

Information provided in Online Help may differ from information provided in documents shipped with the application; in this case, Online Help is considered up-to-date. You can proceed to Online Help by clicking links in the application interface, or by clicking the Online Help link in documents. Online Help can be updated without prior notice. You can switch between Online Help and Offline Help if necessary.

Kaspersky Security Center is designed for centralized execution of basic administration and maintenance tasks on an organization's network. The application provides the administrator access to detailed information about the organization's network security level; it allows configuring all the components of protection built using Kaspersky applications.

Kaspersky Security Center is an application aimed at corporate network administrators and employees responsible for protection of devices in a wide range of organizations.

Using Kaspersky Security Center, you can do the following:

Create a hierarchy of Administration Servers to manage the organization's network, as well as networks at remote offices or client organizations.
The client organization is an organization whose anti-virus protection is ensured by the service provider.
Create a hierarchy of administration groups to manage a selection of client devices as a whole.
Manage an anti-virus protection system built based on Kaspersky applications.
Create images of operating systems and deploy them on client devices over the network, as well as perform remote installation of applications by Kaspersky and other software vendors.
Remotely manage applications by Kaspersky and other vendors installed on client devices. Install updates, find and fix vulnerabilities.
Perform centralized deployment of license keys for Kaspersky applications to client devices, monitor their use, and renew licenses.
Receive statistics and reports about the operation of applications and devices.
Receive notifications about critical events during the operation of Kaspersky applications.
Manage mobile devices.
Manage encryption of information stored on the hard drives of devices and removable drives and users' access to encrypted data.
Perform inventory of hardware connected to the organization's network.
Centrally manage files moved to Quarantine or Backup by security applications, as well as manage files for which processing by security applications has been postponed.

You can purchase Kaspersky Security Center through Kaspersky (for example, at https://www.kaspersky.com) or through partner companies.

If you purchase Kaspersky Security Center through Kaspersky, you can copy the application from our website. Information that is required for application activation is sent to you by email after your payment is processed.

Updates functionality (including providing anti-virus signature updates and codebase updates), as well as KSN functionality may not be available in the software in the U.S.

In this section

Architecture

Hardware and software requirements

Compatible Kaspersky applications and solutions

Licenses and features of Kaspersky Security Center 15.1

About compatibility of Kaspersky Security Center components

Comparison of Kaspersky Security Center: Windows-based vs. Linux-based

About Kaspersky Security Center Cloud Console

Page top

[Topic 4531]

Architecture

This section provides a description of the components of Kaspersky Security Center and their interaction.

An administrator can manage Administration Server by using Administration Console or Web Console.

Kaspersky Security Center architecture

Kaspersky Security Center comprises the following main components:

Administration Console (also referred to as Console). Provides a user interface to the administration services of Administration Server and Network Agent. Administration Console is implemented as a snap-in for Microsoft Management Console (MMC). Administration Console allows remote connection to Administration Server over the internet.
Kaspersky Security Center Web Console. Provides a web interface for creating and maintaining the protection system of a client organization's network that is managed by Kaspersky Security Center.
Kaspersky Security Center Administration Server (also referred to as Server). Centralizes storage of information about applications installed on the organization's network and about how to manage them.
Kaspersky update servers. HTTP(S) servers at Kaspersky from which Kaspersky applications download database and application module updates.
KSN servers. Servers that contain a Kaspersky database with constantly updated information about the reputation of files, web resources, and software. Kaspersky Security Network ensures faster responses by Kaspersky applications to threats, improves the performance of some protection components, and reduces the likelihood of false positives.
Client devices. Client company's devices protected by Kaspersky Security Center. Each device that has to be protected must have one of the Kaspersky security applications installed.

Main installation scenario

Page top

[Topic 96255]

Requirements for a distribution point

Main installation scenario

Page top

[Topic 255791]

Administration Server requirements

Minimum hardware requirements:

CPU with an operating frequency of 1 GHz or higher. For a 64-bit operating system, the minimum CPU frequency is 1.4 GHz.
RAM: 4 GB.
Available disk space: 10 GB. When Vulnerability and patch management is used, at least 100 GB of free disk space must be available.

For deployment in cloud environments, the requirements for Administration Server and database server are the same as the requirements for physical Administration Server (depending on how many devices you want to manage).

Software requirements:

Microsoft Data Access Components (MDAC) 2.8
Microsoft Windows DAC 6.0
Microsoft Windows Installer 4.5

The following operating systems are supported:

Windows Server 2012 R2 Standard/Datacenter/Essentials/Foundation/Server Core 64-bit
Windows Server 2016 Standard/Datacenter/Essentials/Server Core (Installation Option) (LTSB) 64-bit
Windows Server 2019 Standard/Datacenter/Core 64-bit
Windows Server 2022 Standard/Datacenter/Core 64-bit
Windows Storage Server 2019 64-bit

The following virtualization platforms are supported:

VMware vSphere 6.7
VMware vSphere 7.0
Microsoft Hyper-V Server 2019 64-bit
Microsoft Hyper-V Server 2022 64-bit
Citrix XenServer 7.1 LTSR
Citrix XenServer 8.x
Parallels Desktop 18
Oracle VM VirtualBox 7.x

The following database servers are supported (can be installed on a different device):

Microsoft SQL Server 2016 (all editions) 64-bit
Microsoft SQL Server 2017 (all editions) on Windows/Linux 64-bit
Microsoft SQL Server 2019 (all editions) on Windows/Linux 64-bit (requires additional actions)
Microsoft SQL Server 2022 (all editions) on Windows/Linux 64-bit
MySQL 5.7 Community 32-bit/64-bit
MySQL Standard Edition 8.0 (release 8.0.20 and later) 32-bit/64-bit
MySQL Enterprise Edition 8.0 (release 8.0.20 and later) 32-bit/64-bit
MariaDB 10.5 (build 10.5.27 and later) 32-bit/64-bit
MariaDB Galera Cluster 10.3 32-bit/64-bit with InnoDB storage engine
PostgreSQL 13.x 64-bit
PostgreSQL 14.x 64-bit
PostgreSQL 15.x 64-bit
Postgres Pro 13.x Windows/Linux 64-bit
Postgres Pro 14.x Windows/Linux 64-bit

Refer to the following topic for details and limitations: Selecting a DBMS.

SIEM and other information management systems:

HP (Micro Focus) ArcSight ESM 7.0
IBM QRadar 7.3
Splunk 7.1

Page top

[Topic 255792]

Web Console requirements

Kaspersky Security Center Web Console Server

Minimum hardware requirements:

CPU: 4 cores, operating frequency of 2.5 GHz
RAM: 8 GB
Available disk space: 40 GB

Minimum requirements for the Administration Server certificate:

Certificate signature algorithm SHA-2
Minimum key length 2048

If you need to reissue the certificate, refer to the Kaspersky Security Center Knowledge Base.

Operating systems supported by Kaspersky Security Center Web Console Server

Operating systems. Microsoft Windows (64-bit versions only)

Windows Server 2012 R2 Standard/Datacenter/Foundation/Essentials/Server Core

Windows Server 2016 Standard/Datacenter/Essentials/Server Core (Installation Option) (LTSB)

Windows Server 2019 Standard/Datacenter/Core

Windows Server 2022 Standard/Datacenter/Core

Windows Storage Server 2019

Virtualization platforms

VMware vSphere 6.7

VMware vSphere 7.0

Citrix XenServer 7.1 LTSR

Citrix XenServer 8.x

Parallels Desktop 18

Oracle VM VirtualBox 7.x

Client devices

For a client device, use of Kaspersky Security Center Web Console requires only a browser.

The minimum screen resolution is 1366x768 pixels.

The hardware and software requirements for the device are identical to the requirements of the browser that is used with Kaspersky Security Center Web Console.

Browsers:

Google Chrome 128.0.6613.120 or later
Microsoft Edge 128.0.2739.67 or later
Safari 17.6 on macOS
"Yandex" Browser 24.7.3.1081 or later
Mozilla Firefox Extended Support Release 115.14.0 or later

Page top

[Topic 255794]

Mobile servers requirements

iOS Mobile Device Management (iOS MDM) Server

Hardware requirements:

CPU with an operating frequency of 1 GHz or higher. For a 64-bit operating system, the minimum CPU frequency is 1.4 GHz.
RAM: 2 GB.
Available disk space: 2 GB.

Software requirements: Microsoft Windows (the version of the supported operating system is defined by the Administration Server requirements).

Page top

[Topic 255796]

Administration Console requirements

Hardware requirements:

CPU with an operating frequency of 1 GHz or higher. For a 64-bit operating system, the minimum CPU frequency is 1.4 GHz.
RAM: 512 MB.
Available disk space: 1 GB.

Software requirements:

Microsoft Windows operating system (supported version of the operating system is determined by the requirements of Administration Server):
- Windows Server 2012 R2 Standard/Datacenter/Foundation/Essentials 64-bit
- Windows Server 2016 Standard/Datacenter/Essentials (LTSB) 64-bit
- Windows Server 2019 Standard/Datacenter 64-bit
- Windows Server 2022 Standard/Datacenter 64-bit
- Windows Storage Server 2019 64-bit
Microsoft Management Console 2.0
Microsoft Windows Installer 4.5
Microsoft Internet Explorer 11.0 running on:
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2016
- Microsoft Windows Server 2019
- Microsoft Windows Storage Server 2019
Microsoft Edge running on Microsoft Windows Server 2022 Standard

Page top

[Topic 255797]

Network Agent requirements

Minimum hardware requirements:

CPU with an operating frequency of 1 GHz or higher. For a 64-bit operating system, the minimum CPU frequency is 1.4 GHz.
RAM: 512 MB.
Available disk space: 1 GB.

Software requirement for Linux-based devices: the Perl language interpreter version 5.10 or later must be installed.

Operating systems supported by Network Agent

Operating systems. Microsoft Windows

Windows Embedded POSReady 2009 with latest Service Pack 32-bit

Windows Embedded 7 Standard with Service Pack 1 32-bit/64-bit

Windows Embedded 8.1 Industry Pro 32-bit/64-bit

Windows 10 Enterprise 2015 LTSB 32-bit/64-bit

Windows 10 Enterprise 2016 LTSB 32-bit/64-bit

Windows 10 IoT Enterprise 2015 LTSB 32-bit/64-bit

Windows 10 IoT Enterprise 2016 LTSB 32-bit/64-bit

Windows 10 Enterprise 2019 LTSC 32-bit/64-bit

Windows 10 IoT Enterprise version 1703 32-bit/64-bit

Windows 10 IoT Enterprise version 1709 32-bit/64-bit

Windows 10 IoT Enterprise version 1803 32-bit/64-bit

Windows 10 IoT Enterprise version 1809 32-bit/64-bit

Windows 10 20H2 IoT Enterprise 32-bit/64-bit

Windows 10 21H2 IoT Enterprise 32-bit/64-bit

Windows 10 IoT Enterprise 32-bit/64-bit

Windows 10 IoT Enterprise version 1909 32-bit/64-bit

Windows 10 IoT Enterprise LTSC 2021 32-bit/64-bit

Windows 10 IoT Enterprise version 1607 32-bit/64-bit

Windows 10 TH1 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 TH2 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 RS1 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 RS2 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 RS3 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 RS4 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 RS5 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 RS6 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 19H1 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 19H2 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 20H1 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 20H2 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 21H1 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 21H2 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 10 22H2 Home/Pro/Pro for Workstations/Enterprise/Education 32-bit/64-bit

Windows 11 Home/Pro/Pro for Workstations/Enterprise/Education 64-bit

Windows 11 22H2 Home/Pro/Pro for Workstations/Enterprise/Education 64-bit

Windows 11 23H2 Home/Pro/Pro for Workstations/Enterprise/Education 64-bit

Windows 11 24H2 Home/Pro/Pro for Workstations/Enterprise/Education 64-bit

Windows 8 Pro/Enterprise 32-bit/64-bit

Windows 8.1 Pro/Enterprise 32-bit/64-bit

Windows 7 Home/Pro/Enterprise/Ultimate with Service Pack 1 32-bit/64-bit

Microsoft Windows XP Professional with Service Pack 2 32-bit/64-bit (supported by Network Agent version 10.5.1781 only)

Windows XP Professional with Service Pack 3 and later 32-bit (supported by Network Agent version 14.0.0.20023)

Windows XP Professional for Embedded Systems with Service Pack 3 32-bit (supported by Network Agent version 14.0.0.20023)

Windows MultiPoint Server 2011 Standard/Premium 64-bit

Windows Server 2008 Standard/Enterprise/Datacenter/Foundation with Service Pack 2 32-bit/64-bit

Windows Server 2008 R2 Standard/Datacenter/Enterprise/Foundation/ with Service Pack 1 and later 64-bit

Windows Server 2012 Standard/Datacenter/Essentials/Foundation/Server Core 64-bit

Windows Server 2012 R2 Standard/Datacenter/Essentials/Foundation/Server Core 64-bit

Windows Server 2016 Standard/Datacenter/Essentials/Server Core (Installation Option) (LTSB) 64-bit

Windows Server 2019 Standard/Datacenter/Core 64-bit

Windows Server 2019 RS5 Standard/Essentials 64-bit

Windows Server 2022 Standard/Datacenter/Core 64-bit

Windows Server 2022 21H2 Standard/Datacenter 64-bit

Windows Storage Server 2019 64-bit

Operating systems. Linux

Debian GNU/Linux 10.х (Buster) 32-bit/64-bit

Debian GNU/Linux 11.х (Bullseye) 32-bit/64-bit

Debian GNU/Linux 12 (Bookworm) 32-bit/64-bit

Ubuntu Server 18.04 LTS (Bionic Beaver) 64-bit

Ubuntu Server 20.04 LTS (Focal Fossa) 64-bit

Ubuntu Server 22.04 LTS (Jammy Jellyfish) 64-bit

Ubuntu Server 22.04 LTS ARM 64-bit

Ubuntu Server 24.04 LTS (Noble Numbat) 64-bit

CentOS 6.7 and later 32-bit

CentOS 6.х (up to 6.6) 32-bit/64-bit

CentOS 7.x 64-bit

CentOS Stream 8 64-bit

CentOS Stream 9 64-bit

CentOS Stream 9 ARM 64-bit

Red Hat Enterprise Linux Server 6.x 32-bit/64-bit

Red Hat Enterprise Linux Server 7.x 64-bit

Red Hat Enterprise Linux Server 8.x 64-bit

Red Hat Enterprise Linux Server 9.x 64-bit

SUSE Linux Enterprise Server 12 (all Service Packs) 64-bit

SUSE Linux Enterprise Server 15 (all Service Packs) 64-bit

SUSE Linux Enterprise Server 15 (all Service Packs) ARM 64-bit

openSUSE 15 64-bit

EulerOS 2.0 SP10 64-bit

EulerOS 2.0 SP10 ARM 64-bit

Astra Linux Special Edition RUSB.10015-01 (operational update 1.5) 64-bit

Astra Linux Special Edition RUSB.10015-01 (operational update 1.6) 64-bit

Astra Linux Special Edition RUSB.10015-16 (release 1) (operational update 1.6) 64-bit

Astra Linux Special Edition RUSB.10015-17 (operational update 1.7.3) 64-bit

Astra Linux Special Edition RUSB.10015-01 (operational update 1.7) 64-bit

Astra Linux Special Edition RUSB.10015-01 (operational update 1.8) 64-bit

Astra Linux Special Edition RUSB.10015-37 (operational update 7.7) 64-bit

Astra Linux Special Edition RUSB.10152-02 (operational update 4.7) ARM 64-bit

Astra Linux Common Edition (operational update 2.12) 64-bit

ALT Workstation 10.1 64-bit

ALT Server 10.1 64-bit

ALT Education 10.1 64-bit

ALT SP Server 10 32-bit/64-bit

ALT SP Server 10 ARM 64-bit

ALT SP Workstation 10 32-bit/64-bit

ALT SP Workstation 10 ARM 64-bit

ALT Server 10 64-bit

ALT Server 10 ARM 64-bit

ALT Workstation 10 32-bit/64-bit

ALT 8 SP Workstation (8.4) ARM 64-bit

ALT 8 SP Server (8.4) ARM 64-bit

ALT 8 SP Server (LKNV.11100-01) 32-bit/64-bit

ALT 8 SP Server (LKNV.11100-02) 32-bit/64-bit

ALT 8 SP Server (LKNV.11100-03) 32-bit/64-bit

ALT 8 SP Workstation (LKNV.11100-01) 32-bit/64-bit

ALT 8 SP Workstation (LKNV.11100-02) 32-bit/64-bit

ALT 8 SP Workstation (LKNV.11100-03) 32-bit/64-bit

Mageia 4 32-bit

Oracle Linux 7 64-bit

Oracle Linux 8 64-bit

Oracle Linux 9 64-bit

Linux Mint 20.x 64-bit

Linux Mint 21.1 and later 64-bit

AlterOS 7.5 and later 64-bit

GosLinux IC6/7.17 64-bit

GosLinux IC6/7.2 64-bit

SberOS 3.3.1 64-bit

Platform V SberLinux OS Server (SLO) 8.8 64-bit

Platform V SberLinux OS Server (SLO) 8.9.2 64-bit

RED OS 7.3 ARM 64-bit

RED OS 7.3 Server 64-bit

RED OS 7.3 Certified Edition 64-bit

RED OS 8 Certified Edition 64-bit

ROSA Enterprise Linux Server 7.9 64-bit

ROSA Enterprise Linux Desktop 7.9 64-bit

ROSA COBALT 7.9 64-bit

ROSA CHROME 12 64-bit

AlmaLinux 8 and later 64-bit

AlmaLinux 9 and later 64-bit

Rocky Linux 8 and later 64-bit

Rocky Linux 9 and later 64-bit

Atlant, Alcyone build, version 2022.02 64-bit

MSVSPHERE 9.2 SERVER 64-bit

MSVSPHERE 9.2 ARM 64-bit

SynthesisM Server 8.6 64-bit

SynthesisM Client 8.6 64-bit

OSnova 2.10 64-bit

Kylin 10 64-bit

EMIAS 1.0 64-bit

Amazon Linux 2 64-bit

MosOS 15.4 Arbat 64-bit

OS MES (Moscow Electronic School) 64-bit

Operating systems. macOS

macOS 12.x

macOS 13.x

macOS 14.x

For Network Agent, the Apple Silicon (M1) architecture is also supported, as well as Intel.

The following virtualization platforms are supported:

VMware vSphere 6.7
VMware vSphere 7.0
Parallels Desktop 18
Oracle VM VirtualBox 7.x
Citrix XenServer 7.1 LTSR
Citrix XenServer 8.x
Kernel-based Virtual Machine (all Linux operating systems supported by Network Agent)

On the devices running Windows 10 version RS4 or RS5, Kaspersky Security Center might be unable to detect some vulnerabilities in folders where case sensitivity is enabled.

Before installing Network Agent on the devices running Windows 7, Windows Server 2008 or Windows Server 2008 R2, make sure that you have installed the security update KB3063858 for OS Windows (Security Update for Windows 7 (KB3063858), Security Update for Windows 7 for x64-based Systems (KB3063858), Security Update for Windows Server 2008 (KB3063858), Security Update for Windows Server 2008 x64 Edition (KB3063858), Security Update for Windows Server 2008 R2 x64 Edition (KB3063858).

In Microsoft Windows XP, Network Agent might not perform some operations correctly.

You can install or update Network Agent for Windows XP in Microsoft Windows XP only. The supported editions of Microsoft Windows XP and their corresponding versions of the Network Agent are listed in the list of supported operating systems. You can download the required version of the Network Agent for Microsoft Windows XP from this page.

We recommend that you install the same version of the Network Agent as Kaspersky Security Center.

Kaspersky Security Center fully supports Network Agent of the same or newer versions.

Network Agent for macOS is provided together with Kaspersky security application for this operating system.

Page top

[Topic 172903]

Compatible Kaspersky applications and solutions

Kaspersky Security Center supports centralized deployment and management of all Kaspersky applications and solutions that are currently supported. The table below shows what Kaspersky applications and solutions are supported by MMC-based Administration Console and Kaspersky Security Center Web Console. To find out versions of the applications and solutions, refer to the Product Support Lifecycle webpage.

List of Kaspersky applications and solutions supported by Kaspersky Security Center

Name of Kaspersky application or solution	Supported by MMC-based Administration Console	Supported by Kaspersky Security Center Web Console

For workstations
Kaspersky Endpoint Security for Windows
Kaspersky Endpoint Security for Linux
Kaspersky Endpoint Security for Linux Elbrus Edition
Kaspersky Endpoint Security for Mac
Kaspersky Endpoint Agent
Kaspersky Embedded Systems Security for Windows
Kaspersky Embedded Systems Security for Linux
For industrial solutions
Kaspersky Industrial CyberSecurity for Nodes
Kaspersky Industrial CyberSecurity for Linux Nodes
Kaspersky Industrial CyberSecurity for Networks (centralized deployment is not supported)
For mobile devices
Kaspersky Endpoint Security for Android
Kaspersky Security for iOS
For file servers
Kaspersky Security for Windows Server
Kaspersky Endpoint Security for Windows
Kaspersky Endpoint Security for Linux
For virtual environments
Kaspersky Security for Virtualization Light Agent
Kaspersky Security for Virtualization Agentless
For mail and collaboration servers
Kaspersky Security for Microsoft Exchange Servers
For detection of targeted attacks
Kaspersky Sandbox Server
Kaspersky Endpoint Detection and Response Optimum
Kaspersky Managed Detection and Response
For KasperskyOS devices
Kaspersky IoT Secure Gateway
KasperskyOS Thin Client
Reputation databases
Kaspersky Private Security Network

See also:

Main installation scenario

Page top

[Topic 209155]

Licenses and features of Kaspersky Security Center 15.1

Kaspersky Security Center requires a license for some of its features.

The table below shows which license covers what features of Kaspersky Security Center.

To enable the features of Kaspersky Security Center, you must activate Administration Server by adding an Administration Server license key.

You have to manually add a license key for each Administration Server.

Licenses and Kaspersky Security Center features

Features of Kaspersky Security Center	Kaspersky Vulnerability and patch management	Kaspersky Endpoint Security for Business Select	Kaspersky Endpoint Security for Business Advanced	Kaspersky Total Security for Business	Kaspersky Hybrid Cloud Security Standard	Kaspersky Hybrid Cloud Security Enterprise	Kaspersky EDR Optimum
Vulnerability assessment
Patch management
Role-based access control
Installation of operating systems and applications
Mobile device management (that is, management of users' iOS and Android devices)
Configure cloud environment for work in cloud environments such as AWS, Microsoft Azure, or Google Cloud
Exporting events to SIEM systems: Syslog
Exporting events to SIEM systems: QRadar by IBM and ArcSight by Micro Focus

Kaspersky applications: licensing and activation

Adding an Administration Server license key

Configuring the interface

Page top

[Topic 211939]

About compatibility of Kaspersky Security Center components

In the table below, you can find information about the compatibility of Kaspersky Security Center components.

Compatibility of Kaspersky Security Center components

Component	Compatible with
Kaspersky Security Center 15.1 Administration Server	Kaspersky Security Center 15.1 Administration Console. Kaspersky Security Center 15.1 Web Console. Kaspersky Security Center Network Agent of the following versions: 15.1, 15, 14.2, 14.
Kaspersky Security Center 15.1 Web Console	Kaspersky Security Center Administration Server of the following versions: 15.1 and 14.2.
Kaspersky Security Center 15.1 Primary Administration Server	Secondary Administration Servers: Kaspersky Security Center 14 Windows. Kaspersky Security Center 14.2 Windows. Kaspersky Security Center 15.1 Windows. Kaspersky Security Center 14.2 Linux. Kaspersky Security Center 15 Linux. Kaspersky Security Center 15.1 Linux.
Kaspersky Security Center 15.1 Secondary Administration Server	Primary Administration Servers: Kaspersky Security Center 14 Windows. Kaspersky Security Center 14.2 Windows. Kaspersky Security Center 15.1 Windows. Kaspersky Security Center 14.2 Linux. Kaspersky Security Center 15 Linux. Kaspersky Security Center 15.1 Linux.

We recommend that you use the latest version of both Kaspersky Security Center Administration Server and Kaspersky Security Center Web Console. Otherwise, the functionality of Kaspersky Security Center may be limited. You can install and upgrade Kaspersky Security Center Administration Server and Kaspersky Security Center Web Console independently. In this case, you have to ensure that the version of the installed Kaspersky Security Center Web Console is compatible with the version of Administration Server to which you connect.

If you have the latest version of Kaspersky Security Center Web Console and the previous version of Kaspersky Security Center, and an error occurs during domain authentication, the error text will contain a default message.

Page top

[Topic 211055]

Comparison of Kaspersky Security Center: Windows-based vs. Linux-based

Kaspersky provides Kaspersky Security Center as an on-premises solution for two platforms—Windows and Linux. In the Windows-based solution, you install Administration Server on a Windows device, and the Linux-based solution has the Administration Server version that is designed to be installed on a Linux device. This Online Help contains information about Kaspersky Security Center Windows. For detailed information about the Linux-based solution, refer to the Kaspersky Security Center Linux Online Help.

The table below lets you compare the main features of Kaspersky Security Center as a Windows-based solution and as a Linux-based solution.

Feature comparison of Kaspersky Security Center working as a Windows-based solution and Linux-based solution

Feature or property	Kaspersky Security Center 15.1

	Windows-based solution	Linux-based solution
Administration Server location	On-premises	On-premises
Database management system (DBMS) location	On-premises	On-premises
Operating system to install Administration Server on	Windows	Linux
Administration console type	On-premises and web-based	Web-based
Operating system to install the web-based administration console on	Windows or Linux	Linux
Hierarchy of Administration Servers
Administration group hierarchy
Network polling		(by IP ranges, domain controllers, Samba 4 Active Directory, Microsoft Active Directory)
Maximum number of managed devices	100,000	50,000 (with PostgreSQL and Postgres Pro)
Protection of Windows, macOS, and Linux-managed devices
Protection of mobile devices
Protection of virtual machines
Protection of public cloud infrastructure
Device-centric security management
User-centric security management
Application policies
Tasks for Kaspersky applications
Kaspersky Security Network
KSN Proxy
Kaspersky Private Security Network
Centralized deployment of license keys for Kaspersky applications
Updating anti-virus databases automatically
Support for virtual Administration Servers
Installing third-party software updates and fixing third-party software vulnerabilities
Notifications about events that occurred on managed devices
Creating and managing user accounts
Sign-in to the console by using domain authentication		(Single Sign-on is not supported)
Integration with SIEM systems		(by using Syslog only)
Monitoring the policies and tasks status
Deployment of the Kaspersky Security Center failover cluster
Installing Administration Server on a Windows Server failover cluster
Using SNMP to send Administration Server statistics to third-party applications
Remote diagnostics of client devices
Remote connection to the desktop of a client device
Managing object revisions
Updating Kaspersky applications automatically
Deployment of operating systems on client devices
Web Server for publishing installation packages and other files
Viewing and working with alerts detected by Kaspersky Endpoint Detection and Response Optimum
Using Administration Server as WSUS server
Integration with Kaspersky Managed Detection and Response
Support for Adaptive Anomaly Control
Support of clusters and server arrays in administration groups
Managing third-party licenses

Page top

[Topic 196993]

About Kaspersky Security Center Cloud Console

Using Kaspersky Security Center as an on-premises application means that you install Kaspersky Security Center, including Administration Server, on a local device and manage the network security system through the Microsoft Management Console-based Administration Console (available only in Kaspersky Security Center Windows) or Kaspersky Security Center Web Console.

However, you can use Kaspersky Security Center as a cloud service instead. In this case Kaspersky Security Center is installed and maintained for you by Kaspersky experts in the cloud environment, and Kaspersky gives you access to the Administration Server as a service. You manage the network security system through the cloud-based Administration Console named Kaspersky Security Center Cloud Console. This console has an interface similar to the interface of Kaspersky Security Center Web Console.

The interface and documentation of Kaspersky Security Center Cloud Console are available in the following languages:

English
French
German
Italian
Japanese
Portuguese (Brazil)
Russian
Simplified Chinese
Spanish
Spanish (LATAM)
Traditional Chinese

More information about Kaspersky Security Center Cloud Console and its features is available in the Kaspersky Security Center Cloud Console documentation and in the Kaspersky Endpoint Security for Business documentation.

Page top

[Topic 144300]

Kaspersky Security Center 15.1

This section provides information about using Kaspersky Security Center 15.1.

In this section

Basic concepts

Main installation scenario

Ports used by Kaspersky Security Center

Certificates for work with Kaspersky Security Center

Schemas for data traffic and port usage

Deployment best practices

Installation of Kaspersky Security Center

About upgrading Kaspersky Security Center

Initial setup of Kaspersky Security Center

Discovering networked devices

Licensing

Kaspersky applications. Centralized deployment

Kaspersky applications: licensing and activation

Configuring network protection

Updating Kaspersky Security Center and managed applications

Managing third-party applications on client devices

Monitoring and reporting

Adjustment of distribution points and connection gateways

Other routine work

Export of events to SIEM systems

Using SNMP for sending statistics to third-party applications

Working in a cloud environment

Appendices

Page top

[Topic 3302]

Basic concepts

This section explains basic concepts related to Kaspersky Security Center.

In this section

Administration Server

Hierarchy of Administration Servers

Virtual Administration Server

Mobile Device Server

Web Server

Network Agent

Administration groups

Managed device

Unassigned device

Administrator's workstation

Management plug-in

Management web plug-in

How local application settings relate to policies

Distribution point

Connection gateway

Page top

[Topic 3303]

Administration Server

Kaspersky Security Center components enable remote management of Kaspersky applications installed on client devices.

Devices with the Administration Server component installed will be referred to as Administration Servers (also referred to as Servers). Administration Servers must be protected, including physical protection, against any unauthorized access.

Administration Server is installed on a device as a service with the following set of attributes:

With the name "Kaspersky Security Center Administration Server"
Set to start automatically when the operating system starts
With the LocalSystem account or the user account selected during the installation of Administration Server

Administration Server performs the following functions:

Storage of the administration groups' structure
Storage of information about the configuration of client devices
Organization of repositories for application distribution packages
Remote installation of applications to client devices and removal of applications
Updating application databases and software modules of Kaspersky applications
Management of policies and tasks on client devices
Storage of information about events that have occurred on client devices
Generation of reports on the operation of Kaspersky applications
Deployment of license keys to client devices and storing information about the license keys
Forwarding notifications about the progress of tasks (such as detection of viruses on a client device)

Naming Administration Servers in the application interface

In the interface of the MMC-based Administration Console and Kaspersky Security Center Web Console, Administration Servers can have the following names:

Name of the Administration Server device, for example: "device_name" or "Administration Server: device_name".
IP address of the Administration Server device, for example: "IP_address" or "Administration Server: IP_address".
Secondary Administration Servers and virtual Administration Servers have custom names that you specify when you connect a virtual or a secondary Administration Server to the primary Administration Server.
If you use Kaspersky Security Center Web Console installed on a Linux device, the application displays the names of the Administration Servers that you specified as trusted in the response file.

You can connect to Administration Server by using Administration Console or Kaspersky Security Center Web Console.

See also:

Main installation scenario

Scenario: Deployment for a cloud environment

Installation of Kaspersky Security Center

Interaction of Kaspersky Security Center components and security applications: more information

Page top

[Topic 3304]

Hierarchy of Administration Servers

Administration Servers can be arranged in a hierarchy. Each Administration Server can have several secondary Administration Servers (referred to as secondary Servers) on different nesting levels of the hierarchy. The nesting level for secondary Servers is unrestricted. The administration groups of the primary Administration Server will then include the client devices of all secondary Administration Servers. Thus, isolated and independent sections of networks can be managed by different Administration Servers which are in turn managed by the primary Server.

Virtual Administration Servers are a particular case of secondary Administration Servers.

The hierarchy of Administration Servers can be used to do the following:

Decrease the load on Administration Server (compared to a single installed Administration Server for an entire network).
Decrease intranet traffic and simplify work with remote offices. You do not have to establish connections between the primary Administration Server and all networked devices, which may be located, for example, in different regions. It is sufficient to install a secondary Administration Server in each network segment, distribute devices among administration groups of secondary Servers, and establish connections between the secondary Servers and the primary Server over fast communication channels.
Distribute responsibilities among the anti-virus security administrators. All capabilities for centralized management and monitoring of the anti-virus security status in corporate networks remain available.
How service providers use Kaspersky Security Center. The service provider only needs to install Kaspersky Security Center and Kaspersky Security Center Web Console. To manage a large number of client devices of various organizations, a service provider can add virtual Administration Servers to the hierarchy of Administration Servers.

Each device included in the hierarchy of administration groups can be connected to one Administration Server only. You must independently monitor the connection of devices to Administration Servers. Use the feature for device search in administration groups of different Servers based on network attributes.

Main installation scenario

Page top

[Topic 30636]

Virtual Administration Server

Virtual Administration Server (also referred to as virtual Server) is a component of Kaspersky Security Center intended for managing anti-virus protection of the network of a client organization.

Virtual Administration Server is a particular case of a secondary Administration Server and has the following restrictions as compared with a physical Administration Server:

Virtual Administration Server can be created only on a primary Administration Server.
Virtual Administration Server uses the primary Administration Server database in its operation. Data backup and restoration tasks, as well as update scan and download tasks, are not supported on a virtual Administration Server.
Virtual Server does not support creation of secondary Administration Servers (including virtual Servers).

In addition, virtual Administration Server has the following restrictions:

In the virtual Administration Server properties window, the number of sections is limited.
To install Kaspersky applications remotely on client devices managed by the virtual Administration Server, you must make sure that Network Agent is installed on one of the client devices, in order to ensure communication with the virtual Administration Server. Upon first connection to the virtual Administration Server, the device is automatically assigned as a distribution point, thus functioning as a connection gateway between the client devices and the virtual Administration Server.
A virtual Server can poll the network only through distribution points.
To restart a malfunctioning virtual Server, Kaspersky Security Center restarts the primary Administration Server and all virtual Administration Servers.
Users created on a virtual Server cannot be assigned a role on the Administration Server.

The administrator of a virtual Administration Server has all privileges on this particular virtual Server.

Page top

[Topic 65383]

Mobile Device Server

Mobile Device Server is a component of Kaspersky Security Center that provides access to mobile devices and allows managing them through Administration Console. Mobile Device Server receives information about mobile devices and stores their profiles.

Kaspersky Security Center includes iOS MDM Server as a Mobile Device Server. This Mobile Device Server is used for managing mobile devices that support Apple Push Notification service (APNs).

Mobile Device Servers of Kaspersky Security Center allow you to manage the following objects:

An individual mobile device.
Several mobile devices.
Several mobile devices connected to a cluster of servers simultaneously. After connecting to a cluster of servers, the mobile devices server installed in this cluster is displayed in Administration Console as a single server.

Page top

[Topic 74647]

Web Server

Kaspersky Security Center Web Server (hereinafter also referred to as Web Server) is a component of Kaspersky Security Center that is installed together with Administration Server. Web Server is designed for transmission, over a network, of stand-alone installation packages, iOS MDM profiles, and files from a shared folder.

When you create a stand-alone installation package, it is automatically published on Web Server. The link for downloading the stand-alone package is displayed in the list of created stand-alone installation packages. If necessary, you can cancel publication of the stand-alone package or you can publish it on Web Server again.

When you create an iOS MDM profile for a user's mobile device, it is also automatically published on Web Server. The published profile is automatically deleted from Web Server as soon as it is successfully installed on the user's mobile device.

The shared folder is used for storage of information that is available to all users whose devices are managed through the Administration Server. If a user has no direct access to the shared folder, he or she can be given information from that folder by means of Web Server.

To provide users with information from a shared folder by means of Web Server, the administrator must create a subfolder named "public" in the shared folder and paste the relevant information into it.

The syntax of the information transfer link is as follows:

https://<Web Server name>:<HTTPS port>/public/<object>

where:

<Web Server name> is the name of Kaspersky Security Center Web Server.
<HTTPS port> is an HTTPS port of Web Server that has been defined by the Administrator. The HTTPS port can be set in the Web Server section of the properties window of Administration Server. The default port number is 8061.
<object> is the subfolder or file to which the user has access.

The administrator can send the new link to the user in any convenient way, such as by email.

By using this link, the user can download the required information to a local device.

Page top

[Topic 3305]

Network Agent

Interaction between Administration Server and devices is performed by the Network Agent component of Kaspersky Security Center. Network Agent must be installed on all devices on which Kaspersky Security Center is used to manage Kaspersky applications.

Network Agent is installed on a device as a service, with the following set of attributes:

With the name "Kaspersky Security Center Network Agent"
Set to start automatically when the operating system starts
Using the LocalSystem account

A device that has Network Agent installed is called a managed device or device.

You can install Network Agent on a Windows, Linux, or Mac device. You can get the component from one of the following sources:

Installation package in Administration Server storage (you must have Administration Server installed)
Installation package located at Kaspersky web servers

You do not have to install Network Agent on the device where you install Administration Server, because the server version of Network Agent is automatically installed together with Administration Server.

The name of the process that Network Agent starts is klnagent.exe.

Network Agent synchronizes the managed device with the Administration Server. We recommend that you set the synchronization interval (also referred to as the heartbeat) to 15 minutes per 10,000 managed devices.

See also:

Network Agent policy settings

Deploying Network Agent and the security application

Page top

[Topic 165736]

Administration groups

An administration group (hereinafter also referred to as group) is a logical set of managed devices combined on the basis of a specific trait for the purpose of managing the grouped devices as a single unit within Kaspersky Security Center.

All managed devices within an administration group are configured to do the following:

Use the same application settings (which you can specify in group policies).
Use a common operating mode for all applications through the creation of group tasks with specified settings. Examples of group tasks include creating and installing a common installation package, updating the application databases and modules, scanning the device on demand, and enabling real-time protection.

A managed device can belong to only one administration group.

You can create hierarchies that have any degree of nesting for Administration Servers and groups. A single hierarchy level can include secondary and virtual Administration Servers, groups, and managed devices. You can move devices from one group to another without physically moving them. For example, if a worker's position in the enterprise changes from that of accountant to developer, you can move this worker's device from the Accountants administration group to the Developers administration group. Thereafter, the device will automatically receive the application settings required for developers.

See also:

Managing administration groups

Page top

[Topic 162465]

Managed device

A managed device is a device running Windows, Linux, or macOS on which Network Agent is installed, or a mobile device on which a Kaspersky security application is installed. You can manage such devices by creating tasks and policies for applications installed on these devices. You can also receive reports from managed devices.

You can make a non-mobile managed device function as a distribution point and as a connection gateway.

A device can be managed by only one Administration Server. One Administration Server can manage up to 100,000 devices, including mobile devices.

Page top

[Topic 165744]

Unassigned device

An unassigned device is a device on the network that has not been included in any administration group. You can perform some actions on unassigned devices, for example, move them to administration groups or install applications on them.

When a new device is discovered on your network, this device goes to the Unassigned devices administration group. You can configure rules for devices to be moved automatically to other administration groups after the devices are discovered.

Page top

[Topic 3307]

Administrator's workstation

Administrator's workstation is a device on which Administration Console is installed or that you use to open Kaspersky Security Center Web Console. Administrators can use these devices for centralized remote management of Kaspersky applications installed on client devices.

After Administration Console is installed on your device, its icon appears, allowing you to start Administration Console. Find it in the Start → Programs → Kaspersky Security Center menu.

There are no restrictions on the number of administrator's workstations. From any administrator's workstation you can manage administration groups of several Administration Servers on the network at once. You can connect an administrator's workstation to an Administration Server (physical or virtual) of any level of the hierarchy.

You can include an administrator's workstation in an administration group as a client device.

Within the administration groups of any Administration Server, the same device can function as an Administration Server client, an Administration Server, or an administrator's workstation.

Page top

[Topic 3308]

Management plug-in

Kaspersky applications are managed through Administration Console by using a dedicated component named management plug-in. Each Kaspersky application that can be managed through Kaspersky Security Center includes a management plug-in.

Using the application management plug-in, you can perform the following actions in Administration Console:

Creating and editing application policies and settings, as well as the settings of application tasks.
Obtaining information about application tasks, application events, as well as application operation statistics received from client devices.

You can download management plug-ins from the Kaspersky Technical Support webpage.

See also:

Working with the management plug-ins

Management web plug-in

Page top

[Topic 165761]

Management web plug-in

A special component—the management web plug-in—is used for remote administration of Kaspersky software by means of Kaspersky Security Center Web Console. Hereinafter, a management web plug-in is also referred to as a management plug-in. A management plug-in is an interface between Kaspersky Security Center Web Console and a specific Kaspersky application. With a management plug-in, you can configure tasks and policies for the application.

You can download management web plug-ins from the Kaspersky Technical Support webpage.

The management plug-in provides the following:

Interface for creating and editing application tasks and settings
Interface for creating and editing policies and policy profiles for remote and centralized configuration of Kaspersky applications and devices
Transmission of events generated by the application
Kaspersky Security Center Web Console functions for displaying operational data and events of the application, and statistics relayed from client devices

See also:

Management plug-in

Kaspersky Security Center Web Console

Kaspersky applications deployment through Kaspersky Security Center Web Console

Page top

[Topic 3313]

Policies

A policy is a set of Kaspersky application settings that are applied to an administration group and its subgroups. You can install several Kaspersky applications on the devices of an administration group. Kaspersky Security Center provides a single policy for each Kaspersky application in an administration group. A policy has one of the following statuses (see the table below):

The status of the policy

Status	Description
Active	The current policy that is applied to the device. Only one policy may be active for a Kaspersky application in each administration group. Devices apply the settings values of an active policy for a Kaspersky application.
Inactive	A policy that is not currently applied to a device.
Out-of-office	If this option is selected, the policy becomes active when the device leaves the corporate network.

Policies function according to the following rules:

Multiple policies with different values can be configured for a single application.
Only one policy can be active for the current application.
You can activate an inactive policy when a specific event occurs. For example, you can enforce stricter anti-virus protection settings during virus outbreaks.
A policy can have child policies.

Generally, you can use policies as preparations for emergency situations, such as a virus attack. For example, if there is an attack via flash drives, you can activate a policy that blocks access to flash drives. In this case, the current active policy automatically becomes inactive.

In order to prevent maintaining multiple policies, for example, when different occasions assume changing of several settings only, you may use policy profiles.

A policy profile is a named subset of policy settings values that replaces the settings values of a policy. A policy profile affects the effective settings formation on a managed device. Effective settings are a set of policy settings, policy profile settings, and local application settings that are currently applied for the device.

Policy profiles function according to the following rules:

A policy profile takes an effect when a specific activation condition occurs.
Policy profiles contain values of settings that differ from the policy settings.
Activation of a policy profile changes the effective settings of the managed device.
A policy can include a maximum of 100 policy profiles.

See also:

Main installation scenario

Policies and policy profiles

Creating a policy

Page top

[Topic 165778]

Policy profiles

Sometimes it may be necessary to create several instances of a single policy for different administration groups; you might also want to modify the settings of those policies centrally. These instances might differ by only one or two settings. For example, all the accountants in an enterprise work under the same policy—but senior accountants are allowed to use flash drives, while junior accountants are not. In this case, applying policies to devices only through the hierarchy of administration groups can be inconvenient.

To help you avoid creating several instances of a single policy, Kaspersky Security Center enables you to create policy profiles. Policy profiles are necessary if you want devices within a single administration group to run under different policy settings.

A policy profile is a named subset of policy settings. This subset is distributed on target devices together with the policy, supplementing it under a specific condition called the profile activation condition. Profiles only contain settings that differ from the "basic" policy, which is active on the managed device. Activation of a profile modifies the settings of the "basic" policy that were initially active on the device. The modified settings take values that have been specified in the profile.

See also:

Policies and policy profiles

Creating a policy profile

Page top

[Topic 92435]

Tasks

Kaspersky Security Center manages Kaspersky security applications installed on devices by creating and running tasks. Tasks are required for installing, launching, and stopping applications, scanning files, updating databases and software modules, and performing other actions on applications.

Tasks for a specific application can be created only if the management plug-in for that application is installed.

Tasks can be performed on the Administration Server and on devices.

The following tasks are performed on the Administration Server:

Automatic distribution of reports
Downloading of updates to the repository of the Administration Server
Backup of Administration Server data
Maintenance of the database
Windows Update synchronization
Creation of an installation package based on the operating system (OS) image of a reference device

The following types of tasks are performed on devices:

Local tasks—Tasks that are performed on a specific device
Local tasks can be modified either by the administrator, by using Administration Console tools, or by the user of a remote device (for example, through the security application interface). If a local task has been modified simultaneously by the administrator and the user of a managed device, the changes made by the administrator will take effect because they have a higher priority.
Group tasks—Tasks that are performed on all devices of a specific group
Unless otherwise specified in the task properties, a group task also affects all subgroups of the selected group. A group task also affects (optionally) devices that have been connected to secondary and virtual Administration Servers deployed in the group or any of its subgroups.
Global tasks—Tasks that are performed on a set of devices, regardless of whether they are included in any group

For each application, you can create any number of group tasks, global tasks, or local tasks.

You can make changes to the settings of tasks, view the progress of tasks, and copy, export, import, and delete tasks.

A task is started on a device only if the application for which the task was created is running.

Results of tasks are saved in the Microsoft Windows event log and the Kaspersky Security Center event log, both centrally on the Administration Server and locally on each device.

Do not include private data in task settings. For example, avoid specifying the domain administrator password.

See also:

Main installation scenario

Managing tasks

Creating a task

Page top

[Topic 165863]

Task scope

The scope of a task is the set of devices on which the task is performed. The types of scope are as follows:

For a local task, the scope is the device itself.
For an Administration Server task, the scope is the Administration Server.
For a group task, the scope is the list of devices included in the group.

When creating a global task, you can use the following methods to specify its scope:

Specifying certain devices manually.
You can use an IP address (or IP range), NetBIOS name, or DNS name as the device address.
Importing a list of devices from a TXT file with the device addresses to be added (each address must be placed on an individual line).
If you import a list of devices from a file or create a list manually, and if devices are identified by their names, the list can only contain devices for which information has already been entered into the Administration Server database. Moreover, the information must have been entered when those devices were connected or during device discovery.
Specifying a device selection.
Over time, the scope of a task changes as the set of devices included in the selection change. A selection of devices can be made on the basis of device attributes, including software installed on a device, and on the basis of tags assigned to devices. Device selection is the most flexible way to specify the scope of a task.

Tasks for device selections are always run on a schedule by the Administration Server. These tasks cannot be run on devices that lack connection to the Administration Server. Tasks whose scope is specified by using other methods are run directly on devices and therefore do not depend on the device connection to the Administration Server.

Tasks for device selections are not run on the local time of a device; instead, they are run on the local time of the Administration Server. Tasks whose scope is specified by using other methods are run on the local time of a device.

Page top

[Topic 3316]

How local application settings relate to policies

You can use policies to set identical values of the application settings for all devices in a group.

The values of the settings that a policy specifies can be redefined for individual devices in a group by using local application settings. You can set only the values of settings that the policy allows to be modified, that is, the unlocked settings.

The value of a setting that the application uses on a client device is defined by the lock position () for that setting in the policy:

If a setting modification is locked, the same value (defined in the policy) is used on all client devices.
If a setting modification is unlocked, the application uses a local setting value on each client device instead of the value specified in the policy. The setting can then be changed in the local application settings.

This means that, when a task is run on a client device, the application applies settings that have been defined in two different ways:

By task settings and local application settings, if the setting is not locked against changes in the policy.
By the group policy, if the setting is locked against changes.

Local application settings are changed after the policy is first applied in accordance with the policy settings.

See also:

Policies and policy profiles

Page top

[Topic 98876]

Distribution point

Distribution point (previously known as update agent) is a device with Network Agent installed that is used for distribution of updates, remote installation of applications, and retrieval of information about networked devices. Distribution points accelerate update distribution and free up Administration Server resources.

The features and use cases of Network Agent installed on a device used as a distribution point vary depending on the operating system.

A distribution point can perform the following functions:

Distribute files received from the Administration Server to client devices within the group (including distribution through multicasting using UDP).
The list of files that can be transferred by distribution points includes:
- Updates of Kaspersky databases and software modules
- Third-party software updates
- Installation packages
- Windows updates when you use Administration Server as a WSUS server
Updates can be received either from the Administration Server or from Kaspersky update servers. In the latter case, an update task must be created for the distribution point. Distribution point devices running macOS cannot download updates from Kaspersky update servers.

If one or more devices running macOS are within the scope of the Download updates to the repositories of distribution points task, the task completes with the Failed status, even if it has successfully completed on all Windows devices.
Distribute policies and group tasks through multicasting using UDP.
Act as a gateway for connection to the Administration Server for devices in an administration group.
If a direct connection between managed devices within the group and the Administration Server cannot be established, you can use the distribution point as connection gateway to the Administration Server for this group. In this case, managed devices connect to the connection gateway, which in turn connects to the Administration Server.

The presence of a distribution point that functions as connection gateway does not block the option of a direct connection between managed devices and the Administration Server. If the connection gateway is not available, but direct connection with the Administration Server is technically possible, managed devices are connected to the Administration Server directly.
Poll the network to detect new devices and update information about existing ones. A distribution point can apply the same device discovery methods as the Administration Server.
Perform remote installation of third-party software and Kaspersky applications by using tools of the distribution point operating system. Note that the distribution point can perform installation on client devices without Network Agent.
This feature allows you to remotely transfer Network Agent installation packages to client devices located on networks to which the Administration Server has no direct access.
Act as a proxy server participating in Kaspersky Security Network (KSN).
You can enable KSN proxy server on distribution point side to make the device act as a KSN proxy server. In this case, the KSN proxy service (ksnproxy) is run on the device.

Files are transmitted from the Administration Server to a distribution point over HTTP or, if SSL connection is enabled, over HTTPS. Using HTTP or HTTPS results in a higher level of performance, compared to SOAP, through cutting traffic.

Devices with Network Agent installed can be assigned distribution points either manually (by the administrator), or automatically (by the Administration Server). The full list of distribution points for specified administration groups is displayed in the report about the list of distribution points.

The scope of a distribution point is the administration group to which it has been assigned by the administrator, as well as its subgroups of all levels of embedding. If multiple distribution points have been assigned in the hierarchy of administration groups, Network Agent on the managed device connects to the nearest distribution point in the hierarchy.

A network location can also be the scope of distribution points. The network location is used for manual creation of a set of devices to which the distribution point will distribute updates. Network location can be determined only for devices running a Windows operating system.

If distribution points are assigned automatically by the Administration Server, it assigns them by broadcast domains, not by administration groups. This occurs when all broadcast domains are known. Network Agent exchanges messages with other Network Agents in the same subnet and then sends Administration Server information about itself and other Network Agents. Administration Server can use that information to group Network Agents by broadcast domains. Broadcast domains are known to Administration Server after more than 70% Network Agents in administration groups are polled. Administration Server polls broadcast domains every two hours. After distribution points are assigned by broadcast domains, they cannot be re-assigned by administration groups.

If the administrator manually assigns distribution points, they can be assigned to administration groups or network locations.

Network Agents with the active connection profile do not participate in broadcast domain detection.

Kaspersky Security Center assigns each Network Agent a unique IP multicast address that differs from every other address. This allows you to avoid network overload that might occur due to IP overlaps.

If two or more distribution points are assigned to a single network area or to a single administration group, one of them becomes the active distribution point, and the rest become standby distribution points. The active distribution point downloads updates and installation packages directly from the Administration Server, while standby distribution points receive updates from the active distribution point only. In this case, files are downloaded once from the Administration Server and then are distributed among distribution points. If the active distribution point becomes unavailable for any reason, one of the standby distribution points becomes active. The Administration Server automatically assigns a distribution point to act as standby.

The distribution point status (Active/Standby) is displayed with a check box in the klnagchk report.

A distribution point requires at least 4 GB of free disk space. If the free disk space of the distribution point is less than 2 GB, Kaspersky Security Center creates a security issue with the Warning importance level. The security issue will be published in the device properties, in the Security issues section.

Running remote installation tasks on a device assigned as a distribution point requires additional free disk space. The volume of free disk space must exceed the total size of all installation packages to be installed.

Running any updating (patching) tasks and vulnerability fix tasks on a device assigned as a distribution point requires additional free disk space. The volume of free disk space must be at least twice the total size of all patches to be installed.

Devices functioning as distribution points must be protected, including physical protection, against any unauthorized access.

About distribution points

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 204420]

Connection gateway

A connection gateway is a Network Agent acting in a special mode. A connection gateway accepts connections from other Network Agents and tunnels them to the Administration Server through its own connection with the Server. Unlike an ordinary Network Agent, a connection gateway waits for connections from the Administration Server rather than establishes connections to the Administration Server.

A connection gateway can receive connections from up to 10,000 devices.

You have two options for using connection gateways:

We recommend that you install a connection gateway in a demilitarized zone (DMZ). For other Network Agents installed on out-of-office devices, you need to specially configure a connection to Administration Server through the connection gateway.
A connection gateway does not in any way modify or process data that is transmitted from Network Agents to Administration Server. Moreover, it does not write this data into any buffer and therefore cannot accept data from a Network Agent and later forward it to Administration Server. If Network Agent attempts to connect to Administration Server through the connection gateway, but the connection gateway cannot connect to Administration Server, Network Agent perceives this as if Administration Server is inaccessible. All data remains on Network Agent (not on the connection gateway).

A connection gateway cannot connect to Administration Server through another connection gateway. It means that Network Agent cannot simultaneously be a connection gateway and use a connection gateway to connect to Administration Server.

All connection gateways are included in the list of distribution points in the Administration Server properties.
You can also use connection gateways within the network. For example, automatically assigned distribution points also become connection gateways in their own scope. However, within an internal network, connection gateways do not provide considerable benefit. They reduce the number of network connections received by Administration Server, but do not reduce the volume of incoming data. Even without connection gateways, all devices could still connect to Administration Server.

About using a distribution point as connection gateway

Page top

[Topic 153504]

Main installation scenario

Following this scenario, you can deploy Administration Server, as well as install Network Agent and security applications on networked devices. You can use this scenario both for a closer look at the application and for the application installation for further work.

Installation of Kaspersky Security Center consists of the following steps:

Preparation work
Installation of Kaspersky Security Center and a Kaspersky security application on the Administration Server device
Centralized deployment of Kaspersky security applications on client devices

Deployment of Kaspersky Security Center in cloud environments and deployment of Kaspersky Security Center for service providers are described in other Help sections.

We recommend that you assign a minimum of one hour for Administration Server installation and a minimum of one working day for completion of the scenario. We also recommend that you install a security application, such as Kaspersky Security for Windows Server or Kaspersky Endpoint Security, on the device that will act as Kaspersky Security Center Administration Server.

Upon completion of the scenario, protection will be deployed on the organization's network in the following way:

The DBMS will be installed for the Administration Server.
Kaspersky Security Center Administration Server will be installed.
All required policies and tasks will be created; the default settings of policies and tasks will be specified.
Security applications (for example, Kaspersky Endpoint Security for Windows) and Network Agent will be installed on managed devices.
Administration groups will be created (possibly combined into a hierarchy).
Mobile device protection will be deployed, if necessary.
Distribution points will be assigned, if necessary.

Kaspersky Security Center installation proceeds in stages:

Preparation work

Getting the necessary files
Make sure that you have a license key (activation code) for Kaspersky Security Center or license keys (activation codes) for Kaspersky security applications.

Unpack the archive that you received from your vendor. This archive contains the license keys (KEY files), activation codes, and the list of Kaspersky applications that can be activated by each license key.

If you first want to try out Kaspersky Security Center, you can get a free 30-day trial at the Kaspersky website.

For detailed information about the licensing of the Kaspersky security applications that are not included in Kaspersky Security Center, you can refer to the documentation of those applications.
Selecting a structure for protection of an organization
Find out more about the Kaspersky Security Center components. Select the protection structure and the network configuration which suit your organization best. Based on the network configuration and throughput of communication channels, define the number of Administration Servers to use and how they must be distributed among your offices (if you run a distributed network).

To obtain and maintain optimum performance under varying operational conditions, please take into account the number of networked devices, network topology, and set of Kaspersky Security Center features that you require (for more details, refer to the Kaspersky Security Center Sizing Guide).

Define whether a hierarchy of Administration Servers will be used in your organization. To do this, you must evaluate whether it is possible and expedient to cover all client devices with a single Administration Server or it is necessary to build a hierarchy of Administration Servers. You may also have to build a hierarchy of Administration Servers that is identical to the organizational structure of the organization whose network you want to protect.

If you have to ensure protection of mobile devices, perform all prerequisite actions required for configuration of an iOS MDM Server.

Make sure that the devices that you selected as Administration Servers, as well as those for Administration Console installation, meet all the hardware and software requirements.
Preparation for the use of custom certificates
If your organization's Public Key Infrastructure (PKI) requires that you use custom certificates issued by a specific certification authority (CA), prepare those certificates and make sure that they meet all the requirements.
Preparation for Kaspersky Security Center licensing
If you plan to use a Kaspersky Security Center version with Mobile Device Management, Integration with SIEM systems, and/or with Vulnerability and patch management support, make sure that you have a key file or activation code for the application licensing.
Preparation for licensing of managed security applications
During protection deployment, you have to provide Kaspersky with the active license keys for the applications that you intend to manage through Kaspersky Security Center (see the list of manageable security applications). For detailed information about the licensing of any security application, you can refer to the documentation of this application.
Selecting the hardware configuration of the Administration Server and DBMS
Plan the hardware configuration for the DBMS and the Administration Server, taking into account the number of devices on your network.
Selecting a DBMS
When selecting a DBMS, take into account the number of managed devices to be covered by this Administration Server. If your network includes fewer than 10 000 devices and you do not plan to increase this number, you can choose a free-of-charge DBMS, such as SQL Express, or MySQL, and install it on the same device as Administration Server. Alternatively, you can choose the MariaDB DBMS that allows you to manage up to 20 000 devices. If your network includes more than 10 000 devices (or if you plan to expand your network up to that number of devices), we recommend that you choose a paid-for SQL DBMS and install it on a dedicated device. A paid DBMS can work with multiple Administration Servers, but a DBMS that is free of charge can work with only one.

If you select SQL Server DBMS, note that you can migrate the data stored in the database to MySQL, MariaDB, or Azure SQL DBMS. To perform the migration, back up your data and restore it into the new DBMS.
Installing the DBMS and creating the database
Find out more about the accounts for work with the DBMS and install your DBMS.

Before installation choose a supported DBMS. You can select, for example, PostgreSQL, Postgres Pro, Microsoft SQL Server, MySQL, or MariaDB.

For information about how to install the selected DBMS, refer to its documentation.

If you install MariaDB, MySQL, PostgreSQL, or Postgres Pro, use the recommended settings to ensure the DBMS functions properly.

Write down and save the DBMS settings because you will need them during Administration Server installation. These settings include the SQL Server name, number of the port used for connecting to SQL Server, and account name and password for accessing the SQL Server.

If you decide to install PostgreSQL or Postgres Pro DBMS, ensure that you specified a password for the superuser. If the password is not specified, Administration Server might not be able to connect to the database.

By default, the Kaspersky Security Center Installer creates the database for storage of Administration Server information, but you can opt out of creating this database and use a different database instead. In this case, make sure that the database has been created, you know its name, and the account under which the Administration Server will gain access to this database has the db_owner role for it.

If necessary, contact your DBMS administrator for more information.
Configuring ports
Make sure that all the necessary ports are open for interaction between components in accordance with your selected security structure.

If you have to provide Internet access to the Administration Server, configure the ports and specify the connection settings, depending on the network configuration.
Checking accounts
Make sure that you have all local administrator rights required for successful installation of Kaspersky Security Center Administration Server and further protection deployment on the devices. Local administrator rights on client devices are required for Network Agent installation on these devices. After Network Agent is installed, you can use it to install applications on devices remotely, without using the account with the device administrator rights.

By default, on the device selected for Administration Server installation, the Kaspersky Security Center Installer creates three local accounts under which Administration Server and the Kaspersky Security Center services will be run:
- KL-AK-*: Administration Server service account
- NT Service/KSC*: Account for other services from the Administration Server pool
- KlPxeUser: Account for deployment of operating systems
You can opt out of creating accounts for the Administration Server services and other services. You use your existing accounts instead, such as domain accounts, if you plan to install Administration Server on a failover cluster, or plan to use domain accounts instead of local accounts for any other reason. In this case, make sure that the accounts intended for running Administration Server and the Kaspersky Security Center services have been created, are non-privileged and have all permissions required for access to the DBMS. (If you plan further deployment of operating systems on devices through Kaspersky Security Center, do not opt out of creating accounts.)

Installation of Kaspersky Security Center and a Kaspersky security application on the Administration Server device

Installing the Administration Server, Administration Console, Kaspersky Security Center Web Console, and management plug-ins for security applications
Download Kaspersky Security Center from the Kaspersky website. You can download the full package, Web Console only, or Administration Console only.

Install Administration Server on the device that you selected (or multiple devices, if you plan to use multiple Administration Servers). You can select standard or custom installation of Administration Server. Administration Console will be installed together with Administration Server. It is recommended to install the Administration Server on a dedicated server instead of a domain controller.

Standard installation is recommended if you want to try out Kaspersky Security Center by, for example, testing its operation on a small area within your network. During standard installation, you only configure the database. You can also install only the default set of management plug-ins for Kaspersky applications. You can also use standard installation if you already have some experience working with Kaspersky Security Center and are able to specify all relevant settings after standard installation.

Custom installation is recommended if you plan to modify the Kaspersky Security Center settings, such as a path to the shared folder, accounts and ports for connection to the Administration Server, and database settings. Custom installation enables you to specify which Kaspersky management plug-ins to install. If necessary, you can start custom installation in silent mode.

Administration Console and the server version of Network Agent are installed together with Administration Server. You can also choose to install Kaspersky Security Center Web Console during the installation.

If you want, install Administration Console and/or Kaspersky Security Center Web Console on the administrator's workstation separately to manage Administration Server over the network.
Initial setup and licensing
When Administration Server installation is complete, at the first connection to the Administration Server the quick start wizard starts automatically. Perform initial configuration of Administration Server according to the existing requirements. During the initial configuration stage, the wizard uses the default settings to create the policies and tasks that are required for protection deployment. However, the default settings may be less than optimal for the needs of your organization. If necessary, you can edit the settings of policies and tasks (Configuring protection on a client organization's network, Scenario: Configuring network protection).

If you plan to use the features that are outside the basic functionality, license the application. You can do this at one of the steps of the quick start wizard.
Checking Administration Server installation for success
When all the previous steps are complete, Administration Server is installed and ready for further use.

Make sure that Administration Console is running and you can connect to the Administration Server through Administration Console. Also, make sure that the Download updates to the repository of the Administration Server task is available in Administration Server (in the Tasks folder of the console tree), as well as the policy for Kaspersky Endpoint Security (in the Policies folder of the console tree).

When the check is complete, proceed to the steps below.

Centralized deployment of Kaspersky security applications on client devices

Discovering networked devices
This step is part of the quick start wizard. You can also start the device discovery manually. Kaspersky Security Center receives the addresses and names of all devices detected on the network. You can then use Kaspersky Security Center to install Kaspersky applications and software from other vendors on the detected devices. Kaspersky Security Center regularly starts device discovery, which means that if any new instances appear in the network, they will be detected automatically.
Installing Network Agent and security applications on networked devices
Deployment of protection (Configuring protection on a client organization's network, Scenario: Configuring network protection) of an organization's network entails installation of Network Agent and security applications (for example, Kaspersky Endpoint Security) on devices that have been detected by Administration Server during the device discovery.

Security applications protect devices against viruses and/or other programs posing a threat. Network Agent ensures communication between the device and Administration Server. Network Agent settings are configured automatically by default.

If you want, you can install Network Agent in silent mode with a response file or without a response file.

Before you start install Network Agent and the security applications on networked devices, make sure that these devices are accessible (that is, turned on). You can install Network Agent on virtual machines as well as on physical devices.

Security applications and Network Agent can be installed remotely or locally.

Remote installation—Using the Protection deployment wizard, you can remotely install the security application (for example, Kaspersky Endpoint Security for Windows) and Network Agent on devices that have been detected by Administration Server in the organization's network. Normally, the Remote installation task successfully deploys protection to most networked devices. However, it may return an error on some devices if, for example, a device is turned off or cannot be accessed for any other reason. In this case, we recommend that you connect to the device manually and use local installation.

Local installation—Used on network devices on which protection could not be deployed using the remote installation task. To install protection on such devices, create a stand-alone installation package that you can run locally on those devices.

Network Agent installation on devices running Linux and macOS operating systems is described in the documentation for Kaspersky Endpoint Security for Linux and Kaspersky Endpoint Security for Mac, respectively. Although devices running Linux and macOS operating systems are considered less vulnerable than devices running Windows, we recommend that you nonetheless install security applications on such devices.

After installation, make sure that the security application is installed on managed devices. Run a Kaspersky software version report and view its results.
Deploying license keys to client devices
Deploy license keys to client devices to activate managed security applications on those devices.
Configuring mobile device protection
This step is part of the quick start wizard.

If you want to manage enterprise mobile devices, take the necessary steps for preparation and deploy Mobile Device Management.
Creating an administration group structure
In some cases, deploying protection on networked devices in the most convenient way may require you to divide the entire pool of devices into administration groups taking into account the structure of the organization. You can create moving rules to distribute devices among groups, or you can distribute devices manually. You can assign group tasks for administration groups, define the scope of policies, and assign distribution points.

Make sure that all managed devices have been correctly assigned to the appropriate administration groups, and that there are no longer any unassigned devices on the network.
Assigning distribution points
Kaspersky Security Center assigns distribution points to administration groups automatically, but you can assign them manually, if necessary. We recommend that you use distribution points on large-scale networks to reduce the load on the Administration Server, and on networks that have a distributed structure to provide the Administration Server with access to devices (or device groups) communicated through channels with low throughput rates. You can use devices running Linux as distribution points, as well as devices running Windows.

See also:

Basic concepts

Ports used by Kaspersky Security Center

Schemas for data traffic and port usage

Interaction of Kaspersky Security Center components and security applications: more information

Architecture

Scenario: Deployment for a cloud environment

Providing internet access to Administration Server

iOS MDM Server

Scenario: Monitoring and reporting

Scenario: Configuring network protection

Establishing a background connection

Page top

[Topic 158830]

Ports used by Kaspersky Security Center

The tables below show the default ports that must be open on Administration Servers and on client devices. If you want, you can change default port numbers.

The table below shows the default ports that must be open on Administration Server. However, if you install the Administration Server and the database on different devices, you must make available the necessary ports on the device where the database is located (for example, port 3306 for MySQL Server, port 1433 for Microsoft SQL Server, or port 5432 for PostgreSQL and Postgres Pro). Please refer to the DBMS documentation for the relevant information.

Ports that must be open on Administration Server

Port number	Name of the process that opens the port	Protocol	Port purpose	Scope
8060	klcsweb	TCP	Transmitting published installation packages to client devices	Publishing installation packages. You can change the default port number in the Web Server section of the Administration Server properties window in the Administration Console or in Kaspersky Security Center Web Console.
8061	klcsweb	TCP (TLS)	Transmitting published installation packages to client devices	Publishing installation packages. You can change the default port number in the Web Server section of the Administration Server properties window in the Administration Console or in Kaspersky Security Center Web Console.
13000	klserver	TCP (TLS)	Receiving connections from Network Agents and secondary Administration Servers; also used on secondary Administration Servers for receiving connections from the primary Administration Server (for example, if the secondary Administration Server is in DMZ)	Managing client devices and secondary Administration Servers. You can change the number of the default port for receiving connections from Network Agents when configuring connection ports; you can change the number of default port for receiving connections from secondary Administration Servers when creating a hierarchy of Administration Servers in the Administration Console or in Kaspersky Security Center Web Console.
13000	klserver	UDP	Receiving information about devices that were turned off from Network Agents	Managing client devices. You can change the default port number in the Network Agent policy settings in the Administration Console or in Kaspersky Security Center Web Console.
13291	klserver	TCP (TLS)	Receiving connections from Administration Console to Administration Server	Managing Administration Server. You can change the default port number in the Administration Server properties window in the Administration Console.
13299	klserver	TCP (TLS)	Receiving connections from Kaspersky Security Center Web Console to the Administration Server; receiving connections to the Administration Server over OpenAPI	Kaspersky Security Center Web Console, OpenAPI. You can change the default port number in the Administration Server properties window (in the Connection ports subsection of the General section) in the Administration Console, or when creating a hierarchy of Administration Servers in the Administration Console or in Kaspersky Security Center Web Console.
14000	klserver	TCP	Receiving connections from Network Agents	Managing client devices. You can change the default port number when configuring connection ports during the installation of Kaspersky Security Center, or when manually connecting a client device to the Administration Server.
13111 (only if KSN proxy service is run on the device)	ksnproxy	TCP	Receiving requests from managed devices to KSN proxy server	KSN proxy server. You can change the default port number in the Administration Server properties window.
15111 (only if KSN proxy service is run on the device)	ksnproxy	UDP	Receiving requests from managed devices to KSN proxy server	KSN proxy server. You can change the default port number in the Administration Server properties window.
17000	klactprx	TCP (TLS)	Receiving connections for application activation from managed devices (except for mobile devices)	Activation proxy server used by non-mobile devices to activate Kaspersky applications with activation codes. You can change the default port number in the Administration Server properties window.
17100 (only if you manage mobile devices)	klactprx	TCP (TLS)	Receiving connections for application activation from mobile devices	Activation proxy server for mobile devices. You can change the default port number in the Administration Server properties window.
19170	klserver	HTTPS (TLS)	Tunneling connections to managed devices by using the klsctunnel utility	Remotely connecting to managed devices by using Kaspersky Security Center Web Console. You can change the default port number in the Administration Server properties window (in the Additional ports subsection of the General section) in the Administration Console only.
13292 (only if you manage mobile devices)	klserver	TCP (TLS)	Receiving connections from mobile devices	Mobile Device Management. You can change the default port number in the Administration Server properties window in the Administration Console or in Kaspersky Security Center Web Console.
13294 (only if you manage mobile devices)	klserver	TCP (TLS)	Receiving connections from UEFI protection devices	Managing UEFI protection client devices. You can change the default port number when connecting mobile devices, or later in the Administration Server properties window (in the Additional ports subsection of the General section) in the Administration Console or in Kaspersky Security Center Web Console.
13296	klserver	TCP (TLS)	Publishing Kaspersky Security Center metrics for Prometheus	Publishing Kaspersky Security Center metrics that will be further obtained by Prometheus. You can view the metrics via the following link: https://<`server_address`>:13296/metrics. In <`server_address`>, specify the IP address or domain name of your Administration Server. You can change the default port number in the Administration Server properties window in the Administration Console.
30522, 30523 (ports on the localhost interface)	klnagent	TCP	Receiving Kaspersky application updates from Administration Server by using the FileTransferBridge component	The Administration Server device that receives Kaspersky application updates.

The table below shows the port that must be open on the iOS MDM Server (only if you manage mobile devices).

Port used by Kaspersky Security Center iOS MDM Server

Port number	Name of the process that opens the port	Protocol	Port purpose	Scope
443	kliosmdmservicesrv	TCP (TLS)	Receiving connections from iOS mobile devices	Mobile Device Management. You can change the default port number when installing iOS MDM Server.

Port number

Name of the process that opens the port

Protocol

Port purpose

Scope

443

kliosmdmservicesrv

TCP (TLS)

Receiving connections from iOS mobile devices

Mobile Device Management.

You can change the default port number when installing iOS MDM Server.

The table below shows the port that must be open on Kaspersky Security Center Web Console Server. It can be the same device where Administration Server is installed or a different device.

Port used by Kaspersky Security Center Web Console Server

Port number	Name of the process that opens the port	Protocol	Port purpose	Scope
8080	Node.js: Server-side JavaScript	TCP (TLS)	Receiving connections from browser to Kaspersky Security Center Web Console	Kaspersky Security Center Web Console. You can change the default port number when installing Kaspersky Security Center Web Console on a device running Windows or on a Linux platform. If you install Kaspersky Security Center Web Console on the Linux ALT operating system, you must specify a port number other than 8080, because port 8080 is used by the operating system.

Port number

Name of the process that opens the port

Protocol

Port purpose

Scope

8080

Node.js: Server-side JavaScript

TCP (TLS)

Receiving connections from browser to Kaspersky Security Center Web Console

Kaspersky Security Center Web Console.

You can change the default port number when installing Kaspersky Security Center Web Console on a device running Windows or on a Linux platform. If you install Kaspersky Security Center Web Console on the Linux ALT operating system, you must specify a port number other than 8080, because port 8080 is used by the operating system.

The table below shows the port that must be open on managed devices where Network Agent is installed.

Ports used by Network Agent

Port number	Name of the process that opens the port	Protocol	Port purpose	Scope
15000	klnagent	UDP	Management signals from Administration Server or Distribution point to Network Agents	Managing client devices. You can change the default port number in the Network Agent policy settings in the Administration Console or in Kaspersky Security Center Web Console.
15000	klnagent	UDP broadcast	Getting data about other Network Agents within the same broadcasting domain (the data is then sent to the Administration Server)	Delivering updates and installation packages.
15001	klnagent	UDP	Receiving multicast requests from a distribution point (if in use)	Receiving updates and installation packages from a distribution point. You can change the default port number in the distribution point properties window in the Administration Console or in Kaspersky Security Center Web Console.
30522, 30523 (ports on the localhost interface)	klnagent	TCP	Receiving Kaspersky application updates from Administration Server by using the FileTransferBridge component	Managed devices that receive Kaspersky application updates from Administration Server specified as a database update source.
161	klnagent	SNMP	Monitoring and discovering networked devices.	Device discoverability.

Please note that the klnagent process can also request free ports from the dynamic port range of an endpoint operating system. These ports are allocated to the klnagent process automatically by the operating system, so klnagent process can use some ports that are used by another software. If the klnagent process affects that software operations, change the port settings in this software, or change the default dynamic port range in your operating system to exclude the port used by the software affected.

Also take into account that recommendations on the compatibility of Kaspersky Security Center with third-party software are described for reference only and may not be applicable to new versions of third-party software. The described recommendations for configuring ports are based on the experiences of Technical Support and our best practices.

The table below shows the ports that must be open on a managed device with Network Agent installed acting as a distribution point. The listed ports must be open on the distribution point devices in addition to the ports used by Network Agents (see table above).

Ports used by Network Agent functioning as distribution point

Port number	Name of the process that opens the port	Protocol	Port purpose	Scope
13000	klnagent	TCP (TLS)	Receiving connections from Network Agents and from Kaspersky Security Center when the distribution point acts as a connection gateway in DMZ. If a device with installed Administration Server specified as a distribution point, port 13001 is used for SSL connection by default instead of 13000.	Managing client devices, delivering updates and installation packages. See the following topic for details: Administration Server, a connection gateway in a network segment, and a client device. You can change the default port number in the distribution point properties window in the Administration Console or in Kaspersky Security Center Web Console.
13111 (only if KSN proxy service is run on the device)	ksnproxy	TCP	Receiving requests from managed devices to KSN proxy server	KSN proxy server. You can change the default port number in the distribution point properties window in the Administration Console or in Kaspersky Security Center Web Console.
15111 (only if KSN proxy service is run on the device)	ksnproxy	UDP	Receiving requests from managed devices to KSN proxy server	KSN proxy server. You can change the default port number in the distribution point properties window in the Administration Console or in Kaspersky Security Center Web Console.
17111 (only if KSN proxy service is run on the device)	ksnproxy	HTTPS	Receiving requests from managed devices to KSN proxy server	KSN proxy server. You can change the default port number in the distribution point properties window in the Administration Console or in Kaspersky Security Center Web Console.
13295 (only if you use the distribution point as a push server)	klnagent	TCP (TLS)	Receiving connections from client devices	Push server. You can change the default port number in the distribution point properties window in the Administration Console or in Kaspersky Security Center Web Console.

Ports used by Kaspersky Security Center Web Console

Main installation scenario

Scenario: Mobile Device Management deployment

Page top

[Topic 232137]

Certificates for work with Kaspersky Security Center

This section contains information about Kaspersky Security Center certificates and describes how to issue a custom certificate for Administration Server.

In this section

About Kaspersky Security Center certificates

About Administration Server certificate

Requirements for custom certificates used in Kaspersky Security Center

Scenario: Specifying the custom Administration Server certificate

Replacing the Administration Server certificate by using the klsetsrvcert utility

Connecting Network Agents to Administration Server by using the klmover utility

Reissuing the Web Server certificate

Page top

[Topic 206479]

About Kaspersky Security Center certificates

Kaspersky Security Center uses the following types of certificates to enable a secure interaction between the application components:

Administration Server certificate
Mobile certificate
iOS MDM Server certificate
Kaspersky Security Center Web Server certificate
Kaspersky Security Center Web Console certificate

By default, Kaspersky Security Center uses self-signed certificates (that is, issued by Kaspersky Security Center itself), but you can replace them with custom certificates to better meet the requirements of your organization's network and comply with the security standards. After Administration Server verifies whether a custom certificate meets all applicable requirements, this certificate assumes the same functional scope as a self-signed certificate. The only difference is that a custom certificate is not reissued automatically upon expiration. You replace certificates with custom ones by means of the klsetsrvcert utility or through the Administration Server properties section in Administration Console, depending on the certificate type. When you use the klsetsrvcert utility, you need to specify a certificate type by using one of the following values:

C—Common certificate for ports 13000 and 13291.
CR—Common reserve certificate for ports 13000 and 13291.
M—Mobile certificate for port 13292.
MR—Mobile reserve certificate for port 13292.
MCA—Mobile certification authority for auto-generated user certificates.

You do not need to download the klsetsrvcert utility. It is included in the Kaspersky Security Center distribution kit. The utility is not compatible with previous Kaspersky Security Center versions.

The maximum validity period for any of the Administration Server certificates must be 397 days or less.

Administration Server certificates

An Administration Server certificate is required for authentication of Administration Server, as well as for secure interaction between Administration Server and Network Agent on managed devices or between primary Administration Server and secondary Administration Servers. When you connect Administration Console to Administration Server for the first time, you are prompted to confirm the use of the current Administration Server certificate. Such confirmation is also required every time the Administration Server certificate is replaced, after every reinstallation of Administration Server, and when connecting a secondary Administration Server to the primary Administration Server. This certificate is called common ("C").

The common ("C") certificate is automatically created when the Administration Server component is installed. The certificate consists of two parts:

klserver.cer file; by default, it is located on the device where the Administration Server component is installed in C:\ProgramData\KasperskyLab\adminkit\1093\cert folder.
Secret key located in Windows Protected Storage.

Also, a common reserve ("CR") certificate exists. Kaspersky Security Center automatically generates this certificate 90 days before the expiration of the common certificate. The common reserve certificate is subsequently used for seamless replacement of the Administration Server certificate. When the common certificate is about to expire, the common reserve certificate is used to maintain the connection with Network Agent instances installed on managed devices. With this purpose, the common reserve certificate automatically becomes the new common certificate 24 hours before the old common certificate expires.

You can also back up the Administration Server certificate separately from other Administration Server settings in order to move Administration Server from one device to another without data loss.

Mobile certificates

A mobile certificate ("M") is required for authentication of the Administration Server on mobile devices. You configure the use of the mobile certificate on the dedicated step of the quick start wizard.

Also, a mobile reserve ("MR") certificate exists: it is used for seamless replacement of the mobile certificate. Kaspersky Security Center automatically generates this certificate 60 days before the expiration of the common certificate. When the mobile certificate is about to expire, the mobile reserve certificate is used to maintain the connection with Network Agent instances installed on managed mobile devices. With this purpose, the mobile reserve certificate automatically becomes the new mobile certificate 24 hours before the old mobile certificate expires.

If the connection scenario requires the use of a client certificate on mobile devices (connection involving two-way SSL authentication), you can generate those certificates by means of the certificate authority for auto-generated user certificates ("MCA"). Also, the quick start wizard enables you to start using custom client certificates issued by a different certification authority, while integration with the domain Public Key Infrastructure (PKI) of your organization enables you to issue client certificates by means of your domain certification authority.

iOS MDM Server certificate

An iOS MDM Server certificate is required for authentication of Administration Server on mobile devices running the iOS operating system. The interaction with these devices is performed via the Apple mobile device management (MDM) protocol that involves no Network Agent. Instead, you install a special iOS MDM profile, containing a client certificate, on each device, to ensure two-way SSL authentication.

Also, the quick start wizard enables you to start using custom client certificates issued by a different certification authority, while integration with the domain Public Key Infrastructure (PKI) of your organization enables you to issue client certificates by means of your domain certification authority.

Client certificates are transmitted to iOS devices when you download those iOS MDM profiles. An iOS MDM Server client certificate is unique for each managed iOS device. You generate all iOS MDM Server client certificates by means of the certification authority for auto-generated user certificates ("MCA").

Kaspersky Security Center Web Server certificate

Kaspersky Security Center Web Server (hereinafter referred to as Web Server), a component of Kaspersky Security Center Administration Server, uses a special type of certificate. This certificate is required for publishing Network Agent installation packages that you subsequently download to managed devices, as well as for publishing iOS MDM profiles, iOS apps, and Kaspersky Security for Mobile installation packages. For this purpose, Web Server can use various certificates.

If the mobile device support is disabled, Web Server uses one of the following certificates, in order of priority:

Custom Web Server certificate that you specified manually by means of Administration Console
Common Administration Server certificate ("C")

If the mobile device support is enabled, Web Server uses one of the following certificates, in order of priority:

Custom Web Server certificate that you specified manually by means of Administration Console
Custom mobile certificate
Self-signed mobile certificate ("M")
Common Administration Server certificate ("C")

Kaspersky Security Center Web Console certificate

The Kaspersky Security Center Web Console Server (hereinafter referred to as Web Console) has its own certificate. When you open a website, a browser verifies whether your connection is trusted. The Web Console certificate allows you to authenticate the Web Console and is used to encrypt traffic between a browser and the Web Console.

When you open the Web Console, the browser may inform you that the connection to the Web Console is not private and the Web Console certificate is invalid. This warning appears because the Web Console certificate is self-signed and automatically generated by Kaspersky Security Center. To remove this warning, you can do one of the following:

Replace the Web Console certificate with a custom one (recommended option). Create a certificate that is trusted in your infrastructure and that meets the requirements for custom certificates.
Add the Web Console certificate to the list of trusted browser certificates. We recommend that you use this option only if you cannot create a custom certificate.

Scenario: Specifying the custom Administration Server certificate

Main installation scenario

Administration Server authentication during Administration Console connection

Hierarchy of Administration Servers: primary Administration Server and secondary Administration Server

Data backup and recovery in interactive mode

Working with certificates of mobile devices

Administration Server quick start wizard

Adding iOS mobile devices to the list of managed devices

Signing an iOS MDM profile by a certificate

Web Server

Page top

[Topic 3322]

About Administration Server certificate

Two operations are performed based on the Administration Server certificate: Administration Server authentication during connection by Administration Console and data exchange with devices. The certificate is also used for authentication when the primary Administration Servers are connected to secondary Administration Servers.

Certificate issued by Kaspersky

The Administration Server certificate is created automatically during installation of the Administration Server component and it is stored in the %ALLUSERSPROFILE%\Application Data\KasperskyLab\adminkit\1093\cert folder.

The Administration Server certificate is valid for five years, if the certificate was generated by Administration Server version 12.2 or earlier. Otherwise, the certificate validity term is limited to 397 days. A new certificate is generated by the Administration Server as the reserve certificate 90 days before the expiration date of the current certificate. Subsequently, the new certificate automatically replaces the current certificate one day before the expiration date. All Network Agents on the client devices are automatically reconfigured to authenticate the Administration Server with the new certificate.

Custom certificates

If necessary, you can assign a custom certificate for the Administration Server. For example, this may be necessary for better integration with the existing PKI of your enterprise or for custom configuration of the certificate fields.

The maximum validity period for any of the Administration Server certificates must be 397 days or less.

When replacing the certificate, all Network Agents that were previously connected to Administration Server through SSL, will lose their connection and will return "Administration Server authentication error." To eliminate this error, you will have to restore the connection after the certificate replacement.

If the Administration Server certificate is lost, you must reinstall the Administration Server component, and then restore the data in order to recover it.

If you open Kaspersky Security Center Web Console in different browsers and download the Administration Server certificate file in the Administration Server properties window, the downloaded files have different names.

Page top

[Topic 191451]

Requirements for custom certificates used in Kaspersky Security Center

The table below shows the requirements for custom certificates specified for different components of Kaspersky Security Center.

Requirements for Kaspersky Security Center certificates

Certificate type	Requirements	Comments
Common certificate, Common reserve certificate ("C", "CR")	Minimum key length: 2048. Basic constraints: Path Length Constraint: None Key Usage: Digital signature Certificate signing Key encryption CRL Signing Extended Key Usage (optional): server authentication, client authentication.	Extended Key Usage parameter is optional. Path Length Constraint value may be an integer different from "None", but not less than 1.
Mobile certificate, Mobile reserve certificate ("M", "MR")	Minimum key length: 2048. Basic constraints: CA: true Path Length Constraint: None Key Usage: Digital signature Certificate signing Key encryption CRL Signing Extended Key Usage (optional): server authentication.	Extended Key Usage parameter is optional. Path Length Constraint value may be an integer different from "None", if Common certificate has a Path Length Constraint value not less than 1.
Certificate CA for auto-generated user certificates ("MCA")	Minimum key length: 2048. Basic constraints: CA: true Path Length Constraint: None Key Usage: Digital signature Certificate signing Key encryption CRL Signing Extended Key Usage (optional): server authentication, client authentication.	Extended Key Usage parameter is optional. Path Length Constraint value may be an integer different from "None," if Common certificate has a Path Length Constraint value not less than 1.
Web Server certificate	Extended Key Usage: server authentication. The PKCS #12 / PEM container from which the certificate is specified includes the entire chain of public keys. The Subject Alternative Name (SAN) of the certificate is present; that is, the value of the `subjectAltName` field is valid. The certificate meets the effective requirements of browsers imposed on server certificates, as well as the current baseline requirements of the CA/Browser Forum.
Kaspersky Security Center Web Console certificate	The PEM container from which the certificate is specified includes the entire chain of public keys. The Subject Alternative Name (SAN) of the certificate is present; that is, the value of the `subjectAltName` field is valid. The certificate meets the effective requirements of browsers to server certificates, as well as the current baseline requirements of the CA/Browser Forum.	Encrypted certificates are not supported by Kaspersky Security Center Web Console.

See also:

About Administration Server certificate

Scenario: Specifying the custom Administration Server certificate

Main installation scenario

Page top

[Topic 155201]

Scenario: Specifying the custom Administration Server certificate

You can assign the custom Administration Server certificate, for example, for better integration with the existing public key infrastructure (PKI) of your enterprise or for custom configuration of the certificate fields. It is useful to replace the certificate immediately after installation of Administration Server and before the quick start wizard finishes.

The maximum validity period for any of the Administration Server certificates must be 397 days or less.

Prerequisites

The following conditions must be met:

The new certificate must be created in the PKCS#12 format (for example, by means of the organization's PKI).
For the new certificate, the requirements listed in the table below must be met.

In the table below, pay attention to the requirement "CA: true," which means that the new certificate must be issued by a trusted certification authority (CA). The new certificate with the requirement "CA: true" must include the entire chain of trust and a private key, which must be stored in a file with the pfx or p12 extension.

Requirements for the Administration Server certificates

Certificate type	Requirements
Common certificate, common reserve certificate ("C", "CR")	Minimum key length: 2048. Basic constraints: Path Length Constraint: None Path Length Constraint value may be an integer different from "None," but not less than 1. Key Usage: Digital signature Certificate signing Key encryption CRL Signing Extended Key Usage (EKU): server authentication and client authentication. The EKU is optional, but if your certificate contains it, the server and client authentication data must be specified in the EKU.
Mobile certificate, mobile reserve certificate ("M", "MR")	Minimum key length: 2048. Basic constraints: CA: true Path Length Constraint: None Path Length Constraint value may be an integer different from "None" if the common certificate has a Path Length Constraint value not less than 1. Key Usage: Digital signature Certificate signing Key encryption CRL Signing Extended Key Usage (EKU): server authentication. The EKU is optional, but if your certificate contains it, the server authentication data must be specified in the EKU.
Certificate CA for auto-generated user certificates ("MCA")	Minimum key length: 2048. Basic constraints: CA: true Path Length Constraint: None Path Length Constraint value may be an integer different from "None" if the Common certificate has a Path Length Constraint value not less than 1. Key Usage: Digital signature Certificate signing Key encryption CRL Signing Extended Key Usage (EKU): client authentication. The EKU is optional, but if your certificate contains it, the client authentication data must be specified in the EKU.

Certificate type

Requirements

Common certificate, common reserve certificate ("C", "CR")

Minimum key length: 2048.

Basic constraints:

Path Length Constraint: None
Path Length Constraint value may be an integer different from "None," but not less than 1.

Key Usage:

Digital signature
Certificate signing
Key encryption
CRL Signing

Extended Key Usage (EKU): server authentication and client authentication. The EKU is optional, but if your certificate contains it, the server and client authentication data must be specified in the EKU.

Mobile certificate, mobile reserve certificate ("M", "MR")

Minimum key length: 2048.

Basic constraints:

CA: true
Path Length Constraint: None
Path Length Constraint value may be an integer different from "None" if the common certificate has a Path Length Constraint value not less than 1.

Key Usage:

Digital signature
Certificate signing
Key encryption
CRL Signing

Extended Key Usage (EKU): server authentication. The EKU is optional, but if your certificate contains it, the server authentication data must be specified in the EKU.

Certificate CA for auto-generated user certificates ("MCA")

Minimum key length: 2048.

Basic constraints:

CA: true
Path Length Constraint: None
Path Length Constraint value may be an integer different from "None" if the Common certificate has a Path Length Constraint value not less than 1.

Key Usage:

Digital signature
Certificate signing
Key encryption
CRL Signing

Extended Key Usage (EKU): client authentication. The EKU is optional, but if your certificate contains it, the client authentication data must be specified in the EKU.

Certificates issued by a public CA do not have the certificate signing permission. To use such certificates, make sure that you installed Network Agent version 13 or later on distribution points or connection gateways in your network. Otherwise, you will not be able to use certificates without the signing permission.

Stages

Specifying the Administration Server certificate proceeds in stages:

Replacing the Administration Server certificate
Use the command-line klsetsrvcert utility for this purpose.
Specifying a new certificate and restoring connection of Network Agents to the Administration Server
When the certificate is replaced, all Network Agents that were previously connected to Administration Server through SSL lose their connection and return "Administration Server authentication error." To specify the new certificate and restore the connection, use the command-line klmover utility.
Specifying a new certificate in the settings of Kaspersky Security Center Web Console
After you replace the certificate, specify it in the settings of Kaspersky Security Center Web Console. Otherwise, Kaspersky Security Center Web Console will not be able to connect to the Administration Server.

Results

When you finish the scenario, the Administration Server certificate is replaced and the server is authenticated by Network Agents on the managed devices.

About Administration Server certificate

Requirements for custom certificates used in Kaspersky Security Center

Main installation scenario

Page top

[Topic 227838]

Replacing the Administration Server certificate by using the klsetsrvcert utility

To replace the Administration Server certificate:

From the command line, run the following utility:

klsetsrvcert [-t <type> {-i <inputfile> [-p <password>] [-o <chkopt>] | -g <dnsname>}][-f <time>][-r <calistfile>][-l <logfile>]

You do not need to download the klsetsrvcert utility. It is included in the Kaspersky Security Center distribution kit. It is not compatible with previous Kaspersky Security Center versions.

The description of the klsetsrvcert utility parameters is presented in the table below.

Values of the klsetsrvcert utility parameters

Parameter	Value
`-t <type>`	Type of certificate to be replaced. Possible values of the `<type>` parameter: `C`—Replace the common certificate for ports 13000 and 13291. `CR`—Replace the common reserve certificate for ports 13000 and 13291. `M`—Replace the certificate for mobile devices on port 13292. `MR`—Replace the mobile reserve certificate for port 13292. `MCA`—Mobile client CA for auto-generated user certificates.
`-f <time>`	Schedule for changing the certificate, using the format "DD-MM-YYYY hh:mm" (for ports 13000 and 13291). Use this parameter if you want to replace the common or common reserve certificate before it expires. Specify the time when managed devices must synchronize with Administration Server on a new certificate.
`-i <inputfile>`	Container with the certificate and a private key in the PKCS#12 format (file with the .p12 or .pfx extension).
`-p <password>`	Password used for protection of the p12 container. The certificate and a private key are stored in the container, therefore, the password is required to decrypt the file with the container.
`-o <chkopt>`	Certificate validation parameters (semicolon separated). To use a custom certificate without signing permission, specify `-o NoCA` in the klsetsrvcert utility. This is useful for certificates issued by a public CA. To change encryption key length for certificate types C or CR, specify `-o RsaKeyLen:<key length>` in the klsetsrvcert utility, where `<key length>` parameter is the required key length value. Otherwise, the current certificate key length is used.
`-g <dnsname>`	A new certificate will be created for the specified DNS name.
`-r <calistfile>`	Trusted root Certificate Authority list, format PEM.
`-l <logfile>`	Results output file. By default, the output is redirected into the standard output stream.

For example, to specify the custom Administration Server certificate, use the following command:

klsetsrvcert -t C -i <inputfile> -p <password> -o NoCA

After the certificate is replaced, all Network Agents connected to Administration Server through SSL lose their connection. To restore it, use the command-line klmover utility.

To avoid losing the Network Agents connections, use the following commands:

To install the new certificate,
klsetsrvcert.exe -t CR -i <inputfile> -p <password> -o NoCA
To specify the date when the new certificate will be applied,
klsetsrvcert.exe -f "DD-MM-YYYY hh:mm"

where "DD-MM-YYYY hh:mm" is the date 3–4 weeks later than the current date. The time shift for changing the certificate to the new one will allow the new certificate to be distributed to all Network Agents.

Page top

[Topic 227839]

Connecting Network Agents to Administration Server by using the klmover utility

After you replace the Administration Server certificate by using the command-line klsetsrvcert utility, you need to establish the SSL connection between Network Agents and Administration Server because the connection is broken.

To specify the new Administration Server certificate and restore the connection:

From the command line, run the following utility:

klmover [-address <server address>] [-pn <port number>] [-ps <SSL port number>] [-nossl] [-cert <path to certificate file>]

The administrator rights are required to run the utility.

This utility is automatically copied to the Network Agent installation folder, when Network Agent is installed on a client device.

To prevent intruders from moving devices out of your Administration Server's control, we strongly recommend enabling password protection for running the klmover utility. To enable password protection, select the Use uninstallation password option in the Network Agent policy settings.

The klmover utility requires local administrator rights. Password protection for running the klmover utility can be omitted for devices operated without local administrator rights.

Enabling the Use uninstallation password also enables password protection for the Cleaner tool (cleaner.exe).

You cannot use the klmover utility for client devices connected to Administration Server through connection gateways. For such devices you have to either reconfigure Network Agent or reinstall Network Agent and specify connection gateway.

The description of the klmover utility parameters is presented in the table below.

Values of the klmover utility parameters

Parameter	Value
`-address <server address>`	Address of the Administration Server for connection. You can specify an IP address, the NetBIOS name, or the DNS name.
`-pn <port number>`	Number of the port through which non-encrypted connection to the Administration Server is established. The default port number is 14000.
`-ps <SSL port number>`	Number of the SSL port through which encrypted connection to the Administration Server is established by using SSL. The default port number is 13000.
`-nossl`	Use non-encrypted connection to the Administration Server. If the key is not in use, Network Agent is connected to the Administration Server by using encrypted SSL protocol.
`-cert <path to certificate file>`	Use the specified certificate file for authentication of access to Administration Server.
`-virtserv`	Name of the virtual Administration Server.
`-cloningmode`	Network Agent disk cloning mode. Use one of the following parameters to configure the disk cloning mode: `-cloningmode`—Request the status of the disk cloning mode. `-cloningmode 1`—Enable the disk cloning mode. `-cloningmode 0`—Disable the disk cloning mode.

For example, to connect Network Agent to Administration Server, run the following command:

klmover -address kscserver.mycompany.com -logfile klmover.log

Manually connecting a client device to the Administration Server. Klmover utility

Moving devices connected to Administration Server through connection gateways to another Administration Server

Page top

[Topic 208265]

Reissuing the Web Server certificate

The Web Server certificate used in Kaspersky Security Center is required for publishing Network Agent installation packages that you subsequently download to managed devices, as well as for publishing iOS MDM profiles, iOS apps, and Kaspersky Endpoint Security for Mobile installation packages. Depending on the current application configuration, various certificates can function as the Web Server certificate (for more detail, see About Kaspersky Security Center certificates).

You may need to reissue the Web Server certificate to meet the specific security requirements of your organization or to maintain continuous connection of your managed devices before starting to upgrade the application. Kaspersky Security Center provides two ways of reissuing the Web Server certificate; the choice between the two methods depends on whether you have mobile devices connected and managed through the mobile protocol (i.e., by using the mobile certificate).

If you have never specified your own custom certificate as the Web Server certificate in the Web Server section of the Administration Server properties window, the mobile certificate acts as the Web Server certificate. In this case, the Web Server certificate reissuance is performed through the reissuance of the mobile protocol itself.

To reissue the Web Server certificate when you have no mobile devices managed through the mobile protocol:

In the console tree, right-click the name of the relevant Administration Server and in the context menu select Properties.
In the Administration Server properties window that opens, in the left pane, select the Administration Server connection settings section.
In the list of subsections, select the Certificates subsection.
If you plan to continue using the certificate issued by Kaspersky Security Center, do the following:
1. On the right pane, in the Administration Server authentication by mobile devices group of settings, select the Certificate issued through Administration Server option and click the Reissue button.
2. In the Reissue certificate window that opens, in the Connection address and Activation term group of settings, select the relevant options and click OK.
3. In the confirmation window, click Yes.
Alternatively, if you plan to use your own custom certificate, do the following:
1. Check whether your custom certificate meets the requirements of Kaspersky Security Center and the requirements for trusted certificates by Apple. If necessary, modify the certificate.
2. Select the Other certificate option and click the Browse button.
3. In the Certificate window that opens, in the Certificate type field select the type of your certificate and then specify the certificate location and settings:
  - If you have selected PKCS #12 container, click the Browse button next to the Certificate file field and specify the certificate file on your hard drive. If the certificate file is password-protected, enter the password in the Password (if any) field.
  - If you have selected X.509 certificate, click the Browse button next to the Private key (.prk, .pem) field and specify the private key on your hard drive. If the private key is password-protected, enter the password in the Password (if any) field. Then click the Browse button next to the Public key (.cer) field and specify the private key on your hard drive.
4. In the Certificate window, click OK.
5. In the confirmation window, click Yes.
The mobile certificate is reissued to be used as the Web Server certificate.

To reissue the Web Server certificate when you have any mobile devices managed through the mobile protocol:

Generate your custom certificate and prepare it for the usage in Kaspersky Security Center. Check whether your custom certificate meets the requirements of Kaspersky Security Center and the requirements for trusted certificates by Apple. If necessary, modify the certificate.
You can use the kliossrvcertgen.exe utility for certificate generation.
In the console tree, right-click the name of the relevant Administration Server and in the context menu select Properties.
In the Administration Server properties window that opens, in the left pane, select the Web Server section.
In the Over HTTPS menu, select the Specify another certificate option.
In the Over HTTPS menu, click the Change button.
In the Certificate window that opens, in the Certificate type field select the type of your certificate:
- If you have selected PKCS #12 container, click the Browse button next to the Certificate file field and specify the certificate file on your hard drive. If the certificate file is password-protected, enter the password in the Password (if any) field.
- If you have selected X.509 certificate, click the Browse button next to the Private key (.prk, .pem) field and specify the private key on your hard drive. If the private key is password-protected, enter the password in the Password (if any) field. Then click the Browse button next to the Public key (.cer) field and specify the private key on your hard drive.
In the Certificate window, click OK.
If necessary, in the Administration Server properties window, in the Web Server HTTPS port field change the number of the HTTPS port for Web Server. Click OK.
The Web Server certificate is reissued.

Page top

[Topic 183039]

Schemas for data traffic and port usage

This section provides schemas for data traffic between Kaspersky Security Center components, managed security applications, and external servers under various configurations. The schemas are provided with numbers for the ports that must be available on the local devices.

In this section

Administration Server and managed devices on LAN

Primary Administration Server on LAN and two secondary Administration Servers

Administration Server on LAN, managed devices on internet, reverse proxy in use

Administration Server on LAN, managed devices on internet, connection gateway in use

Administration Server in DMZ, managed devices on internet

Interaction of Kaspersky Security Center components and security applications: more information

See also:

Main installation scenario

Page top

[Topic 183040]

Administration Server and managed devices on LAN

The figure below shows the traffic of the data if Kaspersky Security Center is deployed on a local area network (LAN) only.

Server and managed devices are on a local network. Managed devices connect to Server via distribution points.

Administration Server and managed devices on a local area network (LAN)

The figure shows how different managed devices connect to the Administration Server in different ways: directly or via a distribution point. Distribution points reduce the load on the Administration Server during update distribution and optimize network traffic. However, distribution points are only needed if the number of managed devices is large enough. If the number of managed devices is small, all the managed devices can receive updates from the Administration Server directly.

The arrows indicate the initiation of traffic: each arrow points from a device that initiates the connection to the device that "answers" the call. The number of the port and the name of the protocol used for data transfer are provided. Each arrow has a number label, and details about the corresponding data traffic are as follows:

Administration Server sends data to the database. If you install the Administration Server and the database on different devices, you must make available the necessary ports on the device where the database is located (for example, port 3306 for MySQL Server, or port 1433 for Microsoft SQL Server). Please refer to the DBMS documentation for the relevant information.
Requests for communication from the Administration Server are transferred to all non-mobile managed devices through UDP port 15000.
Network Agents send requests to each other within one broadcasting domain. The data is then sent to the Administration Server and is used for defining the limits of the broadcasting domain and for automatic assignment of distribution points (if this option is enabled).

If Administration Server does not have direct access to the managed devices, communication requests from Administration Server to these devices are not sent directly.
Information about shutdown of the managed devices is transferred from Network Agent to the Administration Server through UDP port 13000.
The Administration Server receives connection from Network Agents and from secondary Administration Servers through TLS port 13000.
If you used an earlier version of Kaspersky Security Center, the Administration Server on your network can receive connection from Network Agents through non-TLS port 14000. Kaspersky Security Center also supports connection of Network Agents through port 14000, although using TLS port 13000 is recommended.

The distribution point was called "Update agent" in earlier versions of Kaspersky Security Center.
The managed devices (except for mobile devices) request activation through TCP port 17000. This is not necessary if the device has its own access to the internet; in this case, the device sends the data to Kaspersky servers over the internet directly.
Data from MMC-based Administration Console is transferred to the Administration Server through port 13291. (The Administration Console can be installed on the same or on a different device.)
Applications on a single device exchange local traffic (either on the Administration Server or on a managed device). No external ports have to be opened.
Data from the Administration Server to the Kaspersky servers (such as KSN data or information about licenses) and data from the Kaspersky servers to the Administration Server (such as application updates and anti-virus database updates) are transferred using the HTTPS protocol.
If you do not want your Administration Server to have access to the internet, you must manage this data manually.
Kaspersky Security Center Web Console Server sends data to the Administration Server, which may be installed on the same or on a different device, through TLS port 13299.

See also:

Standard configuration: Single office

Ports used by Kaspersky Security Center

Page top

[Topic 183051]

Primary Administration Server on LAN and two secondary Administration Servers

The figure below shows the hierarchy of Administration Servers: the primary Administration Server is on a local area network (LAN). A secondary Administration Server is in the demilitarized zone (DMZ); another secondary Administration Server is on the internet.

Primary Server and its managed devices are on LAN, the secondary are in DMZ, other servers and devices are on internet.

Hierarchy of Administration Servers: primary Administration Server and two secondary Administration Servers

Administration Server sends data to the database. If you install the Administration Server and the database on different devices, you must make available the necessary ports on the device where the database is located (for example, port 3306 for MySQL Server, or port 1433 for Microsoft SQL Server). Please refer to the DBMS documentation for the relevant information.
Requests for communication from the Administration Server are transferred to all non-mobile managed devices through UDP port 15000.
Network Agents send requests to each other within one broadcasting domain. The data is then sent to the Administration Server and is used for defining the limits of the broadcasting domain and for automatic assignment of distribution points (if this option is enabled).

If Administration Server does not have direct access to the managed devices, communication requests from Administration Server to these devices are not sent directly.
Information about shutdown of the managed devices is transferred from Network Agent to the Administration Server through UDP port 13000.
The Administration Server receives connection from Network Agents and from secondary Administration Servers through TLS port 13000.
If you used an earlier version of Kaspersky Security Center, the Administration Server on your network can receive connection from Network Agents through non-TLS port 14000. Kaspersky Security Center also supports connection of Network Agents through port 14000, although using TLS port 13000 is recommended.

The distribution point was called "Update agent" in earlier versions of Kaspersky Security Center.
The managed devices (except for mobile devices) request activation through TCP port 17000. This is not necessary if the device has its own access to the internet; in this case, the device sends the data to Kaspersky servers over the internet directly.
Data from MMC-based Administration Console is transferred to the Administration Server through port 13291. (The Administration Console can be installed on the same or on a different device.)
Applications on a single device exchange local traffic (either on the Administration Server or on a managed device). No external ports have to be opened.
Data from the Administration Server to the Kaspersky servers (such as KSN data or information about licenses) and data from the Kaspersky servers to the Administration Server (such as application updates and anti-virus database updates) are transferred using the HTTPS protocol.
If you do not want your Administration Server to have access to the internet, you must manage this data manually.
Kaspersky Security Center Web Console Server sends data to the Administration Server, which may be installed on the same or on a different device, through TLS port 13299.
9a. Data from the browser, which is installed on a separate device of the administrator, is transferred to Kaspersky Security Center Web Console Server through TLS port 8080. The Kaspersky Security Center Web Console Server can be installed either on the Administration Server or on another device.

See also:

Hierarchy of Administration Servers

Ports used by Kaspersky Security Center

Page top

[Topic 183056]

Administration Server on LAN, managed devices on internet, reverse proxy in use

The figure below shows data traffic if the Administration Server is on a local area network (LAN) and the managed devices, including mobile devices, are on the internet. In this figure, a reverse proxy of your choice is in use. Refer to the documentation of the application for details.

Administration Server is on LAN, managed devices are on internet, Microsoft Forefront Threat Management Gateway is in use.

Administration Server on a local area network; managed devices connect to the Administration Server through a reverse proxy

This deployment scheme is recommended if you do not want the mobile devices to connect to the Administration Server directly and do not want to assign a connection gateway in the DMZ.

Administration Server sends data to the database. If you install the Administration Server and the database on different devices, you must make available the necessary ports on the device where the database is located (for example, port 3306 for MySQL Server, or port 1433 for Microsoft SQL Server). Please refer to the DBMS documentation for the relevant information.
Requests for communication from the Administration Server are transferred to all non-mobile managed devices through UDP port 15000.
Network Agents send requests to each other within one broadcasting domain. The data is then sent to the Administration Server and is used for defining the limits of the broadcasting domain and for automatic assignment of distribution points (if this option is enabled).

If Administration Server does not have direct access to the managed devices, communication requests from Administration Server to these devices are not sent directly.
Information about shutdown of the managed devices is transferred from Network Agent to the Administration Server through UDP port 13000.
The Administration Server receives connection from Network Agents and from secondary Administration Servers through TLS port 13000.
If you used an earlier version of Kaspersky Security Center, the Administration Server on your network can receive connection from Network Agents through non-TLS port 14000. Kaspersky Security Center also supports connection of Network Agents through port 14000, although using TLS port 13000 is recommended.

The distribution point was called "Update agent" in earlier versions of Kaspersky Security Center.
The managed devices (except for mobile devices) request activation through TCP port 17000. This is not necessary if the device has its own access to the internet; in this case, the device sends the data to Kaspersky servers over the internet directly.
Data from MMC-based Administration Console is transferred to the Administration Server through port 13291. (The Administration Console can be installed on the same or on a different device.)
Applications on a single device exchange local traffic (either on the Administration Server or on a managed device). No external ports have to be opened.
Data from the Administration Server to the Kaspersky servers (such as KSN data or information about licenses) and data from the Kaspersky servers to the Administration Server (such as application updates and anti-virus database updates) are transferred using the HTTPS protocol.
If you do not want your Administration Server to have access to the internet, you must manage this data manually.
Kaspersky Security Center Web Console Server sends data to the Administration Server, which may be installed on the same or on a different device, through TLS port 13299.
9a. Data from the browser, which is installed on a separate device of the administrator, is transferred to Kaspersky Security Center Web Console Server through TLS port 8080. The Kaspersky Security Center Web Console Server can be installed either on the Administration Server or on another device.
For Android mobile devices only: data from the Administration Server is transferred to Google servers. This connection is used to notify Android mobile devices that they are required to connect to the Administration Server. Then push notifications are sent to the mobile devices.
For Android mobile devices only: push notifications from Google servers are sent to the mobile device. This connection is used to notify mobile devices that they are required to connect to the Administration Server.
For iOS mobile devices only: data from the iOS MDM Server is transferred to Apple Push Notification servers. Then push notifications are sent to the mobile devices.
For iOS mobile devices only: push notifications are sent from Apple servers to the mobile device. This connection is used to notify iOS mobile devices that they are required to connect to the Administration Server.
For mobile devices only: data from the managed application is transferred to the Administration Server (or to the connection gateway) through TLS port 13292 / 13293—directly or through a reverse proxy.
For mobile devices only: data from the mobile device is transferred to the Kaspersky infrastructure.
If a mobile device does not have internet access, the data is transferred to Administration Server through port 17100, and the Administration Server sends it to the Kaspersky infrastructure; however, this scenario applies very rarely.
Requests for packages from managed devices, including mobile devices, are transferred to the Web Server, which is on the same device as the Administration Server.
For iOS mobile devices only: data from the mobile device is transferred through TLS port 443 to the iOS MDM Server, which is on the same device as the Administration Server or on the connection gateway.

See also:

Ports used by Kaspersky Security Center

Page top

[Topic 183058]

Administration Server on LAN, managed devices on internet, connection gateway in use

The figure below shows data traffic if the Administration Server is on a local area network (LAN) and the managed devices, including mobile devices, are on the internet. A connection gateway is in use.

This deployment scheme is recommended if you do not want the mobile devices to connect to the Administration Server directly and do not want to use a reverse proxy or corporate firewall.

Administration Server is on LAN, managed devices are on internet. A connection gateway is in use.

Managed mobile devices connected to the Administration Server through a connection gateway

In this figure, the managed devices are connected to the Administration Server through a connection gateway that is located in the DMZ. No reverse proxy or corporate firewall is in use.

Administration Server sends data to the database. If you install the Administration Server and the database on different devices, you must make available the necessary ports on the device where the database is located (for example, port 3306 for MySQL Server, or port 1433 for Microsoft SQL Server). Please refer to the DBMS documentation for the relevant information.
Requests for communication from the Administration Server are transferred to all non-mobile managed devices through UDP port 15000.
Network Agents send requests to each other within one broadcasting domain. The data is then sent to the Administration Server and is used for defining the limits of the broadcasting domain and for automatic assignment of distribution points (if this option is enabled).

If Administration Server does not have direct access to the managed devices, communication requests from Administration Server to these devices are not sent directly.
Information about shutdown of the managed devices is transferred from Network Agent to the Administration Server through UDP port 13000.
The Administration Server receives connection from Network Agents and from secondary Administration Servers through TLS port 13000.
If you used an earlier version of Kaspersky Security Center, the Administration Server on your network can receive connection from Network Agents through non-TLS port 14000. Kaspersky Security Center also supports connection of Network Agents through port 14000, although using TLS port 13000 is recommended.

The distribution point was called "Update agent" in earlier versions of Kaspersky Security Center.

4a. A connection gateway in DMZ also receives connection from the Administration Server through TLS port 13000. Because a connection gateway in DMZ cannot reach the Administration Server's ports, the Administration Server creates and maintains a permanent signal connection with a connection gateway. The signal connection is not used for data transfer; it is only used for sending an invitation to the network interaction. When the connection gateway needs to connect to the Server, it notifies the Server through this signal connection, and then the Server creates the required connection for data transfer.

Out-of-office devices connect to the connection gateway through TLS port 13000 as well.
The managed devices (except for mobile devices) request activation through TCP port 17000. This is not necessary if the device has its own access to the internet; in this case, the device sends the data to Kaspersky servers over the internet directly.
Data from MMC-based Administration Console is transferred to the Administration Server through port 13291. (The Administration Console can be installed on the same or on a different device.)
Applications on a single device exchange local traffic (either on the Administration Server or on a managed device). No external ports have to be opened.
Data from the Administration Server to the Kaspersky servers (such as KSN data or information about licenses) and data from the Kaspersky servers to the Administration Server (such as application updates and anti-virus database updates) are transferred using the HTTPS protocol.
If you do not want your Administration Server to have access to the internet, you must manage this data manually.
Kaspersky Security Center Web Console Server sends data to the Administration Server, which may be installed on the same or on a different device, through TLS port 13299.
9a. Data from the browser, which is installed on a separate device of the administrator, is transferred to Kaspersky Security Center Web Console Server through TLS port 8080. The Kaspersky Security Center Web Console Server can be installed either on the Administration Server or on another device.
For Android mobile devices only: data from the Administration Server is transferred to Google servers. This connection is used to notify Android mobile devices that they are required to connect to the Administration Server. Then push notifications are sent to the mobile devices.
For Android mobile devices only: push notifications from Google servers are sent to the mobile device. This connection is used to notify mobile devices that they are required to connect to the Administration Server.
For iOS mobile devices only: data from the iOS MDM Server is transferred to Apple Push Notification servers. Then push notifications are sent to the mobile devices.
For iOS mobile devices only: push notifications are sent from Apple servers to the mobile device. This connection is used to notify iOS mobile devices that they are required to connect to the Administration Server.
For mobile devices only: data from the managed application is transferred to the Administration Server (or to the connection gateway) through TLS port 13292 / 13293—directly or through a reverse proxy.
For mobile devices only: data from the mobile device is transferred to the Kaspersky infrastructure.
If a mobile device does not have internet access, the data is transferred to Administration Server through port 17100, and the Administration Server sends it to the Kaspersky infrastructure; however, this scenario applies very rarely.
Requests for packages from managed devices, including mobile devices, are transferred to the Web Server, which is on the same device as the Administration Server.
For iOS mobile devices only: data from the mobile device is transferred through TLS port 443 to the iOS MDM Server, which is on the same device as the Administration Server or on the connection gateway.

See also:

Ports used by Kaspersky Security Center

About using a distribution point as connection gateway

Page top

[Topic 183041]

Administration Server in DMZ, managed devices on internet

The figure below shows data traffic if the Administration Server is in the demilitarized zone (DMZ) and the managed devices, including mobile devices, are on the internet.

Server data traffic is in demilitarized zone. Android and iOS devices, a laptop, and administrator's device are on internet.

Administration Server in DMZ, managed mobile devices on the internet

In this figure, a connection gateway is not in use: the mobile devices connect to the Administration Server directly.

Administration Server sends data to the database. If you install the Administration Server and the database on different devices, you must make available the necessary ports on the device where the database is located (for example, port 3306 for MySQL Server, or port 1433 for Microsoft SQL Server). Please refer to the DBMS documentation for the relevant information.
Requests for communication from the Administration Server are transferred to all non-mobile managed devices through UDP port 15000.
Network Agents send requests to each other within one broadcasting domain. The data is then sent to the Administration Server and is used for defining the limits of the broadcasting domain and for automatic assignment of distribution points (if this option is enabled).

If Administration Server does not have direct access to the managed devices, communication requests from Administration Server to these devices are not sent directly.
Information about shutdown of the managed devices is transferred from Network Agent to the Administration Server through UDP port 13000.
The Administration Server receives connection from Network Agents and from secondary Administration Servers through TLS port 13000.
If you used an earlier version of Kaspersky Security Center, the Administration Server on your network can receive connection from Network Agents through non-TLS port 14000. Kaspersky Security Center also supports connection of Network Agents through port 14000, although using TLS port 13000 is recommended.

The distribution point was called "Update agent" in earlier versions of Kaspersky Security Center.
The managed devices (except for mobile devices) request activation through TCP port 17000. This is not necessary if the device has its own access to the internet; in this case, the device sends the data to Kaspersky servers over the internet directly.
Data from MMC-based Administration Console is transferred to the Administration Server through port 13291. (The Administration Console can be installed on the same or on a different device.)
Applications on a single device exchange local traffic (either on the Administration Server or on a managed device). No external ports have to be opened.
Data from the Administration Server to the Kaspersky servers (such as KSN data or information about licenses) and data from the Kaspersky servers to the Administration Server (such as application updates and anti-virus database updates) are transferred using the HTTPS protocol.
If you do not want your Administration Server to have access to the internet, you must manage this data manually.
Kaspersky Security Center Web Console Server sends data to the Administration Server, which may be installed on the same or on a different device, through TLS port 13299.
9a. Data from the browser, which is installed on a separate device of the administrator, is transferred to Kaspersky Security Center Web Console Server through TLS port 8080. The Kaspersky Security Center Web Console Server can be installed either on the Administration Server or on another device.
For Android mobile devices only: data from the Administration Server is transferred to Google servers. This connection is used to notify Android mobile devices that they are required to connect to the Administration Server. Then push notifications are sent to the mobile devices.
For Android mobile devices only: push notifications from Google servers are sent to the mobile device. This connection is used to notify mobile devices that they are required to connect to the Administration Server.
For iOS mobile devices only: data from the iOS MDM Server is transferred to Apple Push Notification servers. Then push notifications are sent to the mobile devices.
For iOS mobile devices only: push notifications are sent from Apple servers to the mobile device. This connection is used to notify iOS mobile devices that they are required to connect to the Administration Server.
For mobile devices only: data from the managed application is transferred to the Administration Server (or to the connection gateway) through TLS port 13292 / 13293—directly or through a reverse proxy.
For mobile devices only: data from the mobile device is transferred to the Kaspersky infrastructure.
If a mobile device does not have internet access, the data is transferred to Administration Server through port 17100, and the Administration Server sends it to the Kaspersky infrastructure; however, this scenario applies very rarely.
Requests for packages from managed devices, including mobile devices, are transferred to the Web Server, which is on the same device as the Administration Server.
For iOS mobile devices only: data from the mobile device is transferred through TLS port 443 to the iOS MDM Server, which is on the same device as the Administration Server or on the connection gateway.

See also:

Ports used by Kaspersky Security Center

Internet access: Administration Server in DMZ

Page top

[Topic 158520]

Interaction of Kaspersky Security Center components and security applications: more information

This section provides the schemas for interaction of Kaspersky Security Center components and managed security applications. The schemas provide the numbers of the ports that must be available and the names of the processes that open those ports.

In this section

Conventions used in interaction schemas

Administration Server and DBMS

Administration Server and Administration Console

Administration Server and client device: Managing the security application

Upgrading software on a client device through a distribution point

Hierarchy of Administration Servers: primary Administration Server and secondary Administration Server

Hierarchy of Administration Servers with a secondary Administration Server in DMZ

Administration Server, a connection gateway in a network segment, and a client device

Administration Server and two devices in DMZ: a connection gateway and a client device

Administration Server and Kaspersky Security Center Web Console

Activating and managing the security application on a mobile device

See also:

Main installation scenario

Page top

[Topic 158522]

Conventions used in interaction schemas

The following table provides the conventions used across the schemas.

Document conventions

Icon	Meaning
	Administration Server
	Secondary Administration Server
	DBMS
	Client device (that has Network Agent and an application from Kaspersky Endpoint Security family installed, or has a different security application installed that Kaspersky Security Center can manage)
	Connection gateway
	Distribution point
	Mobile client device with Kaspersky Security for Mobile
	Browser on the user's device
	Process running on the device and opening a port
	Port and its number
	TCP traffic (the arrow direction shows the traffic flow direction)
	UDP traffic (the arrow direction shows the traffic flow direction)
	COM invoke
	DBMS transport
	DMZ boundary

Page top

[Topic 158523]

Administration Server and DBMS

Data from the Administration Server enter the SQL Server, MySQL, or MariaDB database.

Data flow from the Administration Server.

Administration Server and DBMS

If you install the Administration Server and the database on different devices, you must make available the necessary ports on the device where the database is located (for example, port 3306 for MySQL Server, or port 1433 for Microsoft SQL Server). Please refer to the DBMS documentation for the relevant information.

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Selecting a DBMS for Administration Server

Page top

[Topic 158545]

Administration Server and Administration Console

Administration Console connects to Administration Server through TLS port TCP 13291.

Administration Server and Administration Console

For schema clarifications, see the table below.

Administration Server and Administration Console (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS	Port purpose
Administration Server	13291	klserver	TCP	Yes	Receiving connections from Administration Console

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Page top

[Topic 158525]

Administration Server and client device: Managing the security application

The Administration Server receives connection from Network Agents via SSL port 13000 (see figure below).

Port and its number are located above the line indicating the connection between a KSC component and a managed application.

Administration Server and client device: managing the security application, connection via port 13000 (recommended)

If you used an earlier version of Kaspersky Security Center, the Administration Server on your network can receive connections from Network Agents via non-SSL port 14000 (see figure below). Kaspersky Security Center 15.1 also supports connection of Network Agents via port 14000, although using SSL port 13000 is recommended.

Client device connects to Server via TLS port TCP 14000. Server connects to a client device via UDP port 15000.

Administration Server and client device: managing the security application, connection via port 14000 (lower security)

For clarifications of schemas, see the table below.

Administration Server and client device: Managing the security application (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS (for TCP only)	Port purpose
Network Agent	15000	klnagent	UDP	Null	Multicasting for Network Agents
Administration Server	13000	klserver	TCP	Yes	Receiving connections from Network Agents
Administration Server	14000	klserver	TCP	No	Receiving connections from Network Agents

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Page top

[Topic 158532]

Upgrading software on a client device through a distribution point

The client device connects to the distribution point via port 13000 and, if you are using the distribution point as a push server, also via port 13295; the distribution point multicasts to Network Agents via port 15000 (see figure below). Updates and installation packages are received from a distribution point via port 15001.

Software upgrade through a distribution point.

Upgrading software on a client device through a distribution point

For schema clarifications, see the table below.

Upgrading software through a distribution point (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS (for TCP only)	Port purpose
Network Agent	15000	klnagent	UDP	Null	Multicasting for Network Agents
Network Agent	15001	klnagent	UDP	Null	Receiving updates and installation packages from a distribution point
Distribution point	13000	klnagent	TCP	Yes	Receiving connections from Network Agents
Distribution point	13295	klnagent	TCP	Yes	Receiving connections from client devices (server push)

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Page top

[Topic 158529]

Hierarchy of Administration Servers: primary Administration Server and secondary Administration Server

The schema (see figure below) shows how to use port 13000 to ensure interaction between Administration Servers combined into a hierarchy.

When combining two Administration Servers into a hierarchy, make sure that port 13291 is accessible on both Administration Servers. Administration Console connects to the Administration Server through port 13291.

Subsequently, when the Administration Servers are combined into a hierarchy, you will be able to administer both of them by using Administration Console connected to the primary Administration Server. Therefore, the accessibility of port 13291 of the primary Administration Server is the only prerequisite.

A primary Administration Server receives a connection from a secondary Administration Server through TLS port TCP 13000.

Hierarchy of Administration Servers: primary Administration Server and secondary Administration Server

For schema clarifications, see the table below.

Hierarchy of Administration Servers (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS	Port purpose
Primary Administration Server	13000	klserver	TCP	Yes	Receiving connections from secondary Administration Servers

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Creating a hierarchy of Administration Servers: adding a secondary Administration Server

Page top

[Topic 158530]

Hierarchy of Administration Servers with a secondary Administration Server in DMZ

Secondary Server in the DMZ receives a connection from primary Server via TLS port TCP 13000.

Hierarchy of Administration Servers with a secondary Administration Server in DMZ

The schema shows a hierarchy of Administration Servers in which the secondary Administration Server located in DMZ receives a connection from the primary Administration Server (see the table below for schema clarifications). When combining two Administration Servers into a hierarchy, make sure that port 13291 is accessible on both Administration Servers. Administration Console connects to the Administration Server through port 13291.

Hierarchy of Administration Servers with a secondary Administration Server in DMZ (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS	Port purpose
Secondary Administration Server	13000	klserver	TCP	Yes	Receiving connections from the primary Administration Server

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Configuring the connection of Administration Console to Administration Server

Creating a hierarchy of Administration Servers: adding a secondary Administration Server

Page top

[Topic 158533]

Administration Server, a connection gateway in a network segment, and a client device

A gateway accepts a connection from Network Agent on a client device and tunnels it to Server via TLS port TCP 13000.

Administration Server, a connection gateway in a network segment, and a client device

For schema clarifications, see the table below.

Administration Server, a connection gateway in a network segment, and a client device (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS	Port purpose
Administration Server	13000	klserver	TCP	Yes	Receiving connections from Network Agents
Network Agent	13000	klnagent	TCP	Yes	Receiving connections from Network Agents

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Page top

[Topic 158534]

Administration Server and two devices in DMZ: a connection gateway and a client device

A gateway in DMZ accepts a connection from Network Agent on client device and from Server via TLS port TCP 13000.

Administration Server with a connection gateway and a client device in DMZ

For schema clarifications, see the table below.

Administration Server with a connection gateway in a network segment and a client device (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS	Port purpose
Network Agent	13000	klnagent	TCP	Yes	Receiving connections from Network Agents

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Page top

[Topic 178949]

Administration Server and Kaspersky Security Center Web Console

Web Console Server connects with OpenAPI via TLS port TCP 8080. Server is reached over OpenAPI via TLS port TCP 13299.

Administration Server and Kaspersky Security Center Web Console

For schema clarifications, see the table below.

Administration Server and Kaspersky Security Center Web Console (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS	Port purpose
Administration Server	13299	klserver	TCP	Yes	Receiving connections from Kaspersky Security Center Web Console to the Administration Server over OpenAPI
Kaspersky Security Center Web Console Server or Administration Server	8080	Node.js: Server-side JavaScript	TCP	Yes	Receiving connections from Kaspersky Security Center Web Console

Kaspersky Security Center Web Console can be installed on the Administration Server or on another device.

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Page top

[Topic 158535]

Activating and managing the security application on a mobile device

To manage an application, Server is connected via TLS port TCP 13292. TLS port TCP 17100 is used for activation.

Activating and managing the security application on a mobile device

For schema clarifications, see the table below.

Activating and managing the security application on a mobile device (traffic)

Device	Port number	Name of the process that opens the port	Protocol	TLS	Port purpose
Administration Server	13292	klserver	TCP	Yes	Receiving connections from Administration Console to Administration Server
Administration Server	17100	klactprx	TCP	Yes	Receiving connections for application activation from mobile devices

See also:

Conventions used in interaction schemas

Interaction of Kaspersky Security Center components and security applications: more information

Ports used by Kaspersky Security Center

Page top

[Topic 171268]

Deployment best practices

Kaspersky Security Center is a distributed application. Kaspersky Security Center includes the following applications:

Administration Server—The core component, designed for managing devices of an organization and storing data in a DBMS.
Administration Console—The basic tool for the administrator. Administration Console is shipped together with Administration Server, but it can also be installed individually on one or several devices run by the administrator.
Network Agent—Designed for managing the security application installed on a device, as well as getting information about that device and transferring this information to the Administration Server. Network Agents are installed on devices of an organization.

Deployment of Kaspersky Security Center on an organization's network is performed as follows:

Installation of Administration Server
Installation of Administration Console on the administrator's device
Installation of Network Agent and the security application on devices of the enterprise

In this section

Hardening Guide

Preparation for deployment

Deploying Network Agent and the security application

Deploying mobile device management systems

Page top

[Topic 245736]

Hardening Guide

Kaspersky Security Center is designed for centralized execution of basic administration and maintenance tasks on an organization's network. The application provides the administrator access to detailed information about the organization's network security level. Kaspersky Security Center allows you to configure all components of protection built by using Kaspersky applications.

Kaspersky Security Center Administration Server has full access to protection management of client devices and is the most important component of the organization's security system. Therefore, increased protection methods are required for Administration Server.

Before configuring, create a Kaspersky Security Center Administration Server backup copy by using the Backup of Administration Server data task or the klbackup utility and save it in a safe location.

The Hardening Guide describes recommendations and features of configuring Kaspersky Security Center and its components, aimed to reduce the risks of its compromise.

The Hardening Guide contains the following information:

Selecting the Administration Server architecture
Configuring a secure connection to Administration Server
Configuring accounts to access Administration Server
Managing protection of Administration Server
Managing protection of client devices
Configuring protection for managed applications
Administration Server maintenance
Transferring information to third-party applications
Security recommendations for third-party information systems

In this section

Administration Server deployment

Connection safety

Accounts and authentication

Managing protection of Administration Server

Managing protection of client devices

Configuring protection for managed applications

Administration Server maintenance

Event transfer to third-party systems

Security recommendations for third-party information systems

Recommendations for using Kaspersky security applications

Page top

[Topic 245772]

Administration Server deployment

Administration Server architecture

In general, the choice of a centralized management architecture depends on the location of protected devices, access from adjacent networks, delivery schemes of database updates, and so on.

At the initial stage of architecture development, we recommend getting acquainted with the Kaspersky Security Center components and their interaction with each other, as well as with schemas for data traffic and port usage.

Based on this information, you can form an architecture that specifies:

The Administration Server location and network connections
Organization of the administrator's workspaces, and methods of connecting to Administration Server
Deployment methods for Network Agent and protection software
Using distribution points
Using virtual Administration Servers
Using a hierarchy of Administration Servers
Anti-virus database update scheme
Other information flows

Selecting a device for the Administration Server installation

We recommend that you install Administration Server on a dedicated server in the organization infrastructure. If there is no other third-party software installed on the server, you can configure the security settings based on the requirements of Kaspersky Security Center, without depending on the requirements of third-party software.

You can deploy Administration Server on a physical server or on a virtual server. Please make sure that the selected device meets the hardware and software requirements.

Administration Server location

Devices managed by Administration Server can be located as follows:

On a local area network (LAN)
On the internet
In the demilitarized zone (DMZ)

At the same time, Administration Server can also be located in different segments: industrial, corporate, and DMZ segments.

If you use Kaspersky Security Center to manage protection of an isolated network segment, we recommend deploying Administration Server in a segment of the demilitarized zone (DMZ). This allows you to organize a proper network segmentation and minimize traffic flow to the protected segment, while maintaining full management capabilities and update delivery.

Restriction of deploying Administration Server on a domain controller, a terminal server, or a user device

We strongly do not recommend installing Administration Server on a domain controller, a terminal server, or a user device.

We recommend that you provide functional separation of the network key nodes. This approach allows you to maintain the operability of different systems when a node fails or is compromised. At the same time, you can create different security policies for each node.

For example, security restrictions usually applied to a domain controller can significantly reduce the performance of Administration Server and make it impossible to use some features of Administration Server. If an intruder gains privileged access to the domain controller, Active Directory Domain Services (AD DS) database can be modified, damaged, or destroyed. Also, all systems and accounts managed by Active Directory can be compromised.

Accounts for installing and running Administration Server

We recommend running the Administration Server installation under a local administrator account to avoid using domain accounts to access the Administration Server database. A set of the required accounts and their rights depends on the selected DBMS type, DBMS location and method of the Administration Server database creation.

The KLAdmins and KLOperators groups are created automatically during Kaspersky Security Center installation. These groups are granted permissions to connect to the Administration Server and to process Administration Server objects.

Depending on the type of account that is used for installation of Kaspersky Security Center, the KLAdmins and KLOperators groups are created as follows:

If the application is installed under a user account included in a domain, the groups are created on the Administration Server device and in the domain that includes Administration Server.
If the application is installed under a system account, the groups are created on the Administration Server device only.

In order to avoid creating the KLAdmins and KLOperators groups in the domain and, as a result, providing privileges to manage Administration Server to an account outside the Administration Server device, we recommend installing Kaspersky Security Center under a local account.

During Administration Server installation, select the account that will be used to start Administration Server as a service. By default, the application creates a local account named KL-AK-*, under which the Administration Server service (the klserver service) will run.

If necessary, the Administration Server service can be run under the selected account. This account must be granted the required rights to access the DBMS. For security reasons, use a non-privilege account to run the Administration Server service.

To avoid the use of incorrect account settings, we recommend generating the account automatically.

Excluding Administration Server from a domain

If you use Administration Server to protect device groups of high-importance systems, we do not recommend including the Administration Server device in the domain. This allows you to differentiate Kaspersky Security Center management rights and prevent access to Administration Server in case the domain account is compromised.

Take into account that if you install Administration Server on a device included in the workgroup, the following scenarios of working with Administration Server will not be available:

Using a Kaspersky Security Center failover cluster
Using a Windows Server failover cluster
Using SQL Server on a separate device
You can use SQL Server on a separate device only if Administration Server and SQL Server are included in the domain.
Remote installation with Administration Server tools through Active Directory group policies

If you need to disconnect the Administration Server from the Active Directory domain, follow the steps described in the topic: How to change the name of the Kaspersky Security Center.

If it is necessary to install Administration Server on a device included in the workgroup, you can also use Kaspersky Security Center Linux instead of Kaspersky Security Center Windows.

Page top

[Topic 245773]

Connection safety

Usage of TLS

We recommend prohibiting insecure connections to Administration Server. For example, you can prohibit connections that use HTTP in the Administration Server settings.

Please note that by default, several HTTP ports of Administration Server are closed. The remaining port is used for the Administration Server Web Server (8060). This port can be limited by the firewall settings of the Administration Server device.

Strict TLS settings

We recommend using TLS protocol version 1.2 and later, and restricting or prohibiting insecure encryption algorithms.

You can configure encryption protocols (TLS) used by Administration Server. Please note that at the time of the release of a version of Administration Server, the encryption protocol settings are configured by default to ensure secure data transfer.

Restricting access to the Administration Server database

We recommend restricting access to the Administration Server database. For example, grant access only from the Administration Server device. This reduces the likelihood of the Administration Server database being compromised due to known vulnerabilities.

You can configure the parameters according to the operating instructions of the used database, as well as provide closed ports on firewalls.

Prohibition of remote authentication by using Windows accounts

You can use the LP_RestrictRemoteOsAuth flag to prohibit SSPI connections from remote addresses. This flag allows you to prohibit remote authentication on Administration Server by using local or domain Windows accounts.

To switch the LP_RestrictRemoteOsAuth flag to the mode of prohibiting connections from the remote addresses:

Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
Execute the following command in the command line to specify the value of the LP_RestrictRemoteOsAuth flag:
klscflag.exe -fset -pv .core/.independent -s KLLIM -n LP_RestrictRemoteOsAuth -t d -v 1
Restart the Administration Server service.

The LP_RestrictRemoteOsAuth flag does not work if remote authentication is performed through Kaspersky Security Center Web Console or Administration Console that is installed on the Administration Server device.

Authenticating Microsoft SQL Server

If Kaspersky Security Center uses Microsoft SQL Server as a DBMS, it is necessary to protect Kaspersky Security Center data transferred to or from the database and data stored in the database from unauthorized access. To do this, you must secure communication between Kaspersky Security Center and SQL Server. The most reliable way to provide secure communication is to install Kaspersky Security Center and SQL Server on the same device and use the shared memory mechanism for both applications. In all other cases, we recommend that you use an SSL/TLS certificate to authenticate the SQL Server instance.

Configuring an allowlist of IP addresses to connect to Administration Server

By default, users can log in to Kaspersky Security Center from any device where they can open Kaspersky Security Center Web Console or where MMC-based Administration Console is installed. However, you can configure Administration Server so that users can connect to it only from devices with allowed IP addresses. In this case, even if an intruder steals a Kaspersky Security Center account, he or she will be able to log in to Kaspersky Security Center only from IP addresses that are in the allowlist.

Page top

[Topic 245774]

Accounts and authentication

Before performing the below steps, create a Kaspersky Security Center Administration Server backup copy using KL tools (Backup of Administration Server data or klbackup utility) and save it in a safe location.

Using two-step verification with Administration Server

Kaspersky Security Center provides two-step verification for users of Kaspersky Security Center Web Console and Administration Console, based on the RFC 6238 standard (TOTP: Time-Based One-Time Password algorithm).

When two-step verification is enabled for your own account, every time you log in to Kaspersky Security Center Web Console or Administration Console, you enter your user name, password, and an additional single-use security code. If you use domain authentication for your account, you only have to enter an additional single-use security code. To receive a single-use security code, you must install an authenticator app on your computer or your mobile device.

There are both software and hardware authenticators (tokens) that support the RFC 6238 standard. For example, software authenticators include Google Authenticator, Microsoft Authenticator, FreeOTP.

We strongly do not recommend installing the authenticator app on the same device from which the connection to Administration Server is established. You can install an authenticator app on your mobile device.

Using two-factor authentication for an operating system

We recommend using multi-factor authentication (MFA) for authentication on the Administration Server device by using a token, a smart card, or other method (if possible).

Prohibition on saving the administrator password

If you use Administration Console, we do not recommend saving the administrator password in the Administration Server connection dialog box.

If you use Kaspersky Security Center Web Console, we do not recommend saving the administrator password in the browser installed on the user device.

Authentication of an internal user account

By default, the password of an internal user account of Administration Server must comply with the following rules:

The password must be 8 to 256 characters long.
The password must contain characters from at least three of the groups listed below:
- Uppercase letters (A-Z)
- Lowercase letters (a-z)
- Numbers (0-9)
- Special characters (@ # $ % ^ & * - _ ! + = [ ] { } | : ' , . ? / \ ` ~ " ( ) ;)
The password must not contain any whitespaces, Unicode characters, or the combination of "." and "@", when "." is placed before "@".

By default, the maximum number of allowed attempts to enter a password is 10. You can change the number of allowed password entry attempts.

The Kaspersky Security Center user can enter an invalid password a limited number of times. After the limit is reached, the user account is blocked for one hour.

Dedicated administration group for Administration Server

We recommend creating a dedicated administration group for Administration Server. Grant this group special access rights and create a special security policy for it.

To avoid intentionally lowering the security level of Administration Server, we recommend restricting the list of accounts that can manage the dedicated administration group.

The KLAdmins and KLOperators groups

The KLAdmins and KLOperators groups are created automatically during Kaspersky Security Center installation. The KLAdmins group is granted all access rights. The KLOperators group is granted only Read and Execute rights. The rights granted to the KLAdmins group are locked.

You can view the KLAdmins and KLOperators groups, and make changes to these groups, by using the standard administrative tools of the operating system.

When developing regulations for working with Administration Server, it is necessary to determine whether the information security specialist needs full access (and inclusion in the KLAdmins group) to perform standard tasks.

Most of the basic administration tasks can be distributed between company departments (or different employees of the same department) and consequently between different accounts. You can also set up administration groups access differentiation in Kaspersky Security Center. As a result, it is possible to implement a scenario in which authorization under accounts from the KLAdmins group will be anomalous and could be considered an incident.

If Kaspersky Security Center was installed under a system account, groups are created only on the Administration Server device. In this case, we recommend making sure that only entries created during the installation of Kaspersky Security Center are included in the group. We do not recommend adding any groups to the KLAdmins group (local and/or domain) that is created automatically during the Kaspersky Security Center installation. You should also limit the rights to change this group. The KLAdmins group must include only single unprivileged accounts.

If the installation was performed under a domain user account, groups KLAdmins and KLOperators are created both on Administration Server and in the domain that includes Administration Server. A similar approach such as local account installation is recommended.

Restricting the Main Administrator role membership

We recommend restricting the Main Administrator role membership.

By default, after the Administration Server installation, the Main Administrator role is assigned to the local administrators group and the created KLAdmins group. It is useful for management, but it is critical from a security point of view, because the Main Administrator role has an extensive range of privileges, the assignment of this role to users should be strictly regulated.

Local administrators can be excluded from the list of users with administrator privileges of Kaspersky Security Center. The Main Administrator role cannot be removed from the KLAdmins group. You can include in the KLAdmins group the accounts that will be used to manage Administration Server.

If you use domain authentication, we recommend restricting the privileges of domain administrator accounts in Kaspersky Security Center. By default, these accounts have the Main Administrator role. Also, a domain administrator can include its account in the KLAdmins group to obtain the Main Administrator role. To avoid this, in the Kaspersky Security Center security settings you can add the Domain Admins group, and then define prohibiting rules for it. These rules must take precedence over the allowing ones.

You can also use the predefined user roles with an already configured set of rights.

Configuring access rights to application features

We recommend using flexible configuration of access rights to the features of Kaspersky Security Center for each user or group of users.

Role-based access control allows the creation of standard user roles with a predefined set of rights and the assignment of those roles to users depending on their scope of duties.

The main advantages of the role-based access control model:

Ease of administration
Role hierarchy
Least privilege approach
Segregation of duties

You can assign built-in roles to certain employees based on their positions, or create completely new roles.

While configuring roles, pay attention to the privileges associated with changing the protection state of Administration Server device and remote installation of third-party software:

Managing administration groups.
Operations with Administration Server.
Remote installation.
Changing the parameters for storing events and sending notifications.
This privilege allows you to set notifications that run a script or an executable module on the Administration Server device when an event occurs.

Separate account for remote installation of applications

In addition to the basic differentiation of access rights, we recommend restricting the remote installation of applications for all accounts (except for the Main Administrator or another specialized account).

We recommend using a separate account for remote installation of applications. You can assign a role or permissions to the separate account.

Securing Windows Privileged Access

We recommend taking into account Microsoft's recommendations for providing privileged access security. To view these recommendations, go to the Securing privileged access article.

One of the key points of recommendations is the implementation of Privileged Access Workstations (PAW).

Using a managed service account (MSA) or a group managed service accounts (gMSA) to run the Administration Server service

Active Directory has a special type of accounts for securely running services, called group Managed Service Account (MSA/gMSA). Kaspersky Security Center supports managed service accounts (MSA) and group managed service accounts (gMSA). If these types of accounts are used in your domain, you can select one of them as the account for the Administration Server service.

Regular audit of all users

We recommend conducting a regular audit of all users on the Administration Server device. This allows you to respond to certain types of security threats associated with possible compromise of the device.

Page top

[Topic 245776]

Managing protection of Administration Server

Selecting an Administration Server protection software

Depending on the type of the Administration Server deployment and the general protection strategy, select the application to protect the Administration Server device.

If you deploy Administration Server on a dedicated device, we recommend selecting the Kaspersky Endpoint Security application to protect the Administration Server device. This allows applying all available technologies to protect the Administration Server device, including behavioral analysis modules.

If Administration Server is installed on a device that exists in the infrastructure and has previously been used for other tasks, we recommend considering the following protection software:

Kaspersky Industrial CyberSecurity for Nodes. We recommend installing this application on devices that are included in an industrial network. Kaspersky Industrial CyberSecurity for Nodes is an application that has certificates of compatibility with various manufacturers of industrial software.
Recommended security solutions. If Administration Server is installed on a device with other software, we recommend taking into account the recommendations from that software vendor on the compatibility of security solutions (there may already be recommendations for selecting a security solution, and you may need to configure the trusted zone).

Creating a separate security policy for the protection application

We recommend that you create a separate security policy for the application that protects the Administration Server device. This policy must be different from the security policy for client devices. This allows specifying the most appropriate security settings for Administration Server, without affecting the protection level of other devices.

We recommend dividing devices into groups, and then placing the Administration Server device into a separate group for which you can create a special security policy.

Protection modules

If there are no special recommendations from the vendor of the third-party software installed on the same device as Administration Server, we recommend activating and configuring all available protection modules (after checking the operation of these protection modules for a certain time).

Configuring the firewall of the Administration Server device

On the Administration Server device, we recommend configuring the firewall to restrict the number of devices from which administrators can connect to Administration Server through Administration Console or Kaspersky Security Center Web Console.

By default, Administration Server uses port 13291 to receive connections from Administration Console and port 13299 to receive connections from Kaspersky Security Center Web Console. We recommend restricting the number of devices from which Administration Server can be managed by using these ports.

Prohibition of launching the control panel

If you install Administration Server on a device running Microsoft Windows and use the protection application with the Application Launch Control module, you can prohibit the launch of the control panel (control.exe) for unprivileged users, for example, the Administrators group.

After creating the specified prohibiting control rules of the application launch, users with the privileges of the pre-defined Administrator role lose the ability to control other network accounts, including changing their logins and passwords.

Page top

[Topic 245787]

Managing protection of client devices

Restricting of adding license keys to installation packages

Installation packages are stored in the Administration Server shared folder, in the Packages subfolder. If you add a license key to an installation package, the license key may be compromised because the shared Read access rights are enabled to the repository of installation packages.

To avoid compromising the license key, we do not recommend adding license keys to installation packages.

We recommend using automatic distribution of license keys to managed devices, deployment through the Add license key task for a managed application, and adding an activation code or a key file manually to the devices.

Automatic rules for moving devices between administration groups

We recommend restricting the use of automatic rules for moving devices between administration groups.

If you use automatic rules for moving devices, this may lead to propagation of policies that provide more privileges to the moved device than the device has before relocation.

Also, moving a client device to another administration group may lead to propagation of policy settings. These policy settings may be undesirable for distribution to guest and untrusted devices.

This recommendation does not apply for one-time initial allocation of devices to administration groups.

Security requirements for distribution points and connection gateways

Devices with Network Agent installed can act as a distribution point and perform the following functions:

Distribute updates and installation packages received from Administration Server to client devices within the group.
Perform remote installation of third-party software and Kaspersky applications on client devices.
Poll the network to detect new devices and update information about existing ones. The distribution point can use the same methods of device detection as Administration Server.

Placing distribution points on the organization's network used for:

Reducing the load on Administration Server
Traffic optimization
Providing Administration Server with access to devices in hard-to-reach parts of the network

Taking into account the available capabilities, we recommend protecting devices that act as distribution points from any type of unauthorized access (including physically).

Restricting automatic assignment of distribution points

To simplify administration and keep the network operability, we recommend using automatic assignment of distribution points. However, for industrial networks and small networks, we recommend that you avoid assigning distribution points automatically, since, for example, the private information of the accounts used for pushing remote installation tasks, can be transferred to distribution points by means of the operating system.

For industrial networks and small networks, you can manually assign devices to act as distribution points.

You can also view the Report on activity of distribution points.

Page top

[Topic 246284]

Configuring protection for managed applications

Managed application policies

We recommend creating a policy for each type of the used applications and components of Kaspersky Security Center (Network Agent, Kaspersky Endpoint Security for Windows, Kaspersky Endpoint Agent, and others). This policy must be applied to all managed devices (the root administration group) or to a separate group to which new managed devices are automatically moved according to the configured movement rules.

Specifying the password for disabling protection and uninstalling the application

To prevent intruders from disabling Kaspersky security applications, we strongly recommend enabling password protection for disabling protection and deinstallation of Kaspersky security applications. You can set the password, for example, for Kaspersky Endpoint Security for Windows, Kaspersky Security for Windows Servers, Network Agent, and other Kaspersky applications. After you enable password protection, we recommend locking these settings by closing the "lock."

Specifying the password for manual connection of a client device to the Administration Server (klmover utility)

The klmover utility allows you to manually connect a client device to the Administration Server. When Network Agent is installed on a client device, the utility is automatically copied to the Network Agent installation folder.

The klmover utility requires local administrator rights. Password protection for running the klmover utility can be omitted for devices operated without local administrator rights.

Enabling the Use uninstallation password also enables password protection for the Cleaner tool (cleaner.exe).

Using Kaspersky Security Network

In all policies of managed applications and in the Administration Server properties, we recommend enabling the use of Kaspersky Security Network (KSN) and accepting the KSN Statement. When you update or upgrade Administration Server, you can accept the updated KSN Statement. In some cases, when the use of cloud services is prohibited by law or other regulations, you can disable KSN.

Regular scan of managed devices

For all device groups, we recommend creating a task that periodically runs a full scan of devices.

Discovering new devices

We recommend properly configuring device discovery settings: set up integration with Active Directory and specify IP address ranges for discovering new devices.

For security purposes, you can use the default administration group that includes all new devices and the default policies affecting this group.

Selecting a shared folder

If you deploy Administration Server on the device running Windows with the selection of an existing shared folder (that is used, for example, for placing installation packages and storage of updated databases), we recommend ensuring that read rights are granted to the Everyone group, and write rights are granted to the KLAdmins group.

Page top

[Topic 245777]

Administration Server maintenance

Backup copying of Administration Server data

Data backup allows you to restore Administration Server data without data loss.

By default, a data backup task is created automatically after the installation of Administration Server and is executed periodically, saving backups in the appropriate directory.

Settings of the data backup task can be changed as follows:

The backup frequency increases
A special directory for saving copies is specified
Passwords for backup copies is changed

If you store backup copies in a special directory, that is different from the default directory, we recommend limiting the access control list (ACL) for this directory. The Administration Server accounts and accounts of the Administration Server database must have the write access for this directory.

Administration Server maintenance

The Administration Server maintenance allows you to reduce the database volume, and improve the performance and operation reliability of the application. We recommend that you maintain Administration Server at least every week.

The Administration Server maintenance is performed using the dedicated task. The application performs the following actions when maintaining the Administration Server:

Checks the database for errors
Re-organizes database indexes
Updates the database statistics
Shrinks the database (if necessary)

Installing operating system updates and third-party software updates

We strongly recommend that you regularly install software updates for the operating system and third-party software on the Administration Server device.

Client devices do not require a continuous connection to Administration Server, so it is safe to reboot the Administration Server device after installing updates. All events registered on client devices during Administration Server downtime are sent to it after the connection is restored.

Page top

[Topic 245779]

Event transfer to third-party systems

Monitoring and reporting

For timely response to security issues, we recommend configuring the monitoring and reporting features.

Export of events to SIEM systems

For fast detection of security issues before significant damage occurs, we recommend using event export in a SIEM system.

Email notifications of audit events

Kaspersky Security Center allows you to receive information about events that occur during the operation of Administration Server and Kaspersky applications installed on managed devices. For timely response to emergencies, we recommend configuring Administration Server to send notifications about the audit events, critical events, failure events, and warnings that it publishes.

Since these events are intra-system events, a small number of them can be expected, which is quite applicable for mailing.

Statistics of the Administration Server function

For timely response to security issues, we recommend configuring the sending of statistics of the Administration Server function to third-party applications, by using Simple Network Management Protocol (SNMP).

Page top

[Topic 275101]

Security recommendations for third-party information systems

Security recommendations from CIS Benchmarks

When using versions of operating systems, virtualization platforms, or database servers supported by Administration Server and Network Agent, we recommend applying the best information security practices from the Center for Internet Security (CIS), if any, to fine-tune these information systems.

Center for Internet Security (CIS) is a non-profit organization dedicated to improving security in the field of information technology. In particular, CIS develops and distributes safety standards such as CIS Controls and CIS Benchmarks. These standards are a set of recommendations and practices for ensuring the security of information systems.

The CIS portal contains recommendations for the versions of the following information systems supported by Administration Server and Network Agent:

Operating systems of the following families:
- Windows for desktops
- Windows for servers
- Debian
- Ubuntu
- CentOS
- Oracle Linux
- Red Hat Enterprise Linux
- SUSE Linux Enterprise Server
- macOS
VMware virtualization platforms
Database servers:
- Microsoft SQL Server
- MySQL
- MariaDB
- PostgreSQL

Security recommendations for the Astra Linux operating system

When using the Astra Linux operating system, you should follow the security recommendations described in the Red Book for the corresponding version of Astra Linux.

Security recommendations for the RED OS operating system

When using the RED OS operating system, you should use the security recommendations described in the official RED OS documentation.

Page top

[Topic 287156]

Recommendations for using Kaspersky security applications

Using the KLAdmin password in Kaspersky Endpoint Security for Windows

Multiple users with different levels of computer literacy can share a device with Kaspersky Endpoint Security for Windows installed. If users have unrestricted access to Kaspersky Endpoint Security for Windows and its settings, the overall level of device protection may be reduced. Password protection allows you to restrict users' access to Kaspersky Endpoint Security for Windows, according to the permissions granted to them (for example, permission to exit the application).

One of the ways to restrict access to Kaspersky Endpoint Security for Windows and its parameters is to use a KLAdmin account. The KLAdmin account is an administrator account with unrestricted access to Kaspersky Endpoint Security for Windows. The KLAdmin account has the right to perform any password-protected action in Kaspersky Endpoint Security for Windows. The permissions for the KLAdmin account cannot be revoked. You can set the password for the KLAdmin account in the properties of the Kaspersky Endpoint Security for Windows policy. The Kaspersky Endpoint Security for Windows administrator is fully responsible for the safe use of the password for the KLAdmin account. If your organization has its own password policy, follow the instructions of that policy.

Our recommendations for protecting the organization from theft of the KLAdmin password are as follows:

General requirements
Do not use the account name or part of the name as the password.
Minimum password length requirements
Create a password that is at least 10 characters in length.
Requirements for using multiple character types
Set a complex password that contains characters from different categories: lowercase and uppercase letters, numbers, and special characters.
Password expiration requirements
Set a minimum password expiration date of 90 days. A new password must not match any of the last 24 passwords.

Page top

[Topic 171265]

Preparation for deployment

This section describes steps you must take before deploying Kaspersky Security Center.

In this section

Planning Kaspersky Security Center deployment

Preparing to mobile device management

Information about Administration Server performance

Network settings for interaction with external services

Page top

[Topic 92395]

Planning Kaspersky Security Center deployment

This section provides information about the most convenient options for deployment of Kaspersky Security Center components on an organization's network, depending on the following criteria:

Total number of devices
Units (local offices, branches) that are detached organizationally or geographically
Separate networks connected by narrow channels
Need for internet access to the Administration Server

In this section

Typical schemes of protection system deployment

About planning Kaspersky Security Center deployment in an organization's network

Selecting a structure for protection of an enterprise

Standard configurations of Kaspersky Security Center

Selecting a DBMS for Administration Server

Configuring the MariaDB x64 server for working with Kaspersky Security Center 15.1

Configuring the MySQL x64 server for working with Kaspersky Security Center 15.1

Configuring the PostgreSQL or Postgres Pro server for working with Kaspersky Security Center 15.1

Managing mobile devices with Kaspersky Endpoint Security for Android

Providing internet access to Administration Server

About distribution points

Increasing the limit of file descriptors for the klnagent service

Calculating the number and configuration of distribution points

Hierarchy of Administration Servers

Virtual Administration Servers

Information about limitations of Kaspersky Security Center

Network load

See also:

Main installation scenario

Page top

[Topic 54318]

Typical schemes of protection system deployment

This section describes the standard deployment schemes of a protection system in an enterprise network using Kaspersky Security Center.

The system must be protected against any type of unauthorized access. We recommend that you install all available security updates for your operating system before installing the application on your device and physically protect Administration Server(s) and distribution point(s).

You can use Kaspersky Security Center to deploy a protection system on a corporate network by means of the following deployment schemes:

Deploying a protection system through Kaspersky Security Center, in one of the following ways:
- Through Administration Console
- Through Kaspersky Security Center Web Console
Kaspersky applications are automatically installed on client devices, which in turn are automatically connected to the Administration Server by using Kaspersky Security Center.

The basic deployment scheme is protection system deployment through Administration Console. Using Kaspersky Security Center Web Console allows you to launch installation of Kaspersky applications from a browser.
Deploying a protection system manually using stand-alone installation packages generated by Kaspersky Security Center.
Installation of Kaspersky applications on client devices and the administrator's workstation is performed manually; the settings for connecting client devices to the Administration Server are specified when Network Agent is installed.

This deployment method is recommended in cases when remote installation is not possible.

Kaspersky Security Center also allows you to deploy your protection system using Microsoft Active Directory group policies.

Page top

[Topic 159344]

About planning Kaspersky Security Center deployment in an organization's network

One Administration Server can support a maximum of 100,000 devices. If the total number of devices on an organization's network exceeds 100,000, multiple Administration Servers must be deployed on that network and combined into a hierarchy for convenient centralized management.

If an organization includes large-scale remote local offices (branches) with their own administrators, it is useful to deploy Administration Servers in those offices. Otherwise, those offices must be viewed as detached networks connected by low-throughput channels; see section "Standard configuration: A few large-scale offices run by their own administrators".

When detached networks connected with narrow channels are used, traffic can be saved by assigning one or several Network Agents to act as distribution points (see table for calculation of the number of distribution points). In this case, all devices on a detached network retrieve updates from such local update centers. Actual distribution points can download updates both from the Administration Server (default scenario), and from Kaspersky servers on the internet (see section "Standard configuration: Multiple small remote offices").

Section "Standard configurations of Kaspersky Security Center" provides detailed descriptions of the standard configurations of Kaspersky Security Center. When planning the deployment, choose the most suitable standard configuration, depending on the organization's structure.

At the stage of deployment planning, the assignment of the special certificate X.509 to the Administration Server must be considered. Assignment of the X.509 certificate to the Administration Server may be useful in the following cases (partial list):

Inspecting secure socket layer (SSL) traffic by means of an SSL termination proxy or for using a reverse proxy
Integration with the public keys infrastructure (PKI) of an organization
Specifying required values in certificate fields
Providing the required encryption strength of a certificate

Page top

[Topic 61818]

Selecting a structure for protection of an enterprise

Selection of a structure for protection of an organization is defined by the following factors:

Organization's network topology.
Organizational structure.
Number of employees in charge of the network protection, and allocation of their responsibilities.
Hardware resources that can be allocated to protection management components.
Throughput of communication channels that can be allocated to maintenance of protection components on the organizational network.
Time limits for execution of critical administrative operations on the organization's network. Critical administrative operations include, for example, the distribution of anti-virus databases and modification of policies for client devices.

When you select a protection structure, it is recommended first to estimate the available network and hardware resources that can be used for the operation of a centralized protection system.

To analyze the network and hardware infrastructure, it is recommended that you follow the process below:

Define the following settings of the network on which the protection will be deployed:
- Number of network segments.
- Speed of communication channels between individual network segments.
- Number of managed devices in each of the network segments.
- Throughput of each communication channel that can be allocated to maintain the operation of the protection.
Determine the maximum allowed time for the execution of key administrative operations for all managed devices.
Analyze information from steps 1 and 2, as well as data from load testing of the administration system. Based on the analysis, answer the following questions:
- Is it possible to serve all the clients with a single Administration Server, or is a hierarchy of Administration Servers required?
- Which hardware configuration of Administration Servers is required in order to deal with all the clients within the time limits specified in step 2?
- Is it required to use distribution points to reduce load on communication channels?

Upon obtaining answers to the questions in step 3 above, you can compile a set of allowed structures of the organization's protection.

On the organization's network you can use one of the following standard protection structures:

One Administration Server. All client devices are connected to a single Administration Server. Administration Server functions as distribution point.
One Administration Server with distribution points. All client devices are connected to a single Administration Server. Some of the networked client devices function as distribution points.
Hierarchy of Administration Servers. For each network segment, an individual Administration Server is allocated and becomes part of a general hierarchy of Administration Servers. The primary Administration Server functions as distribution point.
Hierarchy of Administration Servers with distribution points. For each network segment, an individual Administration Server is allocated and becomes part of a general hierarchy of Administration Servers. Some of the networked client devices function as distribution points.

Standard configuration: A few large-scale offices run by their own administrators

Standard configuration: Multiple small remote offices

Main installation scenario

Page top

[Topic 92240]

Standard configurations of Kaspersky Security Center

This section describes the following standard configurations used for deployment of Kaspersky Security Center components on an organization's network:

Single office
A few large-scale offices, which are geographically detached and run by their own administrators
Multiple small offices, which are geographically detached

In this section

Standard configuration: Single office

Standard configuration: A few large-scale offices run by their own administrators

Standard configuration: Multiple small remote offices

See also:

Main installation scenario

Page top

[Topic 92241]

Standard configuration: Single office

One or several Administration Servers can be deployed on the organization's network. The number of Administration Servers can be selected either based on available hardware, or on the total number of managed devices.

One Administration Server can support up to 100,000 devices. You must consider the possibility of increasing the number of managed devices in the near future: it may be useful to connect a slightly smaller number of devices to a single Administration Server.

Administration Servers can be deployed either on the internal network, or in the DMZ, depending on whether internet access to the Administration Servers is required.

If multiple Servers are used, it is recommended that you combine them into a hierarchy. Using an Administration Server hierarchy allows you to avoid dubbed policies and tasks, and handle the whole set of managed devices as if they are managed by a single Administration Server (that is, search for devices, build selections of devices, and create reports).

See also:

About distribution points

Requirements for a distribution point

Ports used by Kaspersky Security Center

Main installation scenario

Page top

[Topic 92242]

Standard configuration: A few large-scale offices run by their own administrators

If an organization has a few large-scale, geographically separate offices, you must consider the option of deploying Administration Servers at each of the offices. One or several Administration Servers can be deployed per office, depending on the number of client devices and hardware available. In this case, each of the offices can be viewed as a "Standard configuration: Single office". For ease of administration, it is recommended to combine all of the Administration Servers into a hierarchy (possibly multi-level).

If some employees move between offices with their devices (laptops), create Network Agent connection profiles in the Network Agent policy. Network Agent connection profiles are only supported for Windows and macOS devices.

Standard configuration: Single office

Ports used by Kaspersky Security Center

Page top

[Topic 92243]

Standard configuration: Multiple small remote offices

This standard configuration provides for a headquarters office and many remote small offices that may communicate with the HQ office over the internet. Each of the remote offices may be located behind a Network Address Translation (NAT), that is, no connection can be established between two remote offices because they are isolated.

An Administration Server must be deployed at the headquarters office, and one or multiple distribution points must be assigned to all other offices. If the offices are linked through the internet, it may be useful to create a Download updates to the repositories of distribution points task for the distribution points, so that they will download updates directly from Kaspersky servers, local or network folder, not from the Administration Server.

If some devices at a remote office have no direct access to the Administration Server (for example, access to the Administration Server is provided over the internet but some devices have no internet access), distribution points must be switched into connection gateway mode. In this case, Network Agents on devices at the remote office will be connected, for further synchronization, to the Administration Server—but through the gateway, not directly.

As the Administration Server, most probably, will not be able to poll the remote office network, it may be useful to turn this function over to a distribution point.

The Administration Server will not be able to send notifications to port 15000 UDP to managed devices located behind the NAT at the remote office. To resolve this issue, you can enable the mode of continuous connection to the Administration Server in the properties of devices acting as distribution points (Do not disconnect from the Administration Server check box). This mode is available if the total number of distribution points does not exceed 300. Use push servers to make sure that there is continuous connectivity between a managed device and the Administration Server. Refer to the following topic for details: Using a distribution point as a push server.

See also:

About distribution points

Providing internet access to Administration Server

Ports used by Kaspersky Security Center

Page top

[Topic 92235]

Selecting a DBMS for Administration Server

When selecting the database management system (DBMS) to be used by an Administration Server, you must take into account the number of devices covered by the Administration Server.

The following table lists the valid DBMS options, as well as the recommendations and restrictions on their use.

Recommendations and restrictions on DBMS

DBMS	Recommendations and restrictions
SQL Server Express Edition 2016 or later	Use this DBMS if you intend to run a single Administration Server for less than 10,000 devices. It is recommended to disable the Software inventory task and disable (in the Kaspersky Endpoint Security policy settings) notifications of Administration Server on started applications. You can limit the maximum number of events in the event repository to prevent database overflow. Refer to the following topic for details: Calculation of database space. Concurrent use of the SQL Server Express Edition DBMS by Administration Server and another application is strictly forbidden. The Microsoft SQL Express database is not supported for the Perform Windows Update synchronization task.
Local SQL Server edition, other than Express, 2016 or later	No limitations.
Remote SQL Server edition, other than Express, 2016 or later	Only valid if both devices are in the same Windows domain; if the domains differ, a two-way trust relationship must be established between them.
Local or remote MySQL 5.5, 5.6, or 5.7 (MySQL versions 5.5.1, 5.5.2, 5.5.3, 5.5.4, and 5.5.5 are no longer supported)	Use this DBMS if you intend to run a single Administration Server for less than 10,000 devices. It is recommended to disable the Software inventory task and disable (in the Kaspersky Endpoint Security policy settings) notifications of Administration Server on started applications. Refer to the following topic for details: Calculation of database space.
Local or remote MySQL 8.0.20 or later	Use this DBMS if you intend to run a single Administration Server for less than 50,000 devices. It is recommended to disable the Software inventory task and disable (in the Kaspersky Endpoint Security policy settings) notifications of Administration Server on started applications. Refer to the following topic for details: Calculation of database space.
Local or remote MariaDB (see supported versions)	Use this DBMS if you intend to run a single Administration Server for less than 20,000 devices. It is recommended to disable the Software inventory task and disable (in the Kaspersky Endpoint Security policy settings) notifications of Administration Server on started applications. Refer to the following topic for details: Calculation of database space.
PostgreSQL, Postgres Pro (see supported versions)	Use one of these DBMS if you intend to run a single Administration Server for less than 50,000 devices. It is recommended to disable the Software inventory task and disable (in the Kaspersky Endpoint Security policy settings) notifications of Administration Server on started applications. Refer to the following topic for details: Calculation of database space.

If you are using SQL Server 2019 as a DBMS and you do not have cumulative patch CU12 or later, you have to perform the following after installing Kaspersky Security Center:

Connect to SQL Server using SQL Management Studio.
Run the following commands (if you chose a different name for the database, use that name instead of KAV):
USE KAV

GO

ALTER DATABASE SCOPED CONFIGURATION SET TSQL_SCALAR_UDF_INLINING = OFF

GO
Restart the SQL Server 2019 service.

Otherwise, using SQL Server 2019 may result in errors, such as "There is insufficient system memory in resource pool 'internal' to run this query."

Selecting a DBMS

Page top

[Topic 210277]

Configuring the MariaDB x64 server for working with Kaspersky Security Center 15.1

Kaspersky Security Center 15.1 supports MariaDB DBMS. For more information about supported versions of MariaDB, see section Hardware and software requirements.

If you use the MariaDB DBMS for Kaspersky Security Center, enable support of InnoDB and MEMORY storage and of UTF-8 and UCS-2 encodings.

Recommended settings for the my.ini file

To configure the my.ini file:

Open the my.ini file in a text editor.
Add the following lines into the [mysqld] section of the my.ini file:
sort_buffer_size=10M

join_buffer_size=100M

join_buffer_space_limit=300M

join_cache_level=8

tmp_table_size=512M

max_heap_table_size=512M

key_buffer_size=200M

innodb_buffer_pool_size=<value>

innodb_thread_concurrency=20

innodb_flush_log_at_trx_commit=0

innodb_lock_wait_timeout=300

max_allowed_packet=32M

max_connections=151

max_prepared_stmt_count=12800

table_open_cache=60000

table_open_cache_instances=4

table_definition_cache=60000

The value of the innodb_buffer_pool_size must be no less than 80 percent of the expected KAV database size. Note that the specified memory is allocated at server startup. If the database size is smaller than the specified buffer size, only the required memory is allocated. If you use MariaDB 10.4.3 or older, the actual size of allocated memory is approximately 10 percent greater than the specified buffer size.

It is recommended to use the parameter value innodb_flush_log_at_trx_commit=0, because the values "1" or "2" negatively affect the operating speed of MariaDB. Ensure that the innodb_file_per_table parameter is set to 1.

For MariaDB 10.6, additionally enter the following lines into the [mysqld] section:

optimizer_prune_level=0

optimizer_search_depth=8

By default, the optimizer add-ons join_cache_incremental, join_cache_hashed, and join_cache_bka are enabled. If these add-ons are not enabled, you must enable them.

To check whether optimizer add-ons are enabled:

In the MariaDB client console, execute the command:
SELECT @@optimizer_switch;
Check that its output contains the following lines:
join_cache_incremental=on

join_cache_hashed=on

join_cache_bka=on

If these lines are present and have the value on, then the optimizer add-ons are enabled.

If these lines are missing or have the value off, do the following:
1. Open the my.ini file in a text editor.
2. Add the following lines into the [mysqld] section of the my.ini file:
  optimizer_switch='join_cache_incremental=on'
  
  optimizer_switch='join_cache_hashed=on'
  
  optimizer_switch='join_cache_bka=on'

The add-ons join_cache_incremental, join_cache_hash, and join_cache_bka are enabled.

Page top

[Topic 220593]

Configuring the MySQL x64 server for working with Kaspersky Security Center 15.1

If you use the MySQL DBMS for Kaspersky Security Center, enable support of InnoDB and MEMORY storage and of UTF-8 and UCS-2 encodings.

Recommended settings for the my.ini file

To configure the my.ini file:

Open the my.ini file in a text editor.
Add the following lines into the [mysqld] section of the my.ini file:
sort_buffer_size=10M

join_buffer_size=20M

tmp_table_size=600M

max_heap_table_size=600M

key_buffer_size=200M

innodb_buffer_pool_size=the real value must be no less than 80% of the expected KAV database size

innodb_thread_concurrency=20

innodb_flush_log_at_trx_commit=0 (in most cases, the server uses small transactions)

innodb_lock_wait_timeout=300

max_allowed_packet=32M

max_connections=151

max_prepared_stmt_count=12800

table_open_cache=60000

table_open_cache_instances=4

table_definition_cache=60000

Note that the memory specified in the innodb_buffer_pool_size value is allocated at server startup. If the database size is smaller than the specified buffer size, only the required memory is allocated. The actual size of allocated memory is approximately 10 percent greater than the specified buffer size. Refer to the MySQL documentation for details.

It is recommended to use the parameter value innodb_flush_log_at_trx_commit = 0, because the values "1" or "2" negatively affect the operating speed of MySQL. Ensure that the innodb_file_per_table parameter is set to 1.

Page top

[Topic 241223]

Configuring the PostgreSQL or Postgres Pro server for working with Kaspersky Security Center 15.1

Kaspersky Security Center 15.1 supports PostgreSQL and Postgres Pro DBMSs. If you use one of these DBMSs, consider configuring the DBMS server parameters to optimize the DBMS work with Kaspersky Security Center.

The default path to the configuration file is: C:\Program Files\PostgreSQL\<VERSION>\data\postgresql.conf

Recommended parameters for PostgreSQL and Postgres Pro:

shared_buffers = 25 percent of the RAM value of the device where the DBMS is installed
If RAM is less than 1 GB, then leave the default value.
max_stack_depth = 2MB
temp_buffers = 24MB
work_mem = 16MB
max_connections = 151
max_parallel_workers_per_gather = 0
maintenance_work_mem = 128MB

Make sure the standard_conforming_strings parameter is set to its default value of on. Reload configuration or restart the server after updating the postgresql.conf file. Refer to the PostgreSQL documentation for details.

If you use Postgres Pro 15.7 or Postgres Pro 15.7.1, disable the enable_compound_index_stats parameter:

enable_compound_index_stats = off

For detailed information about PostgreSQL and Postgres Pro server parameters, and on how to specify them, refer to the corresponding DBMS documentation.

Refer to the following topic for details on how to create and configure accounts for PostgreSQL and Postgres Pro: Configuring accounts for work with PostgreSQL and Postgres Pro.

Page top

[Topic 92393]

Managing mobile devices with Kaspersky Endpoint Security for Android

Mobile devices with installed Kaspersky Endpoint Security for Android (hereinafter referred to as KES devices) are managed by means of the Administration Server. Kaspersky Security Center supports the following features for managing KES devices:

Handling mobile devices as client devices:
- Membership in administration groups
- Monitoring, such as viewing statuses, events, and reports
- Modifying local settings and assigning policies for Kaspersky Endpoint Security for Android
Sending commands in centralized mode
Installing mobile apps packages remotely

Administration Server manages KES devices through TLS, TCP port 13292.

Page top

[Topic 92236]

Providing internet access to Administration Server

The following cases require internet access to the Administration Server:

Regular updating of Kaspersky databases, software modules, and applications
Updating third-party software
By default, internet connection is not required for Administration Server to install Microsoft software updates on the managed devices. For example, the managed devices can download the Microsoft software updates directly from Microsoft Update servers or from Windows Server with Microsoft Windows Server Update Services (WSUS) deployed in your organization's network. Administration Server must be connected to the internet in the following cases:
- When you use Administration Server as WSUS server
- To install updates of third-party software other than Microsoft software
Fixing third-party software vulnerabilities
Internet connection is required for Administration Server to perform the following tasks:
- To make a list of recommended fixes for vulnerabilities in Microsoft software. The list is created and regularly updated by Kaspersky specialists.
- To fix vulnerabilities in third-party software other than Microsoft software.
Managing devices (laptops) of out-of-office users
Managing devices in remote offices
Interacting with primary or secondary Administration Servers located in remote offices
Managing mobile devices

This section describes typical ways of providing access to the Administration Server over the internet. Each of the cases focusing on providing internet access to the Administration Server may require a dedicated certificate for the Administration Server.

In this section

Internet access: Administration Server on a local network

Internet access: Administration Server in DMZ

Internet access: Network Agent as connection gateway in DMZ

See also:

Main installation scenario

Page top

[Topic 92237]

Internet access: Administration Server on a local network

If the Administration Server is located on the internal network of an organization, you might want to make TCP port 13000 of the Administration Server accessible from outside by means of port forwarding. If mobile device management is required, you might want to make accessible port 13292 TCP.

See also:

Ports used by Kaspersky Security Center

Main installation scenario

Scenario: Mobile Device Management deployment

Schemas for data traffic and port usage

Page top

[Topic 92238]

Internet access: Administration Server in DMZ

If the Administration Server is located in the DMZ of the organization's network, it has no access to the organization's internal network. Therefore, the following limitations apply:

The Administration Server cannot detect new devices.
The Administration Server cannot perform initial deployment of Network Agent through forced installation on devices on the internal network of the organization.

This only applies to the initial installation of Network Agent. Any further upgrades of Network Agent or the security application installation can, however, be performed by the Administration Server. At the same time, the initial deployment of Network Agents can be performed by other means, for example, through group policies of Microsoft Active Directory.

The Administration Server cannot send notifications to managed devices through port 15000 UDP, which is not critical for the Kaspersky Security Center functioning.
The Administration Server cannot poll Active Directory. However, results of Active Directory polling are not required in most scenarios.

If the above limitations are viewed as critical, they can be removed by using distribution points located on the organization's network:

To perform initial deployment on devices without Network Agent, you first install Network Agent on one of the devices and then assign it the distribution point status. As a result, initial installation of Network Agent on other devices will be performed by the Administration Server through this distribution point.
To detect new devices on the internal network of the organization and poll Active Directory, you must enable the relevant device discovery methods on one of the distribution points.

To ensure a successful sending of notifications to port 15000 UDP on managed devices located on the internal network of the organization, you must cover the entire network with distribution points. In the properties of the distribution points that were assigned, select the Do not disconnect from the Administration Server check box. As a result, the Administration Server will establish a continuous connection to the distribution points while they will be able to send notifications to port 15000 UDP on devices that are on the organization's internal network (it can be an IPv4 or IPv6 network).

Page top

[Topic 92239]

Internet access: Network Agent as connection gateway in DMZ

Administration Server can be located on the internal network of the organization, and in that network's DMZ there can be a device with Network Agent running as a connection gateway with reverse connectivity (Administration Server establishes a connection to Network Agent). In this case, the following conditions must be met to ensure internet access:

Network Agent must be installed on the device that is in the DMZ. When you install Network Agent, in the Connection gateway window of the setup wizard, select Use Network Agent as a connection gateway in DMZ.
The device with the installed connection gateway must be added as a distribution point. When you add the connection gateway, in the Add distribution point window, select the Select → Add connection gateway in DMZ by address option.
To use an internet connection to connect external desktop devices to the Administration Server, the installation package for Network Agent must be corrected. In the properties of the created installation package, select the Advanced → Connect to Administration Server by using a connection gateway option, and then specify the newly created connection gateway.

For the connection gateway in the DMZ, Administration Server creates a certificate signed with the Administration Server certificate. If the administrator decides to assign a custom certificate to Administration Server, it must be done before a connection gateway is created in the DMZ.

If some employees use laptops that can connect to Administration Server either from the local network or over the internet, it may be useful to create a switching rule for Network Agent in the Network Agent's policy.

See also:

Connecting out-of-office devices

Page top

[Topic 92244]

About distribution points

A device with Network Agent installed can be used as a distribution point. In this mode, Network Agent can perform the following functions:

Distribute updates (these can be retrieved either from the Administration Server or from Kaspersky servers). In the latter case, the Download updates to the repositories of distribution points task must be created for the device that serves as the distribution point:
- Install software (including initial deployment of Network Agents) on other devices.
- Poll the network to detect new devices and update information about existing ones. A distribution point can apply the same device discovery methods as the Administration Server.

Deployment of distribution points on an organization's network has the following objectives:

Reducing the load on the Administration Server.
Optimizing traffic.
Providing the Administration Server with access to devices in hard-to-reach spots of the organization's network. The availability of a distribution point on the network behind a NAT (in relation to the Administration Server) allows the Administration Server to perform the following actions:
- Send notifications to devices over UDP on the IPv4 or IPv6 network
- Poll the IPv4 or IPv6 network
- Perform initial deployment
- Act as a push server

A distribution point is assigned for an administration group. In this case, the scope of the distribution point includes all devices within the administration group and all of its subgroups. However, the device that acts as the distribution point may not be included in the administration group to which it has been assigned.

You can make a distribution point function as a connection gateway. In this case, devices in the scope of the distribution point will be connected to the Administration Server through the gateway, not directly. This mode can be useful in scenarios that do not allow the establishment of a direct connection between the Administration Server and managed devices.

If you use a Linux-based device as a distribution point, we strongly recommend increasing the limit of file descriptors for the klnagent service, because if the scope of the distribution point includes many devices, the default maximum number of files that can be opened may not be enough.

Main installation scenario

Page top

[Topic 275856]

Increasing the limit of file descriptors for the klnagent service

If the scope of a Linux-based distribution point includes many devices, the default limit of files that can be opened (file descriptors) may not be enough. To avoid this, you can increase the limit of file descriptors for the klnagent service.

To increase the limit of file descriptors for the klnagent service:

On the Linux-based device that acts as a distribution point, open the /lib/systemd/system/klnagent64.service file, and then specify the hard and soft limits of the file descriptors in the LimitNOFILE parameter of the [Service] section:
LimitNOFILE=<soft_resource_limit>:<hard_resource_limit>

For example, LimitNOFILE=32768:131072. Note that the soft limit of the file descriptors must be less or equal to the hard limit.
Run the following command to ensure that the parameters are specified correctly:
systemd-analyze verify klnagent64.service

If the parameters are specified incorrectly, this command can output one of the following errors:
- /lib/systemd/system/klnagent64.service:11: Failed to parse resource value, ignoring: 32768:13107
  If this error occurs, the symbols in the LimitNOFILE line were specified incorrectly. You must check and correct the entered line.
- /lib/systemd/system/klnagent64.service:11: Soft resource limit chosen higher than hard limit, ignoring: 32768:13107
  If this error occurs, the soft limit of the file descriptors you entered is more than the hard limit. You must check the entered line and ensure that the soft limit of the file descriptors is less or equal to the hard limit.
Run the following command to reload the systemd process:
systemctl daemon-reload
Run the following command to restart the Network Agent service:
systemctl restart klnagent
Run the following command to ensure that the specified parameters are applied correctly:
less /proc/<nagent_proc_id>/limits

where the <nagent_proc_id> parameter is the identifier of the Network Agent process. You can run the following command to obtain the identifier:

ps -ax | grep klnagent

For the Linux-based distribution point, the limit of files that can be opened is increased.

Page top

[Topic 154282]

Calculating the number and configuration of distribution points

The more client devices a network contains, the more distribution points it requires. We recommend that you not disable automatic assignment of distribution points. When automatic assignment of distribution points is enabled, Administration Server assigns distribution points if the number of client devices is quite large and defines their configuration.

Using exclusively assigned distribution points

If you plan to use certain specific devices as distribution points (that is, exclusively assigned servers), you can opt out of using automatic assignment of distribution points. In this case, make sure that the devices that you intend to make distribution points have sufficient volume of free disk space, are not shut down regularly, and have Sleep mode disabled.

Number of exclusively assigned distribution points on a network that contains a single network segment, based on the number of networked devices

Number of client devices in the network segment	Number of distribution points
Less than 300	0 (Do not assign distribution points)
More than 300	Acceptable: (N/10,000 + 1), recommended: (N/5000 + 2), where N is the number of networked devices

Number of exclusively assigned distribution points on a network that contains multiple network segments, based on the number of networked devices

Number of client devices per network segment	Number of distribution points
Less than 10	0 (Do not assign distribution points)
10–100	1
More than 100	Acceptable: (N/10,000 + 1), recommended: (N/5000 + 2), where N is the number of networked devices

Using standard client devices (workstations) as distribution points

If you plan to use standard client devices (that is, workstations) as distribution points, we recommend that you assign distribution points as shown in the tables below in order to avoid excessive load on the communication channels and on Administration Server:

Number of workstations functioning as distribution points on a network that contains a single network segment, based on the number of networked devices

Number of client devices in the network segment	Number of distribution points
Less than 300	0 (Do not assign distribution points)
More than 300	(N/300 + 1), where N is the number of networked devices; there must be at least 3 distribution points

Number of workstations functioning as distribution points on a network that contains multiple network segments, based on the number of networked devices

Number of client devices per network segment	Number of distribution points
Less than 10	0 (Do not assign distribution points)
10–30	1
31–300	2
More than 300	(N/300 + 1), where N is the number of networked devices; there must be at least 3 distribution points

If a distribution point is shut down (or not available for some other reason), the managed devices in its scope can access the Administration Server for updates.

Standard configuration: Multiple small remote offices

Page top

[Topic 155205]

Hierarchy of Administration Servers

An MSP may run multiple Administration Servers. It can be inconvenient to administer several separate Administration Servers, so a hierarchy can be applied. A "primary/secondary" configuration for two Administration Servers provides the following options:

A secondary Administration Server inherits policies and tasks from the primary Administration Server, thus preventing duplication of settings.
Selections of devices on the primary Administration Server can include devices from secondary Administration Servers.
Reports on the primary Administration Server can contain data (including detailed information) from secondary Administration Servers.

The primary Administration Server only receives data from non-virtual secondary Administration Servers within the scope of the options listed above. This limitation does not apply to virtual Administration Servers, which share the database with their primary Administration Server.

Page top

[Topic 92246]

Virtual Administration Servers

On the basis of a physical Administration Server, multiple virtual Administration Servers can be created, which will be similar to secondary Administration Servers. Compared to the discretionary access model, which is based on access control lists (ACLs), the virtual Administration Server model is more functional and provides a larger degree of isolation. In addition to a dedicated structure of administration groups for assigned devices with policies and tasks, each virtual Administration Server features its own group of unassigned devices, own sets of reports, selected devices and events, installation packages, moving rules, etc. The functional scope of virtual Administration Servers can be used both by service providers (xSP) to maximize the isolation of customers, and by large-scale organizations with sophisticated workflows and numerous administrators.

Virtual Administration Servers are very similar to secondary Administration Servers, but with the following distinctions:

A virtual Administration Server lacks most global settings and its own TCP ports.
A virtual Administration Server has no secondary Administration Servers.
A virtual Administration Server has no other virtual Administration Servers.
A physical Administration Server views devices, groups, events, and objects on managed devices (items in Quarantine, applications registry, etc.) of all its virtual Administration Servers.
A virtual Administration Server can only scan the network with distribution points connected.

Page top

[Topic 159736]

Information about limitations of Kaspersky Security Center

The following table displays the limitations of the current version of Kaspersky Security Center.

Limitations of Kaspersky Security Center

Type of limitation	Value
Maximum number of managed devices per Administration Server	100,000
Maximum number of devices with the Do not disconnect from the Administration Server option selected	300
Maximum number of administration groups	10,000
Maximum number of events to store	45,000,000
Maximum number of policies	2000
Maximum number of tasks	2000
Maximum total number of Active Directory objects (organizational units, OUs) and accounts of users, devices, and security groups)	1,000,000
Maximum number of profiles in a policy	100
Maximum number of secondary Administration Servers on a single primary Administration Server	500
Maximum number of virtual Administration Servers	500
Maximum number of devices that a single distribution point can cover (distribution points can cover non-mobile devices only)	10,000
Maximum number of devices that may use a single connection gateway	10,000, including mobile devices
Maximum number of mobile devices per Administration Server	100,000 minus the number of stationary managed devices

Page top

[Topic 11961]

Network load

This section contains information about the volume of network traffic that the client devices and Administration Server exchange during key administrative scenarios.

The main load on the network is caused by the following administrative scenarios in progress:

Initial deployment of anti-virus protection
Initial update of anti-virus databases
Synchronization of a client device with Administration Server
Regular updates of anti-virus databases
Processing of events on client devices by Administration Server

In this section

Initial deployment of anti-virus protection

Initial update of anti-virus databases

Synchronizing a client with the Administration Server

Additional update of anti-virus databases

Processing of events from clients by Administration Server

Traffic per 24 hours

Page top

[Topic 11962]

Initial deployment of anti-virus protection

This section provides information about traffic volume values after Network Agent and Kaspersky Endpoint Security for Windows are installed on the client device (see the table below).

The Network Agent is installed using forced installation, when the files required for setup are copied by Administration Server to a shared folder on the client device. After installation, the Network Agent retrieves the distribution package of Kaspersky Endpoint Security for Windows, using the connection to the Administration Server.

Traffic

Scenario	Network Agent installation for a single client device	Installing Kaspersky Endpoint Security for Windows on one client device (with databases updated)	Concurrent installation of Network Agent and Kaspersky Endpoint Security for Windows
Traffic from a client device to Administration Server, KB	1638.4	7843.84	9707.52
Traffic from Administration Server to a client device, KB	69,990.4	259,317.76	329,318.4
Total traffic (for a single client device), KB	71,628.8	267,161.6	339,025.92

After Network Agents are installed on the client devices, one of the devices in the administration group can be assigned to act as distribution point. It is used for distribution of installation packages. In this case, traffic volume transferred during initial deployment of anti-virus protection varies significantly depending on whether you are using IP multicasting.

If IP multicasting is used, installation packages are sent once to all running devices in the administration group. Thus, total traffic becomes N times smaller, where N stands for the total number of running devices in the administration group. If you are not using IP multicasting, the total traffic is identical to the traffic calculated as if the distribution packages are downloaded from the Administration Server. However, the package source is the distribution point, not the Administration Server.

Page top

[Topic 11979]

Initial update of anti-virus databases

The traffic rates during initial update of anti-virus databases (when starting the database update task for the first time on a client device), are as follows:

Traffic from a client device to Administration Server: 1,8 MB.
Traffic from Administration Server to a client device: 113 MB.
Total traffic (for a single client device): 114 MB.

The data may vary slightly depending upon the current version of the anti-virus database.

Page top

[Topic 11982]

Synchronizing a client with the Administration Server

This scenario describes the state of the administration system when intensive data synchronization occurs between a client device and the Administration Server. Client devices connect to the Administration Server with the interval defined by the administrator. The Administration Server compares the status of data on a client device with that on the Server, records information in the database about the last client device connection, and synchronizes data.

This section contains information about traffic values for basic administration scenarios when connecting a client to the Administration Server (see table below). The data in the table may vary slightly depending upon the current version of the anti-virus database.

Traffic

Scenario	Traffic from client devices to Administration Server, KB	Traffic from Administration Server to client devices, KB	Total traffic (for a single client device), KB
Initial synchronization prior to updating databases on a client device	699.44	568.42	1267.86
Initial synchronization after updating databases on a client device	735.8	4474.88	5210.68
Synchronization with no changes on a client device and the Administration Server	11.99	6.73	18.72
Synchronization after changing the value of a setting in a group policy	9.79	11.39	21.18
Synchronization after changing the value of a setting in a group task	11.27	11.72	22.99
Forced synchronization with no changes on a client device	77.59	99.45	177.04

Overall traffic volume varies considerably depending on whether IP multicasting is used within administration groups. If IP multicasting is used, the total traffic volume decreases approximately by N times for the group, where N stands for the total number of devices included in the administration group.

The volume of traffic at initial synchronization before and after an update of the databases is specified for the following cases:

Installing Network Agent and a security application on a client device
Moving a client device to an administration group
Applying a policy and tasks that have been created for the group by default, to a client device

The table specifies traffic rates in case of changes to one of the protection settings that are included in the Kaspersky Endpoint Security policy settings. Data for other policy settings may differ from data displayed in the table.

Page top

[Topic 11984]

Additional update of anti-virus databases

The traffic rates in case of an incremental update of anti-virus databases 20 hours after the previous update are as follows:

Traffic from a client device to Administration Server: 169 KB.
Traffic from Administration Server to a client device: 16 MB.
Total traffic (for a single client device): 16.3 MB.

The data in the table may vary slightly depending upon the current version of the anti-virus database.

Traffic volume varies significantly depending on whether IP multicasting is used within administration groups. If IP multicasting is used, the total traffic volume decreases approximately by N times for the group, where N stands for the total number of devices included in the administration group.

Page top

[Topic 11986]

Processing of events from clients by Administration Server

This section provides information about traffic volume values when a client device encounters a "Virus detected" event, which is then sent to the Administration Server and registered in the database (see table below).

Traffic

Scenario	Data transfer to Administration Server when a "Virus detected" event occurs	Data transfer to Administration Server when nine "Virus detected" events occur
Traffic from a client device to Administration Server, KB	49.66	64.05
Traffic from Administration Server to a client device, KB	28.64	31.97
Total traffic (for a single client device), KB	78.3	96.02

Data in the table may vary slightly depending upon the current version of the anti-virus application and the events that are defined in its policy for registration in the Administration Server database.

Page top

[Topic 11981]

Traffic per 24 hours

This section contains information about traffic rates for 24 hours of the administration system's activity in a "quiet" condition, when no data changes are made either by client devices or by the Administration Server (see table below).

Data presented in the table describe the network's condition after standard installation of Kaspersky Security Center and completion of the quick start wizard. The frequency of synchronization of the client device with Administration Server was 20 minutes; updates were downloaded to the Administration Server repository once per hour.

Traffic rates per 24 hours in idle state

Traffic flow	Value
Traffic from a client device to Administration Server, KB	3235.84
Traffic from Administration Server to a client device, KB	64,378.88
Total traffic (for a single client device), KB	67,614.72

Page top

[Topic 92542]

Preparing to mobile device management

This section provides the following information:

About iOS MDM Server intended for management of iOS devices by installing dedicated iOS MDM profiles on them
About management of mobile devices that have Kaspersky Endpoint Security for Android installed

In this section

iOS MDM Server

Managing mobile devices with Kaspersky Endpoint Security for Android

See also:

Mobile Device Management

Scenario: Mobile Device Management deployment

Main installation scenario

Page top

[Topic 92389]

iOS MDM Server

iOS MDM Server allows you to manage iOS devices by installing dedicated iOS MDM profiles on them. The following features are supported:

Device lock
Password reset
Data wipe
Installation or removal of apps
Use of an iOS MDM profile with advanced settings (such as VPN settings, email settings, Wi-Fi settings, camera settings, certificates, etc.)

iOS MDM Server is a web service that receives inbound connections from mobile devices through its TLS port (by default, port 443), which is managed by Kaspersky Security Center using Network Agent. Network Agent is installed locally on a device with an iOS MDM Server deployed.

When deploying an iOS MDM Server, the administrator must perform the following actions:

Provide Network Agent with access to the Administration Server
Provide mobile devices with access to the TCP port of the iOS MDM Server

This section addresses two standard configurations of an iOS MDM Server.

In this section

Standard configuration: Kaspersky Device Management for iOS in DMZ

Standard configuration: iOS MDM Server on the local network of an organization

See also:

Main installation scenario

Ports used by Kaspersky Security Center

Page top

[Topic 92391]

Standard configuration: Kaspersky Device Management for iOS in DMZ

An iOS MDM Server is located in the DMZ of an organization's local network with internet access. A special feature of this approach is the absence of any problems when the iOS MDM web service is accessed from devices over the internet.

Because management of an iOS MDM Server requires Network Agent to be installed locally, you must ensure the interaction of Network Agent with the Administration Server. You can ensure this by using one of the following methods:

By moving the Administration Server to the DMZ.
By using a connection gateway:
1. On the device with iOS MDM Server deployed, connect Network Agent to the Administration Server through a connection gateway.
2. On the device with iOS MDM Server deployed, assign Network Agent to act as connection gateway.

See also:

Simplified deployment scheme

Page top

[Topic 92392]

Standard configuration: iOS MDM Server on the local network of an organization

An iOS MDM Server is located on the internal network of an organization. Port 443 (default port) must be enabled for external access, for example, by publishing the iOS MDM web service on reverse proxy that supports Kerberos constrained delegation.

Any standard configuration requires access to Apple web services for the iOS MDM Server (range 17.0.0.0/8) through TCP port 2197. This port is used for notifying devices of new commands by means of a dedicated service named APNs.

Page top

[Topic 92393_1]

Managing mobile devices with Kaspersky Endpoint Security for Android

Handling mobile devices as client devices:
- Membership in administration groups
- Monitoring, such as viewing statuses, events, and reports
- Modifying local settings and assigning policies for Kaspersky Endpoint Security for Android
Sending commands in centralized mode
Installing mobile apps packages remotely

Administration Server manages KES devices through TLS, TCP port 13292.

Page top

[Topic 28253]

Information about Administration Server performance

This section presents the results of performance testing of the Administration Server for different hardware configurations, as well as the limitations on connecting managed devices to the Administration Server.

In this section

Limitations on connection to an Administration Server

Results of Administration Server performance testing

Results of KSN proxy server performance testing

Page top

[Topic 152283]

Limitations on connection to an Administration Server

An Administration Server supports management of up to 100,000 devices without a loss in performance.

Limitations on connections to an Administration Server without a loss in performance:

One Administration Server can support up to 500 virtual Administration Servers.
The primary Administration Server supports no more than 1000 sessions simultaneously.
Virtual Administration Servers support no more than 1000 sessions simultaneously.

Page top

[Topic 152284]

Results of Administration Server performance testing

Results of Administration Server performance testing have allowed us to determine the maximum numbers of client devices with which Administration Server can be synchronized for specified time intervals. You can use this information to select the optimal scheme for deploying anti-virus protection on computer networks.

Devices with the following hardware configurations (see the tables below) were used for testing:

Administration Server hardware configuration

Parameter	Value
CPU	Intel Xeon CPU E5630, clock speed of 2.53 GHz, 2 socket, 8 cores, 16 logical processors
RAM	26 GB
Hard drive	IBM ServeRAID M5014 SCSI Disk Device, 487 GB
Operating system	Microsoft Windows Server 2019 Standard, version 10.0.17763, build 17763
Network	QLogic BCM5709C Gigabit Ethernet (NDIS VBD Client)

Hardware configuration of the SQL Server device

Parameter	Value
CPU	Intel Xeon CPU X5570, clock speed of 2.93 GHz, 2 socket, 8 cores, 16 logical processors
RAM	32 GB
Hard drive	Adaptec Array SCSI Disk Device, 2047 GB
Operating system	Microsoft Windows Server 2019 Standard, version 10.0.17763, build 17763
Network	Intel 82576 Gigabit

Administration Server supported creation of 500 virtual Administration Servers.

The synchronization interval was 15 minutes for every 10,000 managed devices (see the table below).

Summarized results of Administration Server load testing

Synchronization interval (min)	Number of managed devices
15	10,000
30	20,000
45	30,000
60	40,000
75	50,000
90	60,000
105	70,000
120	80,000
135	90,000
150	100,000

If you connect Administration Server to a MySQL or SQL Express database server, it is not recommended to use the application to manage more than 10,000 devices. For the MariaDB database management system, the maximum recommended number of managed devices is 20,000.

Page top

[Topic 178552]

Results of KSN proxy server performance testing

If your enterprise network includes a large amount of client devices and they use the Administration Server as KSN proxy server, the Administration Server hardware must meet specific requirements to be able to process the requests from the client devices. You can use the testing results below to evaluate the Administration Server load on your network and plan the hardware resources to provide for normal functioning of the KSN proxy service.

The tables below show the hardware configuration of the Administration Server and SQL Server. This configuration was used for testing.

Administration Server hardware configuration

Parameter	Value
CPU	Intel Xeon CPU E5450, clock speed of 3.00 GHz, 2 socket, 8 cores, 16 logical processors
RAM	32 GB
Operating system	Microsoft Windows Server 2016 Standard

SQL Server hardware configuration

Parameter	Value
CPU	Intel Xeon CPU E5450, clock speed of 3.00 GHz, 2 socket, 8 cores, 16 logical processors
RAM	32 GB
Operating system	Microsoft Windows Server 2019 Standard

The table below shows the results of the test.

Summarized results of KSN proxy server performance testing

Parameter	Value
Maximum number of requests processed per second	4914
Maximum CPU utilization	36%

Page top

[Topic 255242]

Network settings for interaction with external services

Kaspersky Security Center uses the following network settings for interacting with external services.

Network settings

Network settings	Address	Description
Port: 443 Protocol: HTTPS	activation-v2.kaspersky.com/activationservice/activationservice.svc	Application activation.
Port: 443 Protocol: HTTPS	https://s00.upd.kaspersky.com https://s01.upd.kaspersky.com https://s02.upd.kaspersky.com https://s03.upd.kaspersky.com https://s04.upd.kaspersky.com https://s05.upd.kaspersky.com https://s06.upd.kaspersky.com https://s07.upd.kaspersky.com https://s08.upd.kaspersky.com https://s09.upd.kaspersky.com https://s10.upd.kaspersky.com https://s11.upd.kaspersky.com https://s12.upd.kaspersky.com https://s13.upd.kaspersky.com https://s14.upd.kaspersky.com https://s15.upd.kaspersky.com https://s16.upd.kaspersky.com https://s17.upd.kaspersky.com https://s18.upd.kaspersky.com https://s19.upd.kaspersky.com https://cm.k.kaspersky-labs.com	Updating Kaspersky databases, software modules, and applications.
Port: 443 Protocol: HTTPS	https://downloads.upd.kaspersky.com	Updating Kaspersky databases, software modules, and applications. Checking if Kaspersky servers are accessible. Before downloading Kaspersky databases and software modules, Kaspersky Security Center checks if Kaspersky servers are accessible. If access to the servers using system DNS is not possible, the application uses public DNS servers.
Port: 80 Protocol: HTTP	http://p00.upd.kaspersky.com http://p01.upd.kaspersky.com http://p02.upd.kaspersky.com http://p03.upd.kaspersky.com http://p04.upd.kaspersky.com http://p05.upd.kaspersky.com http://p06.upd.kaspersky.com http://p07.upd.kaspersky.com http://p08.upd.kaspersky.com http://p09.upd.kaspersky.com http://p10.upd.kaspersky.com http://p11.upd.kaspersky.com http://p12.upd.kaspersky.com http://p13.upd.kaspersky.com http://p14.upd.kaspersky.com http://p15.upd.kaspersky.com http://p16.upd.kaspersky.com http://p17.upd.kaspersky.com http://p18.upd.kaspersky.com http://p19.upd.kaspersky.com http://downloads0.kaspersky-labs.com http://downloads1.kaspersky-labs.com http://downloads2.kaspersky-labs.com http://downloads3.kaspersky-labs.com http://downloads4.kaspersky-labs.com http://downloads5.kaspersky-labs.com http://downloads6.kaspersky-labs.com http://downloads7.kaspersky-labs.com http://downloads8.kaspersky-labs.com http://downloads9.kaspersky-labs.com http://downloads.kaspersky-labs.com http://cm.k.kaspersky-labs.com	Updating Kaspersky databases, software modules, and applications.
Port: 443 Protocol: HTTPS	ds.kaspersky.com	Using Kaspersky Security Network.
Port: 443, 1443 Protocol: HTTPS	ksn-a-stat-geo.kaspersky-labs.com ksn-file-geo.kaspersky-labs.com ksn-verdict-geo.kaspersky-labs.com ksn-url-geo.kaspersky-labs.com ksn-a-p2p-geo.kaspersky-labs.com ksn-info-geo.kaspersky-labs.com ksn-cinfo-geo.kaspersky-labs.com	Using Kaspersky Security Network.
Protocol: HTTPS	click.kaspersky.com redirect.kaspersky.com	Following links from the interface.
Port: 80 Protocol: HTTP	http://crl.kaspersky.com http://ocsp.kaspersky.com	These servers are part of the Public Key Infrastructure (PKI) and are necessary to verify the validity status of the Kaspersky digital signature certificates. The CRL is a list of revoked certificates. The OCSP allows you to request the status of a specific certificate in real time. These servers help to ensure the security of interaction with digital certificates and protect against possible attacks.
Port: 443 Protocol: HTTPS	https://ipm-klca.kaspersky.com	Marketing announcements.

For proper interaction of Kaspersky Security Center with external services, consider the following recommendations:
- Unencrypted network traffic must be allowed on ports 443 and 1443 on the network equipment and proxy server of your organization.
- When Administration Server interacts with Kaspersky update servers and Kaspersky Security Network servers, it is necessary to avoid hijacking network traffic with certificate substitution (

MITM attacks

To download updates through the HTTP or HTTPS protocol by using the klscflag utility:

Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
If you want to download updates through the HTTP protocol, run one of the following commands:
- On the device with Administration Server installed:
  klscflag.exe -fset -pv klserver -s Updater -n DisableKLHttps -t d -v 1
- On a distribution point:
  klscflag.exe -fset -pv klnagent -s Updater -n DisableKLHttps -t d -v 1
If you want to download updates through the HTTPS protocol, run one of the following commands:
- On the device with Administration Server installed:
  klscflag.exe -fset -pv klserver -s Updater -n DisableKLHttps -t d -v 0
- On a distribution point:
  klscflag.exe -fset -pv klnagent -s Updater -n DisableKLHttps -t d -v 0

Page top

[Topic 92444]

Deploying Network Agent and the security application

To manage devices in an organization, you have to install Network Agent on each of them. Deployment of distributed Kaspersky Security Center on corporate devices normally begins with installation of Network Agent on them.

In Microsoft Windows XP, Network Agent might not perform the following operations correctly: downloading updates directly from Kaspersky servers (as a distribution point); functioning as a KSN proxy server (as a distribution point); and detecting third-party vulnerabilities (if Vulnerability and patch management is used).

In this section

Initial deployment

Remote installation of applications on devices with Network Agent installed

Managing device restarts in the remote installation task

Suitability of databases updating in an installation package of a security application

Using tools for remote installation of applications in Kaspersky Security Center for running relevant executable files on managed devices

Monitoring the deployment

Configuring installers

Virtual infrastructure

Support of file system rollback for devices with Network Agent

Local installation of applications

Page top

[Topic 92445]

Initial deployment

If a Network Agent has already been installed on a device, remote installation of applications on that device is performed through this Network Agent. The distribution package of an application to be installed is transferred over communication channels between Network Agents and Administration Server, along with the installation settings defined by the administrator. To transfer the distribution package, you can use relay distribution nodes, that is, distribution points, multicast delivery, etc. For more details on how to install applications on managed devices with Network Agent already installed, see below in this section.

You can perform initial installation of Network Agent on devices running Windows, using one of the following methods:

With third-party tools for remote installation of applications.
By cloning an image of the administrator's hard drive with the operating system and Network Agent: using tools provided by Kaspersky Security Center for handling disk images, or using third-party tools.
With Windows group policies: using standard Windows management tools for group policies, or in automatic mode, through the corresponding, dedicated option in the remote installation task of Kaspersky Security Center.
In forced mode, using special options in the remote installation task of Kaspersky Security Center.
By sending device users links to stand-alone packages generated by Kaspersky Security Center. Stand-alone packages are executable modules that contain the distribution packages of selected applications with their settings defined.
Manually, by running application installers on devices.

The following methods can be used for the initial installation of Network Agent on a device running Linux:

By connecting to the managed device through SSH and running the remote installation task.
By running the package installation on the managed device.

The following methods can be used for the initial installation of Network Agent on a device running macOS:

By running the remote installation task on the macOS distribution point.
By sending device users links to stand-alone packages generated by Kaspersky Security Center. Stand-alone packages are executable modules that contain the distribution packages of selected applications, with pre-defined settings.

When selecting a method and a strategy for deployment of applications on a managed network, you must consider a number of factors (partial list):

Organization's network configuration.
Total number of devices.
Presence of devices on the organization's network, which are not members of any Active Directory domain, and the presence of uniform accounts with administrator rights on those devices.
Capacity of the channel between the Administration Server and devices.
Type of communication between Administration Server, and remote subnets and the capacity of the network channels in those subnets.
Security settings applied on remote devices at the start of deployment (such as use of UAC and Simple File Sharing mode).

In this section

Configuring installers

Installation packages

MSI properties and transform files

Deployment with third-party tools for remote installation of applications

About remote installation tasks in Kaspersky Security Center

Deployment by capturing and copying the image of a device

Incorrect copying of a hard drive image

Deployment using group policies of Microsoft Windows

Forced deployment through the remote installation task of Kaspersky Security Center

Running stand-alone packages created by Kaspersky Security Center

Options for manual installation of applications

Creating an MST file

Page top

[Topic 92446]

Configuring installers

This method of defining the settings is inappropriate for silent installation of applications on groups of devices. In general, the administrator must specify values for settings in centralized mode; those values can subsequently be used for silent installation on selected networked devices.

Page top

[Topic 92447]

Installation packages

The first and main method of defining the installation settings of applications is all-purpose and thus suitable for all installation methods, both with Kaspersky Security Center tools, and with most third-party tools. This method consists of creating installation packages of applications in Kaspersky Security Center.

Installation packages are generated using the following methods:

Automatically, from specified distribution packages, on the basis of included descriptors (files with the kud extension that contain rules for installation and results analysis, and other information)
From the executable files of installers or from installers in native format (.msi, .deb, .rpm), for standard or supported applications

Generated installation packages are organized hierarchically as folders with subfolders and files. In addition to the original distribution package, an installation package contains editable settings (including the installer's settings and rules for processing such cases as necessity of restarting the operating system in order to complete installation), as well as minor auxiliary modules.

Values of installation settings that would be specific for an individual supported application can be defined in the user interface of Administration Console when the installation package is created. When performing remote installation of applications through Kaspersky Security Center tools, installation packages are delivered to devices so that running the installer of an application makes all administrator-defined settings available for that application. When using third-party tools for installation of Kaspersky applications, you only have to ensure the availability of the entire installation package on the device, that is, the availability of the distribution package and its settings. Installation packages are created and stored by Kaspersky Security Center in a dedicated subfolder of the shared folder.

Do not specify any details of privileged accounts in the parameters of installation packages.

For the instruction about using this configuration method for Kaspersky applications before deployment through third-party tools, see section "Deployment using group policies of Microsoft Windows".

Immediately after Kaspersky Security Center installation, a few installation packages are automatically generated; they are ready for installation and include Network Agent packages and security application packages for Microsoft Windows.

Although the license key for an application can be set in the properties of an installation package, it is advisable to avoid this method of license distribution because there it is easy to obtain read access to installation packages. You should use automatically distributed license keys or installation tasks for license keys.

Page top

[Topic 92448]

MSI properties and transform files

Another way of configuring installation on Windows platform is to define MSI properties and transform files. This method can be applied in the following cases:

When installing through Windows group policies, by using regular Microsoft tools or other third-party tools for handling Windows group policies.
When installing applications by using third-party tools intended for handling installers in Microsoft Installer format.

Page top

[Topic 92458]

Deployment with third-party tools for remote installation of applications

When any tools for remote installation of applications (such as Microsoft System Center) are available in an organization, it is convenient to perform initial deployment by using those tools.

The following actions must be performed:

Select the method for configuring installation that best suits the deployment tool to be used.
Define the mechanism for synchronization between the modification of the settings of installation packages (through the Administration Console interface) and the operation of selected third-party tools used for deployment of applications from installation package data.
When performing installation from a shared folder, you must make sure that this file resource has sufficient capacity.

See also:

Defining a shared folder

Configuring installers

Page top

[Topic 92459]

About remote installation tasks in Kaspersky Security Center

Kaspersky Security Center provides various mechanisms for remote installation of applications, which are implemented as remote installation tasks (forced installation, installation by copying a hard drive image, installation through group policies of Microsoft Windows). You can create a remote installation task both for a specified administration group and for specific devices or a selection of devices (such tasks are displayed in Administration Console, in the Tasks folder). When creating a task, you can select installation packages (those of Network Agent and / or another application) to be installed within this task, as well as specify certain settings that define the method of remote installation. In addition, you can use the Remote installation wizard, which is based on creation of a remote installation task and results monitoring.

Tasks for administration groups affect both devices included in a specified group and all devices in all subgroups within that administration group. A task covers devices of secondary Administration Servers included in a group or any of its subgroups if the corresponding setting is enabled in the task.

Tasks for specific devices refresh the list of client devices at each run in accordance with the selection contents at the moment the task starts. If a selection includes devices that have been connected to secondary Administration Servers, the task will run on those devices, too. For details on those settings and installation methods see below in this section.

To ensure a successful operation of a remote installation task on devices connected to secondary Administration Servers, you must use the relaying task to relay installation packages used by your task to corresponding secondary Administration Servers in advance.

Page top

[Topic 92460]

Deployment by capturing and copying the image of a device

If you need to install Network Agent on devices on which an operating system and other software also must be installed (or reinstalled), you can use the mechanism of capturing and copying the image of that device.

To perform deployment by capturing and copying a hard drive:

Create a reference device with an operating system and the relevant software installed, including Network Agent and a security application.
Capture the reference image on the device and distribute that image on new devices through the dedicated task of Kaspersky Security Center.
To capture and install disk images, you can use either third-party tools available in the organization, or the feature provided (under the Vulnerability and patch management license) by Kaspersky Security Center.

If you use any third-party tools to process disk images, you must delete the information that Kaspersky Security Center uses to identify the managed device, when performing deployment on a device from a reference image. Otherwise, Administration Server will not be able to properly distinguish devices that have been created by copying the same image.

When capturing a disk image with Kaspersky Security Center tools, this issue is solved automatically.

Copying a disk image with third-party tools

When applying third-party tools for capturing the image of a device with Network Agent installed, use one of the following methods:

Recommended method. When installing Network Agent on a reference device, capture the device image before the first run of Network Agent service (because unique information identifying the device is created at the first connection of Network Agent to the Administration Server). After that, it is recommended that you avoid running Network Agent service until the completion of the image capturing operation.
On the reference device, stop the Network Agent service and run the klmover utility with the -dupfix key. The utility klmover is included in the installation package of Network Agent. Avoid any subsequent runs of Network Agent service until the image capturing operation completes.
Make sure that klmover will be run with the -dupfix key before (mandatory requirement) the first run of the Network Agent service on target devices, at the first launch of the operating system after the image deployment. The utility klmover is included in the installation package of Network Agent.
Use the Network Agent disk cloning mode.

If the hard drive image has been copied incorrectly, you can resolve this problem.

You can also capture the image of a device without Network Agent installed. To do this, perform image deployment on target devices and then deploy Network Agent. If using this method, provide access to the network folder with stand-alone installation packages from a device.

See also:

Network Agent disk cloning mode

Page top

[Topic 92573]

Incorrect copying of a hard drive image

If a hard drive image with Network Agent installed has been copied without following the rules of deployment, some devices may be displayed together in Administration Console under a single icon with a name that changes constantly.

You can resolve this issue using one of the following methods:

Removing Network Agent
This method is the most reliable. You must remove Network Agent on devices that have been incorrectly copied from the image, using third-party tools, and then install it again. Network Agent cannot be removed through Kaspersky Security Center tools, because Administration Server cannot distinguish between faulty devices (they all share the same icon in Administration Console).
Running the klmover utility with the "-dupfix" key
Use third-party tools to run the klmover utility, located in the Network Agent installation folder, with the "-dupfix" key (klmover -dupfix) once on faulty devices (those incorrectly copied from the image). You cannot run the utility with Kaspersky Security Center tools, because Administration Server cannot distinguish between faulty devices (they all share the same icon in Administration Console).

Then delete the icon on which the faulty devices had been displayed before you run the utility.
Toughening up the rule for detection of incorrectly copied devices.
This method is only applicable if Administration Server and Network Agents version 10 Service Pack 1 or later are installed.

The rule for detection of incorrectly copied Network Agents must be toughened so that changing the NetBIOS name of a device results in an automatic "fix" of those Network Agents (with the assumption that all of the copied devices have unique NetBIOS names).

On the device with Administration Server, you must import the reg file shown below to the Registry and then restart the Administration Server service.
- If a 32-bit operating system is installed on the device with Administration Server:
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\1093\1.0.0.0\ServerFlags]

"KLSRV_CheckClones"=dword:00000003
- If a 64-bit operating system is installed on the device with Administration Server:
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\1093\1.0.0.0\ServerFlags]

"KLSRV_CheckClones"=dword:00000003

Page top

[Topic 92461]

Deployment using group policies of Microsoft Windows

It is recommended that you perform the initial deployment of Network Agents through Microsoft Windows group policies if the following conditions are met:

This device is member of an Active Directory domain.
The deployment scheme allows you to wait for the next routine restart of target devices before starting deployment of Network Agents on them (or you can force a Windows group policy to be applied to those devices).

This deployment scheme consists of the following:

The application distribution package in Microsoft Installer format (MSI package) is located in a shared folder (a folder where the LocalSystem accounts of target devices have read permissions).
In the Active Directory group policy, an installation object is created for the distribution package.
The installation scope is set by specifying the organizational unit (OU) and / or the security group, which includes the target devices.
The next time a target device logs in to the domain (before device users log in to the system), all installed applications are checked for the presence of the required application. If the application is not found, the distribution package is downloaded from the resource specified in the policy and is then installed.

An advantage of this deployment scheme is that assigned applications are installed on target devices while the operating system is loading, that is, even before the user logs in to the system. Even if a user with sufficient rights removes the application, it will be reinstalled at the next launch of the operating system. This deployment scheme's shortcoming is that changes made by the administrator to the group policy will not take effect until the devices are restarted (if no additional tools are involved).

You can use group policies to install both Network Agent and other applications if their respective installers are in Windows Installer format.

When this deployment scheme is selected, you must also assess the load on the file resource from which files will be copied to devices after applying the Windows group policy.

Handling Microsoft Windows policies through the remote installation task of Kaspersky Security Center

The simplest way to install applications through group policies of Microsoft Windows is to select the Assign package installation in Active Directory group policies option in the properties of the remote installation task of Kaspersky Security Center. In this case, Administration Server automatically performs the following actions when you run the task:

Creates required objects in the group policy of Microsoft Windows.
Creates dedicated security groups, includes the target devices in those groups, and assigns installation of selected applications for them. The set of security groups will be updated at every task run, in accordance with the pool of devices at the moment of the run.

To make this feature operable, in the task properties, specify an account that has write permissions in Active Directory group policies.

If you intend to install both Network Agent and another application through the same task, selecting the Assign package installation in Active Directory group policies option causes the application to create an installation object in the Active Directory policy for Network Agent only. The second application selected in the task will be installed through the tools of Network Agent as soon as the latter is installed on the device. If you want to install an application other than Network Agent through Windows group policies, you must create an installation task for this installation package only (without the Network Agent package). Not every application can be installed using Microsoft Windows group policies. To find out about this capability, you can refer to information about the possible methods for installing the application.

If required objects are created in the group policy by using Kaspersky Security Center tools, the shared folder of Kaspersky Security Center will be used as the source of the installation package. When planning the deployment, you must correlate the reading speed for this folder with the number of devices and the size of the distribution package to be installed. It may be useful to locate the shared folder of Kaspersky Security Center in a high-performance dedicated file repository.

In addition to its ease of use, automatic creation of Windows group policies through Kaspersky Security Center has this advantage: when planning Network Agent installation, you can easily specify the Kaspersky Security Center administration group into which devices will be automatically moved after installation completes. You can specify this group in the New task wizard or in the settings window of the remote installation task.

When handling Windows group policies through Kaspersky Security Center, you can specify devices for a group policy object by creating a security group. Kaspersky Security Center synchronizes the contents of the security group with the current set of devices in the task. When using other tools for handling group policies, you can associate objects of group policies with selected OUs of Active Directory directly.

Unassisted installation of applications through policies of Microsoft Windows

The administrator can create objects required for installation in a Windows group policy on his or her own behalf. In this case, he or she can provide links to packages stored in the shared folder of Kaspersky Security Center, or upload those packages to a dedicated file server and then provide links to them.

The following installation scenarios are possible:

The administrator creates an installation package and sets up its properties in Administration Console. The group policy object provides a link to the MSI file of this package stored in the shared folder of Kaspersky Security Center.
The administrator creates an installation package and sets up its properties in Administration Console. Then the administrator copies the entire EXEC subfolder of this package from the shared folder of Kaspersky Security Center to a folder on a dedicated file resource of the organization. The group policy object provides a link to the MSI file of this package stored in a subfolder on the dedicated file resource of the organization.
The administrator downloads the application distribution package (including that of Network Agent) from the internet and uploads it to the dedicated file resource of the organization. The group policy object provides a link to the MSI file of this package stored in a subfolder on the dedicated file resource of the organization. The installation settings are defined by configuring the MSI properties or by configuring MST transform files.

Creating an MST file

Page top

[Topic 92462]

Forced deployment through the remote installation task of Kaspersky Security Center

To perform the initial deployment of Network Agent or other applications, you can force installation of selected installation packages by using the remote installation task of Kaspersky Security Center—provided that each device has a user account(s) with local administrator rights.

Forced installation can also be applied if devices cannot be directly accessed by Administration Server: for example, devices are on isolated networks, or they are on a local network while the Administration Server item is in DMZ.

In case of initial deployment, Network Agent is not installed. Therefore, in the settings of the remote installation task, you cannot select distribution of files required for application installation by using Network Agent. You can only choose to distribute files by using operating system resources through Administration Server or distribution points.

The Administration Server service must run under an account that has administrative privileges on the target devices. Alternatively, you can specify an account that has access to the admin$ share in the settings of the remote installation task.

By default, the remote installation task connects to devices by using the credentials of the account under which the Administration Server is running. It is important to clarify that this is the account used for accessing the admin$ share, rather than the account under which the remote installation task runs. Installation is carried out under the LocalSystem account.

You can specify target devices either explicitly (with a list), by selecting the Kaspersky Security Center administration group to which they belong; or by creating a selection of devices based upon a specific criterion. The installation start time is defined by the task schedule. If the Run missed tasks setting is enabled in the task properties, the task can be run either immediately after target devices are turned on or when they are moved to the target administration group.

Forced installation consists of delivering installation packages to target devices, subsequent copying of files to the admin$ resource on each of the target devices, and remote registration of supporting services on those devices. Delivery of installation packages to target devices is performed through a Kaspersky Security Center feature that ensures network interaction. The following conditions must be met in this case:

Target devices are accessible from the Administration Server side or from the distribution point side.
Name resolution for target devices functions properly on the network.
The administrative shares (admin$) remain enabled on target devices.
The following system services are running on target devices:
- Server (LanmanServer)
  By default, this service is running.
- DCOM Server Process Launcher (DcomLaunch)
- RPC Endpoint Mapper (RpcEptMapper)
- Remote Procedure Call (RpcSs)
Port TCP 445 is open on target devices to enable remote access through Windows tools.
TCP 139, UDP 137, and UDP 138 are used by older protocols and are no longer necessary for current applications.

Dynamic outbound access ports must be allowed on the firewall for connections from the Administration Server and distribution points to target devices.
The Active Directory domain policy security settings are allowed to provide the operation of the NTLM protocol during the deployment of Network Agent.
On target devices running Microsoft Windows XP, Simple File Sharing mode is disabled.
On target devices, the access sharing and security model are set as Classic – local users authenticate as themselves. It can in no way be Guest only – local users authenticate as Guest.
Target devices are members of the domain, or uniform accounts with administrator rights are created on target devices in advance.

To successfully deploy Network Agent or other applications to a device that is not joined to a Windows Server 2003 or later Active Directory domain, you must disable remote UAC on that device. Remote UAC is one of the reasons that prevent local administrative accounts from accessing admin$, which is necessary for forced deployment of Network Agent or other applications. Disabling remote UAC does not affect local UAC.

During installation on new devices that have not yet been allocated to any of the Kaspersky Security Center administration groups, you can open the remote installation task properties and specify the administration group to which devices will be moved after Network Agent installation.

When creating a group task, keep in mind that each group task affects all devices in all nested groups within a selected group. Therefore, you must avoid duplicating installation tasks in subgroups.

A simplified way to create tasks for forced installation of applications is automatic installation. To do this, you must open the administration group properties, open the list of installation packages, and then select the ones that must be installed on devices in this group. As a result, the selected installation packages will be automatically installed on all devices in this group and all of its subgroups. The time interval over which the packages will be installed depends on the network throughput and the total number of networked devices.

To reduce the load on Administration Server during the delivery of installation packages to target devices, you can select installation via distribution points in the installation task. Note that this installation method places a significant load on devices acting as distribution points. Therefore, it is recommended that you select devices that meet the requirements for distribution points. If you use distribution points, you have to make sure that they are present in each of the isolated subnets hosting target devices.

Using distribution points as local installation centers may also be useful when performing installation on devices in subnets communicated with Administration Server via a low-capacity channel while a broader channel is available between devices in the same subnet.

The free disk space in the partition with the %ALLUSERSPROFILE%\Application Data\KasperskyLab\adminkit folder must exceed, by many times, the total size of the distribution packages of installed applications.

Page top

[Topic 92463]

Running stand-alone packages created by Kaspersky Security Center

You can use Kaspersky Security Center to send selected users an email message containing a link to this file in the shared folder, prompting them to run the file (either in interactive mode, or with the key "-s" for silent installation). You can attach the stand-alone installation package to an email message and then send it to the users of devices that have no access to the shared folder of Kaspersky Security Center. The administrator can also copy the stand-alone package to a removable drive, deliver it to a relevant device, and then run it later.

You can create a stand-alone package from a Network Agent package, a package of another application (for example, the security application), or both. If the stand-alone package has been created from Network Agent and another application, installation starts with Network Agent.

When creating a stand-alone package with Network Agent, you can specify the administration group to which new devices (those that have not been allocated to any of the administration groups) will be automatically moved when Network Agent installation completes on them.

Stand-alone packages can run in interactive mode (by default), displaying the result for installation of applications they contain, or they can run in silent mode (when run with the key "-s"). Silent mode can be used for installation from scripts, for example, from scripts configured to run after an operating system image is deployed. The result of installation in silent mode is determined by the return code of the process.

Page top

[Topic 92464]

Options for manual installation of applications

Administrators or experienced users can install applications manually in interactive mode. They can use either original distribution packages or installation packages generated from them and stored in the shared folder of Kaspersky Security Center. By default, installers run in interactive mode and prompt users for all required values. However, when running the process setup.exe from the root of an installation package with the key "-s", the installer will be running in silent mode and with the settings that have been defined when configuring the installation package.

When running setup.exe from the root of an installation package stored in the shared folder of Kaspersky Security Center, the package will first be copied to a temporary local folder, and then the application installer will be run from the local folder.

Page top

[Topic 273674]

Creating an MST file

To transform the content of an MSI package and apply custom settings to an existing MSI file, you have to create a transformation file in the MST format. To do this, use the Orca.exe editor that is included in the Windows SDK.

To create an MST file:

Run the Orca.exe editor.
Go to the File tab, and in the menu, click Open.
Select the Kaspersky Network Agent.msi file.
Go to the Transformation tab, and in the menu, select New transformation.
In the Tables column, select Property and write the following values:
- EULA=1
- SERVERADDRESS=<Administration Server address>
Click the Save button.
Go to the Transform tab, and in the menu, select Generate Transform.
In the window that opens, specify a name for the transformation file you create, and then click the Save button.

The MST file is saved.

Page top

[Topic 92465]

Remote installation of applications on devices with Network Agent installed

If an operable Network Agent connected to the primary Administration Server (or to any of its secondary Servers) is installed on a device, you can upgrade Network Agent on this device, as well as install, upgrade, or remove any supported applications through Network Agent.

You can enable the Using Network Agent option in the properties of the remote installation task.

If this option is selected, installation packages with installation settings defined by the administrator will be transferred to target devices over communication channels between Network Agent and the Administration Server.

To optimize the load on the Administration Server and minimize traffic between the Administration Server and the devices, it is useful to assign distribution points on every remote network or in every broadcasting domain (see sections "About distribution points" and "Building a structure of administration groups and assigning distribution points"). In this case, installation packages and the installer settings are distributed from the Administration Server to target devices through distribution points.

Moreover, you can use distribution points for broadcasting (multicast) delivery of installation packages, which allows reducing network traffic significantly when deploying applications.

When transferring installation packages to target devices over communication channels between Network Agents and the Administration Server, all installation packages that have been prepared for transfer will also be cached in the %ALLUSERSPROFILE%\Application Data\KasperskyLab\adminkit\1093\.working\FTServer folder. When using multiple large installation packages of various types and involving a large number of distribution points, the size of this folder may increase dramatically.

Files cannot be deleted from the FTServer folder manually. When original installation packages are deleted, the corresponding data will be automatically deleted from the FTServer folder.

The data received by distribution points is saved in the folder %ALLUSERSPROFILE%\Application Data\KasperskyLab\adminkit\1103\$FTClTmp.

Files cannot be deleted from the $FTClTmp folder manually. As tasks using data from this folder complete, the contents of this folder will be deleted automatically.

Because installation packages are distributed over communication channels between Administration Server and Network Agents from an intermediate repository in a format optimized for network transfers, no changes are allowed in installation packages stored in the original folder of each installation package. Those changes will not be automatically registered by Administration Server. If you need to modify the files of installation packages manually (although you are recommended to avoid this scenario), you must edit any of the settings of an installation package in Administration Console. Editing the settings of an installation package in Administration Console causes Administration Server to update the package image in the cache that has been prepared for transfer to target devices.

Page top

[Topic 92466]

Managing device restarts in the remote installation task

Devices often need a restart to complete the remote installation of applications (particularly on Windows).

If you use the remote installation task of Kaspersky Security Center, in the New task wizard or in the properties window of the task that has been created (Operating system restart section), you can select the action to perform when the Windows device requires a restart:

Do not restart the device. In this case, no automatic restart will be performed. To complete the installation, you must restart the device (for example, manually or through the device management task). Information about the required restart will be saved in the task results and in the device status. This option is suitable for installation tasks on servers and other devices where continuous operation is critical.
Restart the device. In this case, the device is always restarted automatically if a restart is required for completion of the installation. This option is useful for installation tasks on devices that provide for regular pauses in their operation (shutdown or restart).
Prompt user for action. In this case, the restart reminder is displayed on the screen of the client device, prompting the user to restart it manually. Some advanced settings can be defined for this option: text of the message for the user, the message display frequency, and the time interval after which a restart will be forced (without the user's confirmation). The Prompt user for action is the most suitable for workstations where users need a possibility of selecting the most convenient time for a restart.

Page top

[Topic 92467]

Suitability of databases updating in an installation package of a security application

Page top

[Topic 92470]

Using tools for remote installation of applications in Kaspersky Security Center for running relevant executable files on managed devices

Using the New package wizard, you can select any executable file and define the settings of the command line for it. For this you can add to the installation package either the selected file itself or the entire folder in which this file is stored. Then you must create the remote installation task and select the installation package that has been created.

While the task is running, the specified executable file with the defined settings of the command prompt will be run on target devices.

If you use installers in Microsoft Windows Installer (MSI) format, Kaspersky Security Center analyzes the installation results by means of standard tools.

If the Vulnerability and patch management license is available, Kaspersky Security Center (when creating an installation package for any supported application in the corporate environment) also uses rules for installation and analysis of installation results that are in its updatable database.

Otherwise, the default task for executable files waits for the completion of the running process, and of all its child processes. After completion of all of the running processes, the task will be completed successfully regardless of the return code of the initial process. To change such behavior of this task, before creating the task, you have to manually modify the .kpd files that were generated by Kaspersky Security Center in the folder of the newly created installation package and its subfolders.

.kpd files use ASCII encoding. .kud files use Unicode encoding.

For the task not to wait for the completion of the running process, set the value of the Wait setting to 0 in the [SetupProcessResult] section:

Example:

[SetupProcessResult]

Wait=0

For the task to wait only for the completion of the running process on Windows, not for the completion of all child processes, set the value of the WaitJob setting to 0 in the [SetupProcessResult], section, for example:

Example:

[SetupProcessResult]

WaitJob=0

For the task to complete successfully or return an error depending on the return code of the running process, create an executable .bat file that saves the error code to a file, for example:

Example:

echo [ResponseResult] > setup.log

echo ResultCode=2 >> setup.log

exit 0

And then modify the .kud files that were generated by Kaspersky Security Center in the folder of the newly created installation package:

Example:

[SetupMainResult]

File=setup.log

Section=ResponseResult

Value=ResultCode

[SetupMainResult_SuccessCodes]

0=Installation completed successfully.

[SetupMainResult_ErrorCodes]

1=Installation script error

2=Custom error

In this case, any code other than those listed will result in an error returned.

To display a string with a comment on the successful completion of the task or an error in the task results, enter brief descriptions of errors corresponding to return codes of the process in the [SetupProcessResult_SuccessCodes] and [SetupProcessResult_ErrorCodes] sections, for example:

Example:

[SetupProcessResult_SuccessCodes]

0= Installation completed successfully

3010=A restart is required to complete the installation

[SetupProcessResult_ErrorCodes]

1602=Installation canceled by the user

1603=Fatal error during installation

To use Kaspersky Security Center tools for managing the device restart (if a restart is required to complete an operation), list the return codes of the process that indicate that a restart must be performed, in the [SetupProcessResult_NeedReboot] section:

Example:

[SetupProcessResult_NeedReboot]

3010=

Page top

[Topic 92471]

Monitoring the deployment

To monitor the Kaspersky Security Center deployment and make sure that a security application and Network Agent are installed on managed devices, you have to check the traffic light in the Deployment section. This traffic light is located in the workspace of the Administration Server node in the main window of Administration Console. The traffic light reflects the current deployment status. The number of devices with Network Agent and security applications installed is displayed next to the traffic light. When any installation tasks are running, you can monitor their progress here. If any installation errors occur, the number of errors is displayed here. You can view the details of any error by clicking the link.

You can also use the deployment schema in the workspace of the Managed devices folder on the Groups tab. The chart reflects the deployment process, showing the number of devices without Network Agent, with Network Agent, or with Network Agent and a security application.

For more details on the progress of the deployment (or the operation of a specific installation task) open the results window of the relevant remote installation task: Right-click the task and select Results in the context menu. The window displays two lists: the upper one contains the task statuses on devices, while the lower one contains task events on the device that is currently selected in the upper list.

Information about deployment errors are added to the Kaspersky Event Log on Administration Server. Information about errors is also available through the corresponding event selection in the Administration Server node on the Events tab.

Page top

[Topic 92472]

Configuring installers

This section provides information about the files of Kaspersky Security Center installers and the installation settings, as well as recommendations on how to install Administration Server and Network Agent in silent mode.

In this section

General information

Installation in silent mode (with a response file)

Installation of Network Agent in silent mode (without a response file)

Partial installation configuration through setup.exe

Administration Server installation parameters

Network Agent installation parameters

Page top

[Topic 92473]

General information

Installers of Kaspersky Security Center 15.1 components (Administration Server, Network Agent, and Administration Console) are built on Windows Installer technology. An MSI package is the core of an installer. This format of packaging allows using all of the advantages provided by Windows Installer: scalability, availability of a patching system, transformation system, centralized installation through third-party solutions, and transparent registration with the operating system.

Installation of Network Agent in silent mode (without a response file)

Partial installation configuration through setup.exe

Administration Server installation parameters

Network Agent installation parameters

Page top

[Topic 92474]

Installation in silent mode (with a response file)

The installers of Administration Server and Network Agent have the feature of working with the response file (ss_install.xml), where the parameters for installation in silent mode without user participation are integrated. The ss_install.xml file is located in the same folder as the MSI package; it is used automatically during installation in silent mode. You can enable the silent installation mode with the command line key "/s".

An overview of an example run follows:

setup.exe /s

Before you start the installer in silent mode, read the End User License Agreement (EULA). If the Kaspersky Security Center distribution kit does not include a TXT file with the text of the EULA, you can download the file from the Kaspersky website.

The ss_install.xml file is an instance of the internal format of parameters of the Kaspersky Security Center installer. Distribution packages contain the ss_install.xml file with the default parameters.

Please do not modify the ss_install.xml file manually. This file can be modified through the tools of Kaspersky Security Center, when editing the parameters of the installation packages in Administration Console.

To modify the response file for Administration Server installation:

Open the Kaspersky Security Center distribution package. If you use a full package EXE file, unpack it.
From the Server folder, open the command line, and then run the following command:

setup.exe /r ss_install.xml

The Kaspersky Security Center installer starts.
Follow the wizard's steps to configure the Kaspersky Security Center installation.

When you complete the wizard, the response file is automatically modified according to the new settings that you specified.

See also:

General information

Installation of Network Agent in silent mode (without a response file)

Partial installation configuration through setup.exe

Administration Server installation parameters

Network Agent installation parameters

Main installation scenario

Page top

[Topic 92475]

Installation of Network Agent in silent mode (without a response file)

You can install Network Agent with a single .msi package, specifying the values of MSI properties in the standard way. This scenario allows Network Agent to be installed by using group policies.

Do not rename the installation package Kaspersky Network Agent.msi. Renaming this package may cause installation errors during future updates of Network Agent.

To avoid conflicts between parameters defined through MSI properties and parameters defined in the response file, you can disable the response file by setting the property DONT_USE_ANSWER_FILE=1. The MSI file is located in the Kaspersky Security Center distribution package, in the Packages\NetAgent\exec folder. An example of a run of the Network Agent installer with an .msi package is as follows.

Installation of Network Agent in silent mode requires acceptance of the terms of the End User License Agreement. Use the EULA=1 parameter only if you have fully read, understand and accept the terms of the End User License Agreement.

Example:

msiexec /i "Kaspersky Network Agent.msi" /qn DONT_USE_ANSWER_FILE=1 SERVERADDRESS=kscserver.mycompany.com EULA=1

You can also define the installation parameters for an .msi package by preparing the response file in advance (one with an .mst extension). This command appears as follows:

Example:

msiexec /i "Kaspersky Network Agent.msi" /qn TRANSFORMS=test.mst;test2.mst

You can specify several response files in a single command.

See also:

Installing Network Agent in silent mode

Network Agent installation parameters

Ports used by Kaspersky Security Center

General information

Installation in silent mode (with a response file)

Partial installation configuration through setup.exe

Administration Server installation parameters

Main installation scenario

Page top

[Topic 92476]

Partial installation configuration through setup.exe

When running installation of applications through setup.exe, you can add the values of any properties of MSI to the MSI package.

This command appears as follows:

Example:

/v"PROPERTY_NAME1=PROPERTY_VALUE1 PROPERTYNAME2=PROPERTYVALUE2"

See also:

General information

Installation in silent mode (with a response file)

Installation of Network Agent in silent mode (without a response file)

Administration Server installation parameters

Network Agent installation parameters

Page top

[Topic 92477]

Administration Server installation parameters

The table below describes the MSI properties that you can configure when installing Administration Server. All of the parameters are optional, except for EULA and PRIVACYPOLICY.

Parameters of Administration Server installation in silent mode

MSI property	Description	Available values
EULA	Acceptance of the terms of the License Agreement (required)	1—I have fully read, understand and accept the terms of the End User License Agreement. Other value or no value—I do not accept the terms of the License Agreement (installation is not performed).
PRIVACYPOLICY	Acceptance of the terms of the Privacy Policy (required)	1—I am aware and agree that my data will be handled and transmitted (including to third countries) as described in the Privacy Policy. I confirm that I have fully read and understand the Privacy Policy. Other value or no value—I do not accept the terms of the Privacy Policy (installation is not performed).
INSTALLATIONMODETYPE	Type of Administration Server installation	Standard. Custom.
INSTALLDIR	Application installation folder	String value.
ADDLOCAL	List of components to install (separated by commas)	CSAdminKitServer, NAgent, CSAdminKitConsole, NSAC, MobileSupport, KSNProxy, SNMPAgent, GdiPlusRedist, Microsoft_VC90_CRT_x86, Microsoft_VC100_CRT_x86. Minimum list of components sufficient for proper Administration Server installation: `ADDLOCAL=CSAdminKitServer, CSAdminKitConsole, KSNProxy, Microsoft_VC90_CRT_x86, Microsoft_VC100_CRT_x86`
NETRANGETYPE	Network size	NRT_1_100—From 1 to 100 devices. NRT_100_1000—From 101 to 1000 devices. NRT_GREATER_1000—More than 1000 devices.
SRV_ACCOUNT_TYPE	Way of specifying the user for the operation of the Administration Server service	SrvAccountDefault—The user account will be created automatically. SrvAccountUser—The user account is defined manually.
SERVERACCOUNTNAME	User name for the service	String value.
SERVERACCOUNTPWD	User password for the service	String value.
DBTYPE	Database type	MySQL—A MySQL or MariaDB database will be used. MSSQL—A Microsoft SQL Server (SQL Express) database will be used.
MYSQLSERVERNAME	Full name of MySQL or MariaDB server	String value.
MYSQLSERVERPORT	Number of port for connection to MySQL or MariaDB server	Numerical value.
MYSQLDBNAME	Name of MySQL or MariaDB server database	String value.
MYSQLACCOUNTNAME	User name for connection to MySQL or MariaDB server database	String value.
MYSQLACCOUNTPWD	User password for connection to MySQL or MariaDB server database	String value.
MSSQLCONNECTIONTYPE	Type of use of MSSQL database	InstallMSSEE—Install from a package. ChooseExisting—Use the installed server.
MSSQLSERVERNAME	Full name of SQL Server instance	String value.
MSSQLDBNAME	Name of SQL Server database	String value.
MSSQLAUTHTYPE	Method of authentication for connection to SQL Server	Windows. SQLServer.
MSSQLACCOUNTNAME	User name for connection to SQL Server in SQLServer mode	String value.
MSSQLACCOUNTPWD	User password for connection to SQL Server in SQLServer mode	String value.
CREATE_SHARE_TYPE	Method of specifying the shared folder	Create—Create a new shared folder. In this case, the following properties must be defined: SHARELOCALPATH—Path to a local folder. SHAREFOLDERNAME—Network name of a folder. Null—EXISTSHAREFOLDERNAME property must be specified.
EXISTSHAREFOLDERNAME	Full path to an existing shared folder	String value.
SERVERPORT	Port number to connect to Administration Server	Numerical value.
SERVERSSLPORT	Number of port for establishing SSL connection to Administration Server	Numerical value.
SERVERADDRESS	Administration Server address	String value.
SERVERCERT2048BITS	Size of the key for the Administration Server certificate (bits)	1—The size of the key for the Administration Server certificate is 2048 bit. 0—The size of the key for the Administration Server certificate is 1024 bit. If no value is specified, the size of the key for the Administration Server certificate is 2048 bit.
MOBILESERVERADDRESS	Address of the Administration Server for connection of mobile devices; ignored if the MobileSupport component has not been selected	String value.

See also:

General information

Installation in silent mode (with a response file)

Installation of Network Agent in silent mode (without a response file)

Network Agent installation parameters

Installing Network Agent in silent mode

Partial installation configuration through setup.exe

Page top

[Topic 92478]

Network Agent installation parameters

The table below describes the MSI properties that you can configure when installing Network Agent. All of the parameters are optional, except for EULA and SERVERADDRESS.

Parameters of Network Agent installation in silent mode

MSI property	Description	Available values
EULA	Acceptance of the terms of the License Agreement	1—I confirm that I have fully read, understand, and accept the terms and conditions of this End User License Agreement. 0—I do not accept the terms of the License Agreement (installation is not performed). No value—I do not accept the terms of the License Agreement (installation is not performed).
DONT_USE_ANSWER_FILE	Read installation settings from response file	1—Do not use. Other value or no value—Read.
INSTALLDIR	Path to the Network Agent installation folder	String value.
SERVERADDRESS	Administration Server address (required)	String value.
SERVERPORT	Number of port for connection to Administration Server	Numerical value.
SERVERSSLPORT	Number of the port for encrypted connection to Administration Server by using SSL protocol	Numerical value.
USESSL	Whether to use SSL connection	1—Use. Other value or no value—Do not use.
OPENUDPPORT	Whether to open a UDP port	1—Open. Other value or no value—Do not open.
UDPPORT	UDP port number	Numerical value.
USEPROXY	Whether to use a proxy server. For compatibility purposes, it is not recommended to specify proxy connection settings in the Network Agent installation package settings.	1—Use. Other value or no value—Do not use.
PROXYLOCATION (PROXYADDRESS:PROXYPORT)	Proxy address and number of port for connection to proxy server	String value.
PROXYLOGIN	Account for connection to proxy server	String value.
PROXYPASSWORD	Password of account for connection to proxy server (Do not specify any details of privileged accounts in the parameters of installation packages.)	String value.
GATEWAYMODE	Connection gateway use mode	0—Do not use connection gateway. 1—Use this Network Agent as connection gateway. 2—Connect to the Administration Server using connection gateway.
GATEWAYADDRESS	Connection gateway address	String value.
CERTSELECTION	Method of receiving a certificate	GetOnFirstConnection—Receive a certificate from the Administration Server. GetExistent—Select an existing certificate If this option is selected, the CERTFILE property must be specified.
CERTFILE	Path to the certificate file	String value.
VMVDI	Enable dynamic mode for Virtual Desktop Infrastructure (VDI)	1—Enable. 0—Do not enable. No value—Do not enable.
VMOPTIMIZE	Whether the Network Agent settings are optimal for hypervisor	1—Enable. 0—Do not enable. No value—Do not enable.
LAUNCHPROGRAM	Whether to start the Network Agent service after installation. The parameter is ignored if VMVDI=1	1—Start. Other value or no value—Do not start.
NAGENTTAGS	Tag for Network Agent (has priority over the tag given in the response file)	String value.

See also:

General information

Installation in silent mode (with a response file)

Installing Network Agent in silent mode

Installation of Network Agent in silent mode (without a response file)

Ports used by Kaspersky Security Center

Partial installation configuration through setup.exe

Administration Server installation parameters

Page top

[Topic 92479]

Virtual infrastructure

Kaspersky Security Center supports the use of virtual machines. You can install Network Agent and the security application on each virtual machine, and you can protect virtual machines at the hypervisor level. In the first case, you can use either a standard security application or Kaspersky Security for Virtualization Light Agent to protect your virtual machines. In the second case, you can use Kaspersky Security for Virtualization Agentless.

Kaspersky Security Center supports rollbacks of virtual machines to their previous state.

In this section

Tips on reducing the load on virtual machines

Support of dynamic virtual machines

Support of virtual machines copying

See also:

Main installation scenario

Page top

[Topic 92480]

Tips on reducing the load on virtual machines

When installing Network Agent on a virtual machine, you are advised to consider disabling some Kaspersky Security Center features that seem to be of little use for virtual machines.

When installing Network Agent on a virtual machine or on a template intended for generation of virtual machines, we recommend the following actions:

If you are running a remote installation, in the properties window of the Network Agent installation package, in the Advanced section, select the Optimize settings for VDI option.
If you are running an interactive installation through a wizard, in the wizard window, select the Optimize the Network Agent settings for the virtual infrastructure option.

Selecting those options alters the settings of Network Agent so that the following features remain disabled by default (before a policy is applied):

Retrieving information about software installed
Retrieving information about hardware
Retrieving information about vulnerabilities detected
Retrieving information about updates required

Usually, those features are not necessary on virtual machines because they use uniform software and virtual hardware.

Disabling the features is invertible. If any of the disabled features is required, you can enable it through the policy of Network Agent, or through the local settings of Network Agent. The local settings of Network Agent are available through the context menu of the relevant device in Administration Console.

See also:

Main installation scenario

Page top

[Topic 92481]

Support of dynamic virtual machines

Kaspersky Security Center supports dynamic virtual machines. If a virtual infrastructure has been deployed on the organization's network, dynamic (temporary) virtual machines can be used in certain cases. The dynamic VMs are created under unique names based on a template that has been prepared by the administrator. The user works on a VM for a while and then, after being turned off, this virtual machine will be removed from the virtual infrastructure. If Kaspersky Security Center has been deployed on the organization's network, a virtual machine with installed Network Agent will be added to the Administration Server database. After you turn off a virtual machine, the corresponding entry must also be removed from the database of Administration Server.

To make functional the feature of automatic removal of entries on virtual machines, when installing Network Agent on a template for dynamic virtual machines, select the Enable dynamic mode for VDI option:

For remote installation—In the properties window of the installation package of Network Agent (Advanced section)
For interactive installation—In the Network Agent installation wizard

Avoid selecting the Enable dynamic mode for VDI option when installing Network Agent on physical devices.

If you want events from dynamic virtual machines to be stored on the Administration Server for a while after you remove those virtual machines, then, in the Administration Server properties window, in the Events repository section, select the Store events after devices are deleted option and specify the maximum storage term for events (in days).

See also:

Main installation scenario

Page top

[Topic 92482]

Support of virtual machines copying

Copying a virtual machine with installed Network Agent or creating one from a template with installed Network Agent is identical to the deployment of Network Agents by capturing and copying a hard drive image. So, in general case, when copying virtual machines, you need to perform the same actions as when deploying Network Agent by copying a disk image.

However, the two cases described below showcase Network Agent, which detects the copying automatically. Owing to the above reasons, you do not have to perform the sophisticated operations described under "Deployment by capturing and copying the hard drive of a device":

The Enable dynamic mode for VDI option was selected when Network Agent was installed—After each restart of the operating system, this virtual machine will be recognized as a new device, regardless of whether it has been copied or not.
One of the following hypervisors is in use: VMware, HyperV, or Xen: Network Agent detects the copying of the virtual machine by the changed IDs of the virtual hardware.

Analysis of changes in virtual hardware is not absolutely reliable. Before applying this method widely, you must test it on a small pool of virtual machines for the version of the hypervisor currently used in your organization.

See also:

Main installation scenario

Page top

[Topic 92483]

Support of file system rollback for devices with Network Agent

Kaspersky Security Center is a distributed application. Rolling back the file system to a previous state on a device with Network Agent installed will lead to data desynchronization and improper functioning of Kaspersky Security Center.

The file system (or a part of it) can be rolled back in the following cases:

When copying an image of the hard drive.
When restoring a state of the virtual machine by means of the virtual infrastructure.
When restoring data from a backup copy or a recovery point.

Scenarios under which third-party software on devices with Network Agent installed affects the %ALLUSERSPROFILE%\Application Data\KasperskyLab\adminkit\ folder are only critical scenarios for Kaspersky Security Center. Therefore, you must always exclude this folder from the recovery procedure, if possible.

Because the workplace rules of some organizations provide for rollbacks of the file system on devices, support for the file system rollback on devices with Network Agent installed has been added to Kaspersky Security Center, starting with version 10 Maintenance Release 1 (Administration Server and Network Agents must be of version 10 Maintenance Release 1 or later). When detected, those devices are automatically reconnected to the Administration Server with full data cleansing and full synchronization.

By default, support of file system rollback detection is enabled in Kaspersky Security Center 15.1.

As much as possible, avoid rolling back the %ALLUSERSPROFILE%\Application Data\KasperskyLab\adminkit\ folder on devices with Network Agent installed, because full resynchronization of data requires a large amount of resources.

A rollback of the system state is absolutely not allowed on a device with Administration Server installed. Nor is a rollback of the database used by Administration Server.

You can restore a state of Administration Server from a backup copy only with the standard klbackup utility.

Page top

[Topic 6391]

Local installation of applications

This section provides an installation procedure for applications that can be installed on local devices only.

To perform local installation of applications on a specific client device, you must have administrator rights on this device.

To install applications locally on a specific client device:

Install Network Agent on the client device and configure the connection between the client device and Administration Server.
Install the requisite applications on the device as described in the guides of these applications.
Install a management plug-in for each of the installed applications on the administrator's workstation.

Kaspersky Security Center also supports the option of local installation of applications using a stand-alone installation package. Kaspersky Security Center does not support installation of all Kaspersky applications.

In this section

Local installation of Network Agent

Installing Network Agent in silent mode

Installing Network Agent for Linux in silent mode (with an answer file)

Preparing a device running Astra Linux in the closed software environment mode for installation of Network Agent

Installing Network Agent for Linux in interactive mode

Local installation of the application management plug-in

Installing applications in silent mode

Installing applications by using stand-alone packages

Network Agent installation package settings

Viewing the Privacy Policy

Main installation scenario

Page top

[Topic 6392]

Local installation of Network Agent

Expand all | Collapse all

To install Network Agent on a device locally:

On the device, run the setup.exe file from the distribution package downloaded from the internet. Refer to the following topic for details: Obtaining the Network Agent installation package from the Kaspersky Security Center distribution kit.
A window opens prompting you to select Kaspersky applications to install.
In the application selection window, click the Install only Kaspersky Security Center Network Agent link to start the Network Agent setup wizard. Follow the instructions of the wizard.
1. Administration Server
  Port
  
  Specifies the non-SSL port used by the Administration Server to receive connections from Network Agents.
  
  By default, this option is set to 14000.
  
  SSL port
  
  Specifies the SSL port used by the Administration Server to receive connections from Network Agents.
  
  By default, this option is set to 13000.
  
  Use SSL to connect to Administration Server
  
  If this option is enabled, connection to the Administration Server is established through a secure port via SSL.
  
  By default, this option is enabled.
  
  Allow Network Agent to open UDP port
  
  If this option is enabled, the installer automatically opens the port used by the Administration Server to manage the client device and receive information about it.
  
  By default, this option is enabled.
  
  UDP port
  
  Allows you to configure the port used by the Administration Server to manage the client device and receive information about it.
  
  By default, this option is set to 15000.
2. Proxy server configuration
  Use proxy server
  
  If this option is enabled, you can specify the credentials for proxy server authentication.
  
  We recommend that you specify the credentials of an account that has minimum privileges required only for the proxy server authentication.
  
  By default, this option is disabled.
  
  Address
  
  Port
  
  Account
  
  User name of the account under which connection to the proxy server is established.
  
  We recommend that you specify the credentials of an account that has minimum privileges required only for the proxy server authentication.
  
  Password
  
  Password of the account under which connection to the proxy server is established.
  
  We recommend that you specify the credentials of an account that has minimum privileges required only for the proxy server authentication.
3. Connection gateway
  Do not use connection gateway
  
  Use Network Agent as a connection gateway in DMZ
  
  Select this option to use Network Agent as a connection gateway in the demilitarized zone (DMZ) to connect to Administration Server, communicate with it, and keep data on the Network Agent safe during data transmission.
  
  Connect to Administration Server by using a connection gateway
  
  Select this option and then specify the device that will act as the connection gateway.
4. Administration Server certificate
5. Agent tags
6. Advanced settings
  Automatically install applicable updates and patches for components that have the Undefined status
  
  We recommend to keep this option enabled. You can clear this option to disable automatic updating and patching for Kaspersky Security Center components. The administrator can re-enable automatic updating and patching later by using a policy.
  
  By default, this option is disabled.
  
  Enable Network Agent service protection
  
  When this option is enabled, after Network Agent is installed on a managed device, the component cannot be removed or reconfigured without required privileges. The Network Agent service cannot be stopped. This option has no effect on domain controllers.
  
  Enable this option to protect Network Agent on workstations operated with local administrator rights.
  
  By default, this option is disabled.
  
  Enable dynamic mode for VDI
  
  If this option is enabled, dynamic mode for Virtual Desktop Infrastructure (VDI) will be enabled for Network Agent installed on a virtual machine.
  
  By default, this option is disabled.
  
  Optimize the Kaspersky Security Center Network Agent settings for VDI. Disable vulnerability scan and inventory of applications and hardware. You can edit the current settings through Network Agent policies.
  
  If this option is enabled, the following features are disabled in the Network Agent settings:
  - Retrieving information about software installed
  - Retrieving information about hardware
  - Retrieving information about vulnerabilities detected
  - Retrieving information about updates required
  By default, this option is disabled.
7. Start application

When the setup wizard finishes, Network Agent will be installed on the device.

You can view the properties of the Kaspersky Security Center Network Agent service; you can also start, stop, and monitor Network Agent activity by means of standard Microsoft Windows tools: Computer Management\Services.

See also:

Support of dynamic virtual machines

Viewing the Privacy Policy

Page top

[Topic 73101]

Installing Network Agent in silent mode

Network Agent can be installed in silent mode, that is, without the interactive input of installation parameters. Silent installation uses a Windows Installer package (MSI) for Network Agent. The MSI file is located in the Kaspersky Security Center distribution package, in the Packages\NetAgent\exec folder.

Do not rename the installation package Kaspersky Network Agent.msi. Renaming this package may cause installation errors during future updates of Network Agent.

Installation of Network Agent from the MSI package is possible only in silent mode, interactive installation from the MSI package is not supported.

To install Network Agent on a local device in silent mode:

Read the End User License Agreement. Use the command below only if you understand and accept the terms of the End User License Agreement.
Run the command
msiexec /i "Kaspersky Network Agent.msi" /qn <setup_parameters>

where setup_parameters is a list of parameters and their respective values, separated by a space (PROP1=PROP1VAL PROP2=PROP2VAL).

In the list of parameters, you must include EULA=1. Otherwise Network Agent will not be installed.

If you are using the standard connection settings for Kaspersky Security Center, and Network Agent on remote devices, run the command:

msiexec /i "Kaspersky Network Agent.msi" /qn /l*vx c:\windows\temp\nag_inst.log SERVERADDRESS=kscserver.mycompany.com EULA=1

/l*vx is the key for writing logs. The log is created during the installation of Network Agent and saved at C:\windows\temp\nag_inst.log.

In addition to nag_inst.log, the application creates the $klssinstlib.log file, which contains the installation log. This file is stored in the %windir%\temp or %temp% folder. For troubleshooting purposes, you or a Kaspersky Technical Support specialist may need both log files—nag_inst.log and $klssinstlib.log.

If you need to additionally specify the port for connection to the Administration Server run the command:

msiexec /i "Kaspersky Network Agent.msi" /qn /l*vx c:\windows\temp\nag_inst.log SERVERADDRESS=kscserver.mycompany.com EULA=1 SERVERPORT=14000

The parameter SERVERPORT corresponds to the number of port for connection to Administration Server.

The names and possible values for parameters that can be used when installing Network Agent in silent mode are listed in the Network Agent installation parameters section.

See also:

Network Agent installation parameters

Administration Server installation parameters

Installation of Network Agent in silent mode (without a response file)

Viewing the Privacy Policy

Page top

[Topic 199693]

Installing Network Agent for Linux in silent mode (with an answer file)

You can install Network Agent on Linux devices by using an answer file—a text file that contains a custom set of installation parameters: variables and their respective values. Using this answer file allows you to run an installation in silent mode, that is, without user participation.

To perform installation of Network Agent for Linux in silent mode:

Prepare the relevant Linux device for remote installation. Download and create the remote installation package, by using a .deb or .rpm package of Network Agent, by means of any suitable package management system.
If you want to install Network Agent on devices with the SUSE Linux Enterprise Server 15 operating system, install the insserv-compat package first to configure Network Agent.
If you want to install Network Agent on devices that use the operating system RED OS 7.3.4 or later or MSVSPHERE 9.2 or later, install the libxcrypt-compat package for the correct function of Network Agent.
Read the End User License Agreement. Follow the steps below only if you understand and accept the terms of the End User License Agreement.
Set the value of the KLAUTOANSWERS environment variable by entering the full name of the answer file (including the path), for example, as follows:
export KLAUTOANSWERS=/tmp/nagent_install/answers.txt

Create the answer file (in TXT format) in the directory that you have specified in the environment variable. Add to the answer file a list of variables in the VARIABLE_NAME=variable_value format, each variable on a separate line.

For correct usage of the answer file, you must include in it a minimum set of the three required variables:

KLNAGENT_SERVER
KLNAGENT_AUTOINSTALL
EULA_ACCEPTED

You can also add any optional variables to use more specific parameters of your remote installation. The following table lists all of the variables that can be included in the answer file:

Variables of the answer file used as parameters of Network Agent for Linux installation in silent mode

Variable name	Required	Description	Possible values
KLNAGENT_SERVER	Yes	Contains the Administration Server name presented as fully qualified domain name (FQDN) or IP address.	DNS name or IP address.
KLNAGENT_AUTOINSTALL	Yes	Defines whether silent installation mode is enabled.	1—Silent mode is enabled; the user is not prompted for any actions during installation. Other—Silent mode is disabled; the user may be prompted for actions during installation.
EULA_ACCEPTED	Yes	Defines whether the user accepts the End User License Agreement (EULA) of Network Agent; when missing, can be interpreted as non-acceptance of the EULA.	1—I confirm that I have fully read, understand, and accept the terms and conditions of this End User License Agreement. Other or not specified—I do not accept the terms of the License Agreement (installation is not performed).
KLNAGENT_PROXY_USE	No	Defines whether connection with the Administration Server will use proxy settings. The default value is 0.	1—Proxy settings are used. Other—Proxy settings are not used.
KLNAGENT_PROXY_ADDR	No	Defines the address of the proxy server used for connection with the Administration Server.	DNS name or IP address.
KLNAGENT_PROXY_LOGIN	No	Defines the user name used for login to the proxy server.	Any existing user name.
KLNAGENT_PROXY_PASSWORD	No	Defines the user password used for login to the proxy server.	Any set of alphanumeric characters allowed by the password format in the operating system.
KLNAGENT_VM_VDI	No	Defines whether Network Agent is installed on an image for creation of dynamic virtual machines.	1—Network Agent is installed on an image, which is subsequently used for creation of dynamic virtual machines. Other—No image is used during installation.
KLNAGENT_VM_OPTIMIZE	No	Defines whether the Network Agent settings are optimal for hypervisor.	1—The default local settings of Network Agent are modified so that they allow optimized usage on hypervisor.
KLNAGENT_TAGS	No	Lists the tags assigned to the Network Agent instance.	One or multiple tag names separated with semicolon.
KLNAGENT_UDP_PORT	No	Defines the UDP port used by Network Agent. The default value is 15000.	Any existing port number.
KLNAGENT_PORT	No	Defines the non-TLS port used by Network Agent. The default value is 14000.	Any existing port number.
KLNAGENT_SSLPORT	No	Defines the TLS port used by Network Agent. The default value is 13000.	Any existing port number.
KLNAGENT_USESSL	No	Defines whether Transport Layer Security (TLS) is used for connection.	1 (default)—TLS is used. Other—TLS is not used.
KLNAGENT_GW_MODE	No	Defines whether connection gateway is used.	1 (default)—The current settings are not modified (at the first call, no connection gateway is specified). 2—No connection gateway is used. 3—Connection gateway is used. 4—The Network Agent instance is used as connection gateway in demilitarized zone (DMZ).
KLNAGENT_GW_ADDRESS	No	Defines the address of the connection gateway. The value is applicable only if KLNAGENT_GW_MODE=3.	DNS name or IP address.
KLNAGENT_DEVICEOWNER_REGISTRATION_START	No	Allows to run the user registration as a device owner utility after Network Agent installation. If turned off, then the registration as a device owner is not available to a user.	1—The user registration as a device owner utility will run after Network Agent installation. Other—Turned off.

Install Network Agent:
- To install Network Agent from an RPM package to a 32-bit operating system, execute the following command:
  # rpm -i klnagent-<build number>.i386.rpm
- To install Network Agent from an RPM package to a 64-bit operating system, execute the following command:
  # rpm -i klnagent64-<build number>.x86_64.rpm
- To install Network Agent from an RPM package on a 64-bit operating system for the Arm architecture, execute the following command:
  # rpm -i klnagent64-<build number>.aarch64.rpm
- To install Network Agent from a DEB package to a 32-bit operating system, execute the following command:
  # apt-get install ./klnagent_<build number>_i386.deb
- To install Network Agent from a DEB package to a 64-bit operating system, execute the following command:
  # apt-get install ./klnagent64_<build number>_amd64.deb
- To install Network Agent from a DEB package on a 64-bit operating system for the Arm architecture, execute the following command:
  # apt-get install ./klnagent64_<build number>_arm64.deb

Installation of Network Agent for Linux starts in silent mode; the user is not prompted for any actions during the process.

Page top

[Topic 251798]

Preparing a device running Astra Linux in the closed software environment mode for installation of Network Agent

Prior to the installation of Network Agent on a device running Astra Linux in the closed software environment mode, you must perform two preparation procedures—the one in the instructions below and general preparation steps for any Linux device.

Before you begin:

Make sure that the device on which you want to install Network Agent for Linux is running one of the supported Linux distributions.
Download the necessary Network Agent installation file from the Kaspersky website.

Run the commands provided in this instruction under an account with root privileges.

To prepare a device running Astra Linux in the closed software environment mode for installation of Network Agent:

Open the /etc/digsig/digsig_initramfs.conf file, and then specify the following setting:
DIGSIG_ELF_MODE=1
In the command line, run the following command to install the compatibility package:
apt install astra-digsig-oldkeys
Create a directory for the application key:
mkdir -p /etc/digsig/keys/legacy/kaspersky/
Place the application key /opt/kaspersky/ksc64/share/kaspersky_astra_pub_key.gpg in the directory created in the previous step:
cp kaspersky_astra_pub_key.gpg /etc/digsig/keys/legacy/kaspersky/

If the Kaspersky Security Center distribution kit does not include the kaspersky_astra_pub_key.gpg application key, you can download it by clicking the link: https://media.kaspersky.com/utilities/CorporateUtilities/kaspersky_astra_pub_key.gpg.
Update the RAM disks:
update-initramfs -u -k all

Reboot the system.
Perform the preparation steps common for any Linux device.

The device is prepared. You can now proceed to the installation of Network Agent.

Page top

[Topic 279662]

Installing Network Agent for Linux in interactive mode

This article describes how to install Network Agent on Linux devices in the interactive mode, by specifying installation parameters step by step. Alternatively, you can use an answer file—a text file that contains a custom set of installation parameters: variables and their respective values. Using this answer file allows you to run an installation in silent mode, that is, without user participation.

If you want to install Network Agent on devices that use the operating system RED OS 7.3.4 or later or MSVSPHERE 9.2 or later, install the libxcrypt-compat package for the correct function of Network Agent.

To install Network Agent in interactive mode:

Run the Network Agent installation. Depending on your Linux distribution, run one of the following commands:
- To install Network Agent from an RPM package to a 32-bit operating system:
  # yum -i klnagent-<build number>.i386.rpm
- To install Network Agent from an RPM package to a 64-bit operating system:
  # yum -i klnagent64-<build number>.x86_64.rpm
- To install Network Agent from an RPM package on a 64-bit operating system for the Arm architecture:
  # yum -i klnagent64-<build number>.aarch64.rpm
- To install Network Agent from a DEB package to a 32-bit operating system:
  # apt install ./klnagent_<build number>_i386.deb
- To install Network Agent from a DEB package to a 64-bit operating system:
  # apt install ./klnagent64_<build number>_amd64.deb
- To install Network Agent from a DEB package on a 64-bit operating system for the Arm architecture:
  # apt install ./klnagent64_<build number>_arm64.deb
Run the Network Agent configuration:
# /opt/kaspersky/klnagent64/bin/setup/postinstall.pl
Read the End User License Agreement (EULA). The text is displayed in the command line window. Press the space bar to view the next text segment. Then, when prompted, enter one the following values:
- Enter y if you understand and accept the terms of the EULA.
- Enter n if you do not accept the terms of the EULA. To use Network Agent, you must accept the terms of the EULA.
- Enter r to show the EULA again.
Enter the Administration Server DNS name or IP address.
Enter the Administration Server port number. By default, port 14000 is used.
Enter the Administration Server SSL port number. By default, port 13000 is used.
Enter y if you want to use SSL encryption for traffic between Network Agent and Administration Server. Otherwise, enter n.
Select one of the following options to configure Network Agent:
- [1]—Do not configure a connection gateway.
  Your device will not act as a connection gateway and will not connect to Administration Server through a connection gateway.
- [2]—Do not use a connection gateway.
  Your device will not connect to Administration Server through a connection gateway.
- [3]—Connect to Server by using a connection gateway.
  Your device will connect to Administration Server through a connection gateway.
- [4]—Use as a connection gateway.
  Your device will act as a connection gateway.

Network Agent is installed on a Linux device.

See also:

Support of dynamic virtual machines

Viewing the Privacy Policy

Page top

[Topic 6393]

Local installation of the application management plug-in

To install the application management plug-in:

On a device with Administration Console installed, run the klcfginst.exe executable file, which is included in the application distribution package.

The klcfginst.exe file is included in all applications that can be managed through Kaspersky Security Center. Installation is facilitated by the wizard and requires no manual configuration of settings.

Page top

[Topic 6394]

Installing applications in silent mode

To install an application in silent mode:

Open the main window of Kaspersky Security Center.
In the Remote installation folder of the console tree, in the Installation packages subfolder select the installation package of the relevant application or create a new one for that application.
The installation package will be stored on the Administration Server in the Packages service folder that is in the shared folder. A separate subfolder corresponds to each installation package.
Open the folder storing the required installation package in one of the following ways:
- By copying the folder corresponding to the relevant installation package from the Administration Server to the client device. Then open the copied folder on the client device.
- By opening from the client device the shared folder that corresponds to the requisite installation package on the Administration Server.
If the shared folder is located on a device that has Microsoft Windows Vista installed, you must set the Disabled value for the User account control: Run all administrators in Admin Approval Mode setting (Start → Control Panel → Administration → Local security policy → Security settings).
Depending on the selected application, do the following:
- For Kaspersky Anti-Virus for Windows Workstations, Kaspersky Anti-Virus for Windows Servers, and Kaspersky Security Center, navigate to the exec subfolder and run the executable file (the file with the .exe extension) with the /s key.
- For other Kaspersky applications, run the executable file (a file with the .exe extension) with the /s key from the open folder.
Running the executable file with the EULA=1 and PRIVACYPOLICY=1 keys means that you have fully read, understand and accept the terms of the End User License Agreement and the Privacy Policy, respectively. You are also aware that your data will be handled and transmitted (including to third countries) as described in the Privacy Policy. The text of the License Agreement and the Privacy Policy is included in the Kaspersky Security Center distribution kit. Accepting the terms of the License Agreement and the Privacy Policy is necessary for installing the application or upgrading a previous version of the application.

Page top

[Topic 13020]

Installing applications by using stand-alone packages

Kaspersky Security Center lets you create stand-alone installation packages for applications. A stand-alone installation package is an executable file that can be located on the Web Server, sent by email, or transferred to a client device by another method. The received file can be run locally on the client device to install an application without involving Kaspersky Security Center.

To install an application using a stand-alone installation package:

Connect to the necessary Administration Server.
In the Remote installation folder of the console tree, select the Installation packages subfolder.
In the workspace, select the installation package of the required application.
Start the process of creating a stand-alone installation package in one of the following ways:
- By selecting Create stand-alone installation package in the context menu of the installation package.
- By clicking the Create stand-alone installation package link in the workspace of the installation package.
The Stand-alone installation package creation wizard starts. Follow the instructions of the wizard.

At the final step of the wizard, select a method for transferring the stand-alone installation package to the client device.
Transfer the stand-alone installation package to the client device.
Run the stand-alone installation package on the client device.

The application is now installed on the client device with the settings specified in the stand-alone package.

When you create a stand-alone installation package, it is automatically published on Web Server. The link for downloading the stand-alone package is displayed in the list of created stand-alone installation packages. If necessary, you can cancel publication of the selected stand-alone package and republish it on the Web Server. By default, port 8060 is used for downloading stand-alone installation packages.

Page top

[Topic 154925]

Network Agent installation package settings

Expand all | Collapse all

To configure a Network Agent installation package:

In the Remote installation folder of the console tree, select the Installation packages subfolder.
The Remote installation folder is a subfolder of the Advanced folder by default.
In the context menu of the Network Agent installation package, select Properties.

The Network Agent installation package properties window opens.

General

The General section displays general information about the installation package:

Installation package name
Name and version of the application for which the installation package has been created
Installation package size
Installation package creation date
Path to the installation package folder

Settings

This section presents the settings required to ensure proper functioning of Network Agent immediately after it is installed. The settings in this section are available only on devices running Windows.

In the Destination folder group of settings, you can select the client device folder in which Network Agent will be installed.

Install in default folder
If this option is selected, Network Agent will be installed in the <Drive>:\Program Files\Kaspersky Lab\NetworkAgent folder. If this folder does not exist, it will be created automatically.

By default, this option is selected.
Install in specified folder
If this option is selected, Network Agent will be installed in the folder specified in the entry field.

In the following group of settings, you can set a password for the Network Agent remote uninstallation task:

Use uninstallation password
If this option is enabled, by clicking the Modify button you can enter the uninstall password (only available for Network Agent on devices running Windows operating systems).

By default, this option is disabled.
Status
Status of the password: Password set or Password not set.

By default, this password is not installed.
Protect Network Agent service against unauthorized removal or termination, and prevent changes to the settings
When this option is enabled, after Network Agent is installed on a managed device, the component cannot be removed or reconfigured without required privileges. The Network Agent service cannot be stopped. This option has no effect on domain controllers.

Enable this option to protect Network Agent on workstations operated with local administrator rights.

By default, this option is disabled.
Automatically install applicable updates and patches for components that have the Undefined status
If this option is enabled, all downloaded updates and patches for Administration Server, Network Agent, Administration Console, and iOS MDM Server will be installed automatically.

If this option is disabled, all downloaded updates and patches will only be installed after you change their status to Approved. Updates and patches with Undefined status will not be installed.

By default, this option is enabled.

Connection

In this section, you can configure connection of Network Agent to the Administration Server. To establish a connection, you can use the SSL or UDP protocol. For configuring the connection, specify the following settings:

Administration Server
Address of the device with Administration Server installed.
Port
Port number that is used for connection.
SSL port
Port number that is used for connection over the SSL protocol.
Use Server certificate
If this option is enabled, authentication of Network Agent access to the Administration Server will use the certificate file that you can specify by clicking the Browse button.

If this option is disabled, the certificate file will be received from the Administration Server at the first connection of Network Agent to the address specified in the Server address field.

We do not recommend to disable this option, because automatic receipt of an Administration Server certificate by Network Agent upon connection to the Administration Server is considered insecure.

By default, this check box is selected.
Use SSL
If this option is enabled, connection to the Administration Server is established through a secure port via SSL.

By default, this option is disabled. We recommend that you do not disable this option so your connection remains secured.
Use UDP port
If this option is enabled, the Network Agent is connected to Administration Server through a UDP port. This allows to manage client devices and receive information about them.

The UDP port must be open on managed devices where Network Agent is installed. Therefore, we recommend that you do not disable this option.

By default, this option is enabled.
UDP port number
In this field you can specify the port to connect Administration Server to Network Agent using UDP protocol.

The default UDP port is 15000.
Open Network Agent ports in Microsoft Windows Firewall
If this option is enabled, the ports used by Network Agent are added to the Microsoft Windows Firewall exclusion list.

By default, this option is enabled.
Use proxy server
If this option is disabled, direct connection is used to connect the device to the Administration server.

If this option is enabled, specify the proxy server parameters:
- Proxy server address
- Proxy server port
If your proxy server requires authentication, enable the Proxy server authentication option and specify the User name and Password of the account under which connection to the proxy server is established. We recommend that you specify the credentials of an account that has minimum privileges required only for the proxy server authentication.

For compatibility purposes, it is not recommended to specify proxy connection settings in the Network Agent installation package settings.

Advanced

In the Advanced section, you can configure how to use the connection gateway. For this purpose, you can do the following:

Use Network Agent as a connection gateway in the demilitarized zone (DMZ) to connect to Administration Server, communicate with it, and keep data on the Network Agent safe during data transmission.
Connect to Administration Server by using a connection gateway to reduce the number of connections to the Administration Server. In this case, enter the address of the device that will act as the connection gateway in the Connection gateway address field.
Configure the connection for Virtual Desktop Infrastructure (VDI) if your network includes virtual machines. For this purpose, do the following:
- Enable dynamic mode for VDI
  If this option is enabled, dynamic mode for Virtual Desktop Infrastructure (VDI) will be enabled for Network Agent installed on a virtual machine.
  
  By default, this option is disabled.
- Optimize settings for VDI
  If this option is enabled, the following features are disabled in the Network Agent settings:
  - Retrieving information about software installed
  - Retrieving information about hardware
  - Retrieving information about vulnerabilities detected
  - Retrieving information about updates required
  By default, this option is disabled.
Allow running the user registration utility after Network Agent installation
If this option is enabled, the user registration as a device owner utility will run after Network Agent installation. By default, this option is disabled.

Additional components

In this section you can select additional components for concurrent installation with Network Agent.

Tags

The Tags section displays a list of keywords (tags) that can be added to client devices after Network Agent installation. You can add and remove tags from the list, as well as rename them.

If the check box is selected next to a tag, this tag is automatically added to managed devices during Network Agent installation.

If the check box is cleared next to a tag, the tag will not automatically be added to managed devices during Network Agent installation. You can manually add this tag to devices.

When removing a tag from the list, it is automatically removed from all devices to which it was added.

Revision history

In this section, you can view the history of the installation package revisions. You can compare revisions, view revisions, save revisions to a file, and add and edit revision descriptions.

Network Agent installation package settings available to a specific operating system are given in the table below.

Network Agent installation package settings

Property section	Mac	Linux
General
Settings
Connection	(except for the Open Network Agent ports in Microsoft Windows Firewall and Use only automatic detection of proxy server options)	(except for the Open Network Agent ports in Microsoft Windows Firewall and Use only automatic detection of proxy server options)
Advanced
Additional components
Tags	(except for the automatic tagging rules)	(except for the automatic tagging rules)
Revision history

Page top

[Topic 204023]

Viewing the Privacy Policy

The Privacy Policy is available online at https://www.kaspersky.com/products-and-services-privacy-policy; it is also available offline. You can read the Privacy Policy, for example, before installing Network Agent.

To read the Privacy Policy offline:

Start the installer of Kaspersky Security Center.
In the installer window, proceed to the Extract installation packages link.
In the list that opens, select Kaspersky Security Center Network Agent, and then click Next.

The privacy_policy.txt file appears on your device, in the folder that you specified, in the NetAgent subfolder.

Page top

[Topic 64428]

Deploying mobile device management systems

This section describes the deployment of mobile device management systems using iOS MDM and Kaspersky Endpoint Security protocols.

In this section

Deploying a system for management using iOS MDM protocol

Adding a KES device to the list of managed devices

Connecting KES devices to the Administration Server

Integration with Public Key Infrastructure

Kaspersky Security Center Web Server

Main installation scenario

Page top

[Topic 64664]

Deploying a system for management using iOS MDM protocol

Kaspersky Security Center lets you manage mobile devices running iOS. iOS MDM devices are iOS mobile devices that are connected to an iOS MDM Server and managed by an Administration Server.

Mobile devices are connected to an iOS MDM Server through the following steps:

The administrator installs the iOS MDM Server.
The administrator gets an Apple Push Notification Service (APNs) certificate.
The APNs certificate lets Administration Server connect to the APNs server to send push notifications to iOS MDM devices.
The administrator installs the APNs certificate on the iOS MDM Server.
The administrator creates an iOS MDM profile for the user of the iOS mobile device.
The iOS MDM profile contains a collection of settings for connecting iOS mobile devices to the Administration Server.

After the iOS MDM profile is installed and the iOS MDM device is synchronized with the Administration Server, the device is displayed in the Mobile devices folder, which is a subfolder of the Mobile Device Management folder in the console tree.

In this section

Installing iOS MDM Server

Installing iOS MDM Server in silent mode

iOS MDM Server deployment scenarios

Simplified deployment scheme

Deployment scheme involving Kerberos constrained delegation (KCD)

Receiving an APNs certificate

Renewing an APNs certificate

Configuring a reserve iOS MDM Server certificate

Installing an APNs certificate on an iOS MDM Server

Configuring access to Apple Push Notification service

Issuing and installing a shared certificate on a mobile device

Page top

[Topic 64668]

Installing iOS MDM Server

To install iOS MDM Server on a local device:

Run the setup.exe executable file.
A window opens prompting you to select Kaspersky applications to install.

In the applications selection window, click the Install iOS MDM Server link to run the iOS MDM Server setup wizard.
Select a destination folder.
The default destination folder is <Disk>:\Program Files\Kaspersky Lab\Mobile Device Management for iOS. If such a folder does not exist, it is created automatically during the installation. You can change the destination folder by using the Browse button.
In the Specify the settings for connection to iOS MDM Server window of the wizard, in the External port for connection to iOS MDM service field, specify an external port for connecting mobile devices to the iOS MDM service.
External port 5223 is used by mobile devices for communication with the APNs server. Make sure that port 5223 is open in the firewall for connection with the address range 17.0.0.0/8.

Port 443 is used for connection to iOS MDM Server by default. If port 443 is already in use by another service or application, it can be replaced with, for example, port 9443.

The iOS MDM Server uses external port 2197 to send notifications to the APNs server.

APNs servers run in load-balancing mode. Mobile devices do not always connect to the same IP addresses to receive notifications. The 17.0.0.0/8 address range is reserved for Apple, and it is therefore recommended to specify this entire range as an allowed range in Firewall settings.
If you want to configure interaction ports for application components manually, select the Set up local ports manually option, and then specify values for the following settings:
- Port for connection to Network Agent. In this field, specify a port for connecting the iOS MDM service to Network Agent. The default port number is 9799.
- Local port to connect to iOS MDM service. In this field, specify a local port for connecting Network Agent to the iOS MDM service. The default port number is 9899.
It is recommended to use default values.
In the External address of Mobile Device Server window of the wizard, in the Web address for remote connection to Mobile Device Server field, specify the address of the client device on which iOS MDM Server is to be installed.
This address will be used for connecting managed mobile devices to the iOS MDM service. The client device must be available for connection of iOS MDM devices.

You can specify the address of a client device in any of the following formats:
- Device FQDN (such as mdm.example.com)
- Device NetBIOS name
Please avoid adding the URL scheme and the port number in the address string: these values will be added automatically.

When the wizard finishes, iOS MDM Server is installed on the local device. The iOS MDM Server is displayed in the Mobile Device Management folder in the console tree.

Page top

[Topic 110107]

Installing iOS MDM Server in silent mode

Kaspersky Security Center allows you to install iOS MDM Server on a local device in silent mode, that is, without the interactive input of installation settings.

To install iOS MDM Server on a local device in silent mode:

Read the End User License Agreement. Use the command below only if you understand and accept the terms of the End User License Agreement.
Run the following command:
.\exec\setup.exe /s /v"DONT_USE_ANSWER_FILE=1 EULA=1 <setup_parameters>"

where setup_parameters is a list of settings and their respective values, separated with spaces (PROP1=PROP1VAL PROP2=PROP2VAL). The setup.exe file is located in the Server folder, which is part of the Kaspersky Security Center distribution kit.

The names and possible values for parameters that can be used when installing iOS MDM Server in silent mode are listed in the table below. Parameters can be specified in any convenient order.

Parameters of iOS MDM Server installation in silent mode

Parameter name	Parameter description	Available values
EULA	Acceptance of the terms of the End User License Agreement. This parameter is mandatory.	1—I have fully read, understand and accept the terms of the End User License Agreement. Other value or no value—I do not accept the terms of the License Agreement (installation is not performed).
DONT_USE_ANSWER_FILE	Whether or not to use an XML file with iOS MDM Server installation settings. The XML file is included in the installation package or stored on the Administration Server. You do not have to specify an additional path to the file. This parameter is mandatory.	1—Do not use the XML file with parameters. Other value or no value—Use the XML file with parameters.
INSTALLDIR	The iOS MDM Server installation folder. This parameter is optional.	String value, for example, `INSTALLDIR=\"C:\install\"`
CONNECTORPORT	Local port for connecting the iOS MDM service to Network Agent. The default port number is 9799. This parameter is optional.	Numerical value.
LOCALSERVERPORT	Local port for connecting Network Agent to the iOS MDM service. The default port number is 9899. This parameter is optional.	Numerical value.
EXTERNALSERVERPORT	Port for connecting a device to iOS MDM Server. The default port number is 443. This parameter is optional.	Numerical value.
EXTERNAL_SERVER_URL	External address of the client device on which iOS MDM Server is to be installed. This address will be used for connecting managed mobile devices to the iOS MDM service. The client device must be available for connection through iOS MDM. The address must not include the URL scheme and number of the port because these values will be added automatically. This parameter is optional.	Device FQDN (such as mdm.example.com) Device NetBIOS name Device IP address
WORKFOLDER	Work folder of iOS MDM Server. If no work folder is specified, data will be written to the default folder. This parameter is optional.	String value, for example, `WORKFOLDER=\"C:\work\"`
MTNCY	Use of iOS MDM Server by multiple virtual Servers. This parameter is optional.	1—iOS MDM Server will be used by multiple virtual Administration Servers. Other value or no value—iOS MDM Server will not be used by multiple virtual Administration Servers.

Example:

\exec\setup.exe /s /v"EULA=1 DONT_USE_ANSWER_FILE=1 EXTERNALSERVERPORT=9443 EXTERNAL_SERVER_URL=\"www.test-mdm.com\""

The iOS MDM Server installation parameters are given in detail in section "Installing iOS MDM Server".

Page top

[Topic 92514]

iOS MDM Server deployment scenarios

The number of copies of iOS MDM Server to be installed can be selected either based on available hardware or on the total number of mobile devices covered.

Please keep in mind that the recommended maximum number of mobile devices for a single installation of Kaspersky Device Management for iOS is 50,000 at most. In order to reduce the load, the entire pool of devices can be distributed among several servers that have iOS MDM Server installed.

Authentication of iOS MDM devices is performed through user certificates (any profile installed on a device contains the certificate of the device owner). Thus, two deployment schemes are possible for an iOS MDM Server:

Simplified scheme
Deployment scheme involving Kerberos constrained delegation (KCD)

See also:

Installing iOS MDM Server

Installing iOS MDM Server in silent mode

Simplified deployment scheme

Deployment scheme involving Kerberos constrained delegation (KCD)

Receiving an APNs certificate

Renewing an APNs certificate

Configuring a reserve iOS MDM Server certificate

Installing an APNs certificate on an iOS MDM Server

Configuring access to Apple Push Notification service

Issuing and installing a shared certificate on a mobile device

Page top

[Topic 92515]

Simplified deployment scheme

When deploying an iOS MDM Server under the simplified scheme, mobile devices connect to the iOS MDM web service directly. In this case, user certificates issued by Administration Server can only be applied for devices authentication. Integration with Public Key Infrastructure (PKI) is impossible for user certificates.

Page top

[Topic 92516]

Deployment scheme involving Kerberos constrained delegation (KCD)

To use the deployment scheme with Kerberos constrained delegation (KCD), the following requirements must be met:

Administration Server and the iOS MDM Server are located on the internal network of the organization.
A reverse proxy with KCD support is in use.

This deployment scheme provides for the following:

Integration with the reverse proxy that supports KCD
Use of KCD for authentication of mobile devices
Integration with the PKI for applying user certificates

When using this deployment scheme, you must do the following:

In Administration Console, in the settings of the iOS MDM web service, select the Ensure compatibility with Kerberos constrained delegation check box.
As the certificate for the iOS MDM web service, specify the customized certificate that was defined when the iOS MDM web service was published on reverse proxy.
User certificates for iOS devices must be issued by the Certificate Authority (CA) of the domain. If the domain contains multiple root CAs, user certificates must be issued by the CA that was specified when the iOS MDM web service was published on the reverse proxy.
You can ensure that the user certificate is in compliance with the this CA-issuance requirement by using one of the following methods:
- Specify the user certificate in the New iOS MDM profile wizard and in the Certificate installation wizard.
- Integrate the Administration Server with the domain's PKI and define the corresponding setting in the rules for issuance of certificates:
  1. In the console tree, expand the Mobile Device Management folder and select the Certificates subfolder.
  2. In the workspace of the Certificates folder, click the Configure certificate issuance rules button to open the Certificate issuance rules window.
  3. In the Integration with PKI section, configure integration with the Public Key Infrastructure.
  4. In the Issuance of mobile certificates section, specify the source of certificates.

Below is an example of setup of Kerberos Constrained Delegation (KCD) with the following assumptions:

The iOS MDM web service is running on port 443.
The name of the device with the reverse proxy is firewall.mydom.local.
The name of device with the iOS MDM web service is iosmdm.mydom.local.
The name of external publishing of the iOS MDM web service is iosmdm.mydom.global.

Service Principal Name for http/iosmdm.mydom.local

In the domain, you have to register the service principal name (SPN) for the device with the iOS MDM web service (iosmdm.mydom.local):

setspn -a http/iosmdm.mydom.local iosmdm

Configuring the domain properties of the device with the reverse proxy (firewall.mydom.local)

To delegate traffic, trust the device with the reverse proxy (firewall.mydom.local) to the service that is defined by the SPN (http/iosmdm.mydom.local).

To trust the device with the reverse proxy to the service defined by the SPN (http/iosmdm.mydom.local), the administrator must perform the following actions:

In the Microsoft Management Console snap-in named "Active Directory Users and Computers", select the device with the reverse proxy installed (firewall.mydom.local).
In the device properties, on the Delegation tab, set the Trust this computer for delegation to specified service only toggle to Use any authentication protocol.
Add the SPN (http/iosmdm.mydom.local) to the Services to which this account can present delegated credentials list.

Special (customized) certificate for the published web service (iosmdm.mydom.global)

You have to issue a special (customized) certificate for the iOS MDM web service on the FQDN iosmdm.mydom.global and specify that it replaces the default certificate in the settings of iOS MDM web service in Administration Console.

Please note that the certificate container (file with the p12 or pfx extension) must also contain a chain of root certificates (public keys).

Publishing the iOS MDM web service on the reverse proxy

On the reverse proxy, for traffic that goes from a mobile device to port 443 of iosmdm.mydom.global, you have to configure KCD on the SPN (http/iosmdm.mydom.local), using the certificate issued for the FQDN (iosmdm.mydom.global). Please note that publishing, and the published web service must share the same server certificate.

Integration with Public Key Infrastructure

Page top

[Topic 64900]

Receiving an APNs certificate

If you already have an APNs certificate, please consider renewing it instead of creating a new one. When you replace the existing APNs certificate with a newly created one, the Administration Server loses the ability to manage the currently connected iOS mobile devices.

When the Certificate Signing Request (CSR) is created at the first step of the APNs Certificate Wizard, its private key is stored in the RAM of your device. Therefore, all the steps of the wizard must be completed within a single session of the application.

To receive an APNs certificate:

In the Mobile Device Management folder of the console tree, select the Mobile Device Servers subfolder.
In the workspace of the Mobile Device Servers folder, select an iOS MDM Server.
In the context menu of the iOS MDM Server, select Properties.
This opens the properties window of the iOS MDM Server.
In the properties window of the iOS MDM Server, select the Certificates section.
In the Certificates section, in the Apple Push Notification certificate group of settings, click the Request new button.
The Receive APNs Certificate Wizard starts and the Request new window opens.
Create a Certificate Signing Request (hereinafter referred to as CSR). To do this, perform the following actions:
1. Click the Create CSR button.
2. In the Create CSR window that opens, specify a name for your request, the names of your company and department, your city, region, and country.
3. Click the Save button and specify a name for the file to which your CSR will be saved.
The private key of the certificate is saved in the device memory.
Use your CompanyAccount to send the file with the CSR you have created to Kaspersky to be signed.
Signing of your CSR will only be available after you upload to CompanyAccount portal a key that allows using Mobile Device Management.

After your online request is processed, you will receive a CSR file signed by Kaspersky.
Send the signed CSR file to Apple Inc. website, using a random Apple ID.
We recommend that you avoid using a personal Apple ID. Create a dedicated Apple ID to make it your corporate ID. After you have created an Apple ID, link it with the organization's mailbox, not a mailbox of an employee.

After your CSR is processed in Apple Inc., you will receive the public key of the APNs certificate. Save the file on disk.
Export the APNs certificate together with the private key created when generating the CSR, in PFX file format. To do this:
1. In the Request new APNs certificate window, click the Complete CSR button.
2. In the Open window, choose a file with the public key of the certificate received from Apple Inc. as the result of CSR processing, and then click the Open button.
  The certificate export process starts.
3. In the next window, enter the private key password and click OK.
  This password will be used for the APNs certificate installation on the iOS MDM Server.
4. In the Save APNs certificate window, specify a file name for APNs certificate, choose a folder, and click Save.

The private and public keys of the certificate are combined, and the APNs certificate is saved in PFX format. After this, you can install the APNs certificate on the iOS MDM Server.

See also:

Renewing an APNs certificate

Page top

[Topic 159855]

Renewing an APNs certificate

To renew an APNs certificate:

In the Mobile Device Management folder of the console tree, select the Mobile Device Servers subfolder.
In the workspace of the Mobile Device Servers folder, select an iOS MDM Server.
In the context menu of the iOS MDM Server, select Properties.
This opens the properties window of the iOS MDM Server.
In the properties window of the iOS MDM Server, select the Certificates section.
In the Certificates section, in the Apple Push Notification certificate group of settings click the Renew button.
The APNs Certificate Renewal Wizard starts, the Renew APNs certificate window opens.
Create a Certificate Signing Request (hereinafter referred to as CSR). To do this, perform the following actions:
1. Click the Create CSR button.
2. In the Create CSR window that opens, specify a name for your request, the names of your company and department, your city, region, and country.
3. Click the Save button and specify a name for the file to which your CSR will be saved.
The private key of the certificate is saved in the device memory.
Use your CompanyAccount to send the file with the CSR you have created to Kaspersky to be signed.
Signing of your CSR will only be available after you upload to CompanyAccount portal a key that allows using Mobile Device Management.

After your online request is processed, you will receive a CSR file signed by Kaspersky.
Send the signed CSR file to Apple Inc. website, using a random Apple ID.
We recommend that you avoid using a personal Apple ID. Create a dedicated Apple ID to make it your corporate ID. After you have created an Apple ID, link it with the organization's mailbox, not a mailbox of an employee.

After your CSR is processed in Apple Inc., you will receive the public key of the APNs certificate. Save the file on disk.
Request the public key of the certificate. To do this, perform the following actions:
1. Proceed to Apple Push Certificates portal. To log in to the portal, use the Apple Id received at the initial request of the certificate.
2. In the list of certificates, select the certificate whose APSP name (in "APSP: <number>" format) matches the APSP name of the certificate used by iOS MDM Server and click the Renew button.
  The APNs certificate is renewed.
3. Save the certificate created on the portal.
Export the APNs certificate together with the private key created when generating the CSR, in PFX file format. To do this, perform the following actions:
1. In the Renew APNs certificate window, click the Complete CSR button.
2. In the Open window, choose a file with the public key of the certificate, received from Apple Inc. as the result of CSR processing, and click the Open button.
  The certificate export process will start.
3. In the next window, enter the private key password and click OK.
  This password will be used for the APNs certificate installation on the iOS MDM Server.
4. In the Renew APNs certificate window that opens, specify a file name for APNs certificate, choose a folder, and click Save.

The private and public keys of the certificate are combined, and the APNs certificate is saved in PFX format.

See also:

Receiving an APNs certificate

Page top

[Topic 210607]

Configuring a reserve iOS MDM Server certificate

The iOS MDM Server functionality enables you to issue a reserve certificate. This certificate is intended for use in iOS MDM profiles, to ensure seamless switching of managed iOS devices after the iOS MDM Server certificate expires.

If your iOS MDM Server uses a default certificate issued by Kaspersky, you can issue a reserve certificate (or specify your own custom certificate as reserve) before the iOS MDM Server certificate expires. By default, the reserve certificate is automatically issued 60 days before the iOS MDM Server certificate expiration. The reserve iOS MDM Server certificate becomes the main certificate immediately after the iOS MDM Server certificate expiration. The public key is distributed to all managed devices through configuration profiles, so you do not have to transmit it manually.

To issue an iOS MDM Server reserve certificate or specify a custom reserve certificate:

In the console tree, in the Mobile Device Management folder, select the Mobile Device Servers subfolder.
In the list of Mobile Device Servers, select the relevant iOS MDM Server, and on the right pane, click the Configure iOS MDM Server button.
In the iOS MDM Server settings window that opens, select the Certificates section.
In the Reserve certificate block of settings, do one of the following:
- If you plan to continue using a self-signed certificate (that is, the one issued by Kaspersky):
  1. Click the Issue button.
  2. In the Activation date window that opens, select one of the two options for the date when the reserve certificate must be applied:
    - If you want to apply the reserve certificate at the time of expiration of the current certificate, select the When current certificate expires option.
    - If you want to apply the reserve certificate before the current certificate expires, select the After specified period (days) option. In the entry field next to this option, specify the duration of the period after which the reserve certificate must replace the current certificate.
    The validity period of the reserve certificate that you specify cannot exceed the validity term of the current iOS MDM Server certificate.
  3. Click the OK button.
  The reserve iOS MDM Server certificate is issued.
- If you plan to use a custom certificate issued by your certification authority:
  1. Click the Add button.
  2. In the File Explorer window that opens, specify a certificate file in the PEM, PFX, or P12 format, which is stored on your device, and then click the Open button.
  Your custom certificate is specified as the reserve iOS MDM Server certificate.

You have a reserve iOS MDM Server certificate specified. The details of the reserve certificate are displayed in the Reserve certificate block of settings (certificate name, issuer name, expiration date, and the date the reserve certificate must be applied, if any).

Adding a configuration profile

Page top

[Topic 64666]

Installing an APNs certificate on an iOS MDM Server

After you receive the APNs certificate, you must install it on the iOS MDM Server.

To install the APNs certificate on the iOS MDM Server:

In the Mobile Device Management folder of the console tree, select the Mobile Device Servers subfolder.
In the workspace of the Mobile Device Servers folder, select an iOS MDM Server.
In the context menu of the iOS MDM Server, select Properties.
This opens the properties window of the iOS MDM Server.
In the properties window of the iOS MDM Server, select the Certificates section.
In the Certificates section, in the Apple Push Notification certificate group of settings click the Install button.
Select the PFX file that contains the APNs certificate.
Enter the password of the private key specified when exporting the APNs certificate.

The APNs certificate will be installed on the iOS MDM Server. The certificate details will be displayed in the properties window of the iOS MDM Server, in the Certificates section.

Page top

[Topic 92518]

Configuring access to Apple Push Notification service

To ensure a proper functioning of the iOS MDM web service and timely responses of mobile devices to the administrator's commands, you need to specify an Apple Push Notification Service certificate (hereinafter referred to as APNs certificate) in the iOS MDM Server settings.

Interacting with Apple Push Notification (hereinafter referred to as APNs), the iOS MDM web service connects to the external address api.push.apple.com through port 2197 (outbound). Therefore, the iOS MDM web service requires access to port TCP 2197 for the range of addresses 17.0.0.0/8. From the iOS device side is access to port TCP 5223 for the range of addresses 17.0.0.0/8.

If you intend to access APNs from the iOS MDM web service side through a proxy server, you must perform the following actions on the device with the iOS MDM web service installed:

Add the following strings to the registry:

For 32-bit operating systems:

HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\Connectors\KLIOSMDM\1.0.0.0\Conset

"ApnProxyHost"="<Proxy Host Name>"

"ApnProxyPort"="<Proxy Port>"

"ApnProxyLogin"="<Proxy Login>"

"ApnProxyPwd"="<Proxy Password>"

For 64-bit operating systems:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\Connectors\KLIOSMDM\1.0.0.0\Conset

"ApnProxyHost"="<Proxy Host Name>"

"ApnProxyPort"="<Proxy Port>"

"ApnProxyLogin"="<Proxy Login>"

"ApnProxyPwd"="<Proxy Password>"

Restart the iOS MDM web service.

See also:

Receiving an APNs certificate

Page top

[Topic 89539]

Issuing and installing a shared certificate on a mobile device

To issue a shared certificate to a user:

In the console tree, in the User accounts folder, select a user account.
In the context menu of the user account, select Install certificate.

The Certificate installation wizard starts. Follow the instructions of the wizard.

When the wizard finishes, a certificate will be created and added to the list of the user's certificates.

The issued certificate will be downloaded by the user, along with the installation package that contains the iOS MDM profile.

After the mobile device is connected to the iOS MDM Server, the iOS MDM profile settings will be applied on the user's device. The administrator will be able to manage the device after connection.

The user's mobile device connected to the iOS MDM Server is displayed in the Mobile Devices subfolder within the Mobile Device Management folder in the console tree.

Page top

[Topic 114929]

Adding a KES device to the list of managed devices

To add the KES device of a user to the list of managed devices using a link to Google Play:

In the console tree, select the User accounts folder.
By default, the User accounts folder is a subfolder of the Advanced folder.
Select the account of the user whose mobile device you want add to the list of managed devices.
In the context menu of the user account, select Add mobile device.
The Mobile device connection wizard starts. In the Certificate source window of the wizard, you have to specify the method for creating the shared certificate that Administration Server will use to identify the mobile device. You can specify a shared certificate in one of the following ways:
- Create a shared certificate automatically, by means of Administration Server tools, and then deliver the certificate to the device.
- Specify a shared certificate file.
In the Device type window of the wizard, select Link to Google Play.
In the User notification method window of the wizard, define the settings for notification of the mobile device user of certificate creation (with an SMS message, by email, or by displaying the information when the wizard has finished).
In the certificate info window of the wizard, click the Finish button to close the wizard.

After the wizard finishes its activities, a link and a QR code will be sent to the mobile device of the user, allowing the user to download Kaspersky Endpoint Security from Google Play. The user proceeds to Google Play by using the link or by scanning the QR code. After this, the operating system of the device prompts the user to accept Kaspersky Endpoint Security for Android installation. After Kaspersky Endpoint Security for Android is downloaded and installed, the mobile device connects to the Administration Server and downloads a shared certificate. After the certificate is installed on the mobile device, the device is displayed in the Mobile devices folder, which is a subfolder of the Mobile Device Management folder in the console tree.

If Kaspersky Endpoint Security for Android has already been installed on the device, the user has to receive the Administration Server connection settings from the administrator and then enter them independently. After the connection settings are defined, the mobile device connects to the Administration Server. The administrator issues a shared certificate for the device and sends the user an email message or an SMS message with a login and password for the certificate download. The user downloads and installs the shared certificate. After the certificate is installed on the mobile device, the device is displayed in the Mobile devices folder, which is a subfolder of the Mobile Device Management folder in the console tree. In this case, Kaspersky Endpoint Security for Android will not be downloaded and installed again.

Page top

[Topic 92520]

Connecting KES devices to the Administration Server

Depending on the method used for connection of devices to the Administration Server, two deployment schemes are possible for Kaspersky Device Management for iOS for KES devices:

Scheme of deployment with direct connection of devices to the Administration Server
Scheme of deployment involving a reverse proxy that supports Kerberos constrained delegation

In this section

Direct connection of devices to the Administration Server

Scheme for connecting KES devices to the Server involving Kerberos constrained delegation (KCD)

Using Firebase Cloud Messaging

Page top

[Topic 92521]

Direct connection of devices to the Administration Server

KES devices can connect directly to port 13292 of the Administration Server.

Depending on the method used for authentication, two options are possible for connection of KES devices to the Administration Server:

Connecting devices with a user certificate
Connecting devices without a user certificate

Connecting a device with a user certificate

When connecting a device with a user certificate, that device is associated with the user account to which the corresponding certificate has been assigned through Administration Server tools.

In this case, two-way SSL authentication (mutual authentication) will be used. Both the Administration Server and the device will be authenticated with certificates.

Connecting a device without a user certificate

When connecting a device without a user certificate, that device is associated with none of the user's accounts on the Administration Server. However, when the device receives any certificate, the device will be associated with the user to which the corresponding certificate has been assigned through Administration Server tools.

When connecting that device to the Administration Server, one-way SSL authentication will be applied, which means that only the Administration Server is authenticated with the certificate. After the device retrieves the user certificate, the type of authentication will change to two-way SSL authentication (2-way SSL authentication, mutual authentication).

Page top

[Topic 92523]

Scheme for connecting KES devices to the Server involving Kerberos constrained delegation (KCD)

The scheme for connecting KES devices to the Administration Server involving Kerberos constrained delegation (KCD) provides for the following:

Integration with a reverse proxy that supports KCD.
Use of Kerberos Constrained Delegation (hereinafter referred to as KCD) for authentication of mobile devices.
Integration with Public Key Infrastructure (hereinafter referred to as PKI) for applying user certificates.

When using this connection scheme, please note the following:

The type of connection of KES devices to the reverse proxy must be "two-way SSL authentication", that is, a device must connect to the reverse proxy through its proprietary user certificate. To do this, you need to integrate the user certificate into the installation package of Kaspersky Endpoint Security for Android, which has been installed on the device. This KES package must be created by the Administration Server specifically for this device (user).
You must specify the special (customized) certificate instead of the default server certificate for the mobile protocol:
1. In the Administration Server properties window, in the Settings section, select the Open port for mobile devices check box and select Add certificate in the drop-down list.
2. In the window that opens, specify the same certificate that was set on the reverse proxy when the point of access to the mobile protocol was published on the Administration Server.
User certificates for KES devices must be issued by the Certificate Authority (CA) of the domain. Keep in mind that if the domain includes multiple root CAs, user certificates must be issued by the CA, which has been set in the publication on the reverse proxy.
You can make sure the user certificate is in compliance with the above-described requirement, using one of the following methods:
- Specify the special user certificate in the New package wizard and in the Certificate installation wizard.
- Integrate the Administration Server with the domain's PKI and define the corresponding setting in the rules for issuance of certificates:
  1. In the console tree, expand the Mobile Device Management folder and select the Certificates subfolder.
  2. In the workspace of the Certificates folder, click the Configure certificate issuance rules button to open the Certificate issuance rules window.
  3. In the Integration with PKI section, configure integration with the Public Key Infrastructure.
  4. In the Issuance of mobile certificates section, specify the source of certificates.

Below is an example of setup of Kerberos Constrained Delegation (KCD) with the following assumptions:

Point of access to the mobile protocol on the Administration Server is set up on port 13292.
The name of the device with the reverse proxy is firewall.mydom.local.
The name of the device with Administration Server is ksc.mydom.local.
Name of the external publishing of the point of access to the mobile protocol is kes4mob.mydom.global.

Domain account for Administration Server

You must create a domain account (for example, KSCMobileSrvcUsr) under which the Administration Server service will run. You can specify an account for the Administration Server service when installing the Administration Server or through the klsrvswch utility. The klsrvswch utility is located in the installation folder of Administration Server. The default installation path: <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.

A domain account must be specified by the following reasons:

The feature for management of KES devices is an integral part of Administration Server.
To ensure a proper functioning of Kerberos Constrained Delegation (KCD), the receive side (i.e., the Administration Server) must run under a domain account.

Service Principal Name for http/kes4mob.mydom.local

In the domain, under the KSCMobileSrvcUsr account, add an SPN for publishing the mobile protocol service on port 13292 of the device with Administration Server. For the kes4mob.mydom.local device with Administration Server, this will appear as follows:

setspn -a http/kes4mob.mydom.local:13292 mydom\KSCMobileSrvcUsr

Configuring the domain properties of the device with the reverse proxy (firewall.mydom.local)

To delegate traffic, you must trust the device with the reverse proxy (firewall.mydom.local) to the service defined by the SPN (http/kes4mob.mydom.local:13292).

To trust the device with the reverse proxy to the service defined by the SPN (http/kes4mob.mydom.local:13292), the administrator must perform the following actions:

In the Microsoft Management Console snap-in named "Active Directory Users and Computers", select the device with the reverse proxy installed (firewall.mydom.local).
In the device properties, on the Delegation tab, set the Trust this computer for delegation to specified service only toggle to Use any authentication protocol.
In the Services to which this account can present delegated credentials list, add the SPN http/kes4mob.mydom.local:13292.

Special (customized) certificate for the publishing (kes4mob.mydom.global)

To publish the mobile protocol of Administration Server, you must issue a special (customized) certificate for the FQDN kes4mob.mydom.global and specify it instead of the default server certificate in the settings of the mobile protocol of Administration Server in Administration Console. To do this, in the properties window of the Administration Server, in the Settings section select the Open port for mobile devices check box and then select Add certificate in the drop-down list.

Please note that the server certificate container (file with the p12 or pfx extension) must also contain a chain of root certificates (public keys).

Configuring publication on the reverse proxy

On the reverse proxy, for traffic that goes from the mobile device side to port 13292 of kes4mob.mydom.global, you have to configure KCD on the SPN (http/kes4mob.mydom.local:13292), using the server certificate issued for the FQND kes4mob.mydom.global. Please note that publishing and the published access point (port 13292 of the Administration Server) must share the same server certificate.

Providing internet access to Administration Server

Administration Server on LAN, managed devices on internet, reverse proxy in use

Page top

[Topic 92525]

Using Firebase Cloud Messaging

To ensure timely delivery of commands to KES devices managed by the Android operating system, Kaspersky Security Center uses the mechanism of push notifications. Push notifications are exchanged between KES devices and Administration Server through Firebase Cloud Messaging (hereinafter referred to as FCM). In Kaspersky Security Center Administration Console, you can specify the Firebase Cloud Messaging settings to connect KES devices to the service.

To retrieve the settings of Firebase Cloud Messaging, you must have a Google account.

To enable the use of FCM:

In Administration Console, select the Mobile Device Management node, and the Mobile devices folder.
In the context menu of the Mobile devices folder, select Properties.
In the folder properties, select the Firebase Cloud Messaging settings section.
In the Firebase project number field, specify the FCM Sender ID.
In the Private key file (in JSON format) field, select the private key file.

At the next synchronization with Administration Server, KES devices managed by Android operating systems will be connected to Firebase Cloud Messaging.

You can edit the Firebase Cloud Messaging settings by clicking the Reset settings button.

When you switch to a different Firebase project, you need to wait 10 minutes for FCM to resume.

FCM service runs in the following address ranges:

From the KES device's side, access is required to ports 443 (HTTPS), 5228 (HTTPS), 5229 (HTTPS), and 5230 (HTTPS) of the following addresses:
- google.com
- fcm.googleapis.com
- android.apis.google.com
- All of the IP addresses listed in Google's ASN of 15169
From the Administration Server side, access is required to port 443 (HTTPS) of the following addresses:
- fcm.googleapis.com
- All of the IP addresses listed in Google's ASN of 15169

If the proxy server settings (Advanced / Configuring Internet access) have been specified in the Administration Server properties in Administration Console, they will be used for interaction with FCM.

Configuring FCM: getting the Sender ID and private key file

To configure FCM:

Register on the Google portal.
Go to the Firebase console.
Do one of the following:
- To create a new project, click Create a project and follow the instructions on the screen.
- Open an existing project.
Click the gear icon and choose Project settings.
The Project settings window opens.
Select the Cloud Messaging tab.
Retrieve the relevant Sender ID from the Sender ID field in the Firebase Cloud Messaging API (V1) section.
Select the Service accounts tab and click Generate new private key.
In the window that opens, click Generate key to generate and download a private key file.

Firebase Cloud Messaging is now configured.

Page top

[Topic 92526]

Integration with Public Key Infrastructure

Integration with Public Key Infrastructure (hereinafter referred to as PKI) is primarily intended for simplifying the issuance of domain user certificates by Administration Server.

The administrator can assign a domain certificate for a user in Administration Console. This can be done using one of the following methods:

Assign the user a special (customized) certificate from a file in the Certificate installation wizard.
Perform integration with PKI and assign PKI to act as the source of certificates for a specific type of certificates or for all types of certificates.

The settings of integration with PKI are available in the workspace of the Mobile Device Management / Certificates folder by clicking the Integrate with public key infrastructure link.

General principle of integration with PKI for issuance of domain user certificates

In Administration Console, click the Integrate with public key infrastructure link in the workspace of the Mobile Device Management / Certificates folder to specify a domain account that will be used by Administration Server to issue domain user certificates through the domain's CA (hereinafter referred to as the account under which integration with PKI is performed).

Please note the following:

The settings of integration with PKI provide you the possibility to specify the default template for all types of certificates. Note that the rules for issuance of certificates (available in the workspace of the Mobile Device Management / Certificates folder by clicking the Configure certificate issuance rules button) allow you to specify an individual template for every type of certificates.
A special Enrollment Agent (EA) certificate must be installed on the device with Administration Server, in the certificates repository of the account under which integration with PKI is performed. The Enrollment Agent (EA) certificate is issued by the administrator of the domain's CA (Certificate Authority).

The account under which integration with PKI is performed must meet the following criteria:

It is a domain user.
It is a local administrator of the device with Administration Server from which integration with PKI is initiated.
It has the right to Log On As Service.
The device with Administration Server installed must be run at least once under this account to create a permanent user profile.

Page top

[Topic 92527]

Kaspersky Security Center Web Server

Kaspersky Security Center Web Server (hereinafter referred to as Web Server) is a component of Kaspersky Security Center. Web Server is designed for publishing stand-alone installation packages, stand-alone installation packages for mobile devices, iOS MDM profiles, and files from the shared folder.

The iOS MDM profiles and installation packages that have been created are published on Web Server automatically and then removed after the first download. The administrator can send the new link to the user in any convenient way, such as by email.

By clicking the link, the user can download the required information to a mobile device.

Web Server settings

If a fine-tuning of Web Server is required, the properties of Administration Console Web Server provide the possibility to change ports for HTTP (8060) and HTTPS (8061). In addition to changing ports, you can replace the server certificate for HTTPS and change the FQDN of Web Server for HTTP.

Page top

[Topic 13057]

Installation of Kaspersky Security Center

This section describes installation of Kaspersky Security Center components. If you want to install the application locally on only one device, two installation options are available:

Standard. This option is recommended if you want to try out Kaspersky Security Center by, for example, testing its operation on a small area within your network. During standard installation, you only configure the database. You can also install only the default set of management plug-ins for Kaspersky applications. You can also use standard installation if you already have some experience working with Kaspersky Security Center and are able to specify all relevant settings after standard installation.
Custom. This option is recommended if you plan to modify the Kaspersky Security Center settings, such as a path to the shared folder, accounts and ports for connection to the Administration Server, and database settings. Custom installation enables you to specify which Kaspersky management plug-ins to install. If necessary, you can start custom installation in silent mode.

If at least one Administration Server is installed on the network, Servers can be installed on other devices remotely through the remote installation task using forced installation. When creating the remote installation task, you should use the Administration Server installation package: ksc_<version_number>.<build number>_full_<localization language>.exe.

Use this package if you want to install all the components required for full functionality of Kaspersky Security Center, or to upgrade the current versions of these components.

If you want to deploy the Kaspersky Security Center failover cluster, you need to install Kaspersky Security Center on all nodes of the cluster.

In this section

Preparing for installation

Accounts for work with the DBMS

Scenario: Authenticating Microsoft SQL Server

Scenario: Authenticating MySQL Server

Scenario: Authenticating PostgreSQL Server

Recommendations on Administration Server installation

Standard installation

Custom installation

Deployment of the Kaspersky Security Center failover cluster

Installing Administration Server on a Windows Server failover cluster

Installing Administration Server in silent mode

Installing Administration Console on the administrator's workstation

Changes in the system after Kaspersky Security Center installation

Removing the application

See also:

Main installation scenario

Page top

[Topic 6267]

Preparing for installation

Perform the following actions before launching the installation.

Check the hardware and software requirements
Make sure that the hardware and software on the device meet the requirements for Administration Server and Administration Console.
Select and install the database management system (DBMS)
Kaspersky Security Center stores its information in a database that is managed by a DBMS. Install the DBMS on the network before Kaspersky Security Center (learn more about how to select a DBMS). If you decide to install PostgreSQL or Postgres Pro DBMS, specify a password for the superuser. If the password is not specified, Administration Server might not be able to connect to the database.

It is recommended that you install the Administration Server on a dedicated server instead of a domain controller. However, if you install Kaspersky Security Center on a server that acts as a read-only domain controller (RODC), Microsoft SQL Server (SQL Express) must not be installed locally (on the same device). In this case, we recommend that you install Microsoft SQL Server (SQL Express) remotely (on a different device), or that you use MySQL, MariaDB, or PostgreSQL if you need to install the DBMS locally.
Prepare folders for Administration Server, Network Agent, and Administration Console
Administration Server, Network Agent, and Administration Console should be installed in folders where case sensitivity is disabled. Additionally, case sensitivity must be disabled for the Administration Server shared folder and the Kaspersky Security Center hidden folder (%ALLUSERSPROFILE%\KasperskyLab\adminkit).
Remove the old Network Agent
The server version of Network Agent is installed on the device together with Administration Server. Administration Server cannot be installed together with the regular version of Network Agent. If the server version of Network Agent is already installed on your device, remove it and start installation of Administration Server again. For details about the server version of Network Agent, refer to Changes in the system after Kaspersky Security Center installation.
Check accounts
Installation of Kaspersky Security Center requires administrator rights on the device on which the installation is performed.

Kaspersky Security Center supports managed service accounts and group managed service accounts. If these types of accounts are used in your domain, and you want to specify one of them as the account for the Administration Server service, then first install the account on the same device on which you want to install Administration Server. For details about installation of managed service accounts on a local device, refer to the official Microsoft documentation.

Page top

[Topic 156275]

Accounts for work with the DBMS

To install Administration Server and work with it, you need a Windows account under which you will run the Administration Server installer (hereinafter also referred to as the installer), a Windows account under which you will start the Administration Server service, and an internal DBMS account to access the DBMS. You can create new accounts or use existing ones. All these accounts require specific rights. A set of the required accounts and their rights depends on the following criteria:

DBMS type:
- Microsoft SQL Server (with Windows authentication or SQL Server authentication)
- MySQL or MariaDB
- PostgreSQL or Postgres Pro
DBMS location:
- Local DBMS. A local DBMS is a DBMS installed on the same device as Administration Server.
- Remote DBMS. A remote DBMS is a DBMS installed on a different device.
Method of the Administration Server database creation:
- Automatic. During the Administration Server installation, you can automatically create an Administration Server database (hereinafter also referred to as a Server database) by using the installer.
- Manual. You can use a third-party application (for example, SQL Server Management Studio) or a script to create an empty database. After that, you can specify this database as the Server database during the Administration Server installation.

Follow the principle of least privilege when you grant rights and permissions to the accounts. This means that the granted rights should be only enough to perform the required actions.

The tables below contain information about the system rights and DBMS rights that you should grant to the accounts before you install and start Administration Server.

Microsoft SQL Server with Windows authentication

If you choose SQL Server as a DBMS, you can use Windows authentication to access SQL Server. Configure system rights for a Windows account used to run the installer and a Windows account used to start the Administration Server service. On SQL Server, create logins for both of these Windows accounts. Depending on the creation method of the Server database, grant the required SQL Server rights to these accounts as described in the table below. For more information on how to configure rights of the accounts, see Configuring accounts for work with SQL Server (Windows authentication).

DBMS: Microsoft SQL Server (including Express Edition) with Windows authentication

	Automatic database creation (by the installer)	Manual database creation (by the Administrator)
Account under which the installer is running	Remote DBMS: only a domain account of the remote device on which the DBMS is installed. Local DBMS: a local administrator account or a domain account.	Remote DBMS: only a domain account of the remote device on which the DBMS is installed. Local DBMS: a local administrator account or a domain account.
Rights of the account under which the installer is running	System rights: local administrator rights. SQL Server rights: Server-level role: sysadmin.	System rights: local administrator rights. SQL Server rights: Server-level role: public. Database role membership for the Server database: db_owner, public. Default schema for the Server database: dbo.
Administration Server service account	Remote DBMS: only a domain account of the remote device on which the DBMS is installed. Local DBMS: A Windows account chosen by the administrator. An account in the KL-AK-* format that the installer automatically creates.	Remote DBMS: only a domain account of the remote device on which the DBMS is installed. Local DBMS: A Windows account chosen by the administrator. An account in the KL-AK-* format that the installer automatically creates (in this case, we do not recommend that you generate a KL-AK-* account).
Rights of the Administration Server service account	System rights: the required rights assigned by the installer. SQL Server rights: the required rights assigned by the installer.	System rights: the required rights assigned by the installer. SQL Server rights: Server-level role: public. Database role membership for the Server database: db_owner, public. Default schema for the Server database: dbo.

Microsoft SQL Server with SQL Server authentication

If you choose SQL Server as a DBMS, you can use SQL Server authentication to access SQL Server. Configure system rights for a Windows account used to run the installer and for a Windows account used to start the Administration Server service. On SQL Server, create a login with a password to use it for authentication. Then, grant this SQL Server account the required rights listed in the table below. For more information on how to configure rights of the accounts, see Configuring accounts for work with SQL Server (SQL Server authentication).

DBMS: Microsoft SQL Server (including Express Edition) with SQL Server authentication

	Automatic database creation (by the installer)	Manual database creation (by the Administrator)
Account under which the installer is running	Remote DBMS: only a domain account of the remote device on which the DBMS is installed. Local DBMS: a local administrator account or a domain account.	Remote DBMS: only a domain account of the remote device on which the DBMS is installed. Local DBMS: a local administrator account or a domain account.
Rights of the account under which the installer is running	System rights: local administrator rights.	System rights: local administrator rights.
Administration Server service account	Remote DBMS: only a domain account of the remote device on which the DBMS is installed. Local DBMS: A Windows account chosen by the administrator. An account in the KL-AK-* format that the installer automatically creates.	Remote DBMS: only a domain account of the remote device on which the DBMS is installed. Local DBMS: A Windows user account chosen by the administrator. An account in the KL-AK-* format that the installer automatically creates.
Rights of the Administration Server service account	System rights: the required rights assigned by the installer.	System rights: the required rights assigned by the installer.
Rights of the login used for SQL Server authentication	SQL Server rights required to create a database and install Administration Server: Server-level role: public. Database role membership for the master database: db_owner. Default schema for the master database: dbo. Permissions: CONNECT ANY DATABASE CONNECT SQL CREATE ANY DATABASE VIEW ANY DATABASE VIEW SERVER STATE (if the Always On option is enabled) SQL Server rights required to work with Administration Server: Server-level role: public. Database role membership for the Server database: db_owner. Default schema for the Server database: dbo. Permissions: CONNECT SQL VIEW ANY DATABASE VIEW SERVER STATE (if the Always On option is enabled) VIEW ANY DEFINITION	SQL Server rights: Server-level role: public. Database role membership for the Server database: db_owner. Default schema for the Server database: dbo. Permissions: CONNECT SQL VIEW ANY DATABASE VIEW ANY DEFINITION

Configuring SQL Server rights for Administration Server data recovery

To restore Administration Server data from the backup, run the klbackup utility under the Windows account used to install Administration Server. Before you start the klbackup utility, on SQL Server, grant the rights to the SQL Server login associated with this Windows account. The SQL Server rights are different depending on the Administration Server version. For the Administration Server version 14.2 or later, you can grant the sysadmin server-level role or the dbcreator server-level role.

SQL Server rights for the Administration Server database recovery

Administration Server version 14.2 or later

Other Administration Server versions

SQL Server rights:
- Server-level role: sysadmin.

SQL Server rights:
- Server-level role: sysadmin.

SQL Server rights:
- Server-level role: dbcreator.
Permissions:
- VIEW ANY DEFINITION

Before you start the klbackup utility, specify the KLSRV_SKIP_ADJUSTING_DBMS_ACCESS server flag. Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center. After that, execute the following command in the command line:

klscflag.exe -fset -pv klserver -n KLSRV_SKIP_ADJUSTING_DBMS_ACCESS -t d -v 1

MySQL and MariaDB

If you choose MySQL or MariaDB as a DBMS, create a DBMS internal account and grant this account the required rights listed in the table below. The installer and the Administration Server service use this internal DBMS account to access the DBMS. Note that the database creation method does not affect the set of required rights. For more information on how to configure the account rights, see Configuring accounts for work with MySQL and MariaDB.

DBMS: MySQL and MariaDB

	Automatic or manual database creation
Account under which the installer is running	Remote DBMS: only a domain account of the remote device with the installed DBMS. Local DBMS: a local administrator account or a domain account.
Rights of the account under which the installer is running	System rights: local administrator rights.
Administration Server service account	Remote DBMS: Only a domain account of the remote device with the installed DBMS. Local DBMS: A Windows account chosen by the administrator. An account in the KL-AK-* format that the installer creates automatically.
Rights of the Administration Server service account	System rights: The required rights assigned by the installer.
Rights of the DBMS internal account	Schema privileges: Administration Server database: ALL (excluding GRANT OPTION). System schemes (mysql and sys): SELECT, SHOW VIEW. The sys.table_exists stored procedure: EXECUTE (if you use MariaDB 10.5 or earlier as a DBMS, you do not need to grant the EXECUTE privilege). Global privileges for all schemes: PROCESS, SUPER.

Configuring privileges for Administration Server data recovery

Rights that you granted to the internal DBMS account are enough to restore Administration Server data from the backup. To start the restore, run the klbackup utility under the Windows account used to install Administration Server.

PostgreSQL or Postgres Pro

If you choose PostgreSQL or Postgres Pro as a DBMS, you can use the Postgres user (the default Postgres role) or create a new Postgres role (hereinafter also referred to as a role) to access the DBMS. Depending on the creation method of the Server database, grant the required rights to the role as described in the table below. For more information on how to configure rights of the role, see Configuring accounts for work with PostgreSQL or Postgres Pro.

DBMS: PostgreSQL or Postgres Pro


	Automatic database creation		Manual database creation
Account under which the installer is running	Remote DBMS: only a domain account of the remote device with the installed DBMS. Local DBMS: a local administrator account or a domain account.		Remote DBMS: only a domain account of the remote device with the installed DBMS. Local DBMS: a local administrator account or a domain account.
Rights of the account under which the installer is running	System rights: local administrator rights.		System rights: local administrator rights.
Administration Server service account	Remote DBMS: Only a domain account of the remote device with the installed DBMS. Local DBMS: A Windows account chosen by the administrator. An account in the KL-AK-* format that the installer creates automatically.		Remote DBMS: Only a domain account of the remote device with the installed DBMS. Local DBMS: A Windows account chosen by the administrator. An account in the KL-AK-* format that the installer creates automatically.
Rights of the Administration Server service account	System rights: The required rights assigned by the installer.		System rights: The required rights assigned by the installer.
Rights of the Postgres role	The Postgres user does not require additional rights.	Privileges for a new role: `CREATEDB`.	For a new role: Privileges on Administration Server database: `ALL`. Privileges on all tables in the public schema: `ALL`. Privileges on all sequences in the public schema: `ALL`.

Configuring privileges for Administration Server data recovery

To restore Administration Server data from the backup, run the klbackup utility under the Windows account used to install Administration Server. Note that the Postgres role used to access to the DBMS must have the owner rights on the Administration Server database.

See also:

Main installation scenario

Page top

[Topic 240593]

Configuring accounts for work with SQL Server (Windows authentication)

Prerequisites

Before you assign rights to the accounts, perform the following actions:

Make sure that you log in to the system under the local administrator account.
Install an environment for working with SQL Server.
Make sure that you have a Windows account under which you will install Administration Server.
Make sure that you have a Windows account under which you will start the Administration Server service.
On SQL Server, create a login for the Windows account used to run the Administration Server installer (hereinafter also referred to as the installer). Also, create a login for the Windows account used to start the Administration Server service.

If you use SQL Server Management Studio, on the General page of the login properties window, select the Windows Authentication option.

If you want to install Administration Server and SQL Server on devices that are located in separate Windows domains, note that these domains must have two-way trust relationships to ensure the correct operation of Administration Server, including running tasks and applying policies. For information about the required accounts for work with various DBMSs and accounts' rights, see Accounts for work with the DBMS.

Configuring the accounts to install Administration Server (automatic creation of the Administration Server database)

To configure the accounts for the Administration Server installation:

On SQL Server, assign the sysadmin server-level role to the login of the Windows account used to run the installer.
Log in to the system under the Windows account used to run the installer.
Run the Administration Server installer.
The Administration Server Setup wizard starts. Follow the instructions of the wizard.
Select the custom installation of Administration Server option.
Select the Microsoft SQL Server as a DBMS that stores the Administration Server database.
Select the Microsoft Windows Authentication mode to establish a connection between Administration Server and SQL Server through a Windows account.
Specify the Windows account used to start the Administration Server service.
You can select the Windows user account for which you created an SQL Server login earlier. Alternatively, you can automatically create a new Windows account in the KL-AK-* format by using the installer. In this case, the installer automatically creates an SQL Server login for this account. Regardless of the account choice, the installer assigns the required system rights and SQL Server rights to the Administration Server service account.

After the installation finishes, the Server database is created, and all the required system rights and SQL Server rights are assigned to the Administration Server service account. Administration Server is ready to use.

Configuring the accounts to install Administration Server (manual creation of the Administration Server database)

To configure the accounts for the Administration Server installation:

On SQL Server, create an empty database. This database will be used as an Administration Server database (hereinafter also referred to as a Server database).
For both SQL Server logins created for the Windows accounts, specify the public server-level role, and then configure the mapping to the created database:
- Server-level role: public
- Database role membership: db_owner, public
- Default schema: dbo
Log in to the system under the Windows account used to run the installer.
Run the Administration Server installer.
The Administration Server Setup wizard starts. Follow the instructions of the wizard.
Select the custom installation of Administration Server option.
Select the Microsoft SQL Server as a DBMS that stores the Administration Server database.
Specify the name of the created database as the Administration Server database name.
Select the Microsoft Windows Authentication mode to establish a connection between Administration Server and SQL Server through a Windows account.
Specify the Windows account used to start the Administration Server service.
You can select the Windows user account for which you created an SQL Server login and configured the login rights earlier.

We do not recommend that you automatically create a new Windows account in the KL-AK-* format. In this case, the installer creates a new Windows account for which you have not created and configured an SQL Server account. Administration Server cannot use this account to start the Administration Server service. If it is necessary to create a KL-AK-* Windows account, do not start Administration Console after the installation. Do the following, instead:

Stop the kladminserver service.
On SQL Server, create an SQL Server login for the created KL-AK-* Windows account.
Grant the rights to this SQL Server login and configure the mapping to the created database:
- Server-level role: public
- Database role membership: db_owner, public
- Default schema: dbo
Restart the kladminserver service, and then run the Administration console.

After the installation finishes, the Administration Server will use the created database to store the Server data. Administration Server is ready to use.

Page top

[Topic 240594]

Configuring accounts for work with SQL Server (SQL Server authentication)

Prerequisites

Before you assign rights to the accounts, perform the following actions:

Make sure that you log in to the system under the local administrator account.
Install an environment for working with SQL Server.
Make sure that you have a Windows account under which you will install Administration Server.
Make sure that you have a Windows account under which you will start the Administration Server service.
On SQL Server, enable the SQL Server authentication mode.
If you use SQL Server Management Studio, in the SQL Server Properties window, on the Security page, select the SQL Server and Windows Authentication mode option.
On SQL Server, create a login with a password. The Administration Server installer (hereinafter also referred to as the installer) and the Administration Server service will use this SQL Server account to access SQL Server.
If you use SQL Server Management Studio, on the General page of the login properties window, select the SQL Server authentication option.

Configuring the accounts to install Administration Server (automatic creation of the Administration Server database)

To configure the accounts for the Administration Server installation:

On SQL Server, map the SQL Server account to the default master database. The master database is a template for the Administration Server database (hereinafter also referred to as a Server database). The master database is used for mapping until the installer creates a Server database. Grant the following rights and permissions to the SQL Server account:
- Server-level role: public
- Database role membership for the master database: db_owner
- Default schema for the master database: dbo
- Permissions:
  - CONNECT ANY DATABASE
  - CONNECT SQL
  - CREATE ANY DATABASE
  - VIEW ANY DATABASE
Log in to the system under the Windows account used to run the installer.
Run the installer.
The Administration Server Setup wizard starts. Follow the instructions of the wizard.
Select the custom installation of Administration Server option.
Select the Microsoft SQL Server as a DBMS that stores the Administration Server database.
Specify the Administration Server database name.
Select the SQL Server Authentication mode to establish a connection between Administration Server and SQL Server through the created SQL Server account. Then, specify the SQL Server account credentials.
Specify the Windows account used to start the Administration Server service.
You can select an existing Windows user account or create a new Windows account in the KL-AK-* format by using the installer. Regardless of the account choice, the installer assigns the required system rights to the Administration Server service account.

After the installation finishes, the Server database is created and all the required system rights are assigned to the Administration Server service account. Administration Server is ready to use.

You can cancel the mapping to the master database, because the installer created a Server database and configured the mapping to this database during the Administration Server installation.

Since the automatic database creation requires more permissions than normal work with Administration Server, you can revoke some permissions. On SQL Server, select the SQL Server account, and then grant the following rights for work with Administration Server:

Server-level role: public
Database role membership for the Server database: db_owner
Default schema for the Server database: dbo
Permissions:
- CONNECT SQL
- VIEW ANY DATABASE

Configuring the accounts to install Administration Server (manual creation of the Administration Server database)

To configure the accounts for the Administration Server installation:

On SQL Server, create an empty database. This database will be used as an Administration Server database.
On SQL Server, grant the following rights and permissions to the SQL Server account:
- Server-level role: public.
- Database role membership for the created database: db_owner.
- Default schema for the created database: dbo.
- Permissions:
  - CONNECT SQL
  - VIEW ANY DATABASE
Log in to the system under the Windows account used to run the installer.
Run the installer.
The Administration Server Setup wizard starts. Follow the instructions of the wizard.
Select the custom installation of Administration Server option.
Select the Microsoft SQL Server as a DBMS that stores the Administration Server database.
Specify the name of the created database as the Administration Server database name.
Select the SQL Server Authentication mode to establish a connection between Administration Server and SQL Server through the created SQL Server account. Then, specify the SQL Server account credentials.
Specify the Windows account used to start the Administration Server service.
You can select an existing Windows user account or create a new Windows account in the KL-AK-* format by using the installer. Regardless of the account choice, the installer assigns the required system rights to the Administration Server service account.

After the installation finishes, the Administration Server will use the created database to store the Administration Server data. All the required system rights are assigned to the Administration Server service account. Administration Server is ready to use.

Page top

[Topic 240816]

Configuring accounts for work with MySQL and MariaDB

Prerequisites

Before you assign rights to the accounts, perform the following actions:

Make sure that you log in to the system under the local administrator account.
Install an environment for working with MySQL or MariaDB.
Make sure that you have a Windows account under which you will install Administration Server.
Make sure that you have a Windows account under which you will start the Administration Server service.

Configuring the accounts to install Administration Server

To configure the accounts for the Administration Server installation:

Run an environment for working with MySQL or MariaDB under the root account that you created when you installed the DBMS.
Create an internal DBMS account with a password. The Administration Server installer (hereinafter also referred to as the installer) and the Administration Server service will use this internal DBMS account to access DBMS. Grant the following privileges to this account:
- Schema privileges:
  - Administration Server database: ALL (excluding GRANT OPTION)
  - System schemes (mysql and sys): SELECT, SHOW VIEW
  - The sys.table_exists stored procedure: EXECUTE
- Global privileges for all schemes: PROCESS, SUPER
To create an internal DBMS account and grant the required privileges to this account, run the script below (in this script, the DBMS login is KSCAdmin, and the Administration Server database name is kav):

/* Create a user named KSCAdmin */

CREATE USER 'KSCAdmin'

/* Specify a password for KSCAdmin */

IDENTIFIED BY '<password>';

If you use MySQL 8.0 or earlier as a DBMS, note that for these versions the "Caching SHA2 password" authentication is not supported. Change the default authentication from "Caching SHA2 password" to "MySQL native password":
- To create a DBMS account that uses the "MySQL native password" authentication, execute the following command:
  CREATE USER 'KSCAdmin'@'%' IDENTIFIED WITH mysql_native_password BY '<password>';
- To change the authentication for an existing DBMS account, execute the following command:
  ALTER USER 'KSCAdmin'@'%' IDENTIFIED WITH mysql_native_password BY '<password>';
/* Grant privileges to KSCAdmin */

GRANT USAGE ON *.* TO 'KSCAdmin';

GRANT ALL ON kav.* TO 'KSCAdmin';

GRANT SELECT, SHOW VIEW ON mysql.* TO 'KSCAdmin';

GRANT SELECT, SHOW VIEW ON sys.* TO 'KSCAdmin';

GRANT EXECUTE ON PROCEDURE sys.table_exists TO 'KSCAdmin';

GRANT PROCESS ON *.* TO 'KSCAdmin';

GRANT SUPER ON *.* TO 'KSCAdmin';

If you use MariaDB 10.5 or earlier as a DBMS, you do not need to grant the EXECUTE privilege. In this case, exclude the following command from the script: GRANT EXECUTE ON PROCEDURE sys.table_exists TO 'KSCAdmin'.
To view the list of privileges granted to the DBMS account, run the following script:
SHOW grants for 'KSCAdmin';
To create an Administration Server database manually, run the following script (in this script, the Administration Server database name is kav):
CREATE DATABASE kav

DEFAULT CHARACTER SET ascii

DEFAULT COLLATE ascii_general_ci;

Use the same database name that you specify in the script that creates the DBMS account.
Log in to the system under the Windows account used to run the installer.
Run the installer.
The Administration Server Setup wizard starts. Follow the instructions of the wizard.
Select the custom installation of Administration Server option.
Select the MySQL or MariaDB as a DBMS that stores the Administration Server database.
Specify the Administration Server database name. Use the same database name that you specify in the script.
Specify the credentials of the DBMS account that you created by the script.
Specify the Windows account used to start the Administration Server service.
You can select an existing Windows user account or automatically create a new Windows account in the KL-AK-* format by using the installer. Regardless of the account choice, the installer assigns the required system rights to the Administration Server service account.

After the installation finishes, the Administration Server database is created and Administration Server is ready to use.

Page top

[Topic 242538]

Configuring accounts for work with PostgreSQL and Postgres Pro

Prerequisites

Before you assign rights to the accounts, perform the following actions:

Make sure that you log in to the system under the local administrator account.
Install an environment for working with PostgreSQL and Postgres Pro.
Make sure that you have a Windows account under which you will install Administration Server.
Make sure that you have a Windows account under which you will start the Administration Server service.

Configuring the accounts to install Administration Server (automatic creation of the Administration Server database)

To configure the accounts for the Administration Server installation:

Run an environment for working with PostgreSQL and Postgres Pro.
Choose a Postgres role to access the DBMS. You can use one of the following roles:
- The Postgres user (the default Postgres role).
  If you use the Postgres user, you do not need to grant additional rights to it.
- A new Postgres role.
  If you want to use a new Postgres role, create this role, and then grant it the CREATEDB privilege. To do this, run the following script (in this script, the role is KSCAdmin):
  
  CREATE USER "KSCAdmin" WITH PASSWORD '<password>' CREATEDB;
  
  The created role will be used as an owner of the Administration Server database (hereinafter also referred to as the Server database).
Log in to the system under the Windows account used to run the Administration Server installer (hereinafter also referred to as the installer).
Run the installer.
The Administration Server Setup wizard starts. Follow the instructions of the wizard.
Select the custom installation of Administration Server option.
Select the PostgreSQL or Postgres Pro as a DBMS that stores the Administration Server database.
Specify the Server database name. The installer will automatically create the Server database.
Specify the credentials of the Postgres role.
Specify the Windows account used to start the Administration Server service.
You can select an existing Windows user account or automatically create a new Windows account in the KL-AK-* format by using the installer. Regardless of the account choice, the installer assigns the required system rights to the Administration Server service account.

After the installation finishes, the Server database is automatically created and Administration Server is ready to use.

Configuring the accounts to install Administration Server (manual creation of the Administration Server database)

To configure the accounts for the Administration Server installation:

Run an environment for working with Postgres.
Create a new Postgres role and an Administration Server database. Then, grant all privileges to the role on the Administration Server database. To do this, log in under the Postgres user in the Postgres database, and then run the following script (in this script, the role is KSCAdmin, the Administration Server database name is KAV):
CREATE USER "KSCAdmin" WITH PASSWORD '<password>';

CREATE DATABASE "KAV" ENCODING 'UTF8';

GRANT ALL PRIVILEGES ON DATABASE "KAV" TO "KSCAdmin";
Grant the following privileges to the created Postgres role:
- Privileges on all tables in the public schema: ALL
- Privileges on all sequences in the public schema: ALL
To do this, log in under the Postgres user in the Server database, and then run the following script (in this script, the role is KSCAdmin):

GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA "public" TO "KSCAdmin";

GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA "public" TO "KSCAdmin";
Log in to the system under the Windows account used to run the installer.
Run the Administration Server installer.
The Administration Server Setup wizard starts. Follow the instructions of the wizard.
Select the custom installation of Administration Server option.
Select the PostgreSQL or Postgres Pro as a DBMS that stores the Administration Server database.
Specify the Server database name. Use the same database name that you specify in the script. Note that the database name is case-sensitive.
Specify the credentials of the Postgres role.
Specify the Windows account used to start the Administration Server service.
You can select an existing Windows user account or automatically create a new Windows account in the KL-AK-* format by using the installer. Regardless of the account choice, the installer assigns the required system rights to the Administration Server service account.

After the installation finishes, the Administration Server will use the created database to store the Administration Server data. Administration Server is ready to use.

Page top

[Topic 198526]

Scenario: Authenticating Microsoft SQL Server

Information in this section is only applicable to configurations in which Kaspersky Security Center uses Microsoft SQL Server as a database management system.

To protect Kaspersky Security Center data transferred to or from the database and data stored in the database from unauthorized access, you must secure communication between Kaspersky Security Center and SQL Server. The most reliable way to provide secure communication is to install Kaspersky Security Center and SQL Server on the same device and use the shared memory mechanism for both applications. In all other cases, we recommend that you use a SSL or TLS certificate to authenticate the SQL Server instance. You can use a certificate from a trusted certification authority (CA) or a self-signed certificate. We recommend that you use a certificate from a trusted CA because a self-signed certificate provides only limited protection.

SQL Server authentication proceeds in stages:

Generating a self-signed SSL or TLS certificate for SQL Server according to the certificate requirements
If you already have a certificate for SQL Server, skip this step.

An SSL certificate is only applicable to SQL Server versions earlier than 2016 (13.x). In SQL Server 2016 (13.x) and later versions, use a TLS certificate.

For example, to generate a TLS certificate, enter the following command in PowerShell:

New-SelfSignedCertificate -DnsName SQL_HOST_NAME -CertStoreLocation cert:\LocalMachine -KeySpec KeyExchange

In the command, instead of SQL_HOST_NAME you must type the SQL Server host name if the host is included in the domain or type the fully qualified domain name (FQDN) of the host if the host is not included in the domain. The same name—host name or FQDN—must be specified as an SQL Server instance name in the Administration Server setup wizard.
Adding the certificate on the SQL Server instance
The instructions for this stage depend on the platform on which SQL Server is running. Refer to the official documentation for details:
To use the certificate on a failover cluster, you must install the certificate on each node of the failover cluster. For details, refer to the Microsoft documentation.
Assigning the service account permissions
Ensure that the service account under which the SQL Server service is run has the Full control permission to access private keys. For details, refer to the Microsoft documentation.
Adding the certificate to the list of trusted certificates for Kaspersky Security Center
On the Administration Server device, add the certificate to the list of trusted certificates. For details, refer to the Microsoft documentation.
Enabling encrypted connections between the SQL Server instance and Kaspersky Security Center
On the Administration Server device, set value 1 to the environment variable KLDBADO_UseEncryption. For example, in Windows Server 2012 R2, you can change environment variables by clicking Environment Variables on the Advanced tab of the System Properties window. Add a new variable, name it KLDBADO_UseEncryption, and then set value 1.
Additional configuration to use TLS 1.2 protocol
If you use the TLS 1.2 protocol, then additionally do the following:
- Ensure that the installed version of SQL Server is a 64-bit application.
- Install Microsoft OLE DB Driver on the Administration Server device. For details, refer to the Microsoft documentation.
- On the Administration Server device, set value 1 to the environment variable KLDBADO_UseMSOLEDBSQL. For example, in Windows Server 2012 R2, you can change environment variables by clicking Environment Variables on the Advanced tab of the System Properties window. Add a new variable, name it KLDBADO_UseMSOLEDBSQL, and then set value 1.
  If the OLE DB Driver version is 19 or newer, also set value MSOLEDBSQL19 to the environment variable KLDBADO_ProviderName.
Enabling usage of TCP/IP protocol on a named instance of SQL Server
If you use a named instance of SQL Server, then additionally enable usage of TCP/IP protocol and assign a TCP/IP port number to the SQL Server Database Engine. When you configure SQL Server connection in the Administration Server setup wizard, specify the SQL Server host name and the port number in the SQL Server instance name field.

Page top

[Topic 261227]

Scenario: Authenticating MySQL Server

We recommend that you use a TLS certificate to authenticate the MySQL server. You can use a certificate from a trusted certification authority (CA) or a self-signed certificate.

Administration Server supports both one-way and two-way SSL authentication for MySQL.

Enable one-way SSL authentication

Follow these steps to configure one-way SSL authentication for MySQL:

Generate a self-signed TLS certificate for the MySQL server
In PowerShell, change directory to the folder where you want to store certificates. Execute the following commands:

$CertCA = New-SelfSignedCertificate ` -Subject "CN=CertCA" ` -CertStoreLocation "Cert:\CurrentUser\My" ` -HashAlgorithm "SHA256" ` -NotAfter (Get-Date).AddDays(365) $CertCABase64 = [System.Convert]::ToBase64String($CertCA.RawData, [System.Base64FormattingOptions]::InsertLineBreaks) $CertLeaf = New-SelfSignedCertificate ` -Subject "CN=CertLeaf" ` –Signer $CertCA ` -CertStoreLocation "Cert:\CurrentUser\My" ` -HashAlgorithm "SHA256" ` -KeyExportPolicy Exportable ` -NotAfter (Get-Date).AddDays(365) $CertLeafBase64 = [System.Convert]::ToBase64String($CertLeaf.RawData, [System.Base64FormattingOptions]::InsertLineBreaks) $CertLeafRSACng = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($CertLeaf) $CertLeafKeyBytes = $CertLeafRSACng.Key.Export([System.Security.Cryptography.CngKeyBlobFormat]::Pkcs8PrivateBlob) $CertLeafKeyBase64 = [System.Convert]::ToBase64String($CertLeafKeyBytes, [System.Base64FormattingOptions]::InsertLineBreaks) $CertCAPemCert = @" -----BEGIN CERTIFICATE----- $CertCABase64 -----END CERTIFICATE----- "@ $CertLeafPemKey = @" -----BEGIN PRIVATE KEY----- $CertLeafKeyBase64 -----END PRIVATE KEY----- "@ $CertLeafPemCert = @" -----BEGIN CERTIFICATE----- $CertLeafBase64 -----END CERTIFICATE----- "@ # Output to file $CertCAPemCert | Out-File -FilePath ca-cert.pem -Encoding Ascii $CertLeafPemKey | Out-File -FilePath server-key.pem -Encoding Ascii $CertLeafPemCert | Out-File -FilePath server-cert.pem -Encoding Ascii

These commands create certificates for the current user and export the certificates to the PEM format. You only need the exported PEM files to authenticate the server. To remove the created certificates from Windows, execute the following command in PowerShell:

certmgr.msc

Locate the created certificates in the Personal → Certificates folder and delete them.
Create a server flag file
Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.

Use the klscflag utility to create the KLSRV_MYSQL_OPT_SSL_CA server flag and specify the path to the certificate as its value.

klscflag -fset -pv klserver -n KLSRV_MYSQL_OPT_SSL_CA -v <path to ca-cert.pem> -t s
Configure the database
Specify the certificates in the my.cnf file. Open the my.cnf file in a text editor and add the following lines into the [mysqld] section:

[mysqld]

ssl-ca="...\mysqlcerts\ca-cert.pem"

ssl-cert="...\mysqlcerts\server-cert.pem"

ssl-key="...\mysqlcerts\server-key.pem"

Enable two-way SSL authentication

Follow these steps to configure two-way SSL authentication for MySQL:

Create server flag files
Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.

Use the klscflag utility to create the server flags and specify the path to the certificate files as their values:

klscflag -fset -pv klserver -n KLSRV_MYSQL_OPT_SSL_CA -v <path to ca-cert.pem> -t s

klscflag -fset -pv klserver -n KLSRV_MYSQL_OPT_SSL_CERT -v <path to server-cert.pem> -t s

klscflag -fset -pv klserver -n KLSRV_MYSQL_OPT_SSL_KEY -v <path to server-key.pem> -t s
Specify the passphrase (optional)
If the server-key.pem requires a passphrase, create a KLSRV_MARIADB_OPT_TLS_PASPHRASE flag and specify the passphrase as its value:

klscflag -fset -pv klserver -n KLSRV_MARIADB_OPT_TLS_PASPHRASE -v <passphrase> -t s
Configure the database
Specify the certificates in the my.cnf file. Open the my.cnf file in a text editor and add the following lines into the [mysqld] section:

[mysqld]

ssl-ca="...\ca-cert.pem"

ssl-cert="...\server-cert.pem"

ssl-key="...\server-key.pem"

Page top

[Topic 257050]

Scenario: Authenticating PostgreSQL Server

Expand all | Collapse all

We recommend that you use a TLS certificate to authenticate the PostgreSQL server. You can use a certificate from a trusted certification authority (CA) or a self-signed certificate. Use a certificate from a trusted CA because a self-signed certificate provides only limited protection.

Administration Server supports both one-way and two-way SSL authentication for PostgreSQL.

Follow these steps to configure SSL authentication for PostgreSQL:

Generate a certificate for the PostgreSQL server.
In an OpenSSL-based cross-platform utility, execute the following commands:

openssl req -new -x509 -days 365 -nodes -text -out psql.crt -keyout psql.key -subj "/CN=psql"

chmod og-rwx psql.key
Generate a certificate for the Administration Server.
Run the following commands. The CN value should match the name of the user that connects to PostgreSQL on behalf of the Administration Server. The username is set to postgres by default.

openssl req -new -x509 -days 365 -nodes -text -out postgres.crt -keyout postgres.key -subj "/CN=postgres"

chmod og-rwx postgres.key
Configure client certificate authentication.
Modify pg_hba.conf as follows:

hostssl all all 0.0.0.0/0 md5

Ensure that pg_hba.conf doesn't include a record that starts with host.
Specify the PostgreSQL certificate.
One-way SSL authentication

Modify postgresql.conf as follows (specify the correct path to the .crt and .key files):

listen_addresses ='localhost, server-ip'

ssl = on

ssl_cert_file = '<psql.crt>'

ssl_key_file = '<psql.key>'

Two-way SSL authentication

Modify postgresql.conf as follows (specify the correct path to the .crt and .key files):

listen_addresses ='localhost, server-ip'

ssl = on

ssl_ca_file = '<postgres.crt>'

ssl_cert_file = '<psql.crt>'

ssl_key_file = '<psql.key>'
Restart the PostgreSQL daemon.
Run the following command:

systemctl restart postgresql-14.service
Specify the server flag for the Administration Server.
One-way SSL authentication

Use the klscflag utility to create the KLSRV_POSTGRES_OPT_SSL_CA server flag and specify the path to the certificate as its value.

Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.

Run the following command:

klscflag -fset -pv klserver -n KLSRV_POSTGRES_OPT_SSL_CA -v <path to psql.crt> -t s

Two-way SSL authentication

Use the klscflag utility to create the server flags and specify the path to the certificate files as their values.

Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.

Run the following commands:

klscflag -fset -pv klserver -n KLSRV_POSTGRES_OPT_SSL_CA -v <path to psql.crt> -t s

klscflag -fset -pv klserver -n KLSRV_POSTGRES_OPT_SSL_CERT -v <path to postgres.crt> -t s

klscflag -fset -pv klserver -n KLSRV_POSTGRES_OPT_SSL_KEY -v <path to postgres.key> -t s

If the postgres.key requires a passphrase, create a KLSRV_POSTGRES_OPT_TLS_PASPHRASE flag and specify the passphrase as its value:

klscflag -fset -pv klserver -n KLSRV_POSTGRES_OPT_TLS_PASPHRASE -v <passphrase> -t s
Restart the Administration Server service.

Page top

[Topic 92398]

Recommendations on Administration Server installation

This section contains recommendations on how to install Administration Server. This section also provides scenarios for using a shared folder on the Administration Server device in order to deploy Network Agent on client devices.

In this section

Creating accounts for the Administration Server services on a failover cluster

Defining a shared folder

Remote installation with Administration Server tools through Active Directory group policies

Remote installation through delivery of the UNC path to a stand-alone package

Updating from the Administration Server shared folder

Installing images of operating systems

Specifying the address of the Administration Server

Page top

[Topic 92400]

Creating accounts for the Administration Server services on a failover cluster

By default, the installer automatically creates non-privileged accounts for services of Administration Server. This behavior is the most convenient for Administration Server installation on an ordinary device.

However, installation of Administration Server on a failover cluster requires a different scenario:

Create non-privileged domain accounts for services of Administration Server and make them members of a global domain security group named KLAdmins.
In the Administration Server Installer, specify the domain accounts that have been created for the services.

See also:

Main installation scenario

Page top

[Topic 92408]

Defining a shared folder

When installing Administration Server, you can specify the location of the shared folder. You can also specify the location of the shared folder after installation, in the Administration Server properties. By default, the shared folder will be created on the device with Administration Server (with read rights for the Everyone subgroup). However, in some cases (such as high load or a need for access from an isolated network), it is useful to locate the shared folder on a dedicated file resource.

The shared folder is used occasionally in Network Agent deployment.

Case sensitivity for the shared folder must be disabled.

Remote installation through delivery of the UNC path to a stand-alone package

Updating from the Administration Server shared folder

Installing images of operating systems

Page top

[Topic 92409]

Remote installation with Administration Server tools through Active Directory group policies

If the target devices are located within a Windows domain (no workgroups), initial deployment (installation of Network Agent and the security application on devices that are not yet managed) has to be performed through group policies of Active Directory. Deployment is performed by using the standard task for remote installation of Kaspersky Security Center. If the network is large-scale, it is useful to locate the shared folder on a dedicated file resource to reduce the load on the disk subsystem of the Administration Server device.

Page top

[Topic 92410]

Remote installation through delivery of the UNC path to a stand-alone package

If the users of networked devices in the organization have local administrator rights, another method of initial deployment is to create a stand-alone Network Agent package (or even a "coupled" Network Agent package together with the security application). After you create a stand-alone package, send users a link to that package, which is stored in the shared folder. Installation starts when users click the link.

Page top

[Topic 92412]

Updating from the Administration Server shared folder

In the Anti-Virus update task, you can configure updating from the shared folder of Administration Server. If the task has been assigned to a large number of devices, it is useful to locate the shared folder on a dedicated file resource.

Page top

[Topic 92413]

Installing images of operating systems

Operating system images are always installed through the shared folder: devices read operating system images from the shared folder. If deployment of images is planned on a large number of corporate devices, it is useful to locate the shared folder on a dedicated file resource.

Page top

[Topic 92414]

Specifying the address of the Administration Server

When installing Administration Server, you can specify the address of the Administration Server. This address will be used as the default address when creating installation packages of Network Agent.

As the Administration Server address, you can specify the following:

NetBIOS name of the Administration Server, which is specified by default
Fully qualified domain name (FQDN) of the Administration Server if the Domain Name System (DNS) on the organization's network has been configured and is functioning properly
External address if the Administration Server is installed in the demilitarized zone (DMZ)

After that, you will be able to change the address of the Administration Server by using Administration Console tools; the address will not change automatically in Network Agent installation packages that have been already created.

Page top

[Topic 13054]

Standard installation

Standard installation is an Administration Server installation that uses the default paths for application files, installs the default set of plug-ins, and does not enable Mobile Device Management.

To install Kaspersky Security Center Administration Server on a local device:

Run the ksc_<version number>.<build number>_full_<localization language>.exe executable file.

A window opens prompting you to select Kaspersky applications to install. In the application selection window, click the Install Kaspersky Security Center Administration Server link to start the Administration Server setup wizard. Follow the instructions of the wizard.

In this section

Step 1. Reviewing the License Agreement and Privacy Policy

Step 2. Selecting an installation method

Step 3. Installing Kaspersky Security Center Web Console

Step 4. Selecting network size

Step 5. Selecting a database

Step 6. Configuring the SQL Server

Step 7. Selecting an authentication mode

Step 8. Unpacking and installing files on the hard drive

See also:

Main installation scenario

Page top

[Topic 67868]

Step 1. Reviewing the License Agreement and Privacy Policy

At this step of the setup wizard, you must read the License Agreement, which is to be concluded between you and Kaspersky, as well as the Privacy Policy.

You may also be prompted to view the License Agreements and Privacy Policies for application management plug-ins that are available in the Kaspersky Security Center distribution kit.

Please carefully read the License Agreement and Privacy Policy. If you agree with all the terms of the License Agreement and the Privacy Policy, confirm that by selecting the appropriate check boxes.

Installation of the application on your device will continue after you select both check boxes.

If you do not accept the License Agreement or the Privacy Policy, cancel installation by clicking the Cancel button.

Page top

[Topic 154916]

Step 2. Selecting an installation method

In the installation type selection window, select Standard.

Standard installation is recommended if you want to try out Kaspersky Security Center by, for example, testing its operation on a small area within your enterprise network. During standard installation, you only configure the database. You do not specify any Administration Server settings: their respective default values are used instead. Standard installation does not allow you to select management plug-ins to install; only the default set of plug-ins is installed. During standard installation, no installation packages for mobile devices are created. However, you can create them later in Administration Console.

Page top

[Topic 204961]

Step 3. Installing Kaspersky Security Center Web Console

This step is displayed only if you are using a 64-bit operating system. Otherwise, this step is not displayed, because Kaspersky Security Center Web Console does not work with 32-bit operating systems.

By default, both Kaspersky Security Center Web Console and MMC-based Administration Console will be installed.

If you want to install only Kaspersky Security Center Web Console:

Select Install only this one.
Choose Web-based console in the drop-down list.

Installation of Kaspersky Security Center Web Console starts automatically after completion of Administration Server installation.

If you want to install only the MMC-based Administration console:

Select Install only this one.
Choose MMC-based console in the drop-down list.

Page top

[Topic 154918]

Step 4. Selecting network size

Specify the size of the network on which Kaspersky Security Center is to be installed. Depending on the number of devices on the network, the wizard configures the installation and appearance of the application interface so that they match.

The following table lists the application installation settings and interface appearance settings, which are adjusted based on various network sizes.

Dependence of installation settings on the network scale selected

Settings	1—100 devices	101—1000 devices	1001—5000 devices	More than 5000 devices
Display with the node for secondary and virtual Administration Servers, and all settings related to the secondary and virtual Administration Servers in the console tree	Not available	Not available	Available	Available
Display with the Security sections in the properties windows of the Administration Server and administration groups	Not available	Not available	Available	Available
Random distribution of startup time for the update task on client devices	Not available	Over an interval of 5 minutes	Over an interval of 10 minutes	Over an interval of 10 minutes

If you connect Administration Server to a MySQL 5.7 or SQL Express database server, it is not recommended using the application to manage more than 10,000 devices. For the MariaDB database management system, the maximum recommended number of managed devices is 20,000.

Page top

[Topic 154920]

Step 5. Selecting a database

At this step of the wizard, select one of the following database management systems (DBMS) that will be used to store the Administration Server database:

Microsoft SQL Server or SQL Server Express
MySQL or MariaDB
PostgreSQL or Postgres Pro

It is recommended to install the Administration Server on a dedicated server instead of a domain controller. However, if you install Kaspersky Security Center on a server that acts as a read-only domain controller (RODC), Microsoft SQL Server (SQL Express) must not be installed locally (on the same device). In this case, we recommend that you install Microsoft SQL Server (SQL Express) remotely (on a different device), or that you use MySQL, MariaDB, or PostgreSQL if you need to install the DBMS locally.

The Administration Server database structure is provided in the klakdb.chm file, which is located in the Kaspersky Security Center installation folder. This file is also available in an archive on the Kaspersky portal: klakdb.zip.

See also:

Selecting a DBMS

Page top

[Topic 154922]

Step 6. Configuring the SQL Server

At this step of the wizard, specify the following connection settings, depending on the database management system (DBMS) that you have selected:

If you selected Microsoft SQL Server or SQL Server Express in the previous step:
- In the SQL Server instance name field, specify the name of the SQL Server on the network. To view a list of all SQL Servers that are on the network, click the Browse button. This field is blank by default.
  If you connect to the SQL Server through a custom port, then together with the SQL Server host name specify the port number separated with a comma, for example:
  
  SQL_Server_host_name,1433
  
  If you secure communication between the Administration Server and SQL Server by means of a certificate, specify in the SQL Server instance name field the same host name that was used at the certificate generating. If you use a named instance of SQL Server, then together with the SQL Server host name specify the port number separated with a comma, for example:
  
  SQL_Server_name,1433
  
  If you use several instances of SQL Server on the same host, then additionally specify the instance name separated with a backslash, for example:
  
  SQL_Server_name\SQL_Server_instance_name,1433
  
  If a SQL Server on the enterprise network has the Always On feature enabled, specify the name of the availability group listener in the SQL Server instance name field. Note that Administration Server supports only the synchronous-commit availability mode when the Always On feature is enabled.
- In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.
If at this stage you want to install SQL Server on the device from which you are installing Kaspersky Security Center, you must stop installation and restart it after SQL Server is installed. The supported SQL Server versions are listed in the system requirements.

If you want to install SQL Server on a remote device, you do not have to interrupt the Kaspersky Security Center setup wizard. Install SQL Server and resume installation of Kaspersky Security Center.
If you selected MySQL or MariaDB in the previous step:
- In the SQL Server instance name field, specify the name of the DBMS instance. By default, the name is the IP address of the device on which Kaspersky Security Center is to be installed.
- In the Port field, specify the port for Administration Server connection to the DBMS. The default port number is 3306.
- In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.
If you selected PostgreSQL or Postgres Pro in the previous step:
- In the PostgreSQL or Postgres Pro Server field, specify the name of the DBMS instance. By default, the name is the IP address of the device on which Kaspersky Security Center is to be installed.
- In the Port field, specify the port for the Administration Server connection to the DBMS. The default port number is 5432.
- In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.

Page top

[Topic 154924]

Step 7. Selecting an authentication mode

Determine the authentication mode that will be used when Administration Server connects to the database management system (DBMS).

Depending on the DBMS that is selected, you can choose from the following authentication modes:

For SQL Express or Microsoft SQL Server select one of the following options:
- Microsoft Windows Authentication mode. Verification of rights uses the account used for starting Administration Server.
- SQL Server Authentication mode. If you select this option, the account specified in the window is used to verify access rights. Fill in the Account and Password fields.
  To see the entered password, click and hold the Show button.
For both authentication modes, the application checks if the database is available. If the database is not available, an error message is displayed, and you have to provide correct credentials.

If the Administration Server database is stored on another device and the Administration Server account does not have access to the database server, you must use SQL Server authentication mode when installing or upgrading Administration Server. This may occur when the device that stores the database is outside the domain or when Administration Server is installed under a LocalSystem account.
For MySQL, MariaDB, PostgreSQL, or Postgres Pro, specify the account and password.

Page top

[Topic 154928]

Step 8. Unpacking and installing files on the hard drive

After the installation of Kaspersky Security Center components is configured, you can start installing files on the hard drive.

If installation requires additional programs, the setup wizard will notify you, on the Installing Prerequisites page, before installation of Kaspersky Security Center begins. The required programs are installed automatically after you click the Next button.

On the last page, you can select which console to start for work with Kaspersky Security Center:

Start MMC-based Administration Console
Start Kaspersky Security Center Web Console
This option is available only if you opted to install Kaspersky Security Center Web Console in one of the previous steps.

You can also click Finish to close the wizard without starting work with Kaspersky Security Center. You can start the work later at any time.

At the first startup of Administration Console or Kaspersky Security Center Web Console, you can perform the initial setup of the application.

When the setup wizard finishes, the following application components are installed on the hard drive on which the operating system was installed:

Administration Server (together with the server version of Network Agent)
Microsoft Management Console-based Administration Console
Kaspersky Security Center Web Console (if you chose to install it)
Application management plug-ins available in the distribution kit

Additionally, Microsoft Windows Installer 4.5 will be installed if it was not installed previously.

Page top

[Topic 13055]

Custom installation

Custom installation is an Administration Server installation during which you are prompted to select components to install and specify the folder in which the application must be installed.

Using this type of installation, you can configure the database and Administration Server, as well as install components that are not included in standard installation or management plug-ins for various Kaspersky security applications. You can also enable Mobile Device Management.

To install Kaspersky Security Center Administration Server on a local device:

Run the ksc_<version number>.<build number>_full_<localization language>.exe executable file.

In this section

Step 1. Reviewing the License Agreement and Privacy Policy

Step 2. Selecting an installation method

Step 3. Selecting the components to be installed

Step 4. Installing Kaspersky Security Center Web Console

Step 5. Selecting network size

Step 6. Selecting a database

Step 7. Configuring the SQL Server

Step 8. Selecting an authentication mode

Step 9. Selecting the account to start Administration Server

Step 10. Selecting the account for running the Kaspersky Security Center services

Step 11. Selecting a shared folder

Step 12. Configuring the connection to Administration Server

Step 13. Defining the Administration Server address

Step 14. Administration Server address for connection of mobile devices

Step 15. Selecting application management plug-ins

Step 16. Unpacking and installing files on the hard drive

See also:

Main installation scenario

Page top

[Topic 67868_1]

Step 1. Reviewing the License Agreement and Privacy Policy

At this step of the setup wizard, you must read the License Agreement, which is to be concluded between you and Kaspersky, as well as the Privacy Policy.

You may also be prompted to view the License Agreements and Privacy Policies for application management plug-ins that are available in the Kaspersky Security Center distribution kit.

Please carefully read the License Agreement and Privacy Policy. If you agree with all the terms of the License Agreement and the Privacy Policy, confirm that by selecting the appropriate check boxes.

Installation of the application on your device will continue after you select both check boxes.

If you do not accept the License Agreement or the Privacy Policy, cancel installation by clicking the Cancel button.

Page top

[Topic 35691]

Step 2. Selecting an installation method

In the installation type selection window, specify Custom.

Custom installation allows you to modify the Kaspersky Security Center settings, such as the path to the shared folder, accounts and ports for connection to the Administration Server, and database settings. Custom installation allows you to specify which Kaspersky management plug-ins to install. During custom installation, you can create installation packages for mobile devices by enabling the corresponding option.

Page top

[Topic 13082]

Step 3. Selecting the components to be installed

Select the components of Kaspersky Security Center Administration Server that you want to install:

Mobile Device Management. Select this check box if you must create installation packages for mobile devices when the Kaspersky Security Center setup wizard is running. You can also create installation packages for mobile devices manually, after Administration Server installation, by using Administration Console tools.
SNMP agent. This component receives statistical information for the Administration Server over the SNMP protocol. The component is available if the application is installed on a device with SNMP installed.
After Kaspersky Security Center is installed, the .mib files required for receiving statistics are located in the SNMP subfolder of the application installation folder.

Network Agent and Administration Console are not displayed in the component list. These components are installed automatically and you cannot cancel their installation.

At this step you must specify a folder for installation of Administration Server components. By default, the components are installed to <Disk>:\Program Files\Kaspersky Lab\Kaspersky Security Center. If no such folder exists, this folder is created automatically during installation. You can change the destination folder by using the Browse button.

Page top

[Topic 176764]

Step 4. Installing Kaspersky Security Center Web Console

By default, both Kaspersky Security Center Web Console and MMC-based Administration Console will be installed.

If you want to install only Kaspersky Security Center Web Console:

Select Install only this one.
Choose Web-based console in the drop-down list.

Installation of Kaspersky Security Center Web Console starts automatically after completion of Administration Server installation.

If you want to install only the MMC-based Administration console:

Select Install only this one.
Choose MMC-based console in the drop-down list.

See also:

Main installation scenario

Page top

[Topic 13083]

Step 5. Selecting network size

The following table lists the application installation settings and interface appearance settings, which are adjusted based on various network sizes.

Dependence of installation settings on the network scale selected

Settings	1—100 devices	101—1000 devices	1001—5000 devices	More than 5000 devices
Display with the node for secondary and virtual Administration Servers, and all settings related to the secondary and virtual Administration Servers in the console tree	Not available	Not available	Available	Available
Display with the Security sections in the properties windows of the Administration Server and administration groups	Not available	Not available	Available	Available
Random distribution of startup time for the update task on client devices	Not available	Over an interval of 5 minutes	Over an interval of 10 minutes	Over an interval of 10 minutes

Page top

[Topic 13085]

Step 6. Selecting a database

At this step of the wizard, select one of the following database management systems (DBMS) that will be used to store the Administration Server database:

Microsoft SQL Server or SQL Server Express
MySQL or MariaDB
PostgreSQL or Postgres Pro

Page top

[Topic 13086]

Step 7. Configuring the SQL Server

At this step of the wizard, specify the following connection settings, depending on the database management system (DBMS) that you have selected:

If you selected Microsoft SQL Server or SQL Server Express in the previous step:
- In the SQL Server instance name field, specify the name of the SQL Server on the network. To view a list of all SQL Servers that are on the network, click the Browse button. This field is blank by default.
  If you connect to the SQL Server through a custom port, then together with the SQL Server host name specify the port number separated with a comma, for example:
  
  SQL_Server_host_name,1433
  
  If you secure communication between the Administration Server and SQL Server by means of a certificate, specify in the SQL Server instance name field the same host name that was used at the certificate generating. If you use a named instance of SQL Server, then together with the SQL Server host name specify the port number separated with a comma, for example:
  
  SQL_Server_name,1433
  
  If you use several instances of SQL Server on the same host, then additionally specify the instance name separated with a backslash, for example:
  
  SQL_Server_name\SQL_Server_instance_name,1433
  
  If a SQL Server on the enterprise network has the Always On feature enabled, specify the name of the availability group listener in the SQL Server instance name field. Note that Administration Server supports only the synchronous-commit availability mode when the Always On feature is enabled.
- In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.
If at this stage you want to install SQL Server on the device from which you are installing Kaspersky Security Center, you must stop installation and restart it after SQL Server is installed. The supported SQL Server versions are listed in the system requirements.

If you want to install SQL Server on a remote device, you do not have to interrupt the Kaspersky Security Center setup wizard. Install SQL Server and resume installation of Kaspersky Security Center.
If you selected MySQL or MariaDB in the previous step:
- In the SQL Server instance name field, specify the name of the DBMS instance. By default, the name is the IP address of the device on which Kaspersky Security Center is to be installed.
- In the Port field, specify the port for Administration Server connection to the DBMS. The default port number is 3306.
- In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.
If you selected PostgreSQL or Postgres Pro in the previous step:
- In the PostgreSQL or Postgres Pro Server field, specify the name of the DBMS instance. By default, the name is the IP address of the device on which Kaspersky Security Center is to be installed.
- In the Port field, specify the port for the Administration Server connection to the DBMS. The default port number is 5432.
- In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.

See also:

Main installation scenario

Page top

[Topic 13087]

Step 8. Selecting an authentication mode

Determine the authentication mode that will be used when Administration Server connects to the database management system (DBMS).

Depending on the DBMS that is selected, you can choose from the following authentication modes:

For SQL Express or Microsoft SQL Server select one of the following options:
- Microsoft Windows Authentication mode. Verification of rights uses the account used for starting Administration Server.
- SQL Server Authentication mode. If you select this option, the account specified in the window is used to verify access rights. Fill in the Account and Password fields.
  To see the entered password, click and hold the Show button.
For both authentication modes, the application checks if the database is available. If the database is not available, an error message is displayed, and you have to provide correct credentials.

If the Administration Server database is stored on another device and the Administration Server account does not have access to the database server, you must use SQL Server authentication mode when installing or upgrading Administration Server. This may occur when the device that stores the database is outside the domain or when Administration Server is installed under a LocalSystem account.
For MySQL, MariaDB, PostgreSQL, or Postgres Pro, specify the account and password.

Page top

[Topic 13084]

Step 9. Selecting the account to start Administration Server

Select the account that will be used to start Administration Server as a service.

Generate the account automatically. The application creates an account named KL-AK-*, under which the kladminserver service will run.
You can select this option if you plan to locate the shared folder and the DBMS on the same device as Administration Server.
Select an account. The Administration Server service (kladminserver) will run under the account that you selected.
You will have to select a domain account if, for example, you plan to use as the DBMS a SQL Server instance of any version, including SQL Express, that is located on another device, and/or you plan to locate the shared folder on another device.

Kaspersky Security Center supports managed service accounts (MSA) and group managed service accounts (gMSA). If these types of accounts are used in your domain, you can select one of them as the account for the Administration Server service.

Before specifying MSA or gMSA, you must install the account on the same device on which you want to install Administration Server. If the account is not installed yet, then cancel the Administration Server installation, install the account, and then restart the Administration Server installation. For details about installation of managed service accounts on a local device, refer to the official Microsoft documentation.

To specify MSA or gMSA:
1. Click the Browse button.
2. In the window that opens, click the Object type button.
3. Select the Account for services type and click OK.
4. Select the relevant account and click OK.

The account that you selected must have different permissions, depending on the DBMS that you plan for use.

For security reasons, please do not assign the privileged status to the account under which you run Administration Server.

The Administration Server account cannot be changed later. You need to reinstall the failover cluster to use another Administration Server account.

See also:

Accounts for work with the DBMS

Changes in the system after Kaspersky Security Center installation

Main installation scenario

Page top

[Topic 91590]

Step 10. Selecting the account for running the Kaspersky Security Center services

Select the account under which the services of Kaspersky Security Center will run on this device:

Generate the account automatically. Kaspersky Security Center creates a local account named KlScSvc on this device in the kladmins group. The services of Kaspersky Security Center will be run under the account that has been created.
Select an account. The Kaspersky Security Center services will be run under the account that you selected.
You will have to select a domain account if, for example, you intend to save reports to a folder located on a different device or if this is required by your organization's security policy. You may also have to select a domain account if you install Administration Server on a failover cluster.

For security reasons, do not grant privileged status to the account under which the services are run.

The KSN proxy service (ksnproxy), Kaspersky activation proxy service (klactprx), and Kaspersky authentication portal service (klwebsrv) will be run under the selected account.

Main installation scenario

Page top

[Topic 13088]

Step 11. Selecting a shared folder

Define the location and name of the shared folder that will be used to do the following:

Store the files necessary for remote installation of applications (these files are copied to Administration Server during creation of installation packages).
Store updates that have been downloaded from an update source to Administration Server.

File sharing (read-only) will be enabled for all users.

You can select either of the following options:

Create a shared folder. Create a new folder. In the text box, specify the path to the folder.
Select an existing shared folder. Select a shared folder that already exists.

The shared folder can be a local folder on the device that is used for installation or a remote directory on any client device on the corporate network. You can click the Browse button to select the shared folder, or specify the shared folder manually by entering its UNC path (for example, \\server\Share) in the corresponding field.

By default, the installer creates a local Share subfolder in the application folder that contains the components of Kaspersky Security Center.

You can define a shared folder later if needed.

Page top

[Topic 13089]

Step 12. Configuring the connection to Administration Server

Expand all | Collapse all

Configure the connection to Administration Server:

Port
The number of the port used to connect to the Administration Server.

The default port number is 14000.
SSL port
Secure Sockets Layer (SSL) port number used to securely connect to the Administration Server via SSL.

The default port number is 13000.
Encryption key length
Select the length of the encryption key: 1024 bit or 2048 bit.

A 1024-bit encryption key places a smaller load on the CPU, but it is considered obsolete because it cannot provide reliable encryption due to its technical specifications. Also, the existing hardware probably will turn out to be incompatible with SSL certificates featuring 1024-bit keys.

A 2048-bit encryption key meets all state-of-the-art encryption standards. However, use of a 2048-bit encryption key may add to the load on a CPU.

By default, 2048 bit (best security) is selected.

You can also change the parameters for connecting to Administration Server later as follows:

You can change port and SSL port numbers in the Connection ports section of the Administration Server properties. For more information about Administration Server connection ports, see Ports used by Kaspersky Security Center.
You can change the encryption key length when replacing the Administration Server certificate with the klsetsrvcert utility by using the -o RsaKeyLen:<key length> parameter.

See also:

Ports used by Kaspersky Security Center

Interaction of Kaspersky Security Center components and security applications: more information

Page top

[Topic 13090]

Step 13. Defining the Administration Server address

Specify the Administration Server address in one of the following ways:

DNS domain name. You can use this method if the network includes a DNS server and client devices can use it to receive the Administration Server address.
NetBIOS name. You can use this method if client devices receive the Administration Server address using the NetBIOS protocol or if a WINS server is available on the network.
IP address. You can use this method if Administration Server has a static IP address that will not be subsequently changed.

If you install Kaspersky Security Center on the active node of the Kaspersky Security Center failover cluster, and you have created a secondary network adapter when preparing the cluster nodes, specify the IP address of this adapter. Otherwise, enter the IP address of the third-party load balancer that you use.

Page top

[Topic 94265]

Step 14. Administration Server address for connection of mobile devices

This setup wizard step is available if you have selected Mobile Device Management for installation.

In the Address for connection of mobile devices window, specify the external address of the Administration Server for connection of mobile devices that are outside of the local network. You can specify the IP address or Domain Name System (DNS) of the Administration Server.

Page top

[Topic 54967]

Step 15. Selecting application management plug-ins

Select the application management plug-ins that need to be installed with Kaspersky Security Center.

For ease of search, plug-ins are divided into groups depending on the type of secured objects.

Page top

[Topic 13092]

Step 16. Unpacking and installing files on the hard drive

After the installation of Kaspersky Security Center components is configured, you can start installing files on the hard drive.

On the last page, you can select which console to start for work with Kaspersky Security Center:

Start MMC-based Administration Console
Start Kaspersky Security Center Web Console
This option is available only if you opted to install Kaspersky Security Center Web Console in one of the previous steps.

You can also click Finish to close the wizard without starting work with Kaspersky Security Center. You can start the work later at any time.

At the first startup of Administration Console or Kaspersky Security Center Web Console, you can perform the initial setup of the application.

Page top

[Topic 222395]

Deployment of the Kaspersky Security Center failover cluster

This section contains both general information about the Kaspersky Security Center failover cluster, and instructions on the preparation and deployment of the Kaspersky Security Center failover cluster in your network.

In this section

Scenario: Deployment of a Kaspersky Security Center failover cluster

About the Kaspersky Security Center failover cluster

Preparing a file server for a Kaspersky Security Center failover cluster

Preparing nodes for a Kaspersky Security Center failover cluster

Installing Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes

Starting and stopping cluster nodes manually

Upgrading Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes

Page top

[Topic 222333]

Scenario: Deployment of a Kaspersky Security Center failover cluster

A Kaspersky Security Center failover cluster provides high availability of Kaspersky Security Center and minimizes downtime of Administration Server in case of a failure. The failover cluster is based on two identical instances of Kaspersky Security Center installed on two computers. One of the instances works as an active node and the other one is a passive node. The active node manages protection of the client devices, while the passive one is prepared to take all of the functions of the active node in case the active node fails. When a failure occurs, the passive node becomes active and the active node becomes passive.

Prerequisites

You have hardware that meets the requirements for the failover cluster.

Stages

Kaspersky applications deployment proceeds in stages:

Creating an account for Kaspersky Security Center services
Create a new domain group (in this scenario the name 'KLAdmins' is used for this group), and then grant the local administrator's permissions to the group on both nodes and on the file server. Then create two new domain user accounts, (in this scenario the names 'ksc' and 'rightless' are used for these accounts), and add the accounts to the KLAdmins domain group.

Add the user account, under which Kaspersky Security Center will be installed, to the previously created KLAdmins domain group.
File server preparation
Prepare the file server to work as a component of the Kaspersky Security Center failover cluster. Make sure that the file server meets the hardware and software requirements, create two shared folders for Kaspersky Security Center data, and configure permissions to access the shared folders.

How-to instructions: Preparing a file server for the Kaspersky Security Center failover cluster
Preparation of active and passive nodes
Prepare two devices with identical hardware and software to work as the active and passive nodes.

How-to instructions: Preparing nodes for the Kaspersky Security Center failover cluster
Database Management System (DBMS) installation
Select any of the supported DBMS, and then install the DBMS on a dedicated device. For information about how to install the DBMS refer to its documentation.
Kaspersky Security Center installation
Install Kaspersky Security Center in the failover cluster mode on both nodes. You must first install Kaspersky Security Center on the active node, and then install it on the passive one.

Additionally, you can install Kaspersky Security Center Web Console on a separate device that is not a cluster node.

How-to instructions: Installing Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes
Testing the failover cluster
Check that you configured the failover cluster correctly and that it works properly. For example, you can stop one of the Kaspersky Security Center services on the active node: kladminserver, klnagent, ksnproxy, klactprx, or klwebsrv. After the service is stopped, the protection management must be automatically switched to the passive node.

Results

The Kaspersky Security Center failover cluster is deployed. Please familiarize yourself with the events that lead to the switch between the active and passive nodes.

Upgrading Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes

Page top

[Topic 222358]

About the Kaspersky Security Center failover cluster

Hardware and software requirements

To deploy a Kaspersky Security Center failover cluster, you must have the following hardware:

Two devices with identical hardware and software. These devices will act as the active and passive nodes.
A file server that supports the CIFS/SMB protocol, version 2.0 or later. You must provide a dedicated device that will act as a file server.
Make sure you have provided high network bandwidth between the file server, and the active and passive nodes.
A device with Database Management System (DBMS).

Deployment schemes

You can choose one of the following schemes to deploy Kaspersky Security Center failover cluster:

A scheme that uses a secondary network adapter.
A scheme that uses a third-party load balancer.

A scheme that uses a secondary network adapter

Scheme legend:

Icon 1 on the deployment scheme. Administration Server sends data to the database. Open the necessary ports on the device where the database is located, for example, port 3306 for MySQL Server, or port 1433 for Microsoft SQL Server. Please refer to the DBMS documentation for the relevant information.

Icon 2 on the deployment scheme. On the managed devices, open the following ports: TCP 13000, UDP 13000, and TCP 17000.

A Kaspersky Security Center deployment scheme that includes a third-party load balancer.

A scheme that uses a third-party load balancer

Scheme legend:

Icon 1 on the deployment scheme. On the load balancer device, open all of the Administration Server ports: TCP 13000, UDP 13000, TCP 13291, TCP 13299, and TCP 17000.

Icon 2 on the deployment scheme. On the managed devices, open the following ports: TCP 13000, UDP 13000, and TCP 17000.

Icon 3 on the deployment scheme. Administration Server sends data to the database. Open the necessary ports on the device where the database is located, for example, port 3306 for MySQL Server, or port 1433 for Microsoft SQL Server. Please refer to the DBMS documentation for the relevant information.

Switch conditions

The failover cluster switches protection management of the client devices from the active node to the passive node if any of the following events occurs on the active node:

The active node is broken due to a software or hardware failure.
The active node was temporarily stopped for maintenance activities.
At least one of the Kaspersky Security Center services (or processes) failed or was deliberately terminated by user. The Kaspersky Security Center services are the following ones: kladminserver, klnagent, klactprx, and klwebsrv.
The network connection between the active node and the storage on the file server was interrupted or terminated.

Upgrading Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes

Page top

[Topic 222364]

Preparing a file server for a Kaspersky Security Center failover cluster

A file server works as a required component of a Kaspersky Security Center failover cluster.

To prepare a file server:

Make sure that the file server meets the hardware and software requirements.
Make sure that the file server and both nodes (active and passive) are included in the same domain or the file server is the domain controller.
On the file server, create two shared folders. One of them is used to keep information about the failover cluster state. The other one is used to store the data and settings of Kaspersky Security Center. You will specify paths to the shared folders while configuring the installation of Kaspersky Security Center.
Grant full access permissions (both share permissions and NTFS permissions) to the created shared folders for the following user accounts and groups:
- Domain group KLAdmins.
- User accounts $<node1> and $<node2>. Here, <node1> and <node2> are the device names of the active and passive nodes.

The file server is prepared. To deploy the Kaspersky Security Center failover cluster, follow the further instructions in this scenario.

Scenario: Deployment of a Kaspersky Security Center failover cluster

Page top

[Topic 222375]

Preparing nodes for a Kaspersky Security Center failover cluster

Prepare two devices to work as active and passive nodes for a Kaspersky Security Center failover cluster.

To prepare nodes for a Kaspersky Security Center failover cluster:

Make sure that you have two devices that meet the hardware and software requirements. These devices will act as the active and passive nodes of the failover cluster.
Make sure that the file server and both nodes are included in the same domain.
Do one of the following:
- On each of the nodes, configure a secondary network adapter.
  A secondary network adapter can be physical or virtual. If you want to use a physical network adapter, connect and configure it with standard operating system tools. If you want to use a virtual network adapter, create it by using third-party software.
  
  Ensure that the following conditions are met:
  - The secondary network adapters are disabled.
    You can create the secondary network adapters in the disabled state or disable them after creation.
  - The secondary network adapters on both nodes have the same IP address.
- Use a third-party load balancer. For example, you can use an nginx server. In this case, do the following:
  1. Provide a dedicated Linux-based device with nginx installed.
  2. Configure load balancing. Set the active node as the main server and the passive node as the backup server.
  3. On the nginx server, open all of the Administration Server ports: TCP 13000, UDP 13000, TCP 13291, TCP 13299, and TCP 17000.
Restart both nodes and the file server.
Map the two shared folders, that you created during the file server preparation step, to each of the nodes. You must map the shared folders as network drives. When mapping the folders, you can select any vacant drive letters. To access the shared folders, use the credentials of the user account that you created during step 1 of the scenario.

The nodes are prepared. To deploy the Kaspersky Security Center failover cluster, follow the further instructions of the scenario.

Scenario: Deployment of a Kaspersky Security Center failover cluster

Page top

[Topic 222473]

Installing Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes

Kaspersky Security Center is installed on both nodes of the Kaspersky Security Center failover cluster separately. First, you install the application on the active node, then on the passive one. When installing, you choose which node will be active and which will be passive.

Only a user from the KLAdmins domain group can install Kaspersky Security Center on every node.

To install Kaspersky Security Center on the active node of the Kaspersky Security Center failover cluster:

Run the ksc_15.1_<build number>_full_<language>.exe executable file.
A window opens and prompts you to select the Kaspersky applications to install. In the application selection window, click the Install Kaspersky Security Center Administration Server link to start the Administration Server setup wizard. Follow the instructions of the wizard.
Please carefully read the License Agreement and Privacy Policy. If you agree with all the terms of the License Agreement and the Privacy Policy, select the following check boxes in the I confirm I have fully read, understood, and accept the following section:
- The terms and conditions of this EULA
- Privacy Policy describing the handling of data
Installation of the application on your device will continue after you select both check boxes.

If you do not accept the License Agreement or the Privacy Policy, cancel installation by clicking the Cancel button.
Select Primary node of the Kaspersky Security Center failover cluster to install the application on the active node.
In the Shared folder window, do the following:
- In the State share and Data share fields, specify the paths to the shared folders that you created on the file server during its preparation.
- In the State share drive and Data share drive fields, select the network drives to which you mapped the shared folders during preparation of the nodes.
- Select the cluster connectivity mode: via a secondary network adapter or a third-party load balancer.
Perform other steps of custom installation, starting with step 3.
In step 13, specify the IP address of a secondary network adapter if you have created an adapter when preparing the cluster nodes. Otherwise, enter the IP address of the third-party load balancer that you use.

Kaspersky Security Center is installed on the active node.

To install Kaspersky Security Center on the passive node of the Kaspersky Security Center failover cluster:

Run the ksc_15.1_<build number>_full_<language>.exe executable file.
A window opens and prompts you to select the Kaspersky applications to install. In the application selection window, click the Install Kaspersky Security Center Administration Server link to start the Administration Server setup wizard. Follow the instructions of the wizard.
Please carefully read the License Agreement and Privacy Policy. If you agree with all the terms of the License Agreement and the Privacy Policy, select the following check boxes in the I confirm I have fully read, understood, and accept the following section:
- The terms and conditions of this EULA
- Privacy Policy describing the handling of data
Installation of the application on your device will continue after you select both check boxes.

If you do not accept the License Agreement or the Privacy Policy, cancel installation by clicking the Cancel button.
Select Secondary node of the Kaspersky Security Center failover cluster to install the application on the passive node.
In the Shared folder window, in the State share field, specify a path to the shared folder with information about the cluster state that you created on the file server during its preparation.
Click the Install button. When installation is over, click the Finish button.

Kaspersky Security Center is installed on the passive node. Now, you can test the Kaspersky Security Center failover cluster to make sure that you configured it correctly and that the cluster works properly.

Page top

[Topic 222447]

Starting and stopping cluster nodes manually

You may need to stop the entire Kaspersky Security Center failover cluster or temporarily detach one of the nodes of the cluster for maintenance. If this is the case, follow the instructions in this section. Do not try to start or stop the services or processes related to the failover cluster by using any other means. This may cause data loss.

Starting and stopping the entire failover cluster for maintenance

To start or stop the entire failover cluster:

On the active node, go to <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
Open the command line, and then run one of the following commands:
- To stop the cluster, run: klfoc -stopcluster --stp klfoc
- To start the cluster, run: klfoc -startcluster --stp klfoc

The failover cluster is started or stopped, depending on the command that you run.

Maintaining one of the nodes

To maintain one of the nodes:

On the active node, stop the failover cluster by using the klfoc -stopcluster --stp klfoc command.
On the node that you want to maintain, go to <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
Open command line, and then detach the node from the cluster by running the detach_node.cmd command.
On the active node, start the failover cluster by using the klfoc -startcluster --stp klfoc command.
Perform maintenance activities.
On the active node, stop the failover cluster by using the klfoc -stopcluster --stp klfoc command.
On the node that was maintained, go to <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
Open command line, and then attach the node to the cluster by running the attach_node.cmd command.
On the active node, start the failover cluster by using the klfoc -startcluster --stp klfoc command.

The node is maintained and attached to the failover cluster.

Scenario: Deployment of a Kaspersky Security Center failover cluster

Page top

[Topic 204942]

Installing Administration Server on a Windows Server failover cluster

The procedure of installing Administration Server on a failover cluster differs from both standard and custom installation on a stand-alone device.

Perform the procedure described in this section on the node that contains a common data storage of the cluster.

To install Kaspersky Security Center Administration Server on a cluster:

Run the ksc_<version number>.<build number>_full_<localization language>.exe executable file.

In this section

Step 1. Reviewing the License Agreement and Privacy Policy

Step 2. Selecting the type of installation on a cluster

Step 3. Specifying the name of the virtual Administration Server

Step 4. Specifying the network details of the virtual Administration Server

Step 5. Specifying a cluster group

Step 6. Selecting a cluster data storage

Step 7. Specifying an account for remote installation

Step 8. Selecting the components to be installed

Step 9. Selecting network size

Step 10. Selecting a database

Step 11. Configuring the SQL Server

Step 12. Selecting an authentication mode

Step 13. Selecting the account to start Administration Server

Step 14. Selecting the account for running the Kaspersky Security Center services

Step 15. Selecting a shared folder

Step 16. Configuring the connection to Administration Server

Step 17. Defining the Administration Server address

Step 18. Administration Server address for connection of mobile devices

Step 19. Unpacking and installing files on the hard drive

Page top

[Topic 67868_2]

Step 1. Reviewing the License Agreement and Privacy Policy

At this step of the setup wizard, you must read the License Agreement, which is to be concluded between you and Kaspersky, as well as the Privacy Policy.

You may also be prompted to view the License Agreements and Privacy Policies for application management plug-ins that are available in the Kaspersky Security Center distribution kit.

Please carefully read the License Agreement and Privacy Policy. If you agree with all the terms of the License Agreement and the Privacy Policy, confirm that by selecting the appropriate check boxes.

Installation of the application on your device will continue after you select both check boxes.

If you do not accept the License Agreement or the Privacy Policy, cancel installation by clicking the Cancel button.

Page top

[Topic 205038]

Step 2. Selecting the type of installation on a cluster

Select the type of installation on the cluster:

Cluster (install on all cluster nodes)
This is the recommended option. If you select this option, Administration Server will be installed on all nodes of the cluster simultaneously.

At the step of selecting the Administration Console for installation, you will need to select the console that will be installed on the current cluster node. If you install a console only on the cluster node, in case of node failure, you will lose access to Administration Server. We recommend that during this step, you select the MMC-based Administration Console for installation on all cluster nodes. After you install Administration Server, install Kaspersky Security Center Web Console on a separate device that is not a cluster node. This allows you to manage Administration Server by using Kaspersky Security Center Web Console if the cluster node fails.
Locally (install on this device only)
If you select this option, Administration Server will be installed only on the current node, as if on a stand-alone server, and Administration Server will not work as a cluster-aware application. For example, you may want to choose this option to save shared storage space if fault tolerance is not needed for Administration Server. In case of the current node failure, you will have to install Administration Server on another node and restore the Administration Server state from a backup.

Further steps are the same as when you use the standard or custom installation method, starting from the installation method selection step.

Page top

[Topic 205041]

Step 3. Specifying the name of the virtual Administration Server

Specify the network name of the new virtual Administration Server. You will be able to use this name to connect Administration Console or Kaspersky Security Center Web Console to Administration Server.

The name that you specify must differ from the cluster name.

Page top

[Topic 205044]

Step 4. Specifying the network details of the virtual Administration Server

To specify the network details of the new virtual Administration Server instance:

In Network to use, select the domain network to which the current cluster node is connected.
Do either of the following:
- If DHCP is used in the selected network to assign IP addresses, select the Use DHCP option.
- If DHCP is not used in the selected network, specify the required IP address.
  The IP address that you specify must differ from the cluster IP address.
Click Add to apply the specified settings.

You will be able to use the automatically assigned or the specified IP address to connect Administration Console or Kaspersky Security Center Web Console to Administration Server.

Page top

[Topic 205049]

Step 5. Specifying a cluster group

A cluster group is a special failover cluster role that contains common resources for all nodes. You have two options:

Creating a new cluster group.
This option is recommended in most cases. The new cluster group will contain all common resources that relate to the Administration Server instance.
Selecting an existing cluster group.
Select this option if you want to use a common resource that is already associated with an existing cluster group. For example, you may want to use this option if you want to use a storage associated with an existing cluster group and if there are no other available storage for a new cluster group.

Page top

[Topic 205064]

Step 6. Selecting a cluster data storage

To select a cluster data storage:

In Available repositories, select the data storage to which the common resources of the virtual Administration Server instance will be installed.
If the selected data storage contains several volumes, under Available sections on disk drive, select the required volume.
In Installation path, enter the path on the common data storage to which the resources of the virtual Administration Server instance will be installed.

The data storage is selected.

Page top

[Topic 205065]

Step 7. Specifying an account for remote installation

Specify the user name and password that will be used for remote installation of the virtual Administration Server instance on a passive node of the cluster.

The account that you specify must be granted administrative privileges on all nodes of the cluster.

Page top

[Topic 205067]

Step 8. Selecting the components to be installed

Select the components of Kaspersky Security Center Administration Server that you want to install:

Mobile Device Management. Select this check box if you must create installation packages for mobile devices when the Kaspersky Security Center setup wizard is running. You can also create installation packages for mobile devices manually, after Administration Server installation, by using Administration Console tools.
SNMP agent. This component receives statistical information for the Administration Server over the SNMP protocol. The component is available if the application is installed on a device with SNMP installed.
After Kaspersky Security Center is installed, the .mib files required for receiving statistics are located in the SNMP subfolder of the application installation folder.

Network Agent and Administration Console are not displayed in the component list. These components are installed automatically and you cannot cancel their installation.

Page top

[Topic 205068]

Step 9. Selecting network size

The following table lists the application installation settings and interface appearance settings, which are adjusted based on various network sizes.

Dependence of installation settings on the network scale selected

Settings	1—100 devices	101—1000 devices	1001—5000 devices	More than 5000 devices
Display with the node for secondary and virtual Administration Servers, and all settings related to the secondary and virtual Administration Servers in the console tree	Not available	Not available	Available	Available
Display with the Security sections in the properties windows of the Administration Server and administration groups	Not available	Not available	Available	Available
Random distribution of startup time for the update task on client devices	Not available	Over an interval of 5 minutes	Over an interval of 10 minutes	Over an interval of 10 minutes

Page top

[Topic 205069]

Step 10. Selecting a database

At this step of the wizard, select one of the following database management systems (DBMS) that will be used to store the Administration Server database:

Microsoft SQL Server or SQL Server Express
MySQL or MariaDB
PostgreSQL or Postgres Pro

Page top

[Topic 205070]

Step 11. Configuring the SQL Server

At this step of the wizard, specify the following connection settings, depending on the database management system (DBMS) that you have selected:

If you selected Microsoft SQL Server or SQL Server Express in the previous step:
- In the SQL Server instance name field, specify the name of the SQL Server on the network. To view a list of all SQL Servers that are on the network, click the Browse button. This field is blank by default.
  If you connect to the SQL Server through a custom port, then together with the SQL Server host name specify the port number separated with a comma, for example:
  
  SQL_Server_host_name,1433
  
  If you secure communication between the Administration Server and SQL Server by means of a certificate, specify in the SQL Server instance name field the same host name that was used at the certificate generating. If you use a named instance of SQL Server, then together with the SQL Server host name specify the port number separated with a comma, for example:
  
  SQL_Server_name,1433
  
  If you use several instances of SQL Server on the same host, then additionally specify the instance name separated with a backslash, for example:
  
  SQL_Server_name\SQL_Server_instance_name,1433
  
  If a SQL Server on the enterprise network has the Always On feature enabled, specify the name of the availability group listener in the SQL Server instance name field. Note that Administration Server supports only the synchronous-commit availability mode when the Always On feature is enabled.
- In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.
If at this stage you want to install SQL Server on the device from which you are installing Kaspersky Security Center, you must stop installation and restart it after SQL Server is installed. The supported SQL Server versions are listed in the system requirements.

If you want to install SQL Server on a remote device, you do not have to interrupt the Kaspersky Security Center setup wizard. Install SQL Server and resume installation of Kaspersky Security Center.
If you selected MySQL or MariaDB in the previous step:
- In the SQL Server instance name field, specify the name of the DBMS instance. By default, the name is the IP address of the device on which Kaspersky Security Center is to be installed.
- In the Port field, specify the port for Administration Server connection to the DBMS. The default port number is 3306.
- In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.
If you selected PostgreSQL or Postgres Pro in the previous step:
- In the PostgreSQL or Postgres Pro Server field, specify the name of the DBMS instance. By default, the name is the IP address of the device on which Kaspersky Security Center is to be installed.
- In the Port field, specify the port for the Administration Server connection to the DBMS. The default port number is 5432.

In the Database name field, specify the name of the DBMS that has been created to store Administration Server data. The default value is KAV.

Page top

[Topic 205071]

Step 12. Selecting an authentication mode

Determine the authentication mode that will be used when Administration Server connects to the database management system (DBMS).

Depending on the DBMS that is selected, you can choose from the following authentication modes:

For SQL Express or Microsoft SQL Server select one of the following options:
- Microsoft Windows Authentication mode. Verification of rights uses the account used for starting Administration Server.
- SQL Server Authentication mode. If you select this option, the account specified in the window is used to verify access rights. Fill in the Account and Password fields.
  To see the entered password, click and hold the Show button.
For both authentication modes, the application checks if the database is available. If the database is not available, an error message is displayed, and you have to provide correct credentials.

If the Administration Server database is stored on another device and the Administration Server account does not have access to the database server, you must use SQL Server authentication mode when installing or upgrading Administration Server. This may occur when the device that stores the database is outside the domain or when Administration Server is installed under a LocalSystem account.

For MySQL, MariaDB, PostgreSQL, or Postgres Pro, specify the account and password.

Page top

[Topic 205073]

Step 13. Selecting the account to start Administration Server

Select the account that will be used to start Administration Server as a service.

Generate the account automatically. The application creates an account named KL-AK-*, under which the kladminserver service will run.
You can select this option if you plan to locate the shared folder and the DBMS on the same device as Administration Server.
Select an account. The Administration Server service (kladminserver) will run under the account that you selected.
You will have to select a domain account if, for example, you plan to use as the DBMS a SQL Server instance of any version, including SQL Express, that is located on another device, and/or you plan to locate the shared folder on another device.

Kaspersky Security Center supports managed service accounts (MSA) and group managed service accounts (gMSA). If these types of accounts are used in your domain, you can select one of them as the account for the Administration Server service.

Before specifying MSA or gMSA, you must install the account on the same device on which you want to install Administration Server. If the account is not installed yet, then cancel the Administration Server installation, install the account, and then restart the Administration Server installation. For details about installation of managed service accounts on a local device, refer to the official Microsoft documentation.

To specify MSA or gMSA:
1. Click the Browse button.
2. In the window that opens, click the Object type button.
3. Select the Account for services type and click OK.
4. Select the relevant account and click OK.

The account that you selected must have different permissions, depending on the DBMS that you plan for use.

For security reasons, please do not assign the privileged status to the account under which you run Administration Server.

The Administration Server account cannot be changed later. You need to reinstall the failover cluster to use another Administration Server account.

Page top

[Topic 205074]

Step 14. Selecting the account for running the Kaspersky Security Center services

Select the account under which the services of Kaspersky Security Center will run on this device:

Generate the account automatically. Kaspersky Security Center creates a local account named KlScSvc on this device in the kladmins group. The services of Kaspersky Security Center will be run under the account that has been created.
Select an account. The Kaspersky Security Center services will be run under the account that you selected.
You will have to select a domain account if, for example, you intend to save reports to a folder located on a different device or if this is required by your organization's security policy. You may also have to select a domain account if you install Administration Server on a failover cluster.

For security reasons, do not grant privileged status to the account under which the services are run.

The KSN proxy service (ksnproxy), Kaspersky activation proxy service (klactprx), and Kaspersky authentication portal service (klwebsrv) will be run under the selected account.

Page top

[Topic 205077]

Step 15. Selecting a shared folder

Define the location and name of the shared folder that will be used to do the following:

Store the files necessary for remote installation of applications (these files are copied to Administration Server during creation of installation packages).
Store updates that have been downloaded from an update source to Administration Server.

File sharing (read-only) will be enabled for all users.

You can select either of the following options:

Create a shared folder. Create a new folder. In the text box, specify the path to the folder.
Select an existing shared folder. Select a shared folder that already exists.

By default, the installer creates a local Share subfolder in the application folder that contains the components of Kaspersky Security Center.

You can define a shared folder later if needed.

Page top

[Topic 205079]

Step 16. Configuring the connection to Administration Server

Expand all | Collapse all

Configure the connection to Administration Server:

Port
The number of the port used to connect to the Administration Server.

The default port number is 14000.
SSL port
Secure Sockets Layer (SSL) port number used to securely connect to the Administration Server via SSL.

The default port number is 13000.
Encryption key length
Select the length of the encryption key: 1024 bit or 2048 bit.

A 1024-bit encryption key places a smaller load on the CPU, but it is considered obsolete because it cannot provide reliable encryption due to its technical specifications. Also, the existing hardware probably will turn out to be incompatible with SSL certificates featuring 1024-bit keys.

A 2048-bit encryption key meets all state-of-the-art encryption standards. However, use of a 2048-bit encryption key may add to the load on a CPU.

By default, 2048 bit (best security) is selected.

You can also change the parameters for connecting to Administration Server later as follows:

You can change port and SSL port numbers in the Connection ports section of the Administration Server properties. For more information about Administration Server connection ports, see Ports used by Kaspersky Security Center.
You can change the encryption key length when replacing the Administration Server certificate with the klsetsrvcert utility by using the -o RsaKeyLen:<key length> parameter.

Page top

[Topic 205081]

Step 17. Defining the Administration Server address

Specify the Administration Server address. You can select one of the following options:

DNS domain name. You can use this method if the network includes a DNS server and client devices can use it to receive the Administration Server address.
NetBIOS name. You can use this method if client devices receive the Administration Server address using the NetBIOS protocol or if a WINS server is available on the network.
IP address. You can use this method if Administration Server has a static IP address that will not be subsequently changed.

Page top

[Topic 205083]

Step 18. Administration Server address for connection of mobile devices

This setup wizard step is available if you have selected Mobile Device Management for installation.

Page top

[Topic 205153]

Step 19. Unpacking and installing files on the hard drive

After the installation of Kaspersky Security Center components is configured, you can start installing files on the hard drive.

On the last page, you can select which console to start for work with Kaspersky Security Center:

Start MMC-based Administration Console
Start Kaspersky Security Center Web Console
This option is available only if you opted to install Kaspersky Security Center Web Console in one of the previous steps.

You can also click Finish to close the wizard without starting work with Kaspersky Security Center. You can start the work later at any time.

At the first startup of Administration Console or Kaspersky Security Center Web Console, you can perform the initial setup of the application.

Page top

[Topic 73098]

Installing Administration Server in silent mode

Administration Server can be installed in silent mode, that is, without the interactive input of installation settings.

To install Administration Server on a local device in silent mode:

Read the End User License Agreement. Use the command below only if you understand and accept the terms of the End User License Agreement.
Read the Privacy Policy. Use the command below only if you understand and agree that your data will be handled and transmitted (including to third countries) as described in the Privacy Policy.
Run the command
setup.exe /s /v"DONT_USE_ANSWER_FILE=1 EULA=1 PRIVACYPOLICY=1 <setup_parameters>"

where setup_parameters is a list of parameters and their respective values, separated with spaces (PARAM1=PARAM1VAL PARAM2=PARAM2VAL). The setup.exe file is located in the Server folder, which is part of the Kaspersky Security Center distribution kit.

The names and possible values for parameters that can be used when installing Administration Server in silent mode are listed in the table below.

Parameters of Administration Server installation in silent mode

Parameter name	Parameter description	Available values
EULA	Acceptance of the terms of the License Agreement.	1—I have fully read, understand and accept the terms of the End User License Agreement. Other value or no value—I do not accept the terms of the License Agreement (installation is not performed).
PRIVACYPOLICY	Acceptance of the terms of the Privacy Policy.	1—I am aware and agree that my data will be handled and transmitted (including to third countries) as described in the Privacy Policy. I confirm that I have fully read and understand the Privacy Policy. Other value or no value—I do not accept the terms of the Privacy Policy (installation is not performed).
INSTALLATIONMODETYPE	Type of Administration Server installation.	Standard—Standard installation. Custom—Custom installation.
INSTALLDIR	Path to the Administration Server installation folder.	String value.
ADDLOCAL	List of Administration Server components (separated with commas) to be installed.	CSAdminKitServer, NAgent, CSAdminKitConsole, NSAC, MobileSupport, KSNProxy, SNMPAgent, GdiPlusRedist, Microsoft_VC90_CRT_x86, Microsoft_VC100_CRT_x86. Minimum list of components sufficient for proper Administration Server installation: `ADDLOCAL=CSAdminKitServer, CSAdminKitConsole, KSNProxy, Microsoft_VC90_CRT_x86, Microsoft_VC100_CRT_x86`.
NETRANGETYPE	Network size (number of devices on the network).	NRT_1_100—From 1 to 100 devices. NRT_100_1000—From 101 to 1000 devices. NRT_GREATER_1000—More than 1000 devices.
SRV_ACCOUNT_TYPE	Mode for specifying the account under which Administration Server will be run as a service.	SrvAccountDefault —The account is created automatically. SrvAccountUser —The account is specified manually. In this case, you must specify values for the `SERVERACCOUNTNAME` and `SERVERACCOUNTPWD` parameters.
SERVERACCOUNTNAME	Name of the account under which Administration Server will be run as a service. You must specify a value for the parameter if SRV_ACCOUNT_TYPE=SrvAccountUser.	String value.
SERVERACCOUNTPWD	Password of the account that will be used to start Administration Server as a service. You must specify a value for the parameter if SRV_ACCOUNT_TYPE=SrvAccountUser.	String value.
SERVERCER	Size of the key for the Administration Server certificate (bits).	1—The size of the key for the Administration Server certificate is 2048 bits. No value —The size of the key for the Administration Server certificate is 1024 bits.
DBTYPE	Type of database that will be used to store the Administration Server database. This parameter is required.	MySQL—A MySQL or MariaDB database will be used. In this case, you must specify values for the `MYSQLSERVERNAME`, `MYSQLSERVERPORT`, `MYSQLDBNAME`, `MYSQLACCOUNTNAME`, and `MYSQLACCOUNTPWD` parameters. MSSQL—A Microsoft SQL Server (SQL Express) database will be used. In this case, you must specify values for the `MSSQLSERVERNAME`, `MSSQLDBNAME`, and `MSSQLAUTHTYPE` parameters. POSTGRES—A PostgreSQL or Postgres Pro database will be used. In this case, you must specify values for the `POSTGRESSERVERNAME`, `POSTGRESSERVERPORT`, `POSTGRESDBNAME`, `POSTGRESACCOUNTNAME`, and `POSTGRESACCOUNTPWD` parameters.
MYSQLSERVERNAME	Full name of the SQL Server. You must specify a value for the parameter if DBTYPE=MySQL.	String value.
MYSQLSERVERPORT	Number of the port for connecting to the SQL Server. You must specify a value for the parameter if DBTYPE=MySQL.	Numerical value.
MYSQLDBNAME	Name of the database that will be created to store Administration Server data. You must specify a value for the parameter if DBTYPE=MySQL.	String value.
MYSQLACCOUNTNAME	Name of the account for connection to the database. You must specify a value for the parameter if DBTYPE=MySQL.	String value.
MYSQLACCOUNTPWD	Password of the account for connecting to the database. You must specify a value for the parameter if DBTYPE=MySQL.	String value.
MSSQLSERVERNAME	Full name of the SQL Server. You must specify a value for the parameter if DBTYPE=MSSQL.	String value.
MSSQLDBNAME	Name of the database. You must specify a value for the parameter if DBTYPE=MSSQL.	String value.
MSSQLAUTHTYPE	Type of authorization when connecting to the SQL Server. You must specify a value for the parameter if DBTYPE=MSSQL.	Windows—Microsoft Windows Authentication mode. SQLServer—SQL Server Authentication mode. In this case, you must specify values for the `MSSQLACCOUNTNAME` and `MSSQLACCOUNTPWD` parameters.
MSSQLACCOUNTNAME	Name of the account for connection to the SQL Server. You must specify a value for the parameter if MSSQLAUTHTYPE=SQLServer.	String value.
MSSQLACCOUNTPWD	Password of the account for connection to the SQL Server. You must specify a value for the parameter if MSSQLAUTHTYPE=SQLServer.	String value.
CREATE_SHARE_TYPE	Method of specifying the shared folder.	Create—Create a new shared folder. In this case, you must specify values for the `SHARELOCALPATH` and `SHAREFOLDERNAME` parameters. ChooseExisting—Select an existing folder. In this case, you must specify a value for the `EXISTSHAREFOLDERNAME` parameter.
SHARELOCALPATH	Full path to a local folder. You must specify a value for the parameter if CREATE_SHARE_TYPE=Create	String value.
SHAREFOLDERNAME	Network name of a shared folder. You must specify a value for the parameter if CREATE_SHARE_TYPE=Create.	String value.
EXISTSHAREFOLDERNAME	Full path to an existing shared folder. You must specify a value for the parameter if CREATE_SHARE_TYPE=ChooseExisting.	String value.
SERVERPORT	Port number to connect to Administration Server.	Numerical value.
SERVERSSLPORT	Number of the port for encrypted connection to Administration Server by using SSL protocol.	Numerical value.
SERVERADDRESS	Administration Server address.	String value.
MOBILESERVERADDRESS	Administration Server address for connection of mobile devices.	String value.

For a detailed description of the Administration Server setup parameters, please refer to the Custom installation section.

See also:

Main installation scenario

Page top

[Topic 56214]

Installing Administration Console on the administrator's workstation

You can install Administration Console on the administrator's workstation separately and manage Administration Server over the network using that Console.

To install Administration Console on the administrator's workstation:

Run the setup.exe executable file.
A window opens prompting you to select Kaspersky applications to install.
In the application selection window, click the Install only Kaspersky Security Center Administration Console link to run the Administration Console setup wizard. Follow the instructions of the wizard.
Select a destination folder. By default, this will be <Disk>:\Program Files\Kaspersky Lab\Kaspersky Security Center Console. If such a folder does not exist, it is created automatically during the installation. You can change the destination folder by using the Browse button.
On the last page of the setup wizard click the Start button to start installation of Administration Console.

When the wizard completes, Administration Console will be installed on the administrator's workstation.

To install Administration Console on the administrator's workstation in silent mode:

Read the End User License Agreement. Use the command below only if you understand and accept the terms of the End User License Agreement.
In the Distrib\Console folder of the Kaspersky Security Center distribution kit, run the setup.exe file by using the following command:
setup.exe /s /v"EULA=1"

If you want to install all management plug-ins from the Distrib\Console\Plugins folder together with the Administration Console, run the following command:

setup.exe /s /v"EULA=1" /pALL

If you want to specify which management plug-ins to install from the Distrib\Console\Plugins folder together with the Administration Console, specify the plug-ins after the "/p" key and separate them with a semicolon:

setup.exe /s /v"EULA=1" /pP1;P2;P3

where P1, P2, P3 are plug-in names that correspond to the plug-in folder names in the Distrib\Console\Plugins folder. For example:

setup.exe /s /v"EULA=1" /pKES4Mac;KESS;MDM4IOS

Administration Console and the management plug-ins (if any) will be installed on the administrator's workstation.

After installing Administration Console, you must connect to the Administration Server. To do this, run Administration Console and, in the window that opens, specify the name or the IP address of the device on which Administration Server is installed, as well as the settings of the account used to connect to it. After connection to Administration Server is established, you can manage the anti-virus protection system using this Administration Console.

You can remove Administration Console with standard Microsoft Windows add / remove tools.

See also:

Main installation scenario

Page top

[Topic 25950]

Changes in the system after Kaspersky Security Center installation

Administration Console icon

After Administration Console is installed on your device, its icon appears, allowing you to start Administration Console. You can find Administration Console in the Start → Programs → Kaspersky Security Center menu.

Administration Server and Network Agent services

Administration Server and Network Agent are installed on the device as services with the properties listed below. The table also contains the attributes of other services that apply on the device after Administration Server installation.

Properties of Kaspersky Security Center services

Component	Service name	Displayed service name	Account
Administration Server	kladminserver	Kaspersky Security Center Administration Server	User-defined or dedicated non-privileged account in KL-AK-* format created during installation
Network Agent	klnagent	Kaspersky Security Center Network Agent	Local system
Web Server for accessing Kaspersky Security Center Web Console and administering the organization's intranet	klwebsrv	Kaspersky web server	Dedicated unprivileged KlScSvc account
Activation proxy server	klactprx	Kaspersky activation proxy server	Dedicated unprivileged KlScSvc account
KSN proxy server	ksnproxy	Kaspersky Security Network proxy server	Dedicated unprivileged KlScSvc account

If you install Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes, the klfocsvc_klfoc service becomes available. The klnagent_klfoc and klfocsvc_klfoc services run under the Local system account. The kladminserver_klfoc service must be run under the 'ksc' account, and other services run under the 'rightless' account. The 'ksc' and 'rightless' accounts must be added in the KLAdmins group with the local administrator's permissions. For correct work of Kaspersky Security Center, you must use only the 'ksc' and 'rightless' accounts for running services. We do not recommend using other accounts with the same rights. The table below contains the properties of services that are applied on the device after Administration Server is installed on the Kaspersky Security Center failover cluster.

Properties of services of Kaspersky Security Center installed in the Kaspersky Security Center failover cluster

Component	Service name	Displayed service name	Account
Administration Server	kladminserver_klfoc	Kaspersky Security Center Administration Server	ksc
Network Agent	klnagent_klfoc	Kaspersky Security Center Network Agent	Local system
Web Server for accessing Kaspersky Security Center Web Console and administering the organization's intranet	klwebsrv_klfoc	Kaspersky web server	rightless
Activation proxy server	klactprx_klfoc	Kaspersky activation proxy server	rightless
KSN proxy server	ksnproxy_klfoc	Kaspersky Security Network proxy server	rightless
Kaspersky Security Center failover cluster	klfocsvc_klfoc	Kaspersky Security Center failover cluster	Local system

Kaspersky Security Center Web Console services

If you install Kaspersky Security Center Web Console on the device, then the following services are deployed (see the table below):

Kaspersky Security Center Web Console services

Displayed service name	Account
Kaspersky Security Center Service Web Console	NT Service/KSCSvcWebConsole
Kaspersky Security Center Web Console	Network service
Kaspersky Security Center Product Plugins Server	NT Service/KSCWebConsolePlugin
Kaspersky Security Center Web Console Management Service	Local system
Kaspersky Security Center Web Console Message Queue	NT Service/KSCWebConsoleMessageQueue

Network Agent server version

The server version of Network Agent will be installed on the device together with Administration Server. The server version of Network Agent is part of Administration Server, is installed and removed together with Administration Server, and can only interact with a locally installed Administration Server. You do not have to configure the connection of Network Agent to Administration Server: configuration is implemented programmatically because the components are installed on the same device. The server version of Network Agent is installed with the same properties as the standard Network Agent and performs the same application management functions. This version will be managed by the policy of the administration group to which the client device of Administration Server belongs. For the server version of Network Agent all tasks are created from the scope of those provided for Administration Server, except for the Server change task.

Network Agent cannot be installed separately on a device that already has Administration Server installed.

You can view the properties of each service of Administration Server and Network Agent, as well as monitor their operation using standard Microsoft Windows management tools: Computer management\Services. Information about the activity of the Kaspersky Administration Server service is stored in the Microsoft Windows system log in a separate Kaspersky Event Log branch on the device where the Administration Server is installed.

We recommend that you avoid starting and stopping services manually and leave service accounts in the service settings unchanged. If necessary, you can modify the Administration Server service account using the klsrvswch utility. Note that you must launch the klsrvswch utility on the Administration Server device under the account with administrator rights that was used to install Administration Server.

User accounts and security groups

The Administration Server Installer creates the following accounts by default:

KL-AK-*: Administration Server service account
KlScSvc: Account for other services from the Administration Server pool
KlPxeUser: Account for deployment of operating systems

If you selected other accounts for the Administration Server service and other services while running the Installer, the specified accounts are used.

Local security groups named KLAdmins and KLOperators with their respective sets of rights are also created automatically on the device that has Administration Server installed.

It is not recommended to install the Administration Server on a domain controller; however, if you install Administration Server on the domain controller, you must start the installer with the domain administrator rights. In this case, the installer automatically creates domain security groups named KLAdmins and KLOperators. If you install Administration Server on a device that is not the domain controller, you must start the installer with the local administrator rights instead. In this case, the installer automatically creates local security groups named KLAdmins and KLOperators.

When configuring email notifications, you may have to create an account on the mail server for ESMTP authentication.

See also:

Accounts for work with the DBMS

Page top

[Topic 6372]

Removing the application

You can remove Kaspersky Security Center with standard Microsoft Windows add/remove tools. Removing the application requires starting a wizard that removes all application components from the device (including plug-ins). The wizard makes your default browser open a web page with a poll where you can tell us why you chose to stop using Kaspersky Security Center. If you have not selected removal of the shared folder (Share) during the wizard operation, you can delete it manually after completion of all related tasks.

After the application is removed, some of its files may remain in the system's temporary folder.

The Application removal task creation wizard will suggest that you store a backup copy of Administration Server.

When the application is removed from Microsoft Windows 7 and Microsoft Windows 2008, premature termination of the Application removal task creation wizard might occur. This can be avoided by disabling the User Account Control (UAC) in the operating system and restarting application removal.

Page top

[Topic 235425]

About upgrading Kaspersky Security Center

This section contains information on how to upgrade Kaspersky Security Center from a previous version. You can upgrade Kaspersky Security Center in different ways, depending on whether Kaspersky Security Center was installed locally or on the Kaspersky Security Center failover cluster nodes.

During the upgrade, concurrent use of the DBMS by Administration Server and another application is strictly forbidden.

Note that if you upgrade the Administration Server to the version 15.1, you will not be able to create new installation packages of Network Agent version 15 or earlier. However, previously created installation packages will be available.

When you upgrade Kaspersky Security Center from a previous version, all the installed plug-ins of supported Kaspersky applications are kept. The Administration Server plug-in and Network Agent plug-in are upgraded automatically (both for the Administration Console and Kaspersky Security Center Web Console).

In this section

Upgrading Kaspersky Security Center from a previous version

Upgrading Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes

Upgrading Kaspersky Security Center on the Microsoft failover cluster nodes

Page top

[Topic 6373]

Upgrading Kaspersky Security Center from a previous version

The following topic describes recommended preparation steps for the upgrade: Upgrading Kaspersky Security Center and managed security applications.

You can install version 15.1 of Administration Server on a device that has an earlier version of Administration Server installed (starting from version 11 (11.0.0.1131b)). When upgrading to version 15.1, all data and settings from the previous version of Administration Server are preserved.

If problems occur during Administration Server installation, you can restore the previous version of Administration Server using the backup copy of the Administration Server data created before the upgrade.

If at least one Administration Server of the new version has been installed on the network, you can upgrade other Administration Servers on the network using the remote installation task that uses the Administration Server installation package.

If you deployed the Kaspersky Security Center failover cluster, you can also upgrade Kaspersky Security Center on its nodes.

To upgrade an earlier version of Administration Server to version 15.1:

Run the ksc_15.1_<build number>_full_<language>.exe installation file for version 15.1 (you can download this file from the Kaspersky website).
In the window that opens, click the Install Kaspersky Security Center link to start the Administration Server setup wizard. Follow the instructions of the wizard.
Read the License Agreement and Privacy Policy. If you agree with all the terms of the License Agreement and the Privacy Policy, select the following check boxes in the I confirm I have fully read, understood, and accept the following section:
- The terms and conditions of this EULA
- Privacy Policy describing the handling of data
Installation of the application on your device will continue after you select both check boxes. The setup wizard prompts you to create a backup of the Administration Server data for the earlier version.

Kaspersky Security Center supports data recovery from a backup created with an older version of Administration Server.
If you want to create a backup of the Administration Server data, specify this in the Backup of Administration Server data window that opens.
A backup is created by the klbackup utility. This utility is included in the distribution kit, and is located at the root of the Kaspersky Security Center installation folder.
Install Administration Server version 15.1 by following the setup wizard.
If a message appears that the Kaspersky Security Center Web Console service is busy, click the Ignore button in the wizard window.

We recommend that you avoid terminating the setup wizard. If you cancel the upgrade at the step of Administration Server installation may cause the upgraded version of Kaspersky Security Center to fail.
For devices on which the earlier version of Network Agent is installed, create and run the task for remote installation of the new version of Network Agent.
We recommend that you upgrade the Network Agent for Linux to the same version as Kaspersky Security Center.

After completion of the remote installation task, the Network Agent version is upgraded.

See also

Main installation scenario

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 235429]

Upgrading Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes

You can install Administration Server version 15.1 on every Kaspersky Security Center failover cluster node that has an earlier version of the Administration Server installed (starting from version 13.2). When upgrading to version 15.1, all data and settings from the previous version of Administration Server are preserved.

If you previously installed Kaspersky Security Center on devices locally, you can also upgrade Kaspersky Security Center on these devices.

To upgrade Kaspersky Security Center on the Kaspersky Security Center failover cluster nodes:

Perform the following actions on the active node of the cluster:
1. Run the ksc_15.1_<build number>_full_<language>.exe executable file.
  A window opens and prompts you to select the Kaspersky applications to upgrade. Click the Install Kaspersky Security Center Administration Server link to start the Administration Server setup wizard. Follow the wizard instructions.
2. Read the License Agreement and Privacy Policy. If you agree with all the terms of the License Agreement and the Privacy Policy, select the following check boxes in the I confirm I have fully read, understood, and accept the following section:
  - The terms and conditions of this EULA
  - Privacy Policy describing the handling of data
  Select both check boxes to continue the installation.
  
  If you do not accept the License Agreement or Privacy Policy, click the Cancel button to cancel the upgrade.
Perform the same actions on the Kaspersky Security Center failover cluster's passive node as on the active node.
Start the cluster.

As a result, you installed the latest version of the Administration Server on the Kaspersky Security Center failover cluster nodes.

Page top

[Topic 279317]

Upgrading Kaspersky Security Center on the Microsoft failover cluster nodes

You can upgrade Administration Server version 15.1 on every Microsoft failover cluster node that has an earlier version of the Administration Server installed (starting from version 13.2). When upgrading to version 15.1, all data and settings from the previous version of Administration Server are preserved.

To upgrade Kaspersky Security Center on the Microsoft failover cluster nodes, perform the following actions on any node of the cluster:

Run the ksc_15.1_<build number>_full_<language>.exe executable file.
A window opens and prompts you to select the Kaspersky applications to upgrade. Click the Install Kaspersky Security Center Administration Server link to start the Administration Server setup wizard. Follow the wizard instructions.
Read the License Agreement and Privacy Policy. If you agree with all the terms of the License Agreement and the Privacy Policy, select the following check boxes in the I confirm I have fully read, understood, and accept the following section:
- The terms and conditions of this EULA
- Privacy Policy describing the handling of data
Select both check boxes to continue the installation.

If you do not accept the License Agreement or Privacy Policy, click the Cancel button to cancel the upgrade.
In the Type of installation on cluster window, select the Cluster (install on all cluster nodes).
Next, the installer configures and finishes upgrading the Administration Server on all nodes of the cluster. During the upgrade, the Administration Server settings cannot be changed.

As a result, you installed the latest version of the Administration Server on the Microsoft failover cluster nodes.

Page top

[Topic 171271]

Initial setup of Kaspersky Security Center

This section describes steps you must take after the Kaspersky Security Center installation to perform its initial setup.

In this section

Hardening Guide

Administration Server quick start wizard

Configuring the connection of Administration Console to Administration Server

Configuring the internet access settings for Administration Server

Connecting out-of-office devices

Encrypt communication with TLS

Configuring the interface

Page top

[Topic 236687]

Hardening Guide

The Hardening Guide is intended for professionals who install and administer Kaspersky Security Center, as well as for those who provide technical support to organizations that use Kaspersky Security Center.

The Hardening Guide describes recommendations and features of configuring Kaspersky Security Center and its components, aimed to reduce the risks of its compromise.

Before configuring, create a Kaspersky Security Center Administration Server backup copy by using the Backup of Administration Server data task or the klbackup utility and save it in a safe location.

The Hardening Guide includes the following information:

Selecting the Administration Server architecture
Configuring a secure connection to Administration Server
Configuring accounts to access Administration Server
Managing protection of Administration Server and client devices
Configuring protection for managed applications
Administration Server maintenance
Transferring information to third-party applications

Before you start to work with Administration Server, Kaspersky Security Center prompts you to read the brief version of the Hardening Guide.

Note that you cannot use Administration Server until you confirm that you have read the Hardening Guide.

To read the Hardening Guide:

Open Administration Console or Kaspersky Security Center Web Console and log in to the console. The console checks whether you confirmed reading the current version of the Hardening Guide.
If you have not yet read the Hardening Guide, a window opens and displays a brief version of it.
Do one of the following:
- If you want to view the brief version of the Hardening Guide as a text document, click the Open in new window link.
- If you want to view the full version of the Hardening Guide, click the Open the Hardening guide in Online Help link.
After you read the Hardening Guide, select the I confirm that I have fully read and understand the Hardening guide check box, and then click the Accept button.

Now, you can work with Administration Server.

When a new version of the Hardening Guide appears, Kaspersky Security Center will prompt you to read it.

Page top

[Topic 3177]

Administration Server quick start wizard

This section provides information about the Administration Server quick start wizard.

In this section

About quick start wizard

Starting Administration Server quick start wizard

Step 1. Configuring a proxy server

Step 2. Selecting the application activation method

Step 3. Selecting the protection areas and operating systems

Step 4. Selecting plug-ins for managed applications

Step 5. Downloading distribution packages and creating installation packages

Step 6. Configuring Kaspersky Security Network usage

Step 7. Configuring email notifications

Step 8. Configuring update management

Step 9. Creating an initial protection configuration

Step 10. Connecting mobile devices

Step 11. Downloading updates

Step 12. Device discovery

Step 13. Closing the quick start wizard

See also:

Main installation scenario

Page top

[Topic 191740]

About quick start wizard

This section provides information about the Administration Server quick start wizard.

Administration Server quick start wizard allows you to create a minimum of necessary tasks and policies, adjust a minimum of settings, download and install plug-ins for managed Kaspersky applications, and create installation packages of managed Kaspersky applications. When the wizard is running, you can make the following changes to the application:

Download and install plug-ins for managed applications. After the quick start wizard has finished, the list of installed management plug-ins is displayed in the Advanced → Details of application management plug-ins installed section of the Administration Server properties window.
Create installation packages of managed Kaspersky applications. After the quick start wizard has finished, installation packages of Network Agent for Windows and managed Kaspersky applications are displayed in the Administration Server → Advanced → Remote installation → Installation packages list.
Add key files or enter activation codes that can be automatically distributed to devices within administration groups. After the quick start wizard has finished, information about license keys is displayed in the Administration Server → Kaspersky Licenses list and in the License keys section of the Administration Server properties window.
Configure interaction with Kaspersky Security Network
(KSN)
An infrastructure of cloud services that provides access to the Kaspersky database with constantly updated information about the reputation of files, web resources, and software. Kaspersky Security Network ensures faster responses by Kaspersky applications to threats, improves the performance of some protection components, and reduces the likelihood of false positives.

An infrastructure of cloud services that provides access to the Kaspersky database with constantly updated information about the reputation of files, web resources, and software. Kaspersky Security Network ensures faster responses by Kaspersky applications to threats, improves the performance of some protection components, and reduces the likelihood of false positives.

.
Set up email delivery of notifications of events that occur during operation of Administration Server and managed applications (successful notification delivery requires that the Messenger service run on the Administration Server and all recipient devices). After the quick start wizard has finished, the email notifications settings are displayed in the Notification section of the Administration Server properties window.
Adjust the update settings and vulnerability fix settings for applications installed on devices.
Create a protection policy for workstations and servers, as well as malware scan tasks, update download tasks, and data backup tasks, for the top level of the hierarchy of managed devices. After the quick start wizard has finished, the created tasks are displayed in the Administration Server → Tasks list, the policies corresponding to the plug-ins for managed applications are displayed in the Administration Server → Policies list.

The quick start wizard creates policies for managed applications, such as Kaspersky Endpoint Security for Windows, unless such policies are already created for the Managed devices group. The quick start wizard creates tasks if tasks with the same names do not exist for the Managed devices group.

In Administration Console, Kaspersky Security Center automatically prompts you to run the quick start wizard after you have started it for the first time. You can also start the quick start wizard manually at any time.

Page top

[Topic 179835]

Starting Administration Server quick start wizard

The application automatically prompts you to run the quick start wizard after Administration Server installation, at the first connection to it. You can also start the quick start wizard manually at any time.

To start the quick start wizard manually:

In the console tree, select the Administration Server node.
In the context menu of the node, select All Tasks → Administration Server quick start wizard.

The wizard prompts you to perform initial configuration of the Administration Server. Follow the instructions of the wizard.

If you start the quick start wizard again, tasks and policies created at the previous run of the wizard cannot be created again.

Page top

[Topic 148954]

Step 1. Configuring a proxy server

Expand all | Collapse all

Specify the internet access settings for Administration Server. You must configure internet access to use Kaspersky Security Network and to download updates of anti-virus databases for Kaspersky Security Center and managed Kaspersky applications.

Select the Use proxy server option if you want to use a proxy server when connecting to the internet. If this option is selected, the fields are available for entering settings. Specify the following settings for a proxy server connection:

Address
Address of the proxy server used for Kaspersky Security Center connection to the internet.
Port number
Number of the port through which Kaspersky Security Center proxy connection will be established.
Bypass proxy server for local addresses
No proxy server will be used to connect to devices in the local network.
Proxy server authentication
If this check box is selected, in the entry fields you can specify the credentials for proxy server authentication.

This entry field is available if the Use proxy server check box is selected.
User name
User account under which connection to the proxy server is established (this field is available if the Proxy server authentication check box is selected).
Password
Password set by the user under whose account the proxy server connection is established (this field is available if the Proxy server authentication check box is selected).

To see the entered password, click and hold the Show button for as long as you require.

You can configure internet access later, separately from the quick start wizard.

Page top

[Topic 148947]

Step 2. Selecting the application activation method

Expand all | Collapse all

Select one of the following Kaspersky Security Center activation options:

By inserting your activation code
Activation code is a unique sequence of 20 alphanumeric characters. You enter an activation code to add a key that activates Kaspersky Security Center. You receive the activation code through the email address that you specified after purchasing Kaspersky Security Center.

To activate the application by using the activation code, you need internet access to establish connection with Kaspersky activation servers.

If you have selected this activation option, you can enable the Automatically distribute license key to managed devices option.

If this option is enabled, the license key will be deployed automatically to managed devices.

If this option is disabled, you can deploy license key to managed devices later, in the Kaspersky Licenses node of the Administration Console tree.

If activation by inserting your activation code was not successful for any reason, you can activate the application by specifying a key file.
By specifying a key file
Key file is a file with the .key extension provided to you by Kaspersky. A key file is intended for adding a key that activates the application.

Key file obtaining methods are described in the following section: About the key file.

To activate the application using a key file, you do not have to connect to Kaspersky activation servers.

If you have selected this activation option, you can enable the Automatically distribute license key to managed devices option.

If this option is enabled, the license key will be deployed automatically to managed devices.

If this option is disabled, you can deploy license key to managed devices later, in the Kaspersky Licenses node of the Administration Console tree.
By postponing the application activation
The application will operate with basic functionality, without Mobile Device Management and without Vulnerability and patch management.

If you choose to postpone application activation, you can add a license key later at any time.

See also:

Main installation scenario

Page top

[Topic 191748]

Step 3. Selecting the protection areas and operating systems

Expand all | Collapse all

Select the protection areas and operating systems that are in use on your network. When you select these options, you specify the filters for application management plug-ins and distribution packages on Kaspersky servers that you can download to install on client devices on your network. Select the options:

Areas
You can select the following protection areas:
- Workstations. Select this option if you want to protect workstations in your network. By default, the Workstation option is selected.
- File servers and storage. Select this option if you want to protect file servers in your network.
- Mobile devices. Select this option if you want to protect mobile devices owned by the company or by the company employees. If you select this option but you have not provided a license with the Mobile Device Management feature, a message is displayed informing you about necessity to provide a license with the Mobile Device Management feature. If you do not provide a license, you cannot use the Mobile device feature.
- Virtualization. Select this option if you want to protect virtual machines in your network.
- Kaspersky Anti-Spam. Select this option if you want to protect mail servers in your organization from spam, fraud, and malware delivery.
- Embedded systems. Select this option if you want to protect Windows-based embedded systems, such as Automated Teller Machine (ATM).
- Industrial networks. Select this option if you want to monitor security data across your industrial network and from network endpoints that are protected by Kaspersky applications.
- Industrial endpoints. Select this option if you want to protect individual nodes within an industrial network.
Operating systems
You can select the following platforms:
- Microsoft Windows
- Linux
- macOS
- Android
- Other
For information about supported operating systems, refer to Hardware and software requirements.

You can select the Kaspersky application packages from the list of available packages later, separately from the quick start wizard. To simplify the search for the required packages, you can filter the list of available packages by the following criteria:

Protection area
Type of downloaded software (distribution package, utility, plug-in, or web plug-in)
Version of the Kaspersky application
Localization language of the Kaspersky application

Page top

[Topic 191767]

Step 4. Selecting plug-ins for managed applications

Expand all | Collapse all

Select plug-ins for managed applications to install. A list of plug-ins located on Kaspersky servers is displayed. The list is filtered according to the options selected on the previous step of the wizard. By default, a full list includes plug-ins of all languages. To display only plug-in of specific language, select the language from Show the Administration Console localization language or drop-down list. The list of plug-ins includes the following columns:

Application name
The plug-ins depending of the protection areas and platforms that you have selected on the previous step are selected.
Application version
The list includes plug-ins of all the versions placed on Kaspersky servers. By default, the plug-ins of the latest versions are selected.
Localization language
By default, the localization language of a plug-in is defined by the Kaspersky Security Center language that you have selected at installation. You can specify other languages in Show the Administration Console localization language or drop-down list.

After the plug-ins are selected, their installation starts automatically in a separate window. To install some plug-ins, you must accept the terms of the EULA. Read the text of EULA, select the I accept the terms of the License Agreement option and click the Install button. If you do not accept the terms of the EULA, the plug-in is not installed.

After the installation completes, close the installation window.

You can also select the management plug-ins later, separately from the quick start wizard.

Page top

[Topic 191791]

Step 5. Downloading distribution packages and creating installation packages

Kaspersky Endpoint Security for Windows includes encryption tool for the information stored on client devices. To download a distribution package of Kaspersky Endpoint Security for Windows valid for the needs of your organization, consult the legislation of the country where the client devices of your organization are located.

In the Encryption type window, select one of the following encryption types:

Strong encryption (AES256). This encryption type uses 256-bit key length.
Lite encryption (AES56). This encryption type uses 56-bit key length.

The Encryption type window is displayed only if you have selected Workstations as a protection scope and Microsoft Windows as a platform.

After you have selected an encryption type, a list of distribution packages of both encryption types is displayed. A distribution package with the selected encryption type is selected in the list. The distribution package language corresponds to the Kaspersky Security Center language. If a distribution package of Kaspersky Endpoint Security for Windows for the Kaspersky Security Center language does not exist, the English distribution package is selected.

In the list, you can select distribution package languages by means Show the Administration Console localization language or drop-down list.

Distributives of managed applications may require a specific minimum version of Kaspersky Security Center to be installed.

In the list, you can select distribution packages of any encryption type, different of that you have selected in the Encryption type window. After you have selected a distribution package for Kaspersky Endpoint Security for Windows, downloading of the distribution packages, corresponding to the components and platforms, starts. You can monitor the downloading progress in the Download status column. After the quick start wizard has finished, installation packages of Network Agent for Windows and managed Kaspersky applications are displayed in the Administration Server → Advanced → Remote installation → Installation packages list.

To finish downloading of some distribution packages you must accept EULA. When you click the Accept button, the text of EULA is displayed. To proceed to the next step of the wizard, you must accept the terms and conditions of the EULA and the terms and conditions of Kaspersky Privacy Policy. Select the options related to the EULA and Kaspersky Privacy Policy, and then click the Accept all button. If you do not accept the terms and conditions, the downloading of the package is canceled.

After you have accepted the terms and conditions of the EULA and the terms and conditions of Kaspersky Privacy Policy, the downloading of the distribution packages continues. When the downloading is finished, the Installation package is created status is displayed. Later, you can use installation packages to deploy Kaspersky applications on client devices.

You can create installation packages manually, separately from the quick start wizard. Go to Administration Server → Advanced → Remote installation → Installation packages in the Administration Console tree.

Page top

[Topic 148962]

Step 6. Configuring Kaspersky Security Network usage

Expand all | Collapse all

You can obtain access to the reputation databases of Kaspersky Security Network to ensure faster responses by Kaspersky applications to threats, improve the effectiveness of some protection components, and reduce the risk of false positives.

Read the KSN Statement, which is displayed in the window. Specify the settings for relaying information about Kaspersky Security Center operations to the Kaspersky Security Network knowledge base. Select one of the following options:

I agree to use Kaspersky Security Network
Kaspersky Security Center and managed applications installed on client devices will automatically transfer their operation details to Kaspersky Security Network. Participation in Kaspersky Security Network ensures faster updates of databases containing information about viruses and other threats, which ensures a faster response to emergent security threats.
I do not agree to use Kaspersky Security Network
Kaspersky Security Center and managed applications will provide no information to Kaspersky Security Network.

If you select this option, the use of Kaspersky Security Network will be disabled.

If you downloaded the Kaspersky Endpoint Security for Windows plug-in, both KSN statements—the KSN Statement for Kaspersky Security Center and the KSN Statement for Kaspersky Endpoint Security for Windows—are displayed. KSN statements for other managed Kaspersky applications whose plug-ins were downloaded are displayed in separate windows and you must accept (or not accept) each of the statements separately.

You can also set up Administration Server access to Kaspersky Security Network (KSN) later in the Administration Server properties window of Administration Console.

Page top

[Topic 148965]

Step 7. Configuring email notifications

Expand all | Collapse all

Configure the sending of notifications about events registered during the operation of Kaspersky applications on managed devices. These settings are used as the default settings for Administration Server.

To configure the delivery of notifications about events occurring in Kaspersky applications, use the following settings:

Recipients (email addresses)
The email addresses of users to whom the application will send notifications. You can enter one or more addresses; if you enter more than one address, separate them with a semicolon.
SMTP servers
The address or addresses of your organization's mail servers.

If you enter more than one address, separate them with a semicolon. You can use the following values:
- IPv4 or IPv6 address
- Windows network name (NetBIOS name) of the device
- DNS name of the SMTP server
SMTP server port
Communication port number of the SMTP server. If you use several SMTP servers, the connection to them is established through the specified communication port. The default port number is 25.
Use ESMTP authentication
Enables support of ESMTP authentication. When the check box is selected, in the User name and Password fields you can specify the ESMTP authentication settings. By default, this check box is cleared.
Settings
Specify the following settings:
- Subject (subject of an email message)
- Sender email address
- TLS settings for SMTP server
You can specify TLS settings for SMTP server:

You can disable usage of TLS, use TLS if the SMTP server supports this protocol, or you can force usage of TLS only. If you choose to use only TLS, specify a certificate for authentication of the SMTP server and choose whether you want to enable communication through any version of TLS or only through TLS 1.2 or later versions. Also, if you choose to use only TLS, you can specify a certificate for client authentication on the SMTP server.
- Browse for an SMTP server certificate file:
You can receive a file with the list of certificates from a trusted certification authority and upload the file to Administration Server. Kaspersky Security Center checks whether the certificate of an SMTP server is also signed by a trusted certification authority. Kaspersky Security Center cannot connect to an SMTP server if the certificate of the SMTP server is not received from a trusted certification authority.
- Browse for a client certificate file:
You can use a certificate that you received from any source, for example, from any trusted certification authority. You must specify the certificate and its private key by using one of the following certificate types:
- X-509 certificate:
Specify the file with the certificate and the file with the private key. You can upload these files in any order. When both files are uploaded, specify the password to decrypt the private key. The password can have an empty value if the private key is not encrypted.
- pkcs12 container:
You must upload a single file that contains the certificate and its private key. When the file is loaded, you must then specify the password for decoding the private key. The password can have an empty value if the private key is not encoded.

You can test the new email notification settings by clicking the Send test message button.

You can also configure event notifications later, separately from the quick start wizard.

Page top

[Topic 148999]

Step 8. Configuring update management

Expand all | Collapse all

Configure the settings for managing updates of applications installed on client devices.

You can configure these settings only if you have provided a license key with the Vulnerabilities and Patch management option.

In the Search for updates and install them group of settings, you can select a mode of Kaspersky Security Center update search and installation:

Search for required updates
The Find vulnerabilities and required updates task is created automatically, if you do not have one.

This option is selected by default.
Find and install required updates
The Find vulnerabilities and required updates and Install required updates and fix vulnerabilities tasks are created automatically, if you do not have ones.

In the Windows Server Update Services group of settings, you can select the update synchronization source:

Use update sources defined in the domain policy
Client devices will download Windows Update updates according to your domain policy settings. Network Agent policy is created automatically, if you do not have one.
Use Administration Server as a WSUS server
Client devices will download Windows Update updates from the Administration Server. The Perform Windows Update synchronization task and Network Agent policy are created automatically, if you do not have ones.

You can create the Find vulnerabilities and required updates and Install required updates and fix vulnerabilities tasks separately from the quick start wizard. To use Administration Server as the WSUS server, create the Perform Windows Update synchronization task, and then select the Use Administration Server as a WSUS server option in the Network Agent policy.

Page top

[Topic 149000]

Step 9. Creating an initial protection configuration

The Configure initial protection window displays a list of policies and tasks that are created automatically. The following policies and tasks are created:

Kaspersky Security Center Network Agent policy
Policies for managed Kaspersky applications whose management plug-ins were installed earlier
Administration Server maintenance task
Backup of Administration Server data task
Download updates to the Administration Server repository task
Find vulnerabilities and required updates task
Install update task

Wait for the creation of policies and tasks to complete before proceeding to the next step of the wizard.

If you have downloaded and installed the plug-in for Kaspersky Endpoint Security for Windows 10 Service Pack 1 and later till the 11.0.1, during the creation of policies and tasks, a window opens for initial configuration of the trusted zone of Kaspersky Endpoint Security for Windows. The application will prompt you to add vendors verified by Kaspersky to the trusted zone for the purposes of excluding their applications from scans to prevent them from being accidentally blocked. You can create recommended exclusions now or create a list of exclusions later by selecting the following in the console tree: Policies → Kaspersky Endpoint Security properties menu → Advanced Threat Protection → Trusted zone → Settings → Add. The list of scan exclusions is available for editing at any time when using the application.

Operations on the trusted zone are performed by using tools integrated into Kaspersky Endpoint Security for Windows. For detailed instructions on how to perform operations and a description of encryption features please refer to Kaspersky Endpoint Security for Windows Online Help.

To finish initial configuration of the trusted zone and return to the wizard, click OK.

Click Next. This button becomes available after all necessary policies and tasks have been created.

You can also create the required tasks and policies later, separately from the quick start wizard.

Page top

[Topic 149001]

Step 10. Connecting mobile devices

Expand all | Collapse all

If you previously enabled the Mobile devices protection scope in the wizard settings, specify the settings for connecting the enterprise mobile devices of the managed organization. If you did not enable Mobile devices protection scope, this step is skipped.

At this step of the wizard, do the following:

Configure ports for connection of mobile devices
Configure Administration Server authentication
Create or manage certificates
Set up issuance, automatic updating, and encryption of general-type certificates
Create a moving rule for mobile devices

To set up the ports for connection of mobile devices:

Click the Configure button to the right of the Mobile device connection field.
In the drop-down list, select Configure ports.
The Administration Server properties window opens, displaying the Additional ports section.
In the Additional ports section, you can specify the mobile device connection settings:
- SSL port for the activation proxy server
  The number of an SSL port for connection of Kaspersky Endpoint Security for Windows to activation servers of Kaspersky.
  
  The default port number is 17000.
- Open port for mobile devices
  A port opens for mobile devices to connect to the Licensing Server. You can define the port number and other settings in the fields below.
  
  By default, this option is enabled.
- Port for mobile device synchronization
  Number of the port through which mobile devices connect to the Administration Server and exchange data with it. The default port number is 13292.
  
  You can assign a different port if port 13292 is being used for other purposes.
- Port for mobile device activation
  The port for connection of Kaspersky Endpoint Security for Android to activation servers of Kaspersky.
  
  The default port number is 17100.
- Open port for UEFI protection devices and KasperskyOS devices
  UEFI protection devices can connect to the Administration Server.
- Port for UEFI protection devices and KasperskyOS devices
  You can change the port number if the Open port for UEFI protection devices and KasperskyOS devices option is enabled. The default port number is 13294.
- Open port for Prometheus
  The port for Prometheus pull requests. The default port number is 13296.
Click OK to save changes and return to the quick start wizard.

You will have to configure authentication of the Administration Server by mobile devices and authentication of mobile devices by the Administration Server. If you want, you can configure authentication later, separately from the quick start wizard.

To configure Administration Server authentication by mobile devices:

Click the Configure button to the right of the Mobile device connection field.
In the drop-down list, select Configure authentication.
The Administration Server properties window opens, displaying the Certificates section.
Select the authentication option for mobile devices in the Administration Server authentication by mobile devices group of settings, and select the authentication option for UEFI protection devices in the Administration Server authentication by UEFI protection devices group of settings.
When Administration Server exchanges data with client devices, it is authenticated through the use of a certificate.

By default, Administration Server uses the certificate that was created during Administration Server installation. If you want, you can add a new certificate.

To add a new certificate (optional):

Select Other certificate.
The Browse button appears.
Click the Browse button.
In the window that opens, specify the certificate settings:
- Certificate type
  In the drop-down list, you can select a certificate type:
  - X.509 certificate. If this option is selected, you should specify the private key of a certificate and an open certificate:
    - Private key (.prk, .pem). In this field, click the Browse button to specify the private key of a certificate in PKCS #8 (*.prk) format.
    - Public key (.cer). In this field, click the Browse button to specify a public key in PEM (*.cer) format.
  - PKCS #12 container. If you select this option, you can specify a certificate file in P12 or PFX format by clicking the Browse button and filling in the Certificate file field.
- Activation time:
  - Immediately
    The current certificate will be immediately replaced with the new one after you click OK.
    
    Previously connected mobile devices will not be able to connect to Administration Server.
  - After this period expires, days
    If you select this option, a reserve certificate will be generated. The current certificate will be replaced with the new one in the specified number of days. The effective date of the reserve certificate is displayed in the Certificates section.
    
    It is recommended that you plan the reissue in advance. The reserve certificate must be downloaded to the mobile devices before the specified period expires. After the current certificate is replaced with the new one, previously connected mobile devices that do not have the reserve certificate will not be able to connect to Administration Server.
Click the Properties button to view the settings of the selected Administration Server certificate.

To reissue a certificate issued through Administration Server:

Select Certificate issued through Administration Server.
Click the Reissue button.
In the window that opens, specify the following settings:
- Connection address:
  - Use old connection address
    The address of the Administration Server to which mobile devices connect remains unchanged.
    
    This option is selected by default.
  - Change connection address to
    If you want mobile devices to connect to a different address, specify the relevant address in this field.
    
    If the address for mobile device connection has changed, a new certificate must be issued. The old certificate becomes invalid on all mobile devices connected. Previously connected devices will not be able to connect to Administration Server so they will become unmanaged.
- Activation time:
  - Immediately
    The current certificate will be immediately replaced with the new one after you click OK.
    
    Previously connected mobile devices will not be able to connect to Administration Server.
  - After this period expires, days
    If you select this option, a reserve certificate will be generated. The current certificate will be replaced with the new one in the specified number of days. The effective date of the reserve certificate is displayed in the Certificates section.
    
    It is recommended that you plan the reissue in advance. The reserve certificate must be downloaded to the mobile devices before the specified period expires. After the current certificate is replaced with the new one, previously connected mobile devices that do not have the reserve certificate will not be able to connect to Administration Server.
Click OK to save changes and return to the Certificates window.
Click OK to save changes and return to the quick start wizard.

To set up issuance, automatic updating, and encryption of general-type certificates for identification of mobile devices by Administration Server:

Click the Configure button on the right of the Mobile device authentication field.
The Certificate issuance rules window opens, displaying the Issuance of mobile certificates section.
If necessary, specify the following settings in the Issuance settings section:
- Certificate lifetime, days
  Certificate lifetime period in days. The default lifetime of a certificate is 365 days. When this period expires, the mobile device will not be able to connect to the Administration Server.
- Certificate source
  Select the source of general-type certificates for mobile devices: certificates are issued by Administration Server, or they are specified manually.
  
  You can modify the certificate templates if integration with the public key infrastructure (PKI) has been configured in the Integration with PKI section. In this case, the following template selection fields are available:
- Default template
  Use a certificate issued by an external certificate source – Certification Center – under the default template.
  
  By default, this option is selected.
- Other template
  Select a template used to issue certificates. You can specify certificate templates in the domain. The Refresh list button updates the list of certificate templates.
If necessary, specify the following settings for automatic issuance of certificates in the Automatic Updates settings section:
- Renew when certificate is to expire in (days)
  The number of days remaining until the current certificate's expiration during which Administration Server should issue a new certificate. For example, if the value of the field is 4, Administration Server issues a new certificate four days before the current certificate expires. The default value is 7.
- Reissue certificate automatically if possible
  Select this option to reissue a certificate automatically for the number of days specified in the Renew when certificate is to expire in (days) field. If a certificate was manually defined, it cannot be automatically renewed, and the enabled option will not work.
  
  By default, this option is disabled.
Certificates are automatically reissued by a Certification Authority.
If necessary, in the Password protection settings section, specify the settings for decrypting certificates during installation.
Select the Prompt for password during certificate installation option to prompt the user for password when the certificate is installed on a mobile device. The password is used only once—during installation of the certificate on the mobile device.

The password will be automatically generated by Administration Server and sent to the email address that you specified. You can specify the user's email address, or your own email address if you want to use another method to forward the password to the user.

You can use the slider to specify the number of characters in the certificate decryption password.

The password prompting option is required, for example, to protect a shared certificate in a stand-alone Kaspersky Endpoint Security for Android installation package. Password protection will prevent an intruder from obtaining access to the shared certificate through theft of the stand-alone installation package from Kaspersky Security Center Web Server.

If this option is disabled, the certificate is automatically decrypted during installation and the user will not be prompted for a password. By default, this option is disabled.
Click OK to save changes and return to the quick start wizard window.
Click the Cancel button to return to the quick start wizard without saving any changes made.

To enable the function for moving mobile devices to an administration group that you choose,

In the Automatic moving of mobile devices field, select the Create a moving rule for mobile devices option.

If the Create a moving rule for mobile devices option is selected, the application automatically creates a moving rule that moves devices running Android and iOS to the Managed devices group:

With Android operating systems on which a Kaspersky Endpoint Security for Android and a mobile certificate are installed
With iOS operating systems on which the iOS MDM profile with a shared certificate is installed

If such a rule already exists, the application does not create it again.

By default, this option is disabled.

Kaspersky no longer supports Kaspersky Safe Browser.

Page top

[Topic 191851]

Step 11. Downloading updates

Updates for anti-virus databases for Kaspersky Security Center and managed Kaspersky applications are downloaded automatically. The updates are downloaded from Kaspersky servers.

To download updates separately from the quick start wizard, create and configure the Download updates to the repository of the Administration Server task.

Page top

[Topic 149002]

Step 12. Device discovery

The Network poll window displays information about the status of network polling performed by the Administration Server.

You can view network devices detected by Administration Server and receive help on working with the Device discovery window by clicking the links in the lower part of the window.

You can poll your network later, separately from the quick start wizard. Use Administration Console to configure the polling of Windows domains, Active Directory, IP ranges, and IPv6 networks.

See also:

Scenario: Discovering networked devices

Main installation scenario

Page top

[Topic 149003]

Step 13. Closing the quick start wizard

In the quick start wizard completion window, select the Run the Remote installation wizard option if you want to start automatic installation of anti-virus applications and/or Network Agent on devices on your network.

To complete the wizard, click the Finish button.

Page top

[Topic 123332]

Configuring the connection of Administration Console to Administration Server

Administration Console is connected to Administration Server through SSL port TCP 13291. The same port can be used by klakaut automation objects.

Port TCP 14000 can be used for connecting Administration Console, distribution points, secondary Administration Servers, and klakaut automation objects, as well as for receiving data from client devices.

Normally, SSL port TCP 13000 can only be used by Network Agent, a secondary Administration Server, and the primary Administration Server in DMZ. In some cases, Administration Console may have to be connected through SSL port 13000:

If a single SSL port is likely to be used both for Administration Console and for other activities (receiving data from client devices, connecting distribution points, connecting secondary Administration Servers).
If a klakaut automation object is not connected to Administration Server directly but through a distribution point in the DMZ.

To allow the connection of Administration Console over port 13000:

Open the system registry of the device on which Administration Server is installed (for example, locally, using the regedit command in the Start → Run menu).
Go to the following hive:
- For 32-bit systems:
  HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\.core\.independent\KLLIM
- For 64-bit systems:
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\.core\.independent\KLLIM
For the LP_ConsoleMustUsePort13291 (DWORD) key, set 00000000 as the value.
The default value specified for this key is 1.
Restart the Administration Server service.

You will now be able to connect Administration Console to Administration Server over port 13000.

Page top

[Topic 246921]

Configuring the internet access settings for Administration Server

Expand all | Collapse all

You must configure internet access to use Kaspersky Security Network, and to download updates of anti-virus databases for Kaspersky Security Center and managed Kaspersky applications.

To specify the internet access settings for Administration Server:

In the console tree, select the Administration Server %s node.
In the context menu of the Administration Server, select Properties.
In the Administration Server properties window, go to Advanced → Configuring internet access.
Select the Use proxy server option if you want to use a proxy server when connecting to the internet. If this option is selected, the fields are available for entering settings. Specify the following settings for a proxy server connection:
- Address
  Address of the proxy server used for Kaspersky Security Center connection to the internet.
- Port number
  Number of the port through which Kaspersky Security Center proxy connection will be established.
- Bypass proxy server for local addresses
  No proxy server will be used to connect to devices in the local network.
- Proxy server authentication
  If this check box is selected, in the entry fields you can specify the credentials for proxy server authentication.
  
  This entry field is available if the Use proxy server check box is selected.
- User name
  User account under which connection to the proxy server is established (this field is available if the Proxy server authentication check box is selected).
- Password
  Password set by the user under whose account the proxy server connection is established (this field is available if the Proxy server authentication check box is selected).
  
  To see the entered password, click and hold the Show button for as long as you require.

You can also configure internet access by using the quick start wizard.

Page top

[Topic 204432]

Connecting out-of-office devices

This section describes how to connect out-of-office devices (that is, managed devices that are located outside of the main network) to Administration Server.

In this section

Scenario: Connecting out-of-office devices through a connection gateway

Scenario: Connecting out-of-office devices through a secondary Administration Server in DMZ

About connecting out-of-office devices

Connecting external desktop devices to Administration Server

About connection profiles for out-of-office users

Creating a connection profile for out-of-office users

About switching Network Agent to other Administration Servers

Creating a Network Agent switching rule by network location

Notifications of events

Page top

[Topic 204219]

Scenario: Connecting out-of-office devices through a connection gateway

This scenario describes how to connect managed devices that are located outside of the main network to Administration Server.

Prerequisites

The scenario has the following prerequisites:

A demilitarized zone (DMZ) is organized in your organization's network.
Kaspersky Security Center Administration Server is deployed on the corporate network.

Stages

This scenario proceeds in stages:

Selecting a client device in the DMZ
This device will be used as a connection gateway. The device that you select must meet the requirements for connection gateways.
Installing Network Agent in the connection gateway role
We recommend that you use a local installation to install Network Agent on the selected device.

By default, the installation file is located at: \\<server name>\KLSHARE\PkgInst\NetAgent_<version number>

In the Connection gateway window of the Network Agent setup wizard, select Use Network Agent as a connection gateway in DMZ. This mode simultaneously activates the connection gateway role and tells Network Agent to wait for connections from Administration Server, rather than establish connections to Administration Server.

Alternatively, you can install Network Agent on a Linux device and configure Network Agent to work as a connection gateway, but pay attention to the list of limitations of Network Agent running on Linux devices.
Allowing connections in firewalls on the connection gateway
To make sure that Administration Server can actually connect to the connection gateway in the DMZ, allow connections to TCP port 13000 in all firewalls between Administration Server and the connection gateway.

If the connection gateway has no real IP address on the internet, but instead is located behind Network Address Translation (NAT), configure a rule to forward connections through NAT.
Creating an administration group for external devices
Create a new group under the Managed devices group. This new group will contain external managed devices.
Connecting the connection gateway to Administration Server
The connection gateway that you have configured is waiting for a connection from Administration Server. However, Administration Server does not list the device with the connection gateway among managed devices. This is because the connection gateway has not tried to establish a connection to Administration Server. Therefore, you need a special procedure to ensure that Administration Server initiates a connection to the connection gateway.

Do the following:
1. Add the connection gateway as a distribution point.
2. Move the connection gateway from the Unassigned devices group to the group that you have created for external devices.
The connection gateway is connected and configured.
Connecting external desktop devices to Administration Server
Usually, external desktop devices are not moved inside the perimeter. Therefore, you need to configure them to connect to Administration Server through the gateway when installing Network Agent.
Setting up updates for external desktop devices
If updates of security applications are configured to be downloaded from Administration Server, external devices download updates through the connection gateway. This has two disadvantages:
- This is unnecessary traffic, which takes up bandwidth of the company's internet communication channel.
- This is not necessarily the quickest way to get updates. It is very likely that it would be cheaper and faster for external devices to receive updates from Kaspersky update servers.
Do the following:
Connecting traveling laptops to Administration Server
Traveling laptops are within the network sometimes and outside the network at other times. For effective management, you need them to connect to Administration Server differently depending on their location. For efficient use of traffic, they also need to receive updates from different sources, depending on their location.

You need to configure rules for out-of-office users: connection profiles and network location descriptions. Each rule defines the Administration Server instance to which traveling laptops must connect, depending on their location and the Administration Server instance from which they must receive updates.

Page top

[Topic 240598]

Scenario: Connecting out-of-office devices through a secondary Administration Server in DMZ

If you want to connect managed devices that are located outside of the main network to Administration Server, you can do it by using a secondary Administration Server located in the demilitarized zone (DMZ).

Prerequisites

Before you start, make sure that you have done the following:

A DMZ is organized in your organization's network.
Kaspersky Security Center Administration Server is deployed on the internal network of the organization.

Stages

This scenario proceeds in stages:

Selecting a client device in the DMZ
In the DMZ, select a client device that will be used as a secondary Administration Server.
Installing Kaspersky Security Center Administration Server
Install Kaspersky Security Center Administration Server on this client device.
Creating a hierarchy of Administration Servers
If you place a secondary Administration Server in the DMZ, the secondary Administration Server must receive a connection from the primary Administration Server. To do this, add a new Administration Server as secondary so that the primary Administration Server connects to the secondary Administration Server through port 13000. When combining two Administration Servers into a hierarchy, make sure that port 13291 is accessible on both Administration Servers. Administration Console connects to an Administration Server through port 13291.
Connecting out-of-office managed devices to the secondary Administration Server
You can connect out-of-office devices to the Administration Server in the DMZ in the same way that the connection is established between Administration Server and managed devices that are located in the main network. Out-of-office managed devices initiate the connection through port 13000.

Page top

[Topic 204435]

About connecting out-of-office devices

Some managed devices are always located outside of the main network (for example, devices in a company's regional branches; kiosks, ATMs, and terminals installed at various points of sale; devices in the home offices of employees). Some devices travel outside the perimeter from time to time (for example, laptops of users who visit regional branches or a customer's office).

You still need to monitor and manage the protection of out-of-office devices—receive actual information about their protection status and keep the security applications on them in the up-to-date state. This is necessary because, for example, if such a device is compromised while being away from the main network, it could become a platform for propagating threats as soon as it connects to the main network. To connect out-of-office devices to Administration Server, you can use two methods:

Connection gateway in the demilitarized zone (DMZ)
See the data traffic scheme: Administration Server on LAN, managed devices on the Internet, connection gateway in use
Administration Server in DMZ
See the data traffic scheme: Administration Server in DMZ, managed devices on Internet

A connection gateway in the DMZ

A recommended method for connecting out-of-office devices to Administration Server is organizing a DMZ in the organization's network and installing a connection gateway in the DMZ. External devices will connect to the connection gateway, and Administration Server inside the network will initiate a connection to the devices via the connection gateway.

As compared to the other method, this one is more secure:

You do not need to open access to Administration Server from outside the network.
A compromised connection gateway does not pose a high risk to the safety of the network devices. A connection gateway does not actually manage anything itself and does not establish any connections.

Also, a connection gateway does not require many hardware resources.

However, this method has a more complicated configuration process:

To act a device as a connection gateway in the DMZ, you need to install Network Agent and connect it to Administration Server in a specific way.
You will not be able to use the same address for connecting to Administration Server for all situations. From outside the perimeter, you will need to use not just a different address (connection gateway address), but also a different connection mode: through a connection gateway.
You also need to define different connection settings for laptops in different locations.

To add a connection gateway to a previously configured network:

Install the Network Agent in the connection gateway mode.
Reinstall the Network Agent on devices that you want to connect to the newly added connection gateway.

Administration Server in the DMZ

Another method is installing a single Administration Server in the DMZ.

This configuration is less secure than the other method. To manage external laptops in this case, Administration Server must accept connections from any address on the internet. It will still manage all devices in the internal network, but from the DMZ. Therefore, a compromised Server could cause an enormous amount of damage, despite the low likelihood of such an event.

The risk gets significantly lower if Administration Server in the DMZ does not manage devices in the internal network. Such a configuration can be used, for example, by a service provider to manage the devices of customers.

You might want to use this method in the following cases:

If you are familiar with installing and configuring Administration Server, and do not want to perform another procedure to install and configure a connection gateway.
If you need to manage more devices. The maximum capacity of Administration Server is 100,000 devices, while a connection gateway can support up to 10,000 devices.

This solution also has possible difficulties:

Administration Server requires more hardware resources and one more database.
Information about devices will be stored in two unrelated databases (for Administration Server inside the network and another one in the DMZ), which complicates monitoring.
To manage all devices, Administration Server needs to be joined into a hierarchy, which complicates not only monitoring but also management. A secondary Administration Server instance imposes limitations on the possible structures of administration groups. You have to decide how and which tasks and policies to distribute to a secondary Administration Server instance.
Configuring external devices to use Administration Server in the DMZ from the outside and to use the primary Administration Server from the inside is not simpler than to just configure them to use a conditional connection through a gateway.
High security risks. A compromised Administration Server instance makes it easier to compromise its managed laptops. If this happens, the hackers just need to wait for one of the laptops to return to the corporate network so that they can continue their attack on the local area network.

Internet access: Network Agent as connection gateway in DMZ

Administration Server in DMZ, managed devices on internet

Internet access: Administration Server in DMZ

Connection gateway

Page top

[Topic 204255]

Connecting external desktop devices to Administration Server

Desktop devices that are always outside of the main network (for example, devices in the company's regional branches; kiosks, ATMs, and terminals installed at various points of sale; devices in the home offices of employees) cannot be connected to Administration Server directly. They must be connected to Administration Server via a connection gateway that is installed in the demilitarized zone (DMZ). This configuration is made when installing Network Agent on those devices.

To connect external desktop devices to Administration Server:

Create a new installation package for Network Agent.
Open the properties of the created installation package and go to the Advanced section, and then select the Connect to Administration Server by using a connection gateway option.
The Connect to Administration Server by using a connection gateway setting is incompatible with the Use Network Agent as a connection gateway in DMZ setting. You cannot enable both of these settings at the same time.
In Connection gateway address, specify the public address of the connection gateway.
If the connection gateway is located behind Network Address Translation (NAT) and does not have its own public address, configure a NAT gateway rule for forwarding connections from the public address to the internal address of the connection gateway.
Create a stand-alone installation package based on the created installation package.
Deliver the stand-alone installation package to the target devices, either electronically or on a removable drive.
Install Network Agent from the stand-alone package.

External desktop devices are connected to Administration Server.

Page top

[Topic 92485]

About connection profiles for out-of-office users

Out-of-office users of laptops (hereinafter also referred to as "devices") may need to change the method of connecting to an Administration Server or switch between Administration Servers depending on the current location of the device on the enterprise network.

Connection profiles are supported only for devices running Windows and macOS.

Using different addresses of a single Administration Server

Devices with Network Agent installed can connect to the Administration Server either from the organization's intranet or from the internet. This situation may require Network Agent to use different addresses for connection to Administration Server: the external Administration Server address for the Internet connection and the internal Administration Server address for the internal network connection.

To do this, you must add a profile (for connection to Administration Server from the Internet) to the Network Agent policy. Add the profile in the policy properties (Connectivity section, Connection profiles subsection). In the profile creation window, you must disable the Use to receive updates only option and select the Synchronize connection settings with the Administration Server settings specified in this profile option. If you use a connection gateway to access Administration Server (for example, in a Kaspersky Security Center configuration as that described in Internet access: Network Agent as connection gateway in DMZ), you must specify the address of the connection gateway in the corresponding field of the connection profile.

Switching between Administration Servers depending on the current network

If the organization has multiple offices with different Administration Servers and some of the devices with Network Agent installed move between them, you need Network Agent to connect to the Administration Server of the local network in the office where the device is currently located.

In this case, you must create a profile for connection to Administration Server in the properties of the policy of Network Agent for each of the offices, except for the home office where the original home Administration Server is located. You must specify the addresses of Administration Servers in connection profiles and enable or disable the Use to receive updates only option:

Select the option if you need Network Agent to be synchronized with the home Administration Server, while using the local Server for downloading updates only.
Disable this option if it is necessary for Network Agent to be managed completely by the local Administration Server.

After that, you must set up the conditions of switching to the newly created profiles: at least one condition for each of the offices, except for the home office. Every condition's purpose consists in detection of items that are specific for an office's network environment. If a condition is true, the corresponding profile gets activated. If none of the conditions is true, Network Agent switches to the home Administration Server.

Internet access: Network Agent as connection gateway in DMZ

Creating a connection profile for out-of-office users

Page top

[Topic 10806]

Creating a connection profile for out-of-office users

Expand all | Collapse all

An Administration Server connection profile is available only on devices running Windows and macOS.

To create a profile for connecting Network Agent to Administration Server for out-of-office users:

In the console tree, select the administration group containing the client devices for which you need to create a profile for connecting Network Agent to the Administration Server.
Do one of the following:
- If you want to create a connection profile for all devices in the group, select a Network Agent policy in the group workspace, on the Policies tab. Open the properties window of the selected policy.
- If you want to create a connection profile for a device in a group, select that device in the group workspace, on the Devices tab, and perform the following actions:
  1. Open the properties window of the selected device.
  2. In the Applications section of the device properties window, select Network Agent.
  3. Open the Network Agent properties window.
In the properties window, in the Connectivity section, select the Connection profiles subsection.
In the Administration Server connection profiles settings group, click the Add button.
By default, the list of connection profiles contains the <Offline mode> and <Home Administration Server> profiles. Profiles cannot be edited or removed.

The <Offline mode> profile does not specify any Server for connection. Therefore, Network Agent, when switched to that profile, does not attempt to connect to any Administration Server while applications installed on client devices run under out-of-office work policies. The <Offline mode> profile can be used if devices are disconnected from the network.

The <Home Administration Server> profile specifies the connection for Administration Server that was selected during Network Agent installation. The <Home Administration Server> profile is applied when a device is reconnected to the home Administration Server after it was running on an external network for some time.
In the New profile window that opens, configure the connection profile:
- Profile name
  In the entry field you can view or change the connection profile name.
- Administration Server
  Address of the Administration Server to which the client device must connect during profile activation.
- Port
  Port number that is used for connection.
- SSL port
  Port number for connection if using the SSL protocol.
- Use SSL
  If this option is enabled, the connection is established through a secure port, by using SSL protocol.
  
  By default, this option is enabled. We recommend that you do not disable this option so your connection remains secured.
- Click the Configure connection through proxy server link to configure connection through a proxy server. Select the Use proxy server option if you want to use a proxy server when connecting to the internet. If this option is selected, fields are available for entering settings. Specify the following settings for a proxy server connection:
  - Proxy server address
    Address of the proxy server used for Kaspersky Security Center connection to the internet.
  - Port number
    Number of the port through which Kaspersky Security Center proxy connection will be established.
  - Proxy server authentication
    If this check box is selected, in the entry fields you can specify the credentials for proxy server authentication.
    
    This entry field is available if the Use proxy server check box is selected.
  - User name (this field is available if the Proxy server authentication option is selected)
    User account under which connection to the proxy server is established (this field is available if the Proxy server authentication check box is selected).
  - Password (this field is available if the Proxy server authentication option is selected)
    Password set by the user under whose account the proxy server connection is established (this field is available if the Proxy server authentication check box is selected).
    
    To see the entered password, click and hold the Show button for as long as you require.
- Connection gateway settings
  Address of the gateway through which client devices connect to the Administration Server.
- Enable out-of-office mode
  If this option is enabled, in case of connection through this profile, applications installed on the client device use policy profiles for devices in out-of-office mode, as well as out-of-office policies. If no out-of-office policy has been defined for the application, the active policy will be used.
  
  If this option is disabled, applications will use active policies.
  
  By default, this option is disabled.
- Use to receive updates only
  If this option is enabled, the profile will only be used for downloading updates by applications installed on the client device. For other operations, connection to the Administration Server will be established with the initial connection settings defined during Network Agent installation.
  
  By default, this option is enabled.
- Synchronize connection settings with the Administration Server settings specified in this profile
  If this option is enabled, Network Agent connects to Administration Server using the settings specified in the profile properties.
  
  If this option is disabled, Network Agent connects to Administration Server using the original settings that have been specified during installation.
  
  This option is available if the Use to receive updates only option is disabled.
  
  By default, this option is disabled.
Select the Enable out-of-office mode when Administration Server is not available option to allow the applications installed on a client device to use policy profiles for devices in out-of-office mode, as well as out-of-office policies, at any connection attempt if the Administration Server is not available. If no out-of-office policy has been defined for the application, the active policy will be used.

A profile for connecting Network Agent to Administration Server is created for out-of-office users. When Network Agent connects to Administration Server by using this profile, applications installed on the client device will use policies for devices in out-of-office mode or out-of-office policies.

Page top

[Topic 10419]

About switching Network Agent to other Administration Servers

The initial settings of the Network Agent connection to Administration Server are defined when installing the Network Agent. To switch the Network Agent to other Administration Servers, you can use the switching rules. This feature is supported only for Network Agents installed on devices running Windows or macOS.

The switching rules can trigger on changing the following network parameters:

Default gateway address.
IP address of the Dynamic Host Configuration Protocol (DHCP) server.
DNS suffix of the subnet.
IP address of the network DNS server.
Windows domain accessibility. This parameter is available only for devices running Windows.
Subnet address and mask.
IP address of the network WINS server. This parameter is available only for devices running Windows.
DNS or NetBIOS name of the client device.
SSL connection address accessibility.

If rules for switching the Network Agent to other Administration Servers have been created, the Network Agent responds to changes in the network parameters as follows:

If the network settings comply with one of the rules created, Network Agent connects to the Administration Server specified in this rule. Applications installed on client devices switch to out-of-office policies, provided such behavior is enabled by a rule.
If none of the rules apply, Network Agent reverts to the default settings of connection to the Administration Server specified during the installation. Applications installed on client devices switch back to active policies.
If the Administration Server is not accessible, Network Agent uses out-of-office policies.

Network Agent switches to the out-of-office policy only if the Enable out-of-office mode when Administration Server is not available option is enabled in the Network Agent policy settings.

The settings of Network Agent connection to Administration Server are saved in a connection profile. In the connection profile, you can create rules for switching client devices to out-of-office policies, and you can configure the profile so that it could only be used for downloading updates.

Page top

[Topic 10807]

Creating a Network Agent switching rule by network location

Expand all | Collapse all

Network Agent-switching by network location is available only on devices running Windows and macOS.

To create a rule for Network Agent switching from one Administration Server to another if network settings change:

In the console tree, select the administration group containing the devices for which you need to create a Network Agent switching rule by the network location description.
Do one of the following:
- If you want to create a rule for all devices in the group, go to the group workspace and select a Network Agent policy on the Policies tab. Open the properties window of the selected policy.
- If you want to create a rule for a device selected from a group, go to the group workspace, select the device on the Devices tab, and perform the following actions:
  1. Open the properties window of the selected device.
  2. In the Applications section of the device properties window, select Network Agent.
  3. Open the Network Agent properties window.
In the Properties window that opens, in the Connectivity section, select the Connection profiles subsection.
In the Network location settings section, click the Add button.
In the New description window that opens, configure the network location description and switching rule. Specify the following network location description settings:
- Network location description name
  The name of a network location description cannot be longer than 255 characters nor contain special symbols, such as ("*<>?\/:|).
- Use connection profile
  In the drop-down list you can specify the connection profile that Network Agent uses to connect to the Administration Server. This profile will be used when the network location description conditions are met. The connection profile contains the settings for Network Agent connection to the Administration Server; it also defines when client devices must switch to out-of-office policies. The profile is used only for downloading updates.
In the Switch conditions section, click the Add button to create a list of network location description conditions.
The conditions in a rule are combined by using the logical AND operator. To trigger a switching rule by the network location description, all of the rule switching conditions must be met.
In the drop-down list, select the value that corresponds to the change in characteristics of the network to which the client device is connected:
- Default connection gateway address—The address of the main network gateway has changed.
- DHCP server address—The IP address of the network Dynamic Host Configuration Protocol (DHCP) server has changed.
- DNS domain—The DNS suffix of the subnet has changed.
- DNS server address—The IP address of the network DNS server has changed.
- Windows domain accessibility (Windows only)—Changes the status of the Windows domain to which the client device is connected. Use this setting only for devices running Windows.
- Subnet—Changes the subnet address and mask.
- WINS server address (Windows only)—The IP address of the network WINS server has changed. Use this setting only for devices running Windows.
- Name resolvability—The DNS or NetBIOS name of the client device has changed.
- SSL connection address accessibility—The client device can or cannot (depending on the option that you select) establish an SSL connection with a specified Server (name:port). For each server, you can additionally specify an SSL certificate. In this case, the Network Agent verifies the Server certificate in addition to checking the capability of an SSL connection. If the certificate does not match, the connection fails.
In the window that opens, specify the condition for Network Agent to be switched to another Administration Server. The name of the window depends on the value selected during the previous step. Specify the following settings of the switching condition:
- Value
  In the field, you can add one or several values for the condition being created.
- Matches at least one value from the list
  If this option is selected, the condition will be met regardless of any value specified in the Value list.
  
  By default, this option is selected.
- Does not match any of the values in the list
  If this option is selected, the condition is met if its value is not in the Value list.
In the New description window, select the Description enabled option to enable the use of the new network location description.

A new switching rule by the network location description is created; any time its conditions are met, the Network Agent uses the connection profile specified in the rule to connect to the Administration Server.

The network location descriptions are checked for a match to the network layout in the order of their appearance in the list. If a network matches several descriptions, the first one will be used. You can change the order of rules on the list using the Up button () and Down button ().

Page top

[Topic 153722]

Notifications of events

This section describes how to select a method for delivering administrator notifications about events on client devices, and how to configure event notification settings.

It also describes how to test the distribution of event notifications by using the Eicar test virus.

In this section

Configuring event notification

Testing notifications

Event notifications displayed by running an executable file

Page top

[Topic 4944]

Configuring event notification

Expand all | Collapse all

Kaspersky Security Center allows you to select a method of notifying the administrator of events on client devices and to configure notification:

Email. When an event occurs, the application sends a notification to email addresses specified. You can edit the text of the notification.
SMS. When an event occurs, the application sends a notification to the phone numbers specified. You can configure SMS notifications to be sent through the mail gateway.
Executable file. When an event occurs on a device, the executable file is started on the administrator's workstation. Using the executable file, the administrator can receive the parameters of any event that has occurred.

To configure notification of events occurring on client devices:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
Click the Configure notifications and event export link and select the Configure notifications value in the drop-down list.
This opens the Properties: Events window.
In the Notification section, select a notification method (by email, by SMS, or by running an executable file) and define the notification settings:
- Email
  The Email tab allows you to configure email notifications for events.
  
  In the Recipients (email addresses) field, specify the email addresses to which the application will send notifications. You can specify multiple addresses in this field, by separating them with semicolons.
  
  In the SMTP servers field, specify mail server addresses, separating them with semicolons. You can use the following values:
  - IPv4 or IPv6 address
  - Windows network name (NetBIOS name) of the device
  - DNS name of the SMTP server
  In the SMTP server port field, specify the number of an SMTP server communication port. The default port number is 25.
  
  If you enable the Use DNS MX lookup option, you can use several MX records of the IP addresses for the same DNS name of the SMTP server. The same DNS name may have several MX records with different values of priority of receiving email messages. Administration Server attempts to send email notifications to the SMTP server in ascending order of MX records priority. By default, this option is disabled.
  
  If you enable the Use DNS MX lookup option and do not enable usage of TLS settings, we recommend that you use the DNSSEC settings on your server device as an additional measure of protection for sending email notifications.
  
  Click the Settings link to define additional notification settings:
  - Subject name (subject name of an email message)
  - Sender email address
  - ESMTP authentication settings
  You have to specify an account for authentication on an SMTP server if the ESMTP authentication option is enabled for the SMTP server.
  - TLS settings for the SMTP server:
    - Do not use TLS
    You can select this option if you want to disable encryption of email messages.
    - Use TLS if supported by SMTP server
    You can select this option if you want to use a TLS connection to an SMTP server. If the SMTP server does not support TLS, Administration Server connects the SMTP server without using TLS.
    - Always use TLS, check the server certificate for validity
    You can select this option if you want to use TLS authentication settings. If the SMTP server does not support TLS, Administration Server cannot connect the SMTP server.
  We recommend that you use this option for better protection of the connection with an SMTP server. If you select this option, you can set authentication settings for a TLS connection.
  
  If you choose Always use TLS, check the server certificate for validity value, you can specify a certificate for authentication of the SMTP server and choose whether you want to enable communication through any version of TLS or only through TLS 1.2 or later versions. Also, you can specify a certificate for client authentication on the SMTP server.
  
  You can specify TLS settings for an SMTP server:
  - Browse for an SMTP server certificate file:
  You can receive a file with the list of certificates from a trusted certification authority and upload the file to Administration Server. Kaspersky Security Center checks whether the certificate of an SMTP server is also signed by a trusted certification authority. Kaspersky Security Center cannot connect to an SMTP server if the certificate of the SMTP server is not received from a trusted certification authority.
  - Browse for a client certificate file:
  You can use a certificate that you received from any source, for example, from any trusted certification authority. You must specify the certificate and its private key by using one of the following certificate types:
  - X-509 certificate:
  You must specify a file with the certificate and a file with the private key. Both files do not depend on each other and the order of loading of the files is not significant. When both files are loaded, you must specify the password for decoding the private key. The password can have an empty value if the private key is not encoded.
  - pkcs12 container:
  You must upload a single file that contains the certificate and its private key. When the file is loaded, you must then specify the password for decoding the private key. The password can have an empty value if the private key is not encoded.
  
  The Notification message field contains standard text with information about the event that the application sends when an event occurs. This text includes substitute parameters, such as event name, device name, and domain name. You can edit the message text by adding other substitute parameters with more relevant details of the event. The list of substitute parameters is available by clicking the button to the right of the field.
  
  If the notification text contains a percent sign (%), you have to type it twice in a row to allow message sending. For example, "CPU load is 100%%".
  
  Click the Configure numeric limit of notifications link to specify the maximum number of notifications that the application can send during the specified time interval.
  
  Click the Send test message button to check if you have configured notifications properly. The application should send a test notification to the email addresses that you specified.
- SMS
  The SMS tab allows you to configure the transmission of SMS notifications of various events to a cell phone. SMS messages are sent through a mail gateway.
  
  In the Recipients (email addresses) field, specify the email addresses to which the application will send notifications. You can specify multiple addresses in this field, by separating them with semicolons. The notifications will be delivered to the phone numbers associated with the specified email addresses.
  
  In the SMTP servers field, specify mail server addresses, separating them with semicolons. You can use the following values:
  - IPv4 or IPv6 address
  - Windows network name (NetBIOS name) of the device
  - DNS name of the SMTP server
  In the SMTP server port field, specify the number of an SMTP server communication port. The default port number is 25.
  
  Click the Settings link to define additional notification settings:
  - Subject name (subject name of an email message)
  - Sender email address
  - ESMTP authentication settings
  If necessary, you can specify an account for authentication on an SMTP server if the option of ESMTP authentication is enabled for the SMTP server.
  - TLS settings for an SMTP server
  You can disable usage of TLS, use TLS if the SMTP server supports this protocol, or you can force usage of TLS only. If you choose to use only TLS, you can specify a certificate for authentication of the SMTP server and choose whether you want to enable communication through any version of TLS or only through TLS 1.2 or later versions. Also, if you choose to use only TLS, you can specify a certificate for client authentication on the SMTP server.
  - Browse for an SMTP server certificate file
  You can receive a file with the list of certificates from a trusted certification authority and upload the file to Kaspersky Security Center. Kaspersky Security Center checks whether the certificate of the SMTP server is also signed by a trusted certification authority. Kaspersky Security Center cannot connect to the SMTP server if the certificate of the SMTP server is not received from a trusted certification authority.
  
  You must upload a single file that contains the certificate and its private key. When the file is loaded, you must then specify the password for decoding the private key. The password can have an empty value if the private key is not encoded.The Notification message field contains standard text with information about the event that the application sends when an event occurs. This text includes substitute parameters, such as event name, device name, and domain name. You can edit the message text by adding other substitute parameters with more relevant details of the event. The list of substitute parameters is available by clicking the button to the right of the field.
  
  If the notification text contains a percent sign (%), you have to type it twice in a row to allow message sending. For example, "CPU load is 100%%".
  
  Click the Configure numeric limit of notifications link to specify the maximum number of notifications that the application can send during the specified time interval.
  
  Click the Send test message button to check whether you configured notifications properly. The application should send a test notification to the recipient that you specified.
- Executable file to be run
  If this notification method is selected, in the entry field you can specify the application that will start when an event occurs.
  
  Clicking the Configure numeric limit of notifications link allows you to specify the maximum number of notifications that the application can send during the specified time interval.
  
  Clicking the Send test message button allows you to check whether you configured notifications properly: the application sends a test notification to the email addresses that you specified.
In the Notification message field, enter the text that the application will send when an event occurs.
You can use the drop-down list to the right of the text field to add substitution settings with event details (for example, event description, or time of occurrence).

If the notification text contains a percent (%), you must specify it twice in succession to allow message sending. For example, "CPU load is 100%%".
Click the Send test message button to check whether notification has been configured correctly.
The application sends a test notification to the specified user.
Click OK to save the changes.

The re-adjusted notification settings are applied to all events that occur on client devices.

You can override notification settings for certain events in the Event configuration section of the Administration Server settings, of a policy settings, or of an application settings.

Scenario: Monitoring and reporting

Page top

[Topic 4834]

Testing notifications

To check whether event notifications are sent, the application uses the notification of the EICAR test "virus" detection on client devices.

To verify sending of event notifications:

Stop the real-time file system protection task on a client device and copy the EICAR test "virus" to that client device. Now re-enable real-time protection of the file system.
Run a scan task for client devices in an administration group or for specific devices, including one with the EICAR "virus".
If the scan task is configured correctly, the test "virus" will be detected. If notifications are configured correctly, you are notified that a virus has been detected.

In the workspace of the Administration Server node, on the Events tab, the Recent events selection displays a record of detection of a "virus".

The EICAR test "virus" contains no code that can do harm to your device. However, most manufacturers' security applications identify this file as virus. You can download the test "virus" from the official EICAR website.

Page top

[Topic 84509]

Event notifications displayed by running an executable file

Kaspersky Security Center can notify the administrator about events on client devices by running an executable file. The executable file must contain another executable file with placeholders of the event to be relayed to the administrator (see the table below).

Placeholders for describing an event

Placeholder	Placeholder description
%SEVERITY%	Event severity. Possible values: Info Warning Error Critical
%COMPUTER%	Name of the device where the event occurred. Maximum length of the device name is 256 characters.
%DOMAIN%	Domain name of the device where the event occurred.
%EVENT%	Name of the event type. Maximum length of the event type name is 50 characters.
%DESCR%	Event description. Maximum length of the description is 1000 characters.
%RISE_TIME%	Event creation time.
%KLCSAK_EVENT_TASK_DISPLAY_NAME%	Task name. Maximum length of the task name is 100 characters.
%KL_PRODUCT%	Product name.
%KL_VERSION%	Product version number.
%KLCSAK_EVENT_SEVERITY_NUM%	Event severity number. Possible values: 1—Info 2—Warning 3—Error 4—Critical
%HOST_IP%	IP address of the device where the event occurred.
%HOST_CONN_IP%	Connection IP address of the device where the event occurred.

Example:

Event notifications are sent by an executable file (such as script1.bat) inside which another executable file (such as script2.bat) with the %COMPUTER% placeholder is launched. When an event occurs, the script1.bat file is run on the administrator's device, which, in turn, runs the script2.bat file with the %COMPUTER% placeholder. The administrator then receives the name of the device where the event occurred.

Page top

[Topic 174316]

Encrypt communication with TLS

To fix vulnerabilities on your organization's corporate network, you can enable traffic encryption by using the TLS protocol. You can enable TLS encryption protocols and supported cipher suites on Administration Server and iOS MDM Server. Kaspersky Security Center supports the TLS protocol versions 1.0, 1.1, 1.2, and 1.3. You can select the required encryption protocol and cipher suites.

Kaspersky Security Center uses self-signed certificates. Additional configuration of the iOS devices is not required. You can also use your own certificates. Kaspersky specialists recommend to use certificates issued by trusted certificate authorities.

Administration Server

To configure allowed encryption protocols and cipher suites on Administration Server:

Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
Use the SrvUseStrictSslSettings flag to configure allowed encryption protocols and cipher suites on Administration Server. Enter the following command:
klscflag -fset -pv ".core/.independent" -s Transport -n SrvUseStrictSslSettings -v <value> -t d

Specify the <value> parameter of the SrvUseStrictSslSettings flag:
- 4—Only the TLS 1.2 and TLS 1.3 protocols are enabled. Also, cipher suites with TLS_RSA_WITH_AES_256_GCM_SHA384 are enabled (these cipher suites are needed for backward compatibility with the previous versions of Kaspersky Security Center). This is the default value.
  Cipher suites supported for the TLS 1.2 protocol:
  - ECDHE-RSA-AES256-GCM-SHA384
  - ECDHE-RSA-AES256-SHA384
  - ECDHE-RSA-CHACHA20-POLY1305
  - AES256-GCM-SHA384 (cipher suite with TLS_RSA_WITH_AES_256_GCM_SHA384)
  - ECDHE-RSA-AES128-GCM-SHA256
  - ECDHE-RSA-AES128-SHA256
  Cipher suites supported for the TLS 1.3 protocol:
  - TLS_AES_256_GCM_SHA384
  - TLS_CHACHA20_POLY1305_SHA256
  - TLS_AES_128_GCM_SHA256
  - TLS_AES_128_CCM_SHA256
- 5—Only the TLS 1.2 and TLS 1.3 protocols are enabled. For the TLS 1.2 and TLS 1.3 protocols, the specific cipher suites listed below are supported.
  Cipher suites supported for the TLS 1.2 protocol:
  - ECDHE-RSA-AES256-GCM-SHA384
  - ECDHE-RSA-AES256-SHA384
  - ECDHE-RSA-CHACHA20-POLY1305
  - ECDHE-RSA-AES128-GCM-SHA256
  - ECDHE-RSA-AES128-SHA256
  Cipher suites supported for the TLS 1.3 protocol:
  - TLS_AES_256_GCM_SHA384
  - TLS_CHACHA20_POLY1305_SHA256
  - TLS_AES_128_GCM_SHA256
  - TLS_AES_128_CCM_SHA256
We do not recommend using 0, 1, 2, or 3 as the parameter value of the SrvUseStrictSslSettings flag. These parameter values correspond to insecure TLS protocol versions (the TLS 1.0 and TLS 1.1 protocols) and insecure cipher suites, and are used only for backward compatibility with earlier Kaspersky Security Center versions.
Restart the following Kaspersky Security Center 15.1 services:
- Administration Server
- Web Server
- Activation Proxy

Traffic encryption by using the TLS protocol is enabled.

You can use the KLTR_TLS12_ENABLED and KLTR_TLS13_ENABLED flags to enable the support of the TLS 1.2 and TLS 1.3 protocols respectively. These flags are enabled by default.

To enable or disable the support of the TLS 1.2 and TLS 1.3 protocols:

Run the klscflag utility.
Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
Enter the one of the following commands at the Windows command prompt, using administrator rights:
- Use this command to enable or disable the support of the TLS 1.2 protocol:
  klscflag -fset -pv ".core/.independent" -s Transport -n KLTR_TLS12_ENABLED -v <value> -t d
- Use this command to enable or disable the support of the TLS 1.3 protocol:
  klscflag -fset -pv ".core/.independent" -s Transport -n KLTR_TLS13_ENABLED -v <value> -t d
Specify the <value> parameter of the flag:
- 1—To enable the support of the TLS protocol.
- 0—To disable the support of the TLS protocol.

iOS MDM Server

The connection between the iOS devices and the iOS MDM Server is encrypted by default.

To configure allowed encryption protocols and cipher suites on the iOS MDM Server:

Open the system registry of the client device with iOS MDM Server installed (for example, locally, using the regedit command in the Start → Run menu).
Go to the following hive:
- For 32-bit systems:
  HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\Connectors\KLIOSMDM\1.0.0.0\Conset
- For 64-bit systems:
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\Connectors\KLIOSMDM\1.0.0.0\Conset
Create a key with the StrictSslSettings name.
Specify DWORD as the key type.
Set the key value:
- 2—The TLS 1.0, TLS 1.1, and TLS 1.2 protocols are enabled.
- 3—Only the TLS 1.2 protocol is enabled (default value).
Restart the Kaspersky Security Center iOS MDM Server service.

Page top

[Topic 94148]

Configuring the interface

Expand all | Collapse all

You can configure the Kaspersky Security Center interface:

Show and hide objects in the console tree, workspace, and properties windows of objects (folders, sections), depending on the features being used.
Show and hide elements of the main window (for example, console tree or standard menus such as Actions and View).

To configure the Kaspersky Security Center interface in accordance with the currently used set of features:

In the console tree, select the Administration Server node.
On the menu bar of the main application window, select View → Configure interface.
In the Configure interface window that opens, configure the display of interface elements using the following check boxes:
- Display Vulnerability and patch management
  If this option is enabled, the Remote installation folder displays the Deploy device images subfolder, and the Repositories folder displays the Hardware subfolder.
  
  This option is disabled by default if the quick start wizard has not finished. This option is enabled by default after the quick start wizard has finished.
  
  If this option is disabled, the menu items Create RDP session and Windows Desktop Sharing will not be available even if you have a Systems management license.
- Display data encryption and protection
  If this option is enabled, the console tree displays the Data encryption and protection folder.
  
  By default, this option is enabled.
- Display endpoint control settings
  If this option is enabled, the following subsections are displayed in the Security Controls section of the properties window of the Kaspersky Endpoint Security for Windows policy:
  - Application Control
  - Device Control
  - Web Control
  - Adaptive Anomaly Control
  If this option is disabled, these subsections are not displayed in the Security Controls section.
  
  By default, this option is enabled.
- Display Mobile Device Management
  If this option is enabled, the Mobile Device Management feature is available. After you restart the application, the console tree displays the Mobile devices folder.
  
  By default, this option is enabled.
- Display secondary Administration Servers
  If the check box is selected, the console tree displays the nodes of secondary and virtual Administration Servers within administration groups. The features connected with secondary and virtual Administration Servers—for example, creation of tasks for remote installation of applications on secondary Administration Servers—are available at that.
  
  By default, this check box is cleared.
- Display security settings sections
  If this option is enabled, the Security section is displayed in the properties window of Administration Server, administration groups and other objects. This option allows you to give users and user groups custom permissions for working with objects.
  
  By default, this option is disabled.
Click OK.

To apply some of the changes, you have to close the main application window and then open it again.

To configure the display of elements in the main application window:

On the menu bar of the main application window, select View → Configure.
In the Configure view window that opens, configure the display of main window elements by using check boxes.
Click OK.

Page top

[Topic 179027]

Discovering networked devices

This section describes steps you must take after the Kaspersky Security Center installation.

In this section

Scenario: Discovering networked devices

Unassigned devices

Equipment inventory

Page top

[Topic 179028]

Scenario: Discovering networked devices

You must perform device discovery before installation of the security applications. The Administration Server receives information about discovered devices and allows you to manage the devices through policies. Regular network polls are needed to update the list of devices available in the network.

Before you start network polling, make sure that the SMB protocol is enabled. Otherwise, Kaspersky Security Center cannot discover devices in the polled network. To enable the SMB protocol, follow the instructions for your operating system.

Discovery of networked devices proceeds in the following stages:

Discover devices
The quick start wizard guides you through initial device discovery, and helps you find networked devices such as computers, tablets, and mobile phones. You can also perform device discovery manually.
Configure scheduled polls
Decide which polling type(s) you want to use regularly. Enable the desired types and configure the poll schedule as you see fit. You can refer to the recommendations for network polling frequency.
Set up rules for adding discovered devices to administration groups (Optional)
If new devices appear on your network, they are discovered during regular polls and are automatically included in the Unassigned devices group. You can set up device moving rules to automate the allocation of devices to the Managed devices group. You can also configure retention rules.

If you skip the step 3, the newly discovered devices are allocated to the Unassigned devices group. If you want, you can move these devices to the Managed devices group manually. If you move the devices to the Managed devices group manually, you can analyze information about each device and decide whether you want to move it to an administration group, and, if so, to which exact group.

Results

Completion of the scenario yields the following:

Kaspersky Security Center Administration Server discovers the devices that are on the network and provides you with information about them.
Future polls are set up and are conducted according to the specified schedule.
The newly discovered devices are arranged according to the configured rules. (Or, if no rules are configured, the devices stay in the Unassigned devices group).

See also:

Ports used by Kaspersky Security Center

Interaction of Kaspersky Security Center components and security applications: more information

Basic concepts

Architecture

Scenario: Installation and initial setup of Kaspersky Security Center Web Console

Page top

[Topic 3871]

Unassigned devices

This section provides information about how to manage devices on an enterprise network if they are not included in an administration group.

In this section

Device discovery

Working with Windows domains. Viewing and changing the domain settings

Configuring retention rules for unassigned devices

Working with IP ranges

Working with the Active Directory groups. Viewing and modifying group settings

Creating rules for moving devices to administration groups automatically

Using VDI dynamic mode on client devices

See also:

Scenario: Discovering networked devices

Main installation scenario

Page top

[Topic 3884]

Device discovery

This section describes the types of device discovery available in Kaspersky Security Center and provides information using each type.

The Administration Server receives information about the structure of the network and devices on this network through regular polling. The information is recorded to the Administration Server database. Administration Server can use the following types of polling:

Windows network polling. The Administration Server can perform two kinds of Windows network poll: quick and full. During a quick poll, the Administration Server only retrieves information from the list of the NetBIOS names of devices in all network domains and workgroups. During a full poll, more information is requested from each client device, such as operating system name, IP address, DNS name, and NetBIOS name. By default, both quick poll and full poll are enabled. Windows network polling may fail to discover devices, for example, if the ports UDP 137, UDP 138, TCP 139 are closed on the router or by the firewall.
Active Directory polling. The Administration Server retrieves information about the Active Directory unit structure and about DNS names of the devices from Active Directory groups. By default, this type of polling is enabled. We recommend that you use Active Directory polling if you use Active Directory; otherwise, the Administration Server does not discover any devices. If you use Active Directory but some of the networked devices are not listed as members, these devices cannot be discovered by Active Directory polling.
IP range polling. The Administration Server polls the specified IP ranges using ICMP packets or the NBNS protocol and compiles a complete set of data on devices within those IP ranges. By default, this type of polling is disabled. It is not recommended to use this type of polling if you use Windows network polling and/or Active Directory polling.
Zeroconf polling. A distribution point that polls the IPv6 network by using zero-configuration networking (also referred to as Zeroconf). By default, this type of polling is disabled. You can use Zeroconf polling if the distribution point runs Linux.

If you set up and enabled device moving rules, the newly discovered devices are automatically included in the Managed devices group. If no moving rules have been enabled, the newly discovered devices are automatically included in the Unassigned devices group.

You can modify device discovery settings for each type. For example, you may want to modify the polling schedule or to set whether to poll the entire domain forest or only a specific domain.

In this section

Windows network polling

Active Directory polling

IP range polling

Zeroconf polling

See also:

Device discovery frequency

Scenario: Discovering networked devices

Main installation scenario

Page top

[Topic 3885]

Windows network polling

Expand all | Collapse all

About Windows network polling

During a quick poll, the Administration Server only retrieves information from the list of the NetBIOS names of devices in all network domains and workgroups. During a full poll, the following information is requested from each client device:

Operating system name
IP address
DNS name
NetBIOS name

Both quick polls and full polls require the following:

Ports UDP 137/138, TCP 139, UDP 445, TCP 445 must be available in the network.
The SMB protocol is enabled.
The Microsoft Computer Browser service must be used, and the primary browser computer must be enabled on the Administration Server.
The Microsoft Computer Browser service must be used, and the primary browser computer must be enabled on the client devices:
- On at least one device, if the number of networked devices does not exceed 32.
- On at least one device for each 32 networked devices.

The full poll can run only if the quick poll has run at least once.

Viewing and modifying the settings for Windows network polling

To modify the settings for the Windows network polling:

In the console tree, in the Device discovery folder, select the Domains subfolder.
You can proceed from the Unassigned devices folder to the Device discovery folder by clicking the Poll now button.

In the workspace of the Domains subfolder, the list of the devices is displayed.
Click Poll now.
The domain properties window opens. If you want, modify the settings of Windows network polling:
- Enable Windows network polling
  This option is selected by default. If you do not want to perform Windows network poll (for example, if you think that Active Directory polling is enough), you can unselect this option.
- Set quick polling schedule
  The default period is 15 minutes.
  
  During a quick poll, the Administration Server only retrieves information from the list of the NetBIOS names of devices in all network domains and workgroups.
  
  The data received at the next polling completely replaces the old data.
  
  The following polling schedule options are available:
  - Every N days
    The polling runs regularly, with the specified interval in days, starting from the specified date and time.
    
    By default, the polling runs every day, starting from the current system date and time.
  - Every N minutes
    The polling runs regularly, with the specified interval in minutes, starting from the specified time.
    
    By default, the polling runs every five minutes, starting from the current system time.
  - By days of week
    The polling runs regularly, on the specified days of week, and at the specified time.
    
    By default, the polling runs every Friday at 6:00:00 PM.
  - Every month on specified days of selected weeks
    The polling runs regularly, on the specified days of each month, and at the specified time.
    
    By default, no days of month are selected; the default start time is 6:00:00 PM.
  - Run missed tasks
    If the Administration Server is switched off or unavailable during the time for which the poll is scheduled, the Administration Server can either start the poll immediately after it is switched on, or wait for the next time for which the poll scheduled.
    
    If this option is enabled, the Administration Server starts polling immediately after it is switched on.
    
    If this option is disabled, the Administration Server waits for the next time for which the polling is scheduled.
    
    By default, this option is enabled.
- Set full polling schedule
  The default period is one hour. The data received at the next polling completely replaces the old data.
  
  The following polling schedule options are available:
  - Every N days
    The polling runs regularly, with the specified interval in days, starting from the specified date and time.
    
    By default, the polling runs every day, starting from the current system date and time.
  - Every N minutes
    The polling runs regularly, with the specified interval in minutes, starting from the specified time.
    
    By default, the polling runs every five minutes, starting from the current system time.
  - By days of week
    The polling runs regularly, on the specified days of week, and at the specified time.
    
    By default, the polling runs every Friday at 6:00:00 PM.
  - Every month on specified days of selected weeks
    The polling runs regularly, on the specified days of each month, and at the specified time.
    
    By default, no days of month are selected; the default start time is 6:00:00 PM.
  - Run missed tasks
    If the Administration Server is switched off or unavailable during the time for which the poll is scheduled, the Administration Server can either start the poll immediately after it is switched on, or wait for the next time for which the poll scheduled.
    
    If this option is enabled, the Administration Server starts polling immediately after it is switched on.
    
    If this option is disabled, the Administration Server waits for the next time for which the polling is scheduled.
    
    By default, this option is enabled.

If you want to perform the poll immediately, click Poll now. Both types of polls will start.

On the virtual Administration Server you can view and edit the polling settings of the Windows network in the properties window of the distribution point, in the Device discovery section.

Scenario: Discovering networked devices

Page top

[Topic 3886]

Active Directory polling

Expand all | Collapse all

Use Active Directory polling if you use Active Directory; otherwise, it is recommended to use other poll types. If you use Active Directory but some of the networked devices are not listed as members, these devices cannot be discovered by Active Directory polling.

Viewing and modifying the settings for Active Directory polling

To view and modify the settings for polling Active Directory groups:

In the console tree, in the Device discovery folder, select the Active Directory subfolder.
Alternatively, you can proceed from the Unassigned devices folder to the Device discovery folder by clicking the Poll now button.
Click Configure polling.
The Active Directory properties window opens. If you want, modify the settings of Active Directory group polling:
- Enable Active Directory polling
  This option is selected by default. However, if you do not use Active Directory, the poll does not retrieve any results. In this case, you can unselect this option.
- Set polling schedule
  The default period is one hour. The data received at the next polling completely replaces the old data.
  
  The following polling schedule options are available:
  - Every N days
    The polling runs regularly, with the specified interval in days, starting from the specified date and time.
    
    By default, the polling runs every day, starting from the current system date and time.
  - Every N minutes
    The polling runs regularly, with the specified interval in minutes, starting from the specified time.
    
    By default, the polling runs every five minutes, starting from the current system time.
  - By days of week
    The polling runs regularly, on the specified days of week, and at the specified time.
    
    By default, the polling runs every Friday at 6:00:00 PM.
  - Every month on specified days of selected weeks
    The polling runs regularly, on the specified days of each month, and at the specified time.
    
    By default, no days of month are selected; the default start time is 6:00:00 PM.
  - Run missed tasks
    If the Administration Server is switched off or unavailable during the time for which the poll is scheduled, the Administration Server can either start the poll immediately after it is switched on, or wait for the next time for which the poll scheduled.
    
    If this option is enabled, the Administration Server starts polling immediately after it is switched on.
    
    If this option is disabled, the Administration Server waits for the next time for which the polling is scheduled.
    
    By default, this option is enabled.
- Advanced
  You can select which Active Directory domains to poll:
  - Active Directory domain to which the Kaspersky Security Center belongs.
  - Domain forest to which the Kaspersky Security Center belongs.
  - Specified list of Active Directory domains.
    If you select this option, you can add domains to the polling scope:
    - Click the Add button.
    - In the corresponding fields, specify the address of the domain controller, the name and password of the account for accessing it.
    - Click OK to save changes.
    You can select the domain controller address on the list and click the Modify or Remove buttons to modify or remove it.
  - Click OK to save changes.

If you want to perform the poll immediately, click the Poll now button.

On the virtual Administration Server, you can view and edit the polling settings of Active Directory groups in the properties window of the distribution point, in the Device discovery section.

See also:

Scenario: Discovering networked devices

Page top

[Topic 3887]

IP range polling

Expand all | Collapse all

The Administration Server polls the specified IP ranges using ICMP packets or the NBNS protocol and compiles a complete set of data on devices within those IP ranges. By default, this type of polling is disabled. It is not recommended to use this type of polling if you use Windows network polling and/or Active Directory polling.

Viewing and modifying the settings for IP range polling

To view and modify the settings for polling IP range groups:

In the console tree, in the Device discovery folder, select the IP ranges subfolder.
You can proceed from the Unassigned devices folder to the Device discovery folder by clicking Poll now.
If you want, in the IP ranges subfolder click Add subnet to add an IP range for polling, and then click OK.
Click Configure polling.
The IP ranges properties window opens. If you want, you can modify the settings of IP range polling:
- Enable IP range polling
  This option is not selected by default. It is not recommended to use this type of polling if you use Windows network polling and/or Active Directory polling.
- Set polling schedule
  The default period is 420 minutes. The data received at the next polling completely replaces the old data.
  
  The following polling schedule options are available:
  - Every N days
    The polling runs regularly, with the specified interval in days, starting from the specified date and time.
    
    By default, the polling runs every day, starting from the current system date and time.
  - Every N minutes
    The polling runs regularly, with the specified interval in minutes, starting from the specified time.
    
    By default, the polling runs every five minutes, starting from the current system time.
  - By days of week
    The polling runs regularly, on the specified days of week, and at the specified time.
    
    By default, the polling runs every Friday at 6:00:00 PM.
  - Every month on specified days of selected weeks
    The polling runs regularly, on the specified days of each month, and at the specified time.
    
    By default, no days of month are selected; the default start time is 6:00:00 PM.
  - Run missed tasks
    If the Administration Server is switched off or unavailable during the time for which the poll is scheduled, the Administration Server can either start the poll immediately after it is switched on, or wait for the next time for which the poll scheduled.
    
    If this option is enabled, the Administration Server starts polling immediately after it is switched on.
    
    If this option is disabled, the Administration Server waits for the next time for which the polling is scheduled.
    
    By default, this option is enabled.

If you want to perform the poll immediately, click Poll now. This button is only available if you selected Enable IP range polling.

On the virtual Administration Server, you can view and edit the settings for IP range polling in the distribution point properties window, in the Device discovery section. Client devices discovered during the poll of IP ranges are displayed in the Domains folder of the virtual Administration Server.

See also:

Scenario: Discovering networked devices

Page top

[Topic 222066]

Zeroconf polling

This polling type is supported only for Linux-based distribution points.

A distribution point can poll networks that have devices with IPv6 addresses. In this case, IP ranges are not specified and the distribution point polls the whole network by using zero-configuration networking (referred to as Zeroconf). To start using Zeroconf, you must install the avahi-browse utility on the distribution point.

To enable Zeroconf polling:

In the console tree, in the Device discovery folder, select the IP ranges subfolder.
You can proceed from the Unassigned devices folder to the Device discovery folder by clicking Poll now.
Click Configure polling.
In the IP ranges properties window that opens, select Enable polling with Zeroconf technology.

After that, the distribution point starts to poll your network. In this case, the specified IP ranges are ignored.

Page top

[Topic 3888]

Working with Windows domains. Viewing and changing the domain settings

To modify the domain settings:

In the console tree, in the Device discovery folder, select the Domains subfolder.
Select a domain and open its properties window in one of the following ways:
- By selecting Properties in the context menu of the domain.
- By clicking the Show group properties link.

The Properties: <Domain name> window opens where you can configure the selected domain.

See also:

Scenario: Discovering networked devices

Page top

[Topic 176626]

Configuring retention rules for unassigned devices

Expand all | Collapse all

After Windows network polling is complete, the found devices are placed into subgroups of the Unassigned devices administration group. This administration group can be found at Advanced → Device discovery → Domains. The Domains folder is the parent group. It contains child groups named after the corresponding domains and workgroups that have been found during the network polling. The parent group may also contain the administration group of mobile devices. You can configure the retention rules of the unassigned devices for the parent group and for each of the child groups. The retention rules do not depend on the network polling settings and work even if the network polling is disabled.

To configure retention rules for unassigned devices:

In the console tree, in the Device discovery folder, do one of the following:
- To configure settings of the parent group, right-click the Domains subfolder and select Properties.
  The parent group properties window opens.
- To configure settings of a child group, right-click its name and select Properties.
  The child group properties window opens.
In the Devices section, specify the following settings:
- Remove the device from the group if it has been inactive for longer than (days)
  If this option is enabled, you can specify the time interval after which the device is automatically removed from the group. By default, this option is also distributed to the child groups. The default time interval is 7 days.
  
  By default, this option is enabled.
- Inherit from parent group
  If this option is enabled, the retention period for the devices in the current group is inherited from the parent group and cannot be changed.
  
  This option is available only for child groups.
  
  By default, this option is enabled.
- Force inheritance in child groups
  The setting values will be distributed to child groups but in the properties of the child groups these settings are locked.
  
  By default, this option is disabled.

Your changes are saved and applied.

See also:

Scenario: Discovering networked devices

Page top

[Topic 52158]

Working with IP ranges

You can customize existing IP ranges and create new ones.

In this section

Creating an IP range

Viewing and changing the IP range settings

See also:

Scenario: Discovering networked devices

Page top

[Topic 3889]

Creating an IP range

To create an IP range:

In the console tree, in the Device discovery folder, select the IP ranges subfolder.
In the context menu of the folder, select New → IP range.
In the New IP range window that opens, set up the new IP range.

The new IP range appears in the IP ranges folder.

See also:

Scenario: Discovering networked devices

Page top

[Topic 3890]

Viewing and changing the IP range settings

To modify the IP range settings:

In the console tree, in the Device discovery folder select the IP ranges subfolder.
Select an IP range and open its properties window in one of the following ways:
- By selecting Properties in the context menu of the IP range.
- By clicking the Show group properties link.

The Properties: <IP range name> window opens where you can configure the properties of the selected IP range.

See also:

Scenario: Discovering networked devices

Page top

[Topic 3891]

Working with the Active Directory groups. Viewing and modifying group settings

To modify the settings for the Active Director group:

In the console tree, in the Device discovery folder, select the Active Directory subfolder.
Select an Active Directory group and open its properties window in one of the following ways:
- By selecting Properties in the context menu of the IP range.
- By clicking the Show group properties link.

The Properties: <Active Directory group name> window opens where you can configure the selected Active Directory group.

See also:

Scenario: Discovering networked devices

Page top

[Topic 5072]

Creating rules for moving devices to administration groups automatically

You can configure devices to be moved automatically to administration groups after they are discovered during a poll on an enterprise network.

To configure rules for moving devices to administration groups automatically:

In the console tree, select the Unassigned devices folder.
In the workspace of this folder, click Configure rules.

This opens the Properties: Unassigned devices window. In the Move devices section, configure the rules to move devices to administration groups automatically.

The first applicable rule in the list (from the top to the bottom of the list) will be applied to a device.

Synchronization with cloud

Scenario: Discovering networked devices

Page top

[Topic 67243]

Using VDI dynamic mode on client devices

A virtual infrastructure can be deployed on a corporate network using temporary virtual machines. Kaspersky Security Center detects temporary virtual machines and adds information about them to the Administration Server database. After a user finishes using a temporary virtual machine, the machine is removed from the virtual infrastructure. However, a record about the removed virtual machine can be saved in the database of the Administration Server. Also, nonexistent virtual machines can be displayed in Administration Console.

To prevent information about nonexistent virtual machines from being saved, Kaspersky Security Center supports dynamic mode for Virtual Desktop Infrastructure (VDI). The administrator can enable support of dynamic mode for VDI in the properties of the installation package of Network Agent to be installed on the temporary virtual machine.

When a temporary virtual machine is disabled, Network Agent notifies the Administration Server that the machine has been disabled. If the virtual machine has been disabled successfully, it is removed from the list of devices connected to the Administration Server. If the virtual machine is disabled with errors and Network Agent does not send a notification about the disabled virtual machine to the Administration Server, a backup scenario is used. In this scenario, the virtual machine is removed from the list of devices connected to the Administration Server after three unsuccessful attempts to synchronize with the Administration Server.

In this section

Enabling VDI dynamic mode in the properties of an installation package for Network Agent

Searching for devices that are part of VDI

Moving devices from VDI to an administration group

See also:

Scenario: Discovering networked devices

Page top

[Topic 67247]

Enabling VDI dynamic mode in the properties of an installation package for Network Agent

To enable VDI dynamic mode:

In the Remote installation folder of the console tree, select the Installation packages subfolder.
In the context menu of the Network Agent installation package, select Properties.
The Properties: Kaspersky Security Center Network Agent window opens.
In the Properties: Kaspersky Security Center Network Agent window, select the Advanced section.
In the Advanced section, select the Enable dynamic mode for VDI option.

The device on which Network Agent is to be installed will be a part of VDI.

See also:

Scenario: Discovering networked devices

Page top

[Topic 67248]

Searching for devices that are part of VDI

To find unassigned devices that make up part of VDI:

Select Search from the context menu of the Unassigned devices folder.
To see a list of all devices that are part of Virtual Desktop Infrastructure, select Search from the context menu of the Administration Server folder.
In the Search window, on the Virtual machines tab, select Yes in the Part of Virtual Desktop Infrastructure settings group.
Click the Find now button.

The list of unassigned devices that are part of Virtual Desktop Infrastructure is displayed.

Scenario: Discovering networked devices

Page top

[Topic 67249]

Moving devices from VDI to an administration group

To move devices that are part of VDI to an administration group:

In the workspace of the Unassigned devices folder, click Configure rules.
This opens the properties window of the Unassigned devices folder.
In the properties window of the Unassigned devices folder, in the Move devices section, click the Add button.
The New rule window opens.
In the New rule window, select the Virtual machines section.
In the This is a virtual machine drop-down list, select Yes.

A rule will be created for device relocation to an administration group.

See also:

Scenario: Discovering networked devices

Page top

[Topic 63679]

Equipment inventory

The hardware list (Repositories → Hardware) that you use to inventory equipment is populated in two ways: automatically and manually. After each network polling, all detected devices are added to the list automatically; however, you can also add devices manually if you do not want to poll the network. You can add other devices to the list manually, for example, routers, printers, or device hardware.

In the properties of a device, you can view and edit detailed information about that device.

The hardware list may contain the following types of devices:

Computers
Mobile devices
Network devices
Virtual devices
OEM components
Computer peripherals
Connected devices
VoIP phones
Network repositories

The administrator can assign the Enterprise equipment attribute to detected devices. This attribute can be assigned manually in the properties of a device, or the administrator can specify criteria for the attribute to be assigned automatically. In this case, the Enterprise equipment attribute is assigned by device type.

Kaspersky Security Center allows writing off equipment. To do this, select the Device is written off option in the properties of a device. The device is not displayed on the equipment list.

An administrator can manage the list of programmable logic controllers (PLC) in the Hardware folder. Detailed information on managing the PLC list is provided in the Kaspersky Industrial CyberSecurity for Nodes User Guide.

In this section

Adding information about new devices

Configuring criteria used to define enterprise devices

Configuring custom fields

See also:

Scenario: Discovering networked devices

Page top

[Topic 63680]

Adding information about new devices

To add information about new devices on the network:

In the Repositories folder of the console tree, select the Hardware subfolder.
In the workspace of the Hardware folder, click the Add device button to open the New device window.
The New device window opens.
In the New device window, in the Type drop-down list select a device type that you want to add.
Click OK.
The device properties window opens on the General section.
In the General section, fill in the entry fields with data on the device. The General section lists the following settings:
- Enterprise device. Select the check box if you want to assign the Enterprise attribute to the device. Using this attribute, you can search for devices in the Hardware folder.
- Device is written off. Select the check box if you do not want the device to be displayed in the list of devices in the Hardware folder.
Click Apply.

The new device will be displayed in the workspace of the Hardware folder.

See also:

Scenario: Discovering networked devices

Equipment inventory

Page top

[Topic 63681]

Configuring criteria used to define enterprise devices

To configure criteria of detection for enterprise devices:

In the Repositories folder of the console tree, select the Hardware subfolder.
In the workspace of the Hardware folder, click the Additional actions button and select Set up rule for Enterprise devices in the drop-down list.
The hardware properties window opens.
In the hardware properties window, in the Enterprise devices section, select a method for assigning the Enterprise attribute to the device:
- Set the Enterprise device attribute manually for the device. The Enterprise hardware attribute is assigned to the device manually in the device properties window, in the General section.
- Set the Enterprise device attribute automatically for the device. In the By device type block of settings, specify device types to which the application will automatically assign the Enterprise attribute.
  This option affects only the devices that were added through network polling. For the devices added manually, set the Enterprise attribute manually.
Click OK.

The criteria of detection for enterprise devices are configured.

See also:

Scenario: Discovering networked devices

Equipment inventory

Page top

[Topic 159862]

Configuring custom fields

To configure custom fields of devices:

In the Repositories folder of the console tree, select the Hardware subfolder.
In the workspace of the Hardware folder, click the Additional actions button and select Configure custom data fields in the drop-down list.
The hardware properties window opens.
In the hardware properties window, select the Custom fields section and click the Add button.
The Add field window opens.
In the Add field window, specify the name of the custom field that will be displayed in the hardware properties.
You can create multiple custom fields with unique names.
Click OK.

The custom fields that have been added are displayed in the Custom fields section of the hardware properties. You can use custom fields to provide specific information about devices. For example, this could be the internal order number for a hardware purchase.

See also:

Scenario: Discovering networked devices

Equipment inventory

Page top

[Topic 173420]

Licensing

This section provides information about general concepts related to Kaspersky Security Center 15.1 licensing.

In this section

Events of the licensing limit exceeded

About licensing

About data provision

Kaspersky Security Center licensing options

Licensing features of Kaspersky Security Center and managed applications

Step 2. Selecting the application activation method

Main installation scenario

Page top

[Topic 138255]

Events of the licensing limit exceeded

Kaspersky Security Center allows you to get information about events when some licensing limits are exceeded by Kaspersky applications installed on client devices.

The importance level of such events when a licensing limit is exceeded is defined according to the following rules:

If the currently used units covered by a single license constitute 90% to 100% of the total number of units covered by the license, the event is published with the Info importance level.
If the currently used units covered by a single license constitute 100% to 110% of the total number of units covered by the license, the event is published with the Warning importance level.
If the number of currently used units covered by a single license exceeds 110% of the total number of units covered by the license, the event is published with the Critical event importance level.

Page top

[Topic 213977]

About licensing

This section contains information about the licensing of Kaspersky applications managed via Kaspersky Security Center.

In this section

About the license

About the End User License Agreement

About the license certificate

About the license key

About the key file

About the subscription

About the activation code

Revoking consent with an End User License Agreement

Page top

[Topic 69240]

About the license

A license is a time-limited right to use Kaspersky Security Center, granted under the terms of the signed License Contract (End User License Agreement).

The scope of services and validity period depend on the license under which the application is used.

The following license types are provided:

Trial
A free license intended for trying out the application. A trial license usually has a short term.

When a trial license expires, all Kaspersky Security Center features become disabled. To continue using the application, you need to purchase a commercial license.

You can use the application under a trial license for only one trial period.
Commercial
A paid license.

When a commercial license expires, key features of the application become disabled. To continue using Kaspersky Security Center, you must renew your commercial license. After a commercial license expires, you cannot continue using the application and must remove it from your device.

We recommend renewing your license before it expires, to ensure uninterrupted protection against all security threats.

Page top

[Topic 179583]

About the End User License Agreement

The End User License Agreement (License Agreement or EULA) is a binding agreement between you and AO Kaspersky Lab stipulating the terms under which you may use the application.

Please carefully read the License Agreement before you start using the application.

Kaspersky Security Center and its components, for example, Network Agent, have their own EULA.

You can view the terms of the End User License Agreement for Kaspersky Security Center using the following methods:

During installation of Kaspersky Security Center.
By reading the license.txt document included in the Kaspersky Security Center distribution kit.
By reading the license.txt document in the Kaspersky Security Center installation folder.
By downloading the license.txt file from the Kaspersky website.

You can view the terms of the End User License Agreement for Network Agent for Windows, Network Agent for Mac, and Network Agent for Linux by using the following methods:

During downloading of the Network Agent distribution package from the Kaspersky web servers.
During installation of Network Agent for Windows, Network Agent for Mac, or Network Agent for Linux.
By reading the license.txt document included in the Network Agent for Windows, Network Agent for Mac, or Network Agent for Linux distribution package.
By reading the license.txt document in the Network Agent for Windows, Network Agent for Mac, or Network Agent for Linux installation folder.
By downloading the license.txt file from the Kaspersky website.

You accept the terms of the End User License Agreement by confirming that you agree with the End User License Agreement when installing the application. If you do not accept the terms of the License Agreement, cancel the application installation and do not use the application.

Page top

[Topic 73976]

About the license certificate

A license certificate is a document that you receive along with a key file or an activation code.

A license certificate contains the following information about the license provided:

License key or order number
Information about the user who has been granted the license
Information about the application that can be activated under the license provided
Limit of the number of licensing units (e.g., devices on which the application can be used under the license provided)
License validity start date
License expiration date or license term
License type

Page top

[Topic 69295]

About the license key

A license key is a sequence of bits that you can apply to activate and then use the application in accordance with the terms of the End User License Agreement. License keys are generated by Kaspersky specialists.

You can add a license key to the application using one of the following methods: by applying a key file or by entering an activation code. The license key is displayed in the application interface as a unique alphanumeric sequence after you add it to the application.

The license key may be blocked by Kaspersky in case the terms of the License Agreement have been violated. If the license key has been blocked, you need to add another one if you want to use the application.

A license key may be active or additional (or reserve).

An active license key is a license key that is currently used by the application. An active license key can be added for a trial or commercial license. The application cannot have more than one active license key.

An additional (or reserve) license key is a license key that entitles the user to use the application, but is not currently in use. The additional license key automatically becomes active when the license associated with the current active license key expires. An additional license key can be added only if an active license key has already been added.

A license key for a trial license can be added as an active license key. A license key for a trial license cannot be added as an additional license key.

Page top

[Topic 69431]

About the key file

A key file is a file with the .key extension provided to you by Kaspersky. Key files are designed to activate the application by adding a license key.

You receive a key file at the email address that you provided when you bought Kaspersky Security Center or ordered the trial version of Kaspersky Security Center.

You do not need to connect to Kaspersky activation servers in order to activate the application with a key file.

You can restore a key file if it has been accidentally deleted. You may need a key file to register a Kaspersky CompanyAccount, for example.

To restore your key file, perform any of the following actions:

Contact the license seller.
Receive a key file through Kaspersky website by using your available activation code.
Export a license key file from other Administration Server.

Page top

[Topic 91039]

About the subscription

Subscription to Kaspersky Security Center is an order for use of the application under the selected settings (subscription expiration date, number of protected devices). You can register your subscription to Kaspersky Security Center with your service provider (for example, your internet provider). A subscription can be renewed manually or in automatic mode; also, you can cancel it.

A subscription can be limited (for example, one-year) or unlimited (with no expiration date). To continue using Kaspersky Security Center after a limited subscription expires, you must renew it. An unlimited subscription is renewed automatically if it has been prepaid to the service provider in due dates.

When a limited subscription expires, you may be provided a grace period for renewal during which the application continues to function. The availability and duration of the grace period is defined by the service provider.

To use Kaspersky Security Center under subscription, you must apply the activation code received from the service provider.

You can apply a different activation code for Kaspersky Security Center only after your subscription expires or when you cancel it.

Depending on the service provider, the set of possible actions for subscription management may vary. The service provider might not provide a grace period for subscription renewal and so the application loses its functionality.

Activation codes purchased under subscription cannot be used for activating earlier versions of Kaspersky Security Center.

When the application is used under subscription, Kaspersky Security Center automatically attempts to access the activation server at specified time intervals until the subscription expires. This ensures that the information about the subscription is synchronized with the activation server. If access to the server using system DNS is not possible, the application uses public DNS servers. You can renew your subscription on the service provider's website.

You can update the information about the subscription manually, without waiting for Kaspersky Security Center to access the activation server. For example, this might be useful when you change the subscription settings.

To update the information about the subscription manually:

In the console tree, select the Kaspersky Licenses folder.
Click Additional actions, and from the drop-down list select Synchronize subscription settings with Licensing server.

The information about the subscription is updated on the activation server.

Page top

[Topic 111091]

About the activation code

Activation code is a unique sequence of 20 alphanumeric characters. You enter an activation code to add a license key that activates Kaspersky Security Center. You receive the activation code through the email address that you specified after purchasing Kaspersky Security Center or after ordering the trial version of Kaspersky Security Center.

To activate the application by using the activation code, you need internet access to establish connection with Kaspersky activation servers. If access to the servers using system DNS is not possible, the application uses public DNS servers.

If the application was activated with an activation code, the application in some cases sends regular requests to Kaspersky activation servers in order to check the current status of the license key. You must provide the application internet access to make it possible to send requests.

If you have lost your activation code after installing the application, contact the Kaspersky partner from whom you purchased the license.

You cannot use key files for activating managed applications; only activation codes are accepted.

See also:

Main installation scenario

Page top

[Topic 192967]

Revoking consent with an End User License Agreement

If you decide to stop protection of your client devices, you can uninstall managed Kaspersky applications and revoke your End User License Agreement (EULA) for these applications.

To revoke a EULA for managed Kaspersky applications:

In the console tree, select Administration Server → Advanced → Accepted EULAs.
A list of EULAs—accepted upon creation of installation packages, at the seamless installation of updates, or upon deployment of Kaspersky Security for Mobile—is displayed.
In the list, select the EULA that you want to revoke.
You can view the following properties of the EULA:
- Date when the EULA was accepted.
- The name of the user who accepted the EULA.
- Link to the terms of the EULA.
- List of the objects that are connected to the EULA: names of installation packages, names of seamless updates, names of mobile apps.
Click the Revoke EULA button.
In the window that opens, you are informed that you must uninstall Kaspersky application corresponding to the EULA.
Click the button to confirm revocation.
Kaspersky Security Center checks whether the installation packages (corresponding to the managed Kaspersky application whose EULA you want to revoke) are deleted.

You can revoke only the EULA for a managed Kaspersky application, whose installation packages are deleted.

The EULA is revoked. It is not displayed in the list of EULAs in the Administration Server → Advanced → Accepted EULAs section. You cannot protect client devices using a Kaspersky application whose EULA you have revoked.

Page top

[Topic 175956]

About data provision

Data transferred to third parties

When using the Mobile Device Management functionality of the Software, for the purpose of timely delivery of commands to devices running the Android operating system through the push notification mechanism the Google Firebase Cloud Messaging service is used. If the User has configured the usage of the Google Firebase Cloud Messaging service, the User accepts to provide the following information to the Google Firebase Cloud Messaging service in automatic mode: installation IDs of the Kaspersky Endpoint Security for Android applications to which push notifications must be sent.

To block exchange of information with the Google Firebase Cloud Messaging service, the User must roll back the usage settings of the Google Firebase Cloud Messaging service to their factory values.

When using the Mobile Device Management functionality of the Software, for the purpose of timely delivery of commands to devices running the iOS operating system through the push notification mechanism the Apple Push Notification Service (APNs) is used. If the User has installed an APNs certificate on an iOS MDM Server, created an iOS MDM profile with a collection of settings for connection of iOS mobile devices to the Software, and installed this profile on mobile devices, the User agrees to provide the following information to APNs in automatic mode:

Token—Push token of the device. The server uses this token when sending push notifications to the device.
PushMagic—String that must be included in the push notification. The string value is generated by the device.

Data processed locally

Kaspersky Security Center is designed for centralized execution of basic administration and maintenance tasks on an organization's network. Kaspersky Security Center provides the administrator with access to detailed information about the organization's network security level; Kaspersky Security Center lets the administrator configure all the components of protection based on Kaspersky applications. Kaspersky Security Center performs the following main functions:

Detecting devices and their users on the organization's network
Creating a hierarchy of administration groups for device management
Installing Kaspersky applications on devices
Managing the settings and tasks of installed applications
Managing the updates for Kaspersky and third-party applications, and finding and fixing vulnerabilities
Activating Kaspersky applications on devices
Managing user accounts
Viewing information about the operation of Kaspersky applications on devices
Viewing reports

To perform its main functions Kaspersky Security Center can receive, store, and process the following information:

Information about the devices on the organization's network received through scanning of Windows domain, Active Directory or Samba domain controllers, or through scanning of IP ranges. Administration Server gets data independently or receives data from Network Agent acting as a distribution point.
Information from Active Directory and Samba about organizational units, domains, users, and groups. Administration Server gets data independently or receives data from Network Agent acting as a distribution point.
Details of managed devices. Network Agent transfers the data listed below from the device to Administration Server. The User enters the display name and description of the device in the Administration Console interface or Kaspersky Security Center Web Console interface:
- Technical specifications of the managed device and its components required for device identification: device display name and description, Windows domain name and type, device name in Windows environment, DNS domain and DNS name, IPv4 address, IPv6 address, network location, MAC address, serial number, operating system type, whether the device is a virtual machine together with hypervisor type, and whether the device is a dynamic virtual machine as part of VDI.
- Other specifications of managed devices and their components required for audit of managed devices and for making decisions about whether specific patches and updates are applicable: Windows Update Agent (WUA) status, operating system architecture, operating system vendor, operating system build number, operating system release ID, operating system location folder, if the device is a virtual machine—the virtual machine type; the name of the virtual Administration Server that manages the device; cloud device data (cloud region, VPC, cloud availability zone, cloud subnet, cloud placement zone).
- Details of actions on managed devices: date and time of the last update, time the device was last visible on the network, restart waiting status, and time the device was turned on.
- Details of device user accounts and their work sessions.
Data received by running remote diagnostics on a managed device: trace files, system information, details of Kaspersky applications installed on the device, dump files, event logs, the results of running the diagnostic scripts received from Kaspersky Technical Support.
Distribution point operation statistics if the device is a distribution point. Network Agent transfers data from the device to Administration Server.
Distribution point settings entered by the User in the Administration Console or Kaspersky Security Center Web Console.
Data necessary for the connection of mobile devices to the Administration Server: certificate, mobile connection port, Administration Server connection address. The User enters the data in the Administration Console or in Kaspersky Security Center Web Console.
Details of mobile devices transferred by using the iOS MDM protocol. The data listed below are transferred from the mobile device to Administration Server:
- Technical specifications of the mobile device and its components required for device identification: device name, model, operating system name and build number, device model number, IMEI number, UDID, MEID, serial number, amount of memory, modem firmware version, Bluetooth MAC address, Wi-Fi MAC address, and SIM card details (ICCID as part of the SIM card ID).
- Details of the mobile network used by the managed device: mobile network type, name of the currently used mobile network, name of the home mobile network, version of the mobile network operator settings, voice roaming and data roaming status, country code of the home network, residence country code, country code of the currently used network, and encryption level.
- Security settings of the mobile device: use of a password and its compliance with the policy settings, list of configuration profiles and provisioning profiles used for installation of third-party applications.
- Date of last synchronization with Administration Server and device management status.
Details of Kaspersky applications installed on the device. The managed application transfers data from the device to Administration Server through Network Agent:
- Settings of Kaspersky applications installed on the managed device: Kaspersky application name and version, status, real-time protection status, last device scan date and time, number of threats detected, number of objects that failed to be disinfected, availability and status of the application components, time of last update and version of anti-virus databases, details of Kaspersky application settings and tasks, information about the active and reserve license keys, application installation date and ID.
- Application operation statistics: events related to the changes in the status of Kaspersky application components on the managed device and to the performance of tasks initiated by the application components.
- Device status defined by the Kaspersky application.
- Tags assigned by the Kaspersky application.
- Set of installed and applicable updates for the Kaspersky application.
Data contained in events from Kaspersky Security Center components and Kaspersky managed applications. Network Agent transfers data from the device to Administration Server.
Data necessary for the integration of Kaspersky Security Center with a SIEM system for event export. The User enters the data in the Administration Console or in Kaspersky Security Center Web Console.
Settings of Kaspersky Security Center components and Kaspersky managed applications presented in policies and policy profiles. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
Task settings of Kaspersky Security Center components and Kaspersky managed applications. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
Data processed by the Vulnerability and patch management feature. Network Agent transfers the data listed below from the device to Administration Server:
- Details of applications and patches installed on managed devices (Applications registry).
- Information about the hardware detected on managed devices (Hardware registry).
  If Network Agent is installed on a device running Windows, it sends to the Administration Server the following information about the device hardware:
  - RAM
  - Mass storage devices
  - Motherboard
  - CPU
  - Network adapters
  - Monitors
  - Video adapter
  - Sound card
  If Network Agent is installed on a device running Linux or macOS, it sends to the Administration Server the following information about the device hardware, if this information is provided by the operating system:
  - Total RAM volume
  - Total volume of mass storage devices
  - Motherboard
  - CPU
  - Network adapters
- Details of vulnerabilities in third-party software detected on managed devices.
- Details of updates available for third-party applications installed on managed devices.
- Details of Microsoft updates found by the WSUS feature.
- List of Microsoft updates found by the WSUS feature that must be installed on the device.
Data required to download updates on isolated Administration Server to fix third-party software vulnerabilities on managed devices. The User enters and transmits data by using the Administration Server klscflag utility.
Data necessary for work of Kaspersky Security Center with the cloud environments (Amazon Web Services, Microsoft Azure, Google Cloud, Yandex Cloud). The User enters the data in the Administration Console or in Kaspersky Security Center Web Console.
User categories of applications. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
Details of executable files detected on managed devices by the Application Control feature. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface. A complete list of data is provided in the Help files of the corresponding application.
Details of files placed in Backup. The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
Details of files placed in Quarantine. The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
Details of files requested by Kaspersky specialists for detailed analysis. The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
Details of the status and triggering of Adaptive Anomaly Control rules. The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
Details of external devices (memory units, information transfer tools, information hardcopy tools, and connection buses) installed or connected to the managed device and detected by the Device Control feature. The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
Information about encrypted devices and the encryption status. The managed application transfers data from the device to Administration Server through Network Agent.
Details of data encryption errors on devices performed using the Data encryption feature of Kaspersky applications. The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
List of managed programmable logic controllers (PLCs). The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
Data required for creation of a threat development chain. The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
Information about attempts by an organization's employees to access cloud services. The managed application transfers data from the device to Administration Server through Network Agent. A complete list of data is provided in the Help files of the corresponding application.
Data required for Kaspersky Security Center integration with the Kaspersky Managed Detection and Response service (the dedicated plug-in must be installed for Kaspersky Security Center Web Console): integration initiation token, integration token, and user session token. The User enters the integration initiation token in the Kaspersky Security Center Web Console interface. The Kaspersky MDR service transfers the integration token and the user session token through the dedicated plug-in.
Details of the entered activation codes or specified key files. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
User accounts: name, description, full name, email address, main phone number, password, secret key generated by Administration Server, and one-time password for two-step verification. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
Data that Identity and Access Manager needs for centralized authentication and for providing Single Sign-on (SSO) between Kaspersky applications integrated with Kaspersky Security Center: installation and configuration settings of Identity and Access Manager, Identity and Access Manager user session, Identity and Access Manager tokens, client application statuses and resource server statuses. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
Revision history of management objects. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
IP address of the device on which a user created a revision. The IP address is defined by Administration Server automatically.
Registry of deleted management objects. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
Installation packages created from the file, as well as installation settings. The User enters data in the Administration Console or Kaspersky Security Center Web Console interface.
Data required for the display of announcements from Kaspersky in Kaspersky Security Center Web Console. The User enters data in the Kaspersky Security Center Web Console interface.
Data required for the functioning of plug-ins of managed applications in Kaspersky Security Center Web Console and saved by the plug-ins in the Administration Server database during their routine operation. The description and ways of providing the data are provided in the Help files of the corresponding application.
Kaspersky Security Center Web Console user settings: localization language and theme of the interface, Monitoring panel display settings, information about the status of notifications (Already read / Not yet read), status of columns in spreadsheets (Show / Hide), Training mode progress. The User enters data in the Kaspersky Security Center Web Console interface.
Kaspersky Event Log for Kaspersky Security Center components and Kaspersky managed applications. Kaspersky Event Log is stored on each device and is never transferred to Administration Server.
Certificate for secure connection of managed devices to the Kaspersky Security Center components. The User enters data by using the Administration Server klsetsrvcert utility.
Certificates for establishing trust to the internal web resources of the organization. The User enters data in the Kaspersky Security Center Web Console interface.
Data required for the Kaspersky Security Center operation in cloud environments, such as Amazon Web Services (AWS), Microsoft Azure, Google Cloud, and Yandex.Cloud. Administration Server receives the data from the virtual machine on which it runs.
Information about the User's acceptance of the terms and conditions of legal agreements with Kaspersky.
The Administration Server data that the User enters in the following components:
- Administration Console
- Kaspersky Security Center Web Console
- Command-line terminal when using the klscflag utility
- Components interacting with the Administration Server via klakaut automation objects and Kaspersky Security Center OpenAPI
Any data that the User enters in the Administration Console or Kaspersky Security Center Web Console interface.

The data listed above can be present in Kaspersky Security Center if one of the following methods is applied:

The User enters data in the interface of the following components:
- Administration Console
- Kaspersky Security Center Web Console
- Command-line terminal when using the klscflag utility
- Components interacting with the Administration Server via klakaut automation objects and Kaspersky Security Center OpenAPI
Network Agent automatically receives data from the device and transfers it to Administration Server.
Network Agent receives data retrieved by the Kaspersky managed application and transfers it to Administration Server. The lists of data processed by Kaspersky managed applications are provided in the Help files for the corresponding applications.
Administration server gets information about networked devices independently or receives information from a Network Agent acting as a distribution point.
Data is transferred from the mobile device to Administration Server by using the iOS MDM protocol.

The listed data is stored in the Administration Server database. User names and passwords are stored in encrypted form.

All data listed above can be transferred to Kaspersky only through dump files, trace files, or log files of Kaspersky Security Center components, including log files created by installers and utilities.

Dump files, trace files, and log files of Kaspersky Security Center components contain random data of Administration Server, Network Agent, Administration Console, iOS MDM Server, and Kaspersky Security Center Web Console. These files can contain personal and sensitive data. Dump files, trace files, and log files are stored on the device in non-encrypted form. Dump files, trace files, and log files are not transferred to Kaspersky automatically; however, the administrator can transfer data to Kaspersky manually upon request by Technical Support to resolve issues in the Kaspersky Security Center operation.

Following the links in the Administration Console or Kaspersky Security Center Web Console, the User agrees to the automatic transfer of the following data:

Kaspersky Security Center code
Kaspersky Security Center version
Kaspersky Security Center localization
License ID
License type
Whether the license was purchased through a partner

The list of data provided via each link depends on the purpose and location of the link.

Kaspersky uses the received data in anonymized form and for general statistics only. Summary statistics are generated automatically from the originally received information and do not contain any personal or confidential data. As soon as new data is accumulated, the previous data is wiped (once a year). Summary statistics are stored indefinitely.

Kaspersky protects any information received in accordance with law and applicable Kaspersky rules. Data is transmitted over a secure channel.

Page top

[Topic 65277]

Kaspersky Security Center licensing options

Expand all | Collapse all

Kaspersky Security Center can work in the following modes:

No license (basic functionality)
Kaspersky Security Center works in this mode before the application is activated or after the commercial license expires. Kaspersky Security Center with support of the basic functionality of Administration Console is delivered as a part of Kaspersky applications for protection of corporate networks. You can also download it from Kaspersky website.
Commercial license
If you need additional functionality which is not included in the basic functionality of Administration Console, you must purchase a commercial license.

When adding a license key in the Administration Server properties window, ensure that you add a license key that lets you use Kaspersky Security Center. You can find this information at the Kaspersky website. Each solution webpage contains the list of applications included in this solution. Administration Server may accept unsupported license keys, for example a license key for Kaspersky Endpoint Security Cloud, but such license keys provide no new features in addition to the basic functionality of Administration Console.

Feature or property	Kaspersky Security Center operation mode

	No license	Commercial license
Basic functionality of Administration Console The following functions are available: Creation of virtual Administration Servers that are used to administer a network of remote offices or client organizations. Creation of a hierarchy of administration groups to manage specific devices as a single entity. Remote installation of applications. Centralized configuration of applications installed on client devices. Control of the anti-virus security status of an organization. Management of user roles. Statistics and reports on the application's operation, as well as notifications about critical events. Centralized operations with files that were moved to Quarantine or Backup and files whose processing was postponed. Encryption and data protection management. Viewing and editing existing licensed applications groups. Viewing and manual editing of the list of hardware components detected by polling the network. Viewing the list of operating system images available for remote installation.
Vulnerability and patch management: basic functionality The following tasks do not require a commercial license: The Find vulnerabilities and required updates task Through this task, Kaspersky Security Center receives the lists of detected vulnerabilities and required updates for the third-party software installed on the managed devices. The Install Windows Update updates task This task can be used to install Windows Update updates only. To use this task, you must manually specify the required updates in the task settings. The Fix vulnerabilities task The Fix vulnerabilities task uses recommended fixes for Microsoft software and user fixes for third-party software. To use this task, you must manually specify user fixes for vulnerabilities in the task settings.
Vulnerability and patch management: advanced functionality The following functions are available: Remote installation of software updates and fixing of vulnerabilities automatically, according to the rules that you define. Usage of Administration Server as the Windows Server Update Services (WSUS) server to provide updates to Windows Update services on devices in centralized mode and with the set frequency.
Mobile Device Management feature in MMC-based Administration Console The Mobile Device Management feature is used to manage iOS MDM and Android mobile devices. The following functions are available for iOS MDM devices: Adding new devices under management of Kaspersky Security Center. Creating and editing configuration profiles, and installing configuration profiles on mobile devices. Installing applications on mobile devices either through App Store or by using manifest files (.plist) or by using mobile installation packages (.ipa). Executing commands on iOS MDM devices, including locking mobile devices, resetting the mobile device password, and deleting all data from the mobile device. The following functions are available for Android devices: Adding new devices under management of Kaspersky Security Center. Managing Kaspersky Endpoint Security for Android through policy. Executing commands on devices. The management unit for Mobile Devices Management is a mobile device. A mobile device is considered to be managed after it is connected to the Mobile Devices Server.		(A license key must be added to the Administration Server properties.)
Mobile device protection in Kaspersky Security Center Web Console Kaspersky Security Center Web Console provides you with the following features to manage Android and iOS mobile devices: Adding new devices under management of Kaspersky Security Center. Managing Kaspersky Endpoint Security for Android and Kaspersky Security for iOS through policies. Sending commands to the mobile devices through relevant protocols and executing the commands.		(A license key must be added on each mobile device.)
Systems management The following functions are available: Installation of operating systems and applications. Kaspersky Security Center allows you to create operating system images and deploy them on client devices on the network, as well as perform remote installation of applications by Kaspersky or other vendors. You can capture operating system images from devices and transfer those images to the Administration Server. Such images of operating systems are stored on the Administration Server in a dedicated folder. The operating system image of a reference device is captured and then created through an installation package creation task. You can use the images received for deployment on new networked devices on which no operating system has been installed yet. A technology named Preboot eXecution Environment (PXE) is used in this case. Licensed applications group management. Remote permission of connection to client devices through a component of Microsoft Windows named Remote Desktop Connection. Remote connection to client devices through Windows Desktop Sharing. Remote connection through Kaspersky Remote Desktop Session Viewer.
Integration with cloud environments Kaspersky Security Center not only works with on-premises devices, but also provides special features for working in a cloud environment, such as Cloud Environment Configuration Wizard. Kaspersky Security Center works with the following virtual machines: Amazon EC2 instances Microsoft Azure virtual machines Google Cloud virtual machines instances Yandex.Cloud virtual machines
Exporting events to SIEM systems: using the Syslog protocol Using the Syslog protocol, you can relay any events that occur on the Kaspersky Security Center Administration Server and in Kaspersky applications that are installed on managed devices. The Syslog protocol is a standard message-logging protocol. You can use it to export events to any SIEM system.

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 173097]

Licensing features of Kaspersky Security Center and managed applications

Licensing of Administration Server and managed applications involves the following:

You can add license key or valid activation code to an Administration Server to activate Vulnerability and patch management, Mobile Device Management, or Integration with the SIEM systems. Some features of Kaspersky Security Center are only accessible depending on active key files or valid activation codes added to the Administration Server.
You can add multiple activation codes and key files for managed applications to the Administration Server repository.

About Kaspersky Security Center licensing

If you activated one of the licensed features (for example, Mobile Device Management) using a key file, but you also want to use another licensed feature (for example, Vulnerability and patch management), you must purchase from your service provider a key file that activates both these features and you must activate Administration Server by using this key file.

Licensing features of managed applications

For licensing of managed applications, an activation code or key file can be deployed automatically or in any other convenient way. The following methods can be applied to deploy an activation code or key file:

Automatic deployment
If you use different managed applications and you have to deploy a specific key file or activation code to devices, opt for other ways of deploying that activation code or key file.

Kaspersky Security Center allows you to automatically deploy available license keys to devices. For example, three license keys are stored in the Administration Server repository. You have selected the Automatically distribute license key to managed devices check box for all three license keys. A Kaspersky security application—for example, Kaspersky Endpoint Security for Windows—is installed on the organization's devices. A new device is discovered to which a license key must be deployed. The application determines, for instance, that two of the license keys from the repository can be applied to the device: license key named Key_1 and license key named Key_2. One of these license keys is deployed to the device. In this case, it cannot be predicted which of the two license keys will be deployed to the device because automatic deployment of license keys does not provide for any administrator activity.

When a license key is deployed, the devices are recounted for that license key. You must make sure that the number of devices to which the license key was deployed does not exceed the license limit. If the number of devices exceeds the license limit, all devices that were not covered by the license will be assigned Critical status.
Adding a key file or activation code to the installation package of a managed application
If you install a managed application using an installation package, you can specify an activation code or key file in this installation package or in the policy of the application. The license key will be deployed to managed devices at the next synchronization of the device with the Administration Server.
Deployment through the add license key task for a managed application
If you opt for using the add license key task for a managed application, you can select the license key that must be deployed to devices and select the devices in any convenient way—for example, by selecting an administration group or a device selection.
Adding an activation code or a key file manually to the devices

Main installation scenario

Page top

[Topic 6374]

Kaspersky applications. Centralized deployment

This section describes the methods for remote installation of Kaspersky applications and their removal from networked devices.

Before deploying applications on client devices, make sure that the hardware and software of client devices meets the applicable requirements.

Network Agent is a component that provides for Administration Server connection with client devices. Therefore, it must be installed on each client device to be connected to the remote centralized control system. The device on which the Administration Server is installed can only use the server version of Network Agent. This version is included in Administration Server as a part that is installed and removed together with it. There is no need to install Network Agent on that device.

Network Agent can be installed remotely or locally like any application. During centralized deployment of security applications through Administration Console, you can install Network Agent jointly with security applications.

Network Agents can differ depending upon the Kaspersky applications with which they work. In some cases, Network Agent can be installed locally only (for details please refer to the documentation for the corresponding applications). You only have to install Network Agent on a client device once.

Kaspersky applications are managed through Administration Console by using management plug-ins. Therefore, to access the application management interface through Kaspersky Security Center, the corresponding management plug-in must be installed on the administrator's workstation.

You can perform remote installation of applications from the administrator's workstation in the Kaspersky Security Center main window.

To install software remotely, you must create a remote installation task.

The created task for remote installation will start according to its schedule. You can interrupt the installation procedure by stopping the task manually.

If remote installation of an application returns an error, you can find the cause of this error and fix it using the remote installation preparation utility.

You can track the progress of remote installation of Kaspersky applications on a network using the deployment report.

For details about management of the listed applications in Kaspersky Security Center, please refer to the documentation for the corresponding applications.

In this section

Replacing third-party security applications

Installing applications using a remote installation task

Installing applications using Remote installation wizard

Working with the management plug-ins

Viewing a protection deployment report

Remote removal of applications

Working with installation packages

Receiving up-to-date versions of applications

Preparing a Windows device for remote installation

Preparing a Linux device and installing Network Agent on a Linux device remotely

Preparing a macOS device for remote installation of Network Agent

See also:

Main installation scenario

Page top

[Topic 180093]

Replacing third-party security applications

Installation of Kaspersky security applications through Kaspersky Security Center may require removal of third-party software incompatible with the application being installed. Kaspersky Security Center provides several ways of removing the third-party applications.

Removing incompatible applications by using the installer

This option is available in Microsoft Management Console-based Administration Console only.

The installer method of removing incompatible applications is supported by various types of installation. Before the security application installation, all incompatible applications are removed automatically if the properties window of the installation package of this security application (Incompatible applications section) has the Uninstall incompatible applications automatically option selected.

Removing incompatible applications when configuring remote installation of an application

You can enable the Uninstall incompatible applications automatically option when you configure remote installation of a security application. In Microsoft Management Console (MMC) based Administration Console, this option is available in the Remote installation wizard. In Kaspersky Security Center Web Console, you can find this option in the Protection deployment wizard. When this option is enabled, Kaspersky Security Center removes incompatible applications before installing a security application on a managed device.

How-to instructions:

Administration Console: Removing incompatible applications using Remote Installation Wizard
Kaspersky Security Center Web Console: Removing incompatible applications before installation

Removing incompatible applications through a dedicated task

To remove incompatible applications, use the Uninstall application remotely task. This task should be run on devices before the security application installation task. For example, in the installation task you can select On completing another task as the schedule type where the other task is Uninstall application remotely.

This method of uninstallation is useful when the security application installer cannot properly remove an incompatible application.

How-to instructions for Administration Console: Creating a task.

Page top

[Topic 6385]

Installing applications using a remote installation task

Kaspersky Security Center allows you to install applications on devices remotely, using remote installation tasks. Those tasks are created and assigned to devices through a dedicated wizard. To assign a task more quickly and easily, you can specify devices (up to 1000 devices) in the wizard window in one of the following ways:

Select networked devices detected by Administration Server. In this case, the task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
Specify device addresses manually or import addresses from a list. You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
Assign task to a device selection. In this case, the task is assigned to devices included in a selection created earlier. You can specify the predefined selection or a custom one that you created.
Assign task to an administration group. In this case, the task is assigned to devices included in an administration group created earlier.

For correct remote installation on a device with no Network Agent installed, the following ports must be opened: a) TCP 139 and 445; b) UDP 137 and 138. By default, these ports are opened on all devices included in the domain. They are opened automatically by the remote installation preparation utility.

In this section

Installing an application on selected devices

Installing an application on client devices in an administration group

Installing an application through Active Directory group policies

Installing applications on secondary Administration Servers

Page top

[Topic 54971]

Installing an application on selected devices

To install an application on selected devices:

In the console tree, select the Tasks folder.
Run the task creation by clicking the Create a task button.
The New task wizard starts. Follow the instructions of the wizard.

In the Select the task type window of the New task wizard, in the Kaspersky Security Center Administration Server node select Install application remotely as the task type.

The New task wizard creates a task of remote installation of the selected application for specific devices. The newly created task is displayed in the workspace of the Tasks folder.
Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

On completion of the remote installation task, the selected application will be installed on the selected devices.

Page top

[Topic 54970]

Installing an application on client devices in an administration group

To install an application on client devices in an administration group:

Establish a connection with the Administration Server that controls the relevant administration group.
Select an administration group in the console tree.
In the group workspace, select the Tasks tab.
Run the task creation by clicking the Create a task button.
The New task wizard starts. Follow the instructions of the wizard.

In the Select the task type window of the New task wizard, in the Kaspersky Security Center Administration Server node select Install application remotely as the task type.

The New task wizard creates a group task of remote installation of the selected application. The new task appears in the workspace of the administration group on the Tasks tab.
Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

On completion of the remote installation task, the selected application will be installed on client devices in the administration group.

Page top

[Topic 54994]

Installing an application through Active Directory group policies

Kaspersky Security Center allows you to install Kaspersky applications on managed devices by using Active Directory group policies.

You can install applications by using Active Directory group policies only from installation packages that include Network Agent.

To install an application using Active Directory group policies:

Start configuring the application installation by using Remote installation wizard.
In the Defining remote installation task settings window of the Remote installation wizard, select the Assign package installation in Active Directory group policies option.
In the Select accounts to access devices window of the Remote installation wizard, select the Account required (Network Agent is not used) option.
Add the account with administrator privileges on the device where Kaspersky Security Center is installed or the account included in the Group Policy Creator Owners domain group.
Grant the permissions to the selected account:
1. Go to Control Panel → Administrative Tools and open Group Policy Management.
2. Click the node with the required domain.
3. Click the Delegation section.
4. In the Permission drop-down list, select Link GPOs.
5. Click Add.
6. In the Select User, Computer, or Group window that opens, select the necessary account.
7. Click OK to close the Select User, Computer, or Group window.
8. In the Groups and users list, select the account that you have just added, and then click Advanced → Advanced.
9. In the Permission entries list, double-click the account that you have just added.
10. Grant the following permissions:
  - Create Group objects
  - Delete Group objects
  - Create group Policy Container objects
  - Delete group Policy Container objects
11. Click OK to save the changes.
Define other settings by following the instructions of the wizard.
Run the created remote installation task manually or wait for its scheduled start.

The following remote installation sequence starts:

When the task is running, the following objects are created in each domain that includes any client devices from the specified set:
- Group policy object (GPO) under the name Kaspersky_AK{GUID}.
- A security group that corresponds to the GPO. This security group includes client devices covered by the task. The content of the security group defines the scope of the GPO.
Kaspersky Security Center installs the selected Kaspersky applications on client devices directly from Share, that is, the shared network folder of the application. In the Kaspersky Security Center installation folder, an auxiliary subfolder will be created that contains the .msi file for the application to be installed.
When new devices are added to the task scope, they are added to the security group after the next start of the task. If the Run missed tasks option is selected in the task schedule, devices are added to the security group immediately.
When devices are deleted from the task scope, they are deleted from the security group after the next start of the task.
When a task is deleted from Active Directory, the GPO, the link to the GPO, and the corresponding security group are deleted, too.

If you want to apply another installation schema using Active Directory, you can configure the required settings manually. For example, this may be required in the following cases:

When the anti-virus protection administrator does not have rights to make changes to the Active Directory of certain domains
When the original installation package has to be stored on a separate network resource
When it is necessary to link a GPO to specific Active Directory units

The following options for using an alternative installation scheme through Active Directory are available:

If installation is to be performed directly from the Kaspersky Security Center shared folder, in the GPO properties you must specify the .msi file located in the exec subfolder of the installation package folder for the required application.
If the installation package has to be located on another network resource, you must copy the whole exec folder content to it, because in addition to the file with .msi extension the folder contains configuration files generated when the package was created. To install the license key with the application, copy the key file to this folder as well.

Page top

[Topic 6388]

Installing applications on secondary Administration Servers

To install an application on secondary Administration Servers:

Establish a connection with the Administration Server that controls the relevant secondary Administration Servers.
Make sure that the installation package corresponding to the application being installed is available on each of the selected secondary Administration Servers. If the installation package cannot be found on any of the secondary Servers, distribute it by using the installation package distribution task.
Create the task of application installation on secondary Administration Servers in one of the following ways:
- If you want to create a task for secondary Administration Servers in the selected administration group, create a group task of remote installation for this group.
- If you want to create a task for specific secondary Administration Serves, create a task of remote installation for specific devices.
The Deployment task creation wizard starts to guide you through creation of the remote installation task. Follow the instructions of the wizard.

In the Select the task type window of the New task wizard, in the Kaspersky Security Center Administration Server section open the Advanced folder and select Install application on secondary Administration Servers remotely as the task type.

The New task wizard will create the task of remote installation of the selected application on specific secondary Administration Servers.
Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

On completion of the remote installation task, the selected application will be installed on secondary Administration Servers.

Page top

[Topic 6390]

Installing applications using Remote installation wizard

Expand all | Collapse all

To install Kaspersky applications, you can use the Remote installation wizard. The Remote installation wizard allows remote installation of applications either through specially created installation packages or directly from a distribution package.

For proper operation of the Remote installation task on a client device that does not have Network Agent installed, the following ports must be open: TCP 139 and 445; UDP 137 and 138. By default, these ports are open for all devices included in the domain. They are opened automatically by the remote installation preparation utility.

To install the application on selected devices by using the Remote installation wizard:

In the console tree, locate the Remote installation folder and select the Installation packages subfolder.
In the workspace of the folder, select the installation package of the application that you have to install.
In the context menu of the installation package, select Install application.
The Remote installation wizard starts.
In the Select devices for installation window, you can create a list of devices on which the application will be installed:
- Install on a group of managed devices
  If this option is selected, the remote installation task is created for a group of devices.
- Select devices for installation
  If this option is selected, the remote installation task is created for specific devices. Those specific devices can include both managed and unassigned ones.
In the Defining remote installation task settings window, specify the settings for remote installation of the application.
In the Force installation package download settings group, specify how files that are required for the application installation are distributed to client devices:
- Using Network Agent
  If this option is enabled, installation packages are delivered to client devices by Network Agent installed on those client devices.
  
  If this option is disabled, installation packages are delivered using the operating system tools of client devices.
  
  We recommend that you enable this option if the task has been assigned to devices with Network Agents installed.
  
  By default, this option is enabled.
- Using operating system resources through Administration Server
  If this option is enabled, files are transmitted to client devices by using operating system tools of client devices through the Administration Server. You can enable this option if no Network Agent is installed on the client device, but the client device is in the same network as the Administration Server.
  
  By default, this option is enabled.
- Using operating system resources through distribution points
  If this option is enabled, installation packages are transmitted to client devices using operating system tools through distribution points. You can select this option if there is at least one distribution point on the network.
  
  If the Using Network Agent option is enabled, the files are delivered using operating system tools only if Network Agent tools are unavailable.
  
  By default, this option is enabled for remote installation tasks that have been created on a virtual Administration Server.
- Number of attempts to install
  If, when running the Remote installation task, Kaspersky Security Center fails to install an application on a managed device within the number of installer runs specified by the parameter, Kaspersky Security Center stops delivering the installation package to this managed device and does not start the installer on the device anymore.
  
  The Number of attempts to install option allows you to save the resources of the managed device, as well as reduce traffic (uninstallation, MSI file run, and error messages).
  
  Recurring task start attempts may indicate a problem on the device that prevents installation. The administrator should resolve the problem within the specified number of installation attempts (for example, by allocating sufficient disk space, removing incompatible applications, or modifying the settings of other applications that prevent installation) and to restart the task (manually or by a schedule).
  
  If installation is not achieved eventually, the problem is considered unresolvable and any further task starts are seen as costly in terms of unnecessary consumption of resources and traffic.
  
  When the task is created, the counter of attempts is set to 0. Each run of the installer that returns an error on the device increments the counter reading.
  
  If the number of attempts specified in the parameter has been exceeded and the device is ready for application installation, you can increase the value of the Number of attempts to install parameter and start the task to install the application. Alternatively, you can create a new Remote installation task.
Define what to do with client devices managed by another Administration Server:
- Install on all devices
  The application will be installed even on devices managed by other Administration Servers.
  
  This option is selected by default. You do not have to change this setting if you have only one Administration Server in your network.
- Install only on devices managed through this Administration Server
  The application will be installed only on devices managed by this Administration Server. Select this option if you have more than one Administration Server in your network and want to avoid conflicts between them.
Define the additional settings:
- Do not re-install application if it is already installed
  If this option is enabled, the selected application will not be re-installed if it has already been installed on this client device.
  
  If this option is disabled, the application will be installed anyway.
  
  By default, this option is enabled.
- Assign package installation in Active Directory group policies
  If this option is enabled, an installation package is installed by using the Active Directory group policies.
  
  This option is available if the Network Agent installation package is selected.
  
  By default, this option is disabled.
In the Selecting a license key window, select a license key and a method for its distribution:
- Do not place license key in installation package (recommended)
  The key is automatically distributed to all devices with which it is compatible:
  - If automatic distribution has been enabled in the key properties.
  - If the Add key task has been created.
- Place license key in installation package
  The key is distributed to devices together with the installation package.
  
  We do not recommend that you distribute the key using this method because the shared Read access rights are enabled to the repository of installation packages.
The Selecting a license key window is displayed if the installation package does not include a license key.

If the installation package includes a license key, the License key properties window is displayed, containing the license key details.
In the Selecting an operating system restart option window, specify whether the devices must be restarted if the operating system has to be restarted during installation of applications on them:
- Do not restart the device
  If this option is selected, the device will not be restarted after the security application installation.
- Restart the device
  If this option is selected, the device will be restarted after the security application installation.
- Prompt user for action
  If this option is selected, after the security application installation, a notification is displayed to the user, informing that the device needs to be restarted. By using the Modify link you can modify message text, the period of message display, and the time of automatic restart.
  
  By default, this option is selected.
- Force closure of applications in blocked sessions
  If this option is enabled, applications on blocked devices are forced to close before the restart.
  
  By default, this option is disabled.
In the Select accounts to access devices window, you can add the accounts that will be used to start the Remote installation task:
- No account required (Network Agent installed)
  If this option is selected, you do not have to specify the account under which the application installer will be run. The task will run under the account under which the Administration Server service is running.
  
  If Network Agent has not been installed on client devices, this option is unavailable.
- Account required (Network Agent is not used)
  Select this option if Network Agent is not installed on the devices for which you assign the remote installation task. In this case, you can specify a user account or an SSH certificate to install the application.
  - Local Account. If this option is selected, specify the user account under which the application installer will be run. Click the Add button, select Local Account, and then specify the user account credentials.
    You can specify multiple user accounts if, for example, none of them have all the required rights on all devices for which you assign the task. In this case, all added accounts are used for running the task, in consecutive order, top-down.
  - SSH certificate. If you want to install an application on a Linux-based client device, you can specify an SSH certificate instead of a user account. Click the Add button, select SSH certificate, and then specify the private and public keys of the certificate.
    To generate a private key, you can use the ssh-keygen utility. Note that Kaspersky Security Center supports the PEM format of private keys, but the ssh-keygen utility generates SSH keys in the OPENSSH format by default. The OPENSSH format is not supported by Kaspersky Security Center. To create a private key in the supported PEM format, add the -m PEM option in the ssh-keygen command. For example:
    
    ssh-keygen -m PEM -t rsa -b 4096 -C "<user email>"
In the Starting installation window, click the Next button to create and start a Remote installation task on the selected devices.
If the Starting installation window has the Do not run the task after the Remote installation wizard finishes option selected, the remote installation task will not start. You can start this task manually later. The task name corresponds to the name of the installation package for the application: Installation of <Installation package name>.

To install the application on devices in an administration group by using the Remote installation wizard:

Establish a connection with the Administration Server that controls the relevant administration group.
Select an administration group in the console tree.
In the workspace of the group, click the Perform action button and select Install application in the drop-down list.
This will start the Remote installation wizard. Follow the instructions of the wizard.
At the final step of the wizard, click Next to create and run a remote installation task on the selected devices.

When the Remote installation wizard finishes, Kaspersky Security Center performs the following actions:

Creates an installation package for application installation (if it was not created earlier). The installation package is located in the Remote installation folder, in the Installation packages subfolder, under a name that corresponds to the application name and version. You can use this installation package for the application installation in the future.
Creates and runs a remote installation task for specific devices or for an administration group. The newly created remote installation task is stored in the Tasks folder or added to the tasks of the administration group for which it has been created. You can start this task manually later. The task name corresponds to the name of the installation package for the application: Installation of <Installation package name>.

Page top

[Topic 269226]

Working with the management plug-ins

Kaspersky applications are managed through the Administration Console by using the management plug-ins. Each Kaspersky application that can be managed through Kaspersky Security Center includes a management plug-in. Using the application management plug-in, you can perform the following actions in the Administration Console:

Create and edit application policies and settings, as well as the settings of application tasks.
Obtain information about application tasks, application events, and application operation statistics received from client devices.

To check the list of installed plug-ins and its versions:

In the Administration Console tree, right-click Administration Server <Server_name>, and select Properties.
Click Advanced → Details of application management plug-ins installed.

The list of installed management plug-ins and their versions appears in the right pane.

You can install the plug-ins for managed applications when you run the Administration Server quick start wizard during the Kaspersky Security Center initial setup. Also, you can install the management plug-ins manually.

To install a management plug-in manually:

Download the management plug-in for the Kaspersky application and the version required (for example, Kaspersky Endpoint Security for Windows 12.6) from Kaspersky Technical Support webpage.
If the Administration Console is running, close it.
Unzip the downloaded plug-in file and run the klcfginst.msi or klcfginst.exe file. Follow the installation wizard's instructions.
When the installation is complete, run the Administration Console and make sure the plug-in is presented in the list of installed plug-ins, as described in the previous procedure.

When you run the Administration Console after installation of a management plug-in that supports the Managed application quick start wizard, this wizard is started automatically. You can go through the steps of the Managed application quick start wizard to create default Kaspersky application policies and tasks. The wizard starts automatically only when you run the Administration Console after the initial plug-in installation or after you update the management plug-in to a version that is compatible with another version of the Kaspersky application for which tasks and policies have not yet been created. You can also start the Managed application quick start wizard manually.

To start the Managed application quick start wizard manually:

In the console tree, select the Administration Server node.
In the context menu of the Administration Server node, select All Tasks → Managed application quick start wizard.
The Managed application quick start wizard starts. Follow the wizard steps to create default Kaspersky application policies and tasks.

To remove a management plug-in:

If the Administration Console is running, close it.
Open Windows Registry editor.
Find the following key:
- HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\28\Plugins for 32-bit system.
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\28\Plugins for 64-bit system.
The key contains installed management plug-ins. For each plug-in, the DisplayName value contains the plug-in name, and the UninstallString value contains the command to uninstall the plug-in.
Find the key for the plug-in you want to uninstall, and copy its UninstallString value to the clipboard.
Paste the value into the command string and run it with system administrator rights.

The management plug-in version must not be earlier than the Kaspersky managed application version. If you update the Kaspersky application on the devices, you must install the management plug-in of the same version.

When you open the policy that was created in an earlier version of plug-in, you will be asked to accept the Kaspersky Security Network Statement.

When you uninstall Kaspersky Security Center Web Console, all management plug-ins are also uninstalled.

If you open and save the policy in the plug-in version that is later than the version of the managed application, the policy will be updated, and you will not be able to open it in the plug-in of the earlier version.

Page top

[Topic 13065]

Viewing a protection deployment report

You can use the protection deployment report to monitor the progress of network protection deployment.

To view a protection deployment report:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
In the workspace of the Reports folder, select the report template named Report on protection deployment.

The workspace displays a report containing information about protection deployment on all networked devices.

You can generate a new protection deployment report and specify the type of data that it should include:

For an administration group
For specific devices
For a device selection
For all devices

Kaspersky Security Center assumes that protection is deployed on a device if a security application is installed and real-time protection enabled.

Page top

[Topic 6389]

Remote removal of applications

Kaspersky Security Center allows you to uninstall applications from devices remotely through remote uninstallation tasks. Those tasks are created and assigned to devices through a dedicated wizard. To assign a task to devices more quickly and easily, you can specify devices in the wizard window in one of the following ways:

Select networked devices detected by Administration Server. In this case, the task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
Specify device addresses manually or import addresses from a list. You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
Assign task to a device selection. In this case, the task is assigned to devices included in a selection created earlier. You can specify the predefined selection or a custom one that you created.
Assign task to an administration group. In this case, the task is assigned to devices included in an administration group created earlier.

Remote removal issues

When performing remote removal of third-party applications, administrators may encounter a warning stating, "Remote uninstallation has finished on this device with warnings: Application for removal is not installed." This issue typically arises when the application to be removed is installed only for the individual user who is currently logged in. If the user is not logged in, such an application becomes invisible and cannot be targeted for remote removal.

This behavior differs with applications intended for use by multiple users on the same device, where applications are globally visible and accessible by all users of the device.

Within Kaspersky Security Center, the application registry algorithm handles applications for individual users and applications for multiple users differently:

Applications for multiple users are maintained in a real-time, up-to-date list of installed applications.
Applications for individual users are monitored using a caching mechanism.
If a user was logged in at the time of application detection, Kaspersky Security Center caches information about that user's applications. Even if the user subsequently logs out, Kaspersky Security Center continues to display these applications as installed based on the cached data, although they are no longer visible or accessible on the device.

This discrepancy can result in situations where Kaspersky Security Center identifies an application as installed based on cached data, but the application removal task fails because the application is not accessible when the user is logged out.

By default, the lifetime of cached application data is set to 30 days. Administrators can modify this setting to reduce the cache duration, thereby minimizing discrepancies between the displayed data and actual application visibility on devices.

To adjust the cache lifetime to 1 hour (3600 seconds), run the following command on the Administration Server:

klscflag -fset -pv klserver -n KLNAG_INV_PERUSER_APPS_CACHE_NONACTIVE_SIDS_LIFETIME_SEC -t d -v 3600

After running this command, restart the Administration Server for the changes to take effect.

Source of information about installed applications

The Network Agent retrieves information about software installed on Windows devices from the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
Contains information about applications installed for all users.
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
Contains information about applications installed for all users.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
Contains information about applications installed for the current user.
HKEY_USER<...>\Software\Microsoft\Windows\CurrentVersion\Uninstall
Contains information about applications installed for specific users.

In this section

Remote removal of an application from client devices of the administration group

Remote removal of an application from selected devices

Page top

[Topic 54998]

Remote removal of an application from client devices of the administration group

To remove an application remotely from client devices of the administration group:

Establish a connection with the Administration Server that controls the relevant administration group.
Select an administration group in the console tree.
In the group workspace, select the Tasks tab.
Run the task creation by clicking the New task button.
The New task wizard starts. Follow the instructions of the wizard.

In the Select the task type window of the New task wizard, in the Kaspersky Security Center Administration Server node, in the Advanced folder select Uninstall application remotely as the task type.

The New task wizard creates a group task of remote removal of the selected application. The new task appears in the workspace of the administration group on the Tasks tab.
Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

On completion of the remote removal task, the selected application will be removed from client devices in the administration group.

Page top

[Topic 54999]

Remote removal of an application from selected devices

To remove an application remotely from selected devices:

In the console tree, select the Tasks folder.
Run task creation by clicking New task.
The New task wizard starts. Follow the instructions of the wizard.

In the Select the task type window of the New task wizard, in the Kaspersky Security Center Administration Server node, in the Advanced folder select Uninstall application remotely as the task type.

The New task wizard creates a task of remote removal of the selected application from specific devices. The newly created task is displayed in the workspace of the Tasks folder.
Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

Upon completion of the remote removal task, the selected application will be removed from the selected devices.

Page top

[Topic 13068]

Working with installation packages

When creating remote installation tasks, the system uses installation packages containing sets of parameters necessary for software installation.

Installation packages can contain a key file. It is recommended that you avoid sharing access to installation packages that contain a key file.

You can use a single installation package several times.

Installation packages created for Administration Server are moved to the console tree and located in the Remote installation folder, in the Installation packages subfolder. Installation packages are stored on the Administration Server, in a service subfolder named Packages, within the specified shared folder.

In this section

Creating an installation package

Creating stand-alone installation packages

Creating custom installation packages

Viewing and editing properties of custom installation packages

Obtaining the Network Agent installation package from the Kaspersky Security Center distribution kit

Distributing installation packages to secondary Administration Servers

Distributing installation packages through distribution points

Transferring application installation results to Kaspersky Security Center

Defining the KSN proxy server address for installation packages

Page top

[Topic 13141]

Creating an installation package

This article describes the procedure of creating the following types of installation packages:

Installation package for a Kaspersky application
Installation package for a specified executable file
Installation package for an application from the Kaspersky database

You do not have to create an installation package manually for the remote installation of Network Agent. It is created automatically during the installation of Kaspersky Security Center and stored in the Installation packages folder. If the package for the remote installation of Network Agent has been deleted, you can re-create it by selecting the nagent.kud file in the NetAgent folder of the Kaspersky Security Center distribution package.

To create an installation package:

Connect to the necessary Administration Server.
In the console tree, select Advanced → Remote installation → Installation packages.
Start the creation of a new installation package in one of the following ways:
- Right-click the Installation packages folder, and then select New → Installation package from the context menu.
- Right-click in the empty area of the installation packages list, and then select Create → Installation package from the context menu.
- Click Create installation package in the installation packages list management section.
The New package wizard starts.
Select one of the following installation package types by clicking the corresponding icon:
- Installation package for a Kaspersky application.
- Installation package for a specified executable file.
- Installation package for an application from the Kaspersky database.
Specify the name of the installation package to be created.
You can specify any name.
Select the application or executable file for which the installation package is to be created, in one of the following ways:
- Click the Browse button and, in the standard Windows Open window, select the distribution package of the required application located on available disks.
  This option is applicable if you choose to create an installation package for a Kaspersky application or for a specified executable file.
- Click the Browse button and, in the Select application window, select the distribution package of the required application.
  This option is applicable if you choose to create an installation package for an application from the Kaspersky database.
If you are creating an installation package for Administration Server, select the sc.kud file. The sc.kud file is located in the root folder of the Kaspersky Security Center distribution package.

Do not specify any details of privileged accounts in the parameters of installation packages.
Review the End User License Agreement and Privacy Policy.
When creating an installation package for an application, you may be prompted to view and accept an End User License Agreement and a Privacy Policy for that application.

Read both documents. If you agree with all the terms of the License Agreement and the Privacy Policy, accept them by selecting the corresponding check boxes.

The installation of the application on your device continues, and the creation of the installation package resumes.

If you are creating an installation package for Kaspersky Endpoint Security for Mac, you can choose the language for the License Agreement and Privacy Policy.
If necessary, enable automatic installation of system components.
If you are creating an installation package for an application from the Kaspersky database, you can enable the automatic installation of necessary system components. The New package wizard displays a list of all available system components for the selected application. You can access this list at any time in the installation package properties.

If you are creating a patch installation package, the list includes all system components needed for the deployment of this patch.
Click the Finish button to complete the package creation process.

Once the New package wizard completes, the new installation package appears in the workspace of the Installation packages folder in the console tree.

See also

Main installation scenario

Page top

[Topic 192396]

Creating stand-alone installation packages

You and device users in your organization can use stand-alone installation packages to install applications on devices manually.

A stand-alone installation package is an executable file (installer.exe) that you can store on Web Server, in a shared folder, or transfer to a client device by another method. You can also send a link to the stand-alone installation package by email. On the client device, the user can run the received file locally to install an application without involving Kaspersky Security Center.

Be sure that the stand-alone installation package is not available for unauthorized persons.

You can create stand-alone installation packages for Kaspersky applications and for third-party applications for Windows, macOS, and Linux platforms. To create a stand-alone installation package for a third-party application, you must create a custom installation package first.

The source to create stand-alone installation packages are installation packages in the list of created on the Administration Server.

To create a stand-alone installation package:

In the console tree, select the Administration Server → Advanced → Remote installation → Installation packages.
A list of installation packages available on Administration Server is displayed.
In the list of installation packages, select an installation package for which you want to create a stand-alone package.
In the context menu, select Create stand-alone installation package.
The Stand-alone installation package creation wizard starts. Proceed through the wizard by using the Next button.
On the first page of the wizard, if you have selected an installation package for the Kaspersky application and you want to install Network Agent together with the selected application, make sure that the Install Network Agent together with this application option is enabled.
By default, this option is enabled. We recommend enabling this option if you are not sure whether Network Agent is installed on the device. If Network Agent is already installed on the device, after the stand-alone installation package with Network Agent is installed, Network Agent will be updated to the newer version.

If you disable this option, Network Agent will not be installed on the device and the device will be unmanaged.

If a stand-alone installation package for the selected application already exists on Administration Server, the wizard informs you about this fact. In this case, you must select one of the following actions:
- Create stand-alone installation package. Select this option if, for example, you want to create a stand-alone installation package for a new application version and also want to retain a stand-alone installation package that you created for a previous application version. The new stand-alone installation package is placed in another folder.
- Use existing stand-alone installation package. Select this option if you want to use an existing stand-alone installation package. The process of package creation will not be started.
- Rebuild existing stand-alone installation package. Select this option if you want to create a stand-alone installation package for the same application again. The stand-alone installation package is placed in the same folder.
On the next page of the wizard, select the Move unassigned devices to this group option and specify an administration group to which you want to move the client device after Network Agent installation.
By default, the device is moved to the Managed devices group.

If you do not want to move the client device to an administration group after Network Agent installation, select the Do not move devices option.
On the next page of the wizard, when the process of the stand-alone installation package creation is finished, a result of the stand-alone package creation and a path to the stand-alone package are displayed.
You can click the links and do any of the following:
- Open the folder with the stand-alone installation package.
- Email the link to the created stand-alone installation package. To perform this action, you must have an email application launched.
- Sample HTML code for publishing the link on a website. A TXT file is created and opened in an application that is associated with a TXT format. In the file, the <a> HTML tag with attributes is displayed.
On the next page of the wizard, if you want to open the list of stand-alone installation packages, enable the Open the list of stand-alone packages option.
Click the FINISH button.
The Stand-alone installation package creation wizard closes.

The stand-alone installation package is created and placed in the PkgInst subfolder of the Administration Server shared folder. You can view the list of stand-alone packages by clicking the View the list of stand-alone packages button above the list of installation packages.

Page top

[Topic 192470]

Creating custom installation packages

Expand all | Collapse all

You can use custom installation packages to do the following:

To install any application (for example, a text editor) on a client device, for example, by means of a task.
To create a stand-alone installation package.

A custom installation package is a folder with a set of files. The source to create a custom installation package is an archive file. The archive file contains a file or files that must be included in the custom installation package. Creating a custom installation package, you can specify command-line parameters, for example, to install the application in a silent mode.

To create a custom installation package:

In the console tree, select the Administration Server → Advanced → Remote installation → Installation packages.
A list of installation packages available on Administration Server is displayed.
Above the list of installation packages, click the Create installation package button.
The New package wizard starts. Proceed through the wizard by using the Next button.
On the first page of the wizard, select Create an installation package for the specified executable file.
On the next page of the wizard, specify the custom installation package name.
On the next page of the wizard, click the Browse button and, in a standard Windows Open window, choose an archive file located on the available disks to create a custom installation package.
You can upload a ZIP, CAB, TAR, or TAR.GZ archive. It is not possible to create an installation package from an SFX (self-extracting archive) file.

Files are downloaded to the Kaspersky Security Center Administration Server.
On the next page of the wizard, specify the command-line parameters of an executable file.
You can specify command-line parameters to install the application from the installation package in a silent mode. Specifying command-line parameters is optional.

If you want, configure the following options:
- Copy entire folder to the installation package
  Select this option if the executable file is accompanied with additional files required for the application installation. Before you enable this option, make sure that all of the required files are stored in the same folder. If this option is enabled, the application adds the entire contents of the folder, including the specified executable file, to the installation package.
- Convert settings to recommended values for applications recognized by Kaspersky Security Center
  The application will be installed with the recommended settings, if information about the specified application is contained in the Kaspersky database.
  
  If you entered parameters in the Executable file command line field, they are rewritten with the recommended settings.
  
  By default, this option is enabled.
  
  The Kaspersky database is created and maintained by Kaspersky analysts. For each application that is added to the database, Kaspersky analysts define optimal installation settings. The settings are defined to ensure successful remote installation of an application to a client device. The database is updated on the Administration Server automatically when you run the Download updates to the repository of the Administration Server task.
The process to create the custom installation package starts.

The wizard informs you when the process is finished.

If the custom installation package is not created, an appropriate message is displayed.
Click the Finish button to close the wizard.

The installation package that you created is downloaded to the Packages subfolder of the Administration Server shared folder. After downloading, the custom installation package appears in the list of installation packages.

In the list of installation packages on Administration Server, you can view and edit custom installation package properties.

Page top

[Topic 192664]

Viewing and editing properties of custom installation packages

Expand all | Collapse all

After you created a custom installation package, you can view general information about the installation package and specify the installation settings in the properties window.

To view and edit properties of a custom installation package:

In the console tree, select the Administration Server → Advanced → Remote installation → Installation packages.
A list of installation packages available on Administration Server is displayed.
In the context menu of an installation package, select Properties.
The properties window of the selected installation package opens.
View the following information:
- Installation package name
- Application name packed into the custom installation package
- Application version
- Installation package creation date
- Path to the custom installation package on the Administration Server
- Executable file command line
Specify the following settings:
- Installation package name
- Install required general system components
  If this option is enabled, before installing an update the application automatically installs all general system components (prerequisites) that are required to install the update. For example, these prerequisites can be operating system updates.
  
  If this option is disabled, you may have to install the prerequisites manually.
  
  By default, this option is disabled.
  
  This option is only available when the application added to the installation package is recognized by Kaspersky Security Center.
- Executable file command line
  If the application requires additional parameters for a silent installation, specify them in this field. Refer to the vendor's documentation for details.
  
  You can also enter other parameters.
  
  This option is only available for packages that are not created on the basis of Kaspersky applications.
Click the OK or Apply button to save the changes, if any.

The new settings are saved.

See also:

Creating custom installation packages

Page top

[Topic 227729]

Obtaining the Network Agent installation package from the Kaspersky Security Center distribution kit

You can obtain the Network Agent installation package from the Kaspersky Security Center distribution kit, without needing to install Kaspersky Security Center. You can then use the installation package to install Network Agent on the client devices.

To obtain the Network Agent installation package from the Kaspersky Security Center distribution kit:

Run the ksc_<version number>.<build number>_full_<localization language>.exe executable file from the Kaspersky Security Center distribution kit.
In the window that opens, click the Extract installation packages link.
In the list of installation packages, select the check box next to the Network Agent installation package, and then click the Next button.
If necessary, click the Browse button to change the displayed folder to extract the installation package to.
Click the Extract button.
The application extracts the Network Agent installation package.
When the process is complete, click the Close button.

The Network Agent installation package is extracted to the selected folder.

You can use the installation package to install Network Agent by one of the following methods:

Locally by running the setup.exe file from the extracted folder
Via silent installation
By using group policies of Microsoft Windows

See also:

Main installation scenario

Local installation of Network Agent

Installation of Network Agent in silent mode (without a response file)

Deployment using group policies of Microsoft Windows

Page top

[Topic 6383]

Distributing installation packages to secondary Administration Servers

To distribute installation packages to secondary Administration Servers:

Establish a connection with the Administration Server that controls the relevant secondary Administration Servers.
Create a task of installation package distribution to secondary Administration Servers in one of the following ways:
- If you want to create a task for secondary Administration Servers in the selected administration group, launch the creation of a group task for this group.
- If you want to create a task for specific secondary Administration Servers, launch the creation of a task for specific devices.
The New task wizard starts. Follow the instructions of the wizard.

In the Select the task type window of the New task wizard, in the Kaspersky Security Center Administration Server node, in the Advanced folder select Distribute installation package as the task type.

The New task wizard will create the task of distributing the selected installation packages to specific secondary Administration Servers.
Run the task manually or wait for it to launch according to the schedule you specified in the task settings.

The selected installation packages will be copied to the specific secondary Administration Servers.

Page top

[Topic 6384]

Distributing installation packages through distribution points

You can use distribution points to distribute installation packages within an administration group.

After the installation packages are received from the Administration Server, distribution points automatically distribute them to client devices through IP multicasting. IP multicasting of new installation packages within an administration group occurs once. If a client device has been disconnected from the corporate network at the time of distribution, Network Agent (on the client device) automatically downloads the necessary installation package from a distribution point when the installation task is started.

Page top

[Topic 6378]

Transferring application installation results to Kaspersky Security Center

After you have created the application installation package, you can configure it so that all diagnostic information about the results of the application installation is transferred to Kaspersky Security Center. For installation packages of Kaspersky applications, transfer of diagnostic information about the application installation results is configured by default, and no additional configuration is required.

To configure the transfer of diagnostic information about the results of application installation to Kaspersky Security Center:

Navigate to the folder of the installation package created by using Kaspersky Security Center for the selected application. The folder can be found in the shared folder specified during Kaspersky Security Center installation.
Open the file with the .kpd or .kud extension for editing (for example, in the Microsoft Windows Notepad editor).
The file has the format of a regular configuration .ini file.
Add the following lines to the file:
[SetupProcessResult]

Wait=1

This command configures Kaspersky Security Center to wait for setup completion for the application, for which the installation package is created, and to analyze the installer return code. If you have to disable the transfer of diagnostic data, set the value of the Wait key to 0.
Add the description of return codes for a successful installation. To do this, add the following lines to the file:
[SetupProcessResult_SuccessCodes]

<return code>=[<description>]

<return code 1>=[<description>]

…

Square brackets contain optional keys.

Syntax for the lines:
- <return code>. Any number corresponding to the installer return code. The number of return codes can be arbitrary.
- <description>. Text description of the installation result. The description can be omitted.
Add the description of return codes for a failed installation. To do this, add the following lines to the file:
[SetupProcessResult_ErrorCodes]

<return code>=[<description>]

<return code 1>=[<description>]

…

The syntax of these lines is identical to the syntax for the lines containing successful setup return codes.
Close the .kpd or .kud file by saving all changes.

Finally, the results of installation of the user-defined application will be registered in the logs of Kaspersky Security Center and then shown in the list of events, in reports, and in task run logs.

Page top

[Topic 215458]

Defining the KSN proxy server address for installation packages

In case the address or the domain of the Administration Server changes, you can define the KSN proxy server address for the installation package.

To define the KSN proxy server address for the installation package:

In the console tree, in the Remote installation folder, double-click the Installation packages subfolder.
In the menu that opens, select Properties.
In the properties window that opens, select the General subsection.
In the General subsection of the properties window, enter the address of the KSN proxy server.

The installation packages will use this address as default.

Page top

[Topic 55959]

Receiving up-to-date versions of applications

Kaspersky Security Center allows you to receive up-to-date versions of corporate applications stored on Kaspersky servers.

To receive up-to-date versions of Kaspersky corporate applications:

Do one of the following:
- In the console tree select the node the with the name of the required Administration Server, make sure the Monitoring tab is selected, and in the Deployment section click the There are new versions of Kaspersky applications available link.
  The There are new versions of Kaspersky applications available link becomes visible when Administration Server finds a new version of a corporate application on a Kaspersky server.
- In the console tree, select Advanced → Remote installation → Installation packages, and in the workspace click Additional actions and from the drop-down list select View current versions of Kaspersky applications.
The list of the current version of Kaspersky applications is displayed.
You can filter the list of Kaspersky applications to simplify the search for the required application.
At the top of the Current application versions window, click the Filter link to filter the application list by the following criteria:
- Components. Use this criterion to filter the Kaspersky application list by the protection areas that are in use on your network.
- Type of downloaded software. Use this criterion to filter the Kaspersky application list by the application type.
- Software products and updates to display. Use this criterion to display available Kaspersky applications by specific versions.
- Displayed languages for software and updates. Use this criterion to display Kaspersky applications with a specific localization language.
Click the Apply button to apply the selected filters.
Select the required application from the list.
Download the application distribution package by clicking the link in the Distribution package web address string.
Updates of managed applications may require a specific minimum version of Kaspersky Security Center to be installed. If this version is later than your current version, these updates are displayed but cannot be approved. Also, no installation packages can be created from such updates until you upgrade Kaspersky Security Center. You are prompted to upgrade your Kaspersky Security Center instance to the required minimum version.

If the Download applications and create installation packages button is displayed for the application selected, you can click this button to download the application distribution package and create an installation package automatically. Kaspersky Security Center downloads the application distribution package to Administration Server, to the shared folder specified during installation of Kaspersky Security Center. The automatically created installation package is displayed in the Remote installation folder in the console tree, in the Installation packages subfolder.

After the Current application versions window is closed, the There are new versions of Kaspersky applications available link disappears from the Deployment section.

You can create installation packages for new versions of applications and manage newly created installation packages in the Remote installation folder in the console tree, in the Installation packages subfolder.

You can also open the Current application versions window by clicking the View current versions of Kaspersky applications link in the workspace of the Installation packages folder.

Installing applications using a remote installation task

Installing applications using Remote installation wizard

Working with the management plug-ins

Viewing a protection deployment report

Remote removal of applications

Working with installation packages

Preparing a Windows device for remote installation

Preparing a Linux device and installing Network Agent on a Linux device remotely

Preparing a macOS device for remote installation of Network Agent

Creating an installation package

Page top

[Topic 12883]

Preparing a Windows device for remote installation

Remote installation of the application on the client device may return an error for the following reasons:

The task has already been successfully performed on this device.
In this case, the task does not have to be performed again.
When a task was started, the device was shut down.
In this case, turn on the device, and then restart the task.
There is no connection between the Administration Server and the Network Agent installed on the client device.
To determine the cause of the problem, use the utility designed for remote diagnostics of client devices (klactgui).
If Network Agent is not installed on the device, the following issues may occur during remote installation:
- The client device has Disable simple file sharing enabled.
- The Server service is not running on the client device.
- The required ports are closed on the client device.
- The account that is used to perform the task has insufficient privileges.
To avoid issues that may occur during installation of the application on a client device without Network Agent installed, you must proceed as described in the procedure of forced deployment through the remote installation task of Kaspersky Security Center.

Previously, the riprep utility was used to prepare a device for remote installation. This is now considered an outdated method for configuring operating systems. The riprep utility is not recommended for use on operating systems newer than Windows XP and Windows Server 2003 R2.

Page top

[Topic 137593]

Preparing a Linux device and installing Network Agent on a Linux device remotely

Network Agent installation comprises two steps:

A Linux device preparation
Network Agent remote installation

A Linux device preparation

To prepare a device running Linux for remote installation of Network Agent:

Make sure that the following software is installed on the target Linux device:
- Sudo (for Ubuntu 10.04, Sudo version is 1.7.2p1 or later)
- Perl language interpreter version 5.10 or later
Test the device configuration:
1. Check whether you can connect to the device through an SSH client (such as PuTTY).
  If you cannot connect to the device, open the /etc/ssh/sshd_config file and make sure that the following settings have the respective values listed below:
  
  PasswordAuthentication no
  
  ChallengeResponseAuthentication yes
  
  Do not modify the /etc/ssh/sshd_config file if you can connect to the device with no issues; otherwise, you may encounter SSH authentication failure when running a remote installation task.
  
  Save the file (if necessary) and restart the SSH service by using the sudo service ssh restart command.
2. Disable the sudo password for the user account under which the device is to be connected.
3. Use the visudo command in sudo to open the sudoers configuration file.
  In the file you have opened, add the following line to the end of the file: <username> ALL = (ALL) NOPASSWD: ALL. In this case, <username> is the user account which is to be used for the device connection using SSH. If you are using the Astra Linux operating system, in the /etc/sudoers file, add the last line with the following text: %astra-admin ALL=(ALL:ALL) NOPASSWD: ALL
4. Save the sudoers file and then close it.
5. Connect to the device again through SSH and make sure that the Sudo service does not prompt you to enter a password; you can do this using the sudo whoami command.
Open the /etc/systemd/logind.conf file, and then do one of the following:
- Specify 'no' as a value for the KillUserProcesses setting: KillUserProcesses=no.
- For the KillExcludeUsers setting, type the user name of the account under which the remote installation is to be performed, for example, KillExcludeUsers=root.
If the target device is running Astra Linux, add export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin string in the /home/<username>/.bashrc file, where <username> is the user account which is to be used for the device connection using SSH.

To apply the changed setting, restart the Linux device or execute the following command:

$ sudo systemctl restart systemd-logind.service
If you want to install Network Agent on devices with the SUSE Linux Enterprise Server 15 operating system, install the insserv-compat package first to configure Network Agent.
If you want to install Network Agent on devices with the Astra Linux operating system running in the closed software environment mode, perform additional steps to prepare Astra Linux devices.

Network Agent remote installation

To install Network Agent on Linux devices remotely:

Download and create an installation package:
1. Before installing the package on the device, make sure that it already has all the dependencies (programs and libraries) installed for this package.
  You can view the dependencies for each package on your own, using utilities that are specific for the Linux distribution on which the package is to be installed. For more details about utilities, refer to your operating system documentation.
2. Download the Network Agent installation package by using the application interface or from the Kaspersky website.
3. To create a remote installation package, use the following files:
  - klnagent.kpd
  - akinstall.sh
  - .deb or .rpm package of Network Agent
Create a remote installation task with the following settings:
- On the Settings page of the New task wizard, select the Using operating system resources through Administration Server check box. Clear all other check boxes.
- On the Selecting an account to run the task page specify the settings of the user account that is used for device connection through SSH.
Run the remote installation task. Use the option for the su command to preserve the environment: -m, -p, --preserve-environment.

Page top

[Topic 228278]

Preparing a device running SUSE Linux Enterprise Server 15 for installation of Network Agent

To install Network Agent on a device with the SUSE Linux Enterprise Server 15 operating system,

Before the Network Agent installation, run the following command:

$ sudo zypper install insserv-compat

This enables you to install the insserv-compat package and configure Network Agent properly.

Run the rpm -q insserv-compat command to check whether the package is already installed.

If your network includes a lot of devices running SUSE Linux Enterprise Server 15, you can use the special software for configuring and managing the company infrastructure. By using this software, you can automatically install the insserv-compat package on all necessary devices at once. For example, you can use Puppet, Ansible, Chef, or you can make your own script—use any method that is convenient for you.

If the device does not have the GPG signing keys for SUSE Linux Enterprise, you may encounter the following warning: Package header is not signed! Select the i option to ignore the warning.

Besides the insserv-compat package installation, make sure that you have completely prepared your Linux devices. After that, deploy and install Network Agent.

Page top

[Topic 199934]

Preparing a macOS device for remote installation of Network Agent

To prepare a device running macOS for remote installation of Network Agent:

Make sure that sudo is installed on the target macOS device.
Test the device configuration:
1. Make sure port 22 is open on the client device. To do this, in the System Preferences, open the Sharing pane, and then make sure the Remote Login check box is selected.
  You can connect to the client device via Secure Shell (SSH) only through port 22. You cannot change the port number.
  
  You can use the ssh <device_name> command to log in to the macOS device remotely. In the Sharing pane, you can use the Allow access for option to set the scope of users who are allowed access to the macOS device.
2. Disable the sudo password for the user account under which the device is to be connected.
  Use the sudo visudo command in the Terminal to open the sudoers configuration file. In the file that you have opened, in the User privilege specification entry specify the following: username ALL = (ALL) NOPASSWD: ALL. In this case, username stands for the user account, which is to be used for the device connection using SSH.
3. Save the sudoers file and then close it.
4. Connect to the device again via SSH and make sure that the Sudo service does not prompt you to enter a password; you can do this using the sudo whoami command.
Download and create an installation package:
1. Download the Network Agent installation package using one of the following methods:
  - In the console tree, by opening the context menu on Remote installation → Installation packages and selecting Show current application versions to choose from available packages
  - By downloading the relevant version of Network Agent from Technical Support website at https://support.kaspersky.com/
  - By requesting the installation package from Technical Support specialists
2. To create a remote installation package, use the following files:
  - klnagent.kud
  - install.sh
  - klnagentmac.dmg
Create a remote installation task with the following settings:
- On the Settings page of the New task wizard, select the Using operating system resources through Administration Server check box. Clear all other check boxes.
- On the Selecting an account to run the task page, to run the task specify the settings of the user account that is used for device connection via SSH.

The client device is ready for remote installation of Network Agent through the corresponding task that you have created.

Page top

[Topic 3612]

Kaspersky applications: licensing and activation

This section describes the features of Kaspersky Security Center related to working with the license keys of managed Kaspersky applications.

Kaspersky Security Center allows you to perform centralized distribution of license keys for Kaspersky applications on client devices, monitor their use, and renew licenses.

When adding a license key using Kaspersky Security Center, the settings of the license key are saved on the Administration Server. Based on this information, the application generates a license key usage report and notifies the administrator of license expirations and violation of license restrictions that are set in the properties of license keys. You can configure notifications of the use of license keys within the Administration Server settings.

In this section

Licensing of managed applications

Viewing information about license keys in use

Adding a license key to the Administration Server repository

Deleting an Administration Server license key

Deploying a license key to client devices

Automatic distribution of a license key

Creating and viewing a license key usage report

Viewing information about the application license keys

Exporting a license key file

Main installation scenario

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 180068_1]

Licensing of managed applications

The Kaspersky applications installed on managed devices must be licensed by applying a key file or activation code to each of the applications. A key file or activation code can be deployed in the following ways:

Automatic deployment
The installation package of a managed application
The Add license key task for a managed application
Manual activation of a managed application

You can add a new active or reserve license key by any of the methods listed above. A Kaspersky application uses an active key at the current moment and stores a reserve key to apply after the active key expires. The application for which you add a license key defines whether the key is active or reserve. The key definition does not depend on the method that you use to add a new license key.

Automatic deployment

If you use different managed applications and you have to deploy a specific key file or activation code to devices, opt for other ways of deploying that activation code or key file.

Kaspersky Security Center allows you to automatically deploy available license keys to devices. For example, three license keys are stored in the Administration Server repository. You have selected the Automatically distribute license key to managed devices check box for all three license keys. A Kaspersky security application—for example, Kaspersky Endpoint Security for Windows—is installed on the organization's devices. A new device is discovered to which a license key must be deployed. The application determines, for instance, that two of the license keys from the repository can be deployed to the device: license key named Key_1 and license key named Key_2. One of these license keys is deployed to the device. In this case, it cannot be predicted which of the two license keys will be deployed to the device because automatic deployment of license keys does not provide for any administrator activity.

When a license key is deployed, the devices are recounted for that license key. You must make sure that the number of devices to which the license key was deployed does not exceed the license limit. If the number of devices exceeds the license limit, all devices that were not covered by the license will be assigned Critical status.

Before deployment, the key file or activation code must be added to the Administration Server repository.

How-to instructions:

Administration Console:
- Adding a license key to the Administration Server repository
- Automatic distribution of a license key
or
Kaspersky Security Center Web Console:
- Adding a license key to the Administration Server repository
- Automatic distribution of a license key

Note that an automatically distributed license key may not be displayed in the virtual Administration Server repository in the following cases:

The license key is not valid for the application.
The virtual Administration Server does not have managed devices.
The license key has already been used for devices managed by another virtual Administration Server and the limit on the number of devices has been reached.

Adding a key file or activation code to the installation package of a managed application

For security reasons, this option is not recommended. A key file or activation code added to an installation package may be compromised.

If you install a managed application using an installation package, you can specify an activation code or key file in this installation package or in the policy of the application. The license key will be deployed to managed devices at the next synchronization of the device with the Administration Server.

How-to instructions:

Administration Console:
- Creating an installation package
- Installing applications on client devices
or
Kaspersky Security Center Web Console: Adding a license key to an installation package

Deployment through the Add license key task for a managed application

If you opt for using the Add license key task for a managed application, you can select the license key that must be deployed to devices and select the devices in any convenient way—for example, by selecting an administration group or a device selection.

Before deployment, the key file or activation code must be added to the Administration Server repository.

How-to instructions:

Administration Console:
- Adding a license key to the Administration Server repository
- Deploying a license key to client devices
or
Kaspersky Security Center Web Console:
- Adding a license key to the Administration Server repository
- Deploying a license key to client devices

Adding an activation code or a key file manually to the devices

You can activate the installed Kaspersky application locally, by using the tools provided in the application interface. Please refer to the documentation of the installed application.

Adding a license key to the Administration Server repository

Deleting an Administration Server license key

Deploying a license key to client devices

Automatic distribution of a license key

Creating and viewing a license key usage report

Viewing information about the application license keys

Exporting a license key file

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 3613]

Viewing information about license keys in use

To view information about license keys in use,

In the console tree, select the Kaspersky Licenses folder.

The workspace of the folder displays a list of license keys used on client devices.

Next to each of the license keys an icon is displayed, corresponding to the type of use:

—Information about the currently used license key is received from a client device connected to the Administration Server. The file of this license key is stored outside of the Administration Server.
—The license key is stored in the Administration Server repository. Automatic distribution is disabled for this license key.
—The license key is stored in the Administration Server repository. Automatic distribution is enabled for this license key.

You can view information about which license keys are used for activation of the application on a client device by opening the Applications section of the client device properties window.

To define the up-to-date settings of virtual Administration Server license keys, the Administration Server sends a request to Kaspersky activation servers at least once per day. If access to the servers using system DNS is not possible, the application uses public DNS servers.

If a license key is received from a client device, you cannot export it as a file.

See also

Licensing of managed applications

Adding a license key to the Administration Server repository

Deleting an Administration Server license key

Deploying a license key to client devices

Automatic distribution of a license key

Creating and viewing a license key usage report

Viewing information about the application license keys

Exporting a license key file

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 3615]

Adding a license key to the Administration Server repository

To add a license key to the Administration Server repository:

In the console tree, select the Kaspersky Licenses folder.
Start the license key adding task in one of the following ways:
- Select Add activation code or key file in the context menu of the list of license keys.
- Click the Add activation code or key file link in the workspace of the list of license keys.
- Click the Add activation code or key file button.
The Add license key wizard starts.
Select how you want to activate Administration Server: by using an activation code or by using a key file.
Specify your activation code or a key file.
Select the Automatically distribute license key to managed devices option if you want to distribute a relevant license key on your network immediately. If you do not select this option, you can manually distribute a license key later.

As a result, the key file is downloaded and the Add license key wizard is finished. You can now see the added license key in the list of Kaspersky licenses.

See also

Licensing of managed applications

Viewing information about license keys in use

Deleting an Administration Server license key

Deploying a license key to client devices

Automatic distribution of a license key

Creating and viewing a license key usage report

Viewing information about the application license keys

Exporting a license key file

Main installation scenario

Scenario: Configuring network protection

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 88413]

Deleting an Administration Server license key

To delete an Administration Server license key:

In the context menu of the Administration Server, select Properties.
In the Administration Server properties window that opens, select the License keys section.
Delete the license key by clicking the Remove button.

This deletes the license key.

If a reserve license key has been added, the reserve license key automatically becomes the active license key after the former active license key is deleted.

After the active license key of Administration Server is deleted, Vulnerability and patch management and Mobile Device Management become unavailable. You can add a deleted license key again or add a new license key.

See also

Licensing of managed applications

Viewing information about license keys in use

Adding a license key to the Administration Server repository

Deploying a license key to client devices

Automatic distribution of a license key

Creating and viewing a license key usage report

Viewing information about the application license keys

Exporting a license key file

Scenario: Configuring network protection

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 3617]

Deploying a license key to client devices

Expand all | Collapse all

Kaspersky Security Center allows you to distribute a license key to client devices through the License key distribution task.

Before deployment, add the license key to the Administration Server repository.

To distribute a license key to client devices:

In the console tree, select the Kaspersky Licenses folder.
In the workspace of the list of license keys, click the Automatically distribute license key to managed devices button.
The Application Activation task creation wizard starts. Proceed through the wizard by using the Next button.
In the list of applications, select the application for which you want to create a task.
At the Add key step of the wizard, add the license key by using one of the following options:
- Select the Activation code option to add an activation code from the Kaspersky Security Center repository.
  Click Select. In the window that opens, select the activation code, and then click OK.
- Select the Key file or key option, and then do the following:
  1. Click Select.
  2. In the context menu, select one of the options:
    - Key file from folder.
      In the window that opens, select the key file from your device, and then click Open.
    - Key from Kaspersky Security Center repository.
      In the window that opens, select the key from the Kaspersky Security Center repository, and then click OK.
If you want to replace the active license key, clear the default Use as a reserve key check box.
For example, this is needed when the organization changes, and another organization's key is required on the device; or if the key was reissued, and a new license expires earlier than the current license. To avoid errors, you have to clear the Use as a reserve key check box.

If you want to find out more information about the issues that may occur when adding a license key to Kaspersky Security Center Windows and the ways to resolve them, refer to the Kaspersky Security Center Knowledge Base.
Check the license key information, and then click Next.
At this step of the wizard, select the devices to which you want to assign the add key task. You can specify devices (up to 1000 devices) in one of the following ways:
- Select networked devices detected by Administration Server. In this case, the task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
- Specify device addresses manually or import addresses from a list. You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
- Assign task to a device selection. In this case, the task is assigned to devices included in a selection created earlier. You can specify the predefined selection or a custom one that you created.
- Assign task to an administration group. In this case, the task is assigned to devices included in the administration group created earlier.
At the Configure task schedule step of the wizard, create a schedule for task start:
- Scheduled start:
  - Once
    The task runs once, on the specified date and time (by default, on the day when the task was created).
  - Manually
    The task does not run automatically. You can only start it manually.
    
    By default, this option is selected.
  - When new updates are downloaded to the repository
    The task runs after updates are downloaded to the repository. For example, you may want to use this schedule for the find vulnerabilities and required updates task.
  - On virus outbreak
    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
    - Anti-virus for workstations and file servers
    - Anti-virus for perimeter defense
    - Anti-virus for mail systems
    By default, all application types are selected.
    
    You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
  - On completing another task
    The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
    
    You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
    
    If necessary, you can search, sort, and filter the tasks in the table as follows:
    - Enter the task name in the search field, to search the task by its name.
    - Click the sort icon to sort the tasks by name.
      By default, the tasks are sorted in alphabetical ascending order.
    - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
- Run missed tasks
  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.
  
  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.
  
  If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.
  
  By default, this option is disabled.
- Use automatically randomized delay for task starts
  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.
  
  If this option is disabled, the task starts on client devices according to the schedule.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  If this option is disabled, the task starts on client devices according to the schedule.
  
  By default, this option is disabled. The default time interval is one minute.
At the Define the task name step of the wizard, specify the name for the task. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
On the Finish task creation step of the wizard, click the Finish button to close the wizard.
If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

Tasks created through the Application Activation task creation wizard are tasks for specific devices stored in the Tasks folder of the console tree.

You can also create a group or local license key distribution task through the task creation wizard for an administration group and for a client device.

See also

Licensing of managed applications

Viewing information about license keys in use

Adding a license key to the Administration Server repository

Deleting an Administration Server license key

Automatic distribution of a license key

Creating and viewing a license key usage report

Viewing information about the application license keys

Exporting a license key file

Main installation scenario

Scenario: Configuring network protection

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 11511]

Automatic distribution of a license key

Kaspersky Security Center allows automatic distribution of license keys to managed devices if they are located in the license keys repository on the Administration Server. Automatic distribution of license keys does not apply to devices in the Unassigned devices folder.

To distribute a license key to managed devices automatically:

In the console tree, select the Kaspersky Licenses folder.
In the workspace of the folder, select the license key that you want to distribute to devices automatically.
Open the properties window of the selected license key in one of the following ways:
- By selecting Properties in the context menu of the license key.
- By clicking the View license key properties link in the information box for the selected license key.
In the license key properties window that opens, select the Automatically distributed license key check box. Close the license key properties window.

The license key will be automatically distributed to all compatible devices.

License key distribution is performed by means of Network Agent. No license key distribution tasks are created for the application.

During automatic distribution of a license key, the licensing limit on the number of devices is taken into account. (The licensing limit is set in the properties of the license key.) If the licensing limit is reached, distribution of this license key on devices ceases automatically.

The virtual Administration Server automatically distributes license keys from its repository and from the repository of the Administration Server. We recommend that you:

Use the Add license key task to select the license key that must be deployed to devices.
Avoid disabling the Allow automatic deployment of license keys from this virtual Administration Server to its devices option in the virtual Administration Server settings. Otherwise, the virtual Administration Server will not distribute license keys to devices, including the license keys from the Administration Server repository.

If you select the Automatically distributed license key check box in the license key properties window, a license key is distributed on your network immediately. If you do not select this option, you can manually distribute a license key later.

See also:

Licensing of managed applications

Viewing information about license keys in use

Adding a license key to the Administration Server repository

Deleting an Administration Server license key

Deploying a license key to client devices

Creating and viewing a license key usage report

Viewing information about the application license keys

Exporting a license key file

Main installation scenario

Scenario: Configuring network protection

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 3618]

Creating and viewing a license key usage report

To create a report on usage of license keys on client devices:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
Select the report template named License key usage report, or create a new report template of the same type.

The workspace of the license key usage report displays information about active and reserve license keys used on the client devices. The report also contains information about devices on which the license keys are used, and about restrictions specified in the properties of those license keys.

See also

Licensing of managed applications

Viewing information about license keys in use

Adding a license key to the Administration Server repository

Deleting an Administration Server license key

Deploying a license key to client devices

Automatic distribution of a license key

Viewing information about the application license keys

Exporting a license key file

Scenario: Monitoring and reporting

Licenses and features of Kaspersky Security Center 15.1

Page top

[Topic 222233]

Viewing information about the application license keys

To learn what license keys are in use for a Kaspersky application:

In the Kaspersky Security Center console tree, select the Managed devices node and go to the Devices tab.
Right-click to open the context menu of the relevant device and select Properties.
In the device properties window that opens, select the Applications section.
In the list of applications that appears, select the application whose license keys you want to view, and then click the Properties button.
In the application properties window that opens, select the License keys section.
The information is displayed in the workspace of this section.

Page top

[Topic 275779]

Exporting a license key file

If your license key has been accidentally deleted and you want to restore it, you can export a license key file from other Administration Server.

To export a license key file, you must have the Export key file right in the General features: Key management functional area.

If a license key is received from a client device, you cannot export it.

To export a license key:

In the console tree, select the Kaspersky Licenses folder.
In the list, select the license key that you want to export as a file.
In the information box that opens, click the Export key file link.
In the window that opens, specify the path to the folder where you want to save a license key file, and then specify a file name. After that, click Save.

The license key file in .key format is exported to the selected folder.

If the license key whose file you exported was added to the Administration Server repository as an activation code, and you want to add the exported license key file to the repository of another Administration Server, you must add it as an activation code, not as a key file. Otherwise, an error occurs. You have to open the exported license key file in any convenient text editor, and then copy the activation code.

Page top

[Topic 171272]

Configuring network protection

This section contains information about manual configuration of policies and tasks, about user roles, about building an administration group structure and hierarchy of tasks.

In this section

Scenario: Configuring network protection

Policy setup and propagation: Device-centric approach

About device-centric and user-centric security management approaches

Manual setup of the Kaspersky Endpoint Security policy

Manual setup of the group update task for Kaspersky Endpoint Security

Manual setup of the group task for scanning a device with Kaspersky Endpoint Security

Scheduling the Find vulnerabilities and required updates task

Manual setup of the group task for updates installation and vulnerabilities fix

Setting the maximum number of events in the event repository

Setting the maximum storage period for the information about fixed vulnerabilities

Managing tasks

Creating a hierarchy of administration groups subordinate to a virtual Administration Server

Policies and policy profiles

Device moving rules

Cloning device moving rules

Software categorization

Prerequisites for installing applications on devices of a client organization

Viewing and editing local application settings

Policy setup and propagation: User-centric approach

Page top

[Topic 179344]

Scenario: Configuring network protection

The quick start wizard creates policies and tasks with the default settings. These settings may turn out to be sub-optimal or even disallowed by the organization. Therefore, we recommend that you fine-tune these policies and tasks and create other policies and tasks, if they are necessary for your network.

Prerequisites

Before you start, make sure that you have done the following:

Installed Kaspersky Security Center Administration Server
Installed Kaspersky Security Center Web Console (optional)
Completed the Kaspersky Security Center main installation scenario
Completed the quick start wizard or manually created the following policies and tasks in the Managed devices administration group:
- Policy of Kaspersky Endpoint Security
- Group task for updating Kaspersky Endpoint Security
- Policy of Network Agent
- Find vulnerabilities and required updates task

Configuring network protection proceeds in stages:

Setup and propagation of Kaspersky application policies and policy profiles
To configure and propagate settings for Kaspersky applications installed on the managed devices, you can use two different security management approaches—device-centric or user-centric. These two approaches can also be combined. To implement device-centric security management, you can use tools provided in Microsoft Management Console-based Administration Console or Kaspersky Security Center Web Console. User-centric security management can be implemented through Kaspersky Security Center Web Console only.
Configuring tasks for remote management of Kaspersky applications
Check the tasks created with the quick start wizard and fine-tune them, if necessary.

How-to instructions:
- Administration Console:
  - Setting up the group task for updating Kaspersky Endpoint Security
  - Scheduling the Find vulnerabilities and required updates task
- Kaspersky Security Center Web Console:
  - Setting up the group task for updating Kaspersky Endpoint Security
  - Find vulnerabilities and required updates task settings
If necessary, create additional tasks to manage the Kaspersky applications installed on the client devices.
Evaluating and limiting the event load on the database
Information about events that occur during the operation of managed applications is transferred from a client device and registered in the Administration Server database. To reduce the load on the Administration Server, evaluate and limit the maximum number of events that can be stored in the database.

How-to instructions:
- Administration Console: Setting the maximum number of events
- Kaspersky Security Center Web Console: Setting the maximum number of events

Results

Upon completion of this scenario, your network will be protected by configuration of Kaspersky applications, tasks, and events received by the Administration Server:

The Kaspersky applications are configured according to the policies and policy profiles.
The applications are managed through a set of tasks.
The maximum number of events that can be stored in the database is set.

When the network protection configuration is complete, you can proceed to configuring regular updates to Kaspersky databases and applications.

For details about how to configure automatic responses to threats detected by Kaspersky Sandbox, please refer to the Kaspersky Sandbox 2.0 Online Help.

Scenario: Regular updating Kaspersky databases and applications

Main installation scenario

Page top

[Topic 177128]

Policy setup and propagation: Device-centric approach

When you complete this scenario, the applications will be configured on all of the managed devices in accordance with the application policies and policy profiles that you define.

Prerequisites

Before you start, make sure that you have installed Kaspersky Security Center Administration Server and Kaspersky Security Center Web Console (optional). If you installed Kaspersky Security Center Web Console, you might also want to consider user-centric security management as an alternative or additional option to the device-centric approach.

Stages

The scenario of device-centric management of Kaspersky applications consists of the following steps:

Configuring application policies
Configure settings for Kaspersky applications installed on the managed devices by creating a policy for each application. The set of policies will be propagated to the client devices.

When you configure the protection of your network in the quick start wizard, Kaspersky Security Center creates the default policy for the following applications:
- Kaspersky Endpoint Security for Windows—for Windows-based client devices
- Kaspersky Endpoint Security for Linux—for Linux-based client devices
If you completed the configuration process by using this wizard, you do not have to create a new policy for this application. Proceed to the manual setup of the Kaspersky Endpoint Security policy.

If you have a hierarchical structure of several Administration Servers and/or administration groups, the secondary Administration Servers and child administration groups inherit the policies from the primary Administration Server by default. You can force the inheritance by the child groups and secondary Administration Servers to prohibit any modifications of the settings configured in the upstream policy. If you want only part of the settings to be forcibly inherited, you can lock them in the upstream policy. The rest unlocked settings will be available for modification in the downstream policies. The created hierarchy of policies will allow you to effectively manage devices in the administration groups.

How-to instructions:
- Administration Console: Creating a policy
- Kaspersky Security Center Web Console: Creating a policy
Creating policy profiles (optional)
If you want devices within a single administration group to run under different policy settings, create policy profiles for those devices. A policy profile is a named subset of policy settings. This subset is distributed on target devices together with the policy, supplementing it under a specific condition called the profile activation condition. Profiles only contain settings that differ from the "basic" policy, which is active on the managed device.

By using profile activation conditions, you can apply different policy profiles, for example, to the devices located in a specific unit or security group of Active Directory, having a specific hardware configuration, or marked with specific tags. Use tags to filter devices that meet specific criteria. For example, you can create a tag called Windows, mark all devices running Windows operating system with this tag, and then specify this tag as an activation condition for a policy profile. As a result, Kaspersky applications installed on all devices running Windows will be managed by their own policy profile.

How-to instructions:
- Administration Console:
  - Creating a policy profile
  - Creating a policy profile activation rule
- Kaspersky Security Center Web Console:
  - Creating a policy profile
  - Creating a policy profile activation rule
Propagating policies and policy profiles to the managed devices
By default, the Administration Server automatically synchronizes with managed devices every 15 minutes. You can circumvent auto-synchronization and run the synchronization manually by using the Force synchronization command. Also the synchronization is forced after you create or change a policy or a policy profile. During the synchronization, the new or changed policies and policy profiles are propagated to the managed devices.

If you use Kaspersky Security Center Web Console, you can check whether the policies and policy profiles were delivered to a device. Kaspersky Security Center specifies the delivery date and time in the properties of the device.

How-to instructions:
- Administration Console: Forced synchronization
- Kaspersky Security Center Web Console: Forced synchronization

Results

When the device-centric scenario is complete, the Kaspersky applications are configured according to the settings specified and propagated through the hierarchy of policies.

The configured application policies and policy profiles will be applied automatically to the new devices added to the administration groups.

See also:

Main installation scenario

Hierarchy of Administration Servers

Administration groups

Policies

Policy profiles

Hierarchy of policies

About user roles

Scenario: Configuring network protection

Page top

[Topic 166721]

About device-centric and user-centric security management approaches

You can manage security settings from the standpoint of device features and from the standpoint of user roles. The first approach is called device-centric security management and the second is called user-centric security management. To apply different application settings to different devices you can use either or both types of management in combination. To implement device-centric security management, you can use tools provided in Microsoft Management Console-based Administration Console or Kaspersky Security Center Web Console. User-centric security management can be implemented through Kaspersky Security Center Web Console only.

Device-centric security management enables you to apply different security application settings to managed devices depending on device-specific features. For example, you can apply different settings to devices allocated in different administration groups. You can also differentiate the devices by usage of those devices in Active Directory, or their hardware specifications.

User-centric security management enables you to apply different security application settings to different user roles. You can create several user roles, assign an appropriate user role to each user, and define different application settings to the devices owned by users with different roles. For example, you may want to apply different application settings to devices of accountants and human resources (HR) specialists. As a result, when user-centric security management is implemented, each department—accounts department and HR department—has its own settings configuration for Kaspersky applications. A settings configuration defines which application settings can be changed by users and which are forcibly set and locked by the administrator.

By using user-centric security management you can apply specific application settings to individual users. This may be required when an employee has a unique role in the company or when you want to monitor security issues related to devices of a specific person. Depending on the role of this employee in the company, you can expand or limit the rights of this person to change application settings. For example, you might want to expand the rights of a system administrator who manages client devices in a local office.

You can also combine the device-centric and user-centric security management approaches. For example, you can configure a specific application policy for each administration group and then create policy profiles for one or several user roles of your enterprise. In this case, the policies and policy profiles are applied in the following order:

The policies created for device-centric security management are applied.
They are modified by the policy profiles according to the policy profile priorities.
The policies are modified by the policy profiles associated with user roles.

Scenario: Configuring network protection

Page top

[Topic 92418]

Manual setup of the Kaspersky Endpoint Security policy

This section provides recommendations on how to configure the Kaspersky Endpoint Security policy, which is created by the quick start wizard. You can perform the setup in the policy properties window.

When editing a setting, keep in mind that you must click the lock icon above the relevant setting in order to allow using its value on a workstation.

In this section

Configuring the policy in the Advanced Threat Protection section

Configuring the policy in the Essential Threat Protection section

Configuring the policy in the General Settings section

Configuring the policy in the Event configuration section

Page top

[Topic 175185]

Configuring the policy in the Advanced Threat Protection section

For a full description of the settings in this section, please refer to the Kaspersky Endpoint Security for Windows documentation.

In the Advanced Threat Protection section, you can configure the use of Kaspersky Security Network for Kaspersky Endpoint Security for Windows. You can also configure Kaspersky Endpoint Security for Windows modules, such as Behavior Detection, Exploit Prevention, Host Intrusion Prevention, and Remediation Engine.

In the Kaspersky Security Network subsection, we recommend that you enable the Kaspersky Security Network option. Using this option helps to redistribute and optimize traffic on the network. If the Kaspersky Security Network option is disabled, you can enable direct use of KSN servers.

Page top

[Topic 92419]

Configuring the policy in the Essential Threat Protection section

For a full description of the settings in this section, please refer to the Kaspersky Endpoint Security for Windows documentation.

In the Essential Threat Protection section of the policy properties window, we recommend that you specify additional settings in the Firewall and File Threat Protection subsections.

The Firewall subsection contains settings that allow you to control the network activity of applications on the client devices. A client device uses a network to which one of the following statuses is assigned: public, local, or trusted. Depending on the network status, Kaspersky Endpoint Security can allow or deny network activity on a device. When you add a new network to your organization, you must assign an appropriate network status to it. For example, if the client device is a laptop, we recommend that this device use the public or trusted network, because the laptop is not always connected to the local network. In the Firewall subsection, you can check whether you correctly assigned statuses to the networks used in your organization.

To check the list of networks:

In the policy properties, go to Essential Threat Protection → Firewall.
In the Available networks section, click the Settings button.
In the Firewall window that opens, go to the Networks tab to view the list of networks.

In the File Threat Protection subsection, you can disable the scanning of network drives. Scanning network drives can place a significant load on network drives. It is more convenient to perform indirect scanning, on file servers.

To disable scanning of network drives:

In the policy properties, go to Essential Threat Protection → File Threat Protection.
In the Security level section, click the Settings button.
In the File Threat Protection window that opens, on the General tab clear the All network drives check box.

Page top

[Topic 92421]

Configuring the policy in the General Settings section

For a full description of the settings in this section, please refer to the Kaspersky Endpoint Security for Windows documentation.

In the General settings section of the policy properties window, we recommend that you specify additional settings in the Reports and Storage and Interface subsections.

In the Reports and Storage subsection, go to the Data transfer to Administration Server section. The About started applications check box specifies whether the Administration Server database saves information about all versions of all software modules on the networked devices. If this check box is selected, the saved information may require a significant amount of disk space in the Kaspersky Security Center database (dozens of gigabytes). Clear the About started applications check box if it is selected in the top-level policy.

If Administration Console manages the threat protection on the organization's network in centralized mode, disable the display of the Kaspersky Endpoint Security for Windows user interface on workstations. To do this, in the Interface subsection, go to the Interaction with user section, and then select Do not display user interface option.

To enable password protection on workstations, in the Interface subsection, go to the Password protection section, click the Settings button, and then select the Enable password protection check box.

Page top

[Topic 92424]

Configuring the policy in the Event configuration section

In the Event configuration section, you should disable the saving of any events on Administration Server, except for the following ones:

On the Critical tab:
- Application autorun is disabled
- Access denied
- Application startup prohibited
- Disinfection impossible
- End User License Agreement violated
- Could not load encryption module
- Cannot start two tasks at the same time
- Active threat detected. Advanced Disinfection should be started
- Network attack detected
- Not all components were updated
- Activation error
- Error enabling portable mode
- Error in interaction with Kaspersky Security Center
- Error disabling portable mode
- Error changing application components
- Error applying file encryption / decryption rules
- Policy cannot be applied
- Process terminated
- Network activity blocked
On the Functional failure tab: Invalid task settings. Settings not applied
On the Warning tab:
- Self-Defense is disabled
- Incorrect reserve key
- User has opted out of the encryption policy
On the Info tab: Application startup prohibited in test mode

Page top

[Topic 92425]

Manual setup of the group update task for Kaspersky Endpoint Security

The optimal and recommended schedule option for Kaspersky Endpoint Security versions 10 and later is When new updates are downloaded to the repository when the Use automatically randomized delay for task starts check box is selected.

Page top

[Topic 92426]

Manual setup of the group task for scanning a device with Kaspersky Endpoint Security

The quick start wizard creates a group task for scanning a device. By default, the task is assigned a Run on Fridays at 7:00 PM schedule with automatic randomization, and the Run missed tasks check box is cleared.

This means that if devices in an organization are shut down on Fridays, for example, at 6:30 PM, the device scan task will never run. You must set up the most convenient schedule for this task based on the workplace rules adopted in the organization.

Page top

[Topic 92427]

Scheduling the Find vulnerabilities and required updates task

The quick start wizard creates the Find vulnerabilities and required updates task for Network Agent. By default, the task is assigned a Run on Tuesdays at 7:00 PM schedule with automatic randomization, and the Run missed tasks check box is selected.

If the organization's workplace rules provide for shutting down all devices at this time, the Find vulnerabilities and required updates task will run after the devices are turned on again, that is, on Wednesday morning. Such activity may be undesirable because a vulnerability scan may increase the load on CPUs and disk subsystems. You must set up the most convenient schedule for the task based on the workplace rules adopted in the organization.

Scenario: Updating third-party software

Scenario: Configuring network protection

Page top

[Topic 92428]

Manual setup of the group task for updates installation and vulnerabilities fix

The quick start wizard creates a group task for updates installation and vulnerabilities fix for Network Agent. By default, the task is set up to run every day at 01:00 AM, with automatic randomization, and the Run missed tasks option is not enabled.

If the organization's workplace rules provide for shutting down devices overnight, the update installation will never run. You must set up the most convenient schedule for the vulnerability scan task based on the workplace rules adopted in the organization. It is also important to keep in mind that installation of updates may require restarting the device.

Page top

[Topic 181228]

Setting the maximum number of events in the event repository

In the Events repository section of the Administration Server properties window, you can edit the settings of events storage in the Administration Server database by limiting the number of event records and record storage term. When you specify the maximum number of events, the application calculates an approximate amount of storage space required for the specified number. You can use this approximate calculation to evaluate whether you have enough free space on the disk to avoid database overflow. The default capacity of the Administration Server database is 400,000 events. The maximum recommended capacity of the database is 45 million events.

The application checks the database every 10 minutes. If the number of events reaches the specified maximum value plus 10,000, the application deletes the oldest events so that only the specified maximum number of events remains.

When the Administration Server deletes old events, it cannot save new events to the database. During this period of time, information about events that were rejected is written to the Kaspersky Event Log. The new events are queued and then saved to the database after the deletion operation is complete.

To limit the number of events that can be stored in the events repository on the Administration Server:

Right-click the Administration Server, and then select Properties.
The Administration Server properties window opens.
In the workspace of the Events repository section, specify the maximum number of events stored in the database.
Click OK.

Additionally, you can change the settings of any task to save events related to the task progress, or save only task execution results. In doing so, you will reduce the number of events in the database, increase the speed of execution of scenarios associated with analysis of the event table in the database, and lower the risk that critical events will be overwritten by a large number of events.

See also:

Scenario: Monitoring and reporting

Scenario: Configuring network protection

Page top

[Topic 222383]

Setting the maximum storage period for the information about fixed vulnerabilities

To set the maximum storage period in the database for the information about the vulnerabilities that have already been fixed on managed devices:

Right-click the Administration Server, and then select Properties.
The Administration Server properties window opens.
In the workspace of the Events repository section, specify the maximum storage period for the information about the fixed vulnerabilities in the database.
By default, the storage period is 90 days.
Click OK.

The maximum storage period for the information about the fixed vulnerabilities is limited to the specified number of days. After that, the Administration Server maintenance task will delete the outdated information from the database.

Page top

[Topic 3772]

Managing tasks

Kaspersky Security Center manages applications installed on devices, by creating and running various tasks. Tasks are required for installing, launching, and stopping applications, scanning files, updating databases and software modules, and performing other actions on applications.

Tasks are subdivided into the following types:

Group tasks. Tasks that are performed on the devices of the selected administration group.
Administration Server tasks. Tasks that are performed on the Administration Server.
Tasks for specific devices. Tasks that are performed on selected devices, regardless of whether they are included in any administration groups.
Local tasks. Tasks that are performed on a specific device.

An application task can only be created if the management plug-in for that application is installed on the administrator's workstation.

You can compile a list of devices (up to 1000 devices) for which a task will be created by in one of the following ways:

By selecting networked devices discovered by Administration Server.
By specifying a list of devices manually. You can use an IP address (or IP range), NetBIOS name, or DNS name as the device address.
Import a list of devices from a .txt file containing the addresses of devices to be added (each address must be placed in an individual line).
If you import a list of devices from a file or create one manually, and devices are identified by their names, the list can only contain devices for which information has already been entered into the Administration Server database when those devices were connected or during device discovery.

For each application, you can create any number of group tasks, tasks for specific devices, or local tasks.

The exchange of task information between an application installed on a device and the Kaspersky Security Center database is carried out when Network Agent is connected to Administration Server.

You can make changes to the settings of tasks, view the progress of tasks, and copy, export, import, and delete tasks.

Tasks are started on a device only if the application for which the task was created is running. When the application is not running, all running tasks are canceled.

Results of completed tasks are saved in the event logs of Microsoft Windows and Kaspersky Security Center, both centrally on the Administration Server and locally on each device.

Do not include private data in task settings. For example, avoid specifying the domain administrator password.

Details of managing tasks for applications with multitenancy support

A group task for an application with multitenancy support is applied to the application depending on the hierarchy of Administration Servers and client devices. The virtual Administration Server from which the task is created must be in the same or a lower-level administration group than the client device on which the application is installed.

In events that correspond to task execution results, a service provider administrator is shown the information about the device on which the task executed. By contrast, a tenant administration is shown Multi-tenant node.

In this section

Creating a task

Creating the Administration Server task

Creating a task for specific devices

Creating a local task

Displaying an inherited group task in the workspace of a nested group

Automatically turning on devices before starting a task

Automatically turning off a device after a task is completed

Limiting task run time

Exporting a task

Importing a task

Converting tasks

Starting and stopping a task manually

Pausing and resuming a task manually

Monitoring task execution

Viewing task run results stored on the Administration Server

Configuring filtering of information about task run results

Modifying a task. Rolling back changes

Comparing tasks

Accounts to start tasks

Exporting task execution history

Change tasks password wizard

See also:

About multi-tenant applications

Scenario: Configuring network protection

Page top

[Topic 3773]

Creating a task

In Administration Console, you can create tasks directly in the folder of the administration group for which a group task is to be created, or in the workspace of the Tasks folder.

To create a group task in the folder of an administration group:

In the console tree, select the administration group for which you want to create a task.
In the group workspace, select the Tasks tab.
Run the task creation by clicking the Create a task button.

The New task wizard starts. Follow the instructions of the wizard.

To create a task in the workspace of the Tasks folder:

In the console tree, select the Tasks folder.
Run the task creation by clicking the Finish button.

The New task wizard starts. Follow the instructions of the wizard.

Do not include private data in task settings. For example, avoid specifying the domain administrator password.

See also

Scenario: Monitoring and reporting

Scenario: Configuring network protection

Page top

[Topic 3778]

Creating the Administration Server task

The Administration Server performs the following tasks:

Deliver reports
Download updates to the Administration Server repository
Backup of Administration Server data
Administration Server maintenance
Perform Windows Update synchronization
Create installation package upon reference device OS image
Install application remotely
Uninstall application remotely
Distribute installation package
Install application on secondary Administration Servers remotely

On a virtual Administration Server, only the automatic report delivery task and the installation package creation task based on the reference device OS image are available. The repository of the virtual Administration Server displays updates downloaded to the primary Administration Server. Backup of virtual Administration Server data is performed together with backup of primary Administration Server data.

To create the Administration Server task:

In the console tree, select the Tasks folder.
Start creation of the task in one of the following ways:
- By selecting New → Task in the context menu of the Tasks folder in the console tree.
- By clicking the Create a task button in the workspace of the Tasks folder.

The New task wizard starts. Follow the instructions of the wizard.

The Download updates to the repository of the Administration Server, Perform Windows Update synchronization, Administration Server maintenance, and Backup of Administration Server data tasks can be created only once. If the Download updates to the repository of the Administration Server, Administration Server maintenance, Backup of Administration Server data, and Perform Windows Update synchronization tasks have already been created for the Administration Server, they will not be displayed in the task type selection window of the New task wizard.

Page top

[Topic 3779]

Creating a task for specific devices

In Kaspersky Security Center, you can create tasks for specific devices. Devices that are in a set can be included in various administration groups or remain outside any administration groups. Kaspersky Security Center can perform the following main tasks for specific devices:

Install an application remotely
Send message to user
Change the Administration Server
Manage devices
Verify updates
Distribute installation packages
Install application on secondary Administration Servers remotely
Uninstall an application remotely

To create a task for specific devices:

In the console tree, select the Tasks folder.
Start creation of the task in one of the following ways:
- By selecting New → Task in the context menu of the Tasks folder in the console tree.
- By clicking the Create a task button in the workspace of the Tasks folder.

The New task wizard starts. Follow the instructions of the wizard.

Page top

[Topic 3780]

Creating a local task

To create a local task for a device:

Select the Devices tab in the workspace of the group that includes the device.
From the list of devices on the Devices tab, select the device for which a local task must be created.
Start creating the task for the selected device in one of the following ways:
- Click the Perform action button and select Create a task in the drop-down list.
- Click the Create a task link in the workspace of the device.
- Use the device properties as follows:
  1. In the context menu of the device, select Properties.
  2. In the device properties window that opens, select the Tasks section and click Add.

The New task wizard starts. Follow the instructions of the wizard.

Detailed instructions on how to create and configure local tasks are provided in the Guides for the respective Kaspersky applications.

Page top

[Topic 3783]

Displaying an inherited group task in the workspace of a nested group

To enable the display of inherited tasks of a nested group in the workspace:

Select the Tasks tab in the workspace of a nested group.
In the workspace of the Tasks tab, click the Show inherited tasks button.

Inherited tasks are displayed in the list of tasks with one of the following icons:

—If they were inherited from a group created on the primary Administration Server.
—If they were inherited from a top-level group.

If the inheritance mode is enabled, inherited tasks can only be edited in the group in which they have been created. Inherited tasks cannot be edited in the group which inherits the tasks.

Page top

[Topic 3784]

Automatically turning on devices before starting a task

Kaspersky Security Center doesn't run tasks on devices that are turned off. You can configure Kaspersky Security Center to turn on these devices automatically before starting a task, by using the Wake-on-LAN function.

To configure the automatic turning on of devices before starting a task:

In the task properties window, select the Schedule section.
To configure actions on devices, click the Advanced link.
In the Advanced window that opens, select the Turn on devices by using the Wake-on-LAN function before starting the task (min) check box, and then specify the time interval in minutes.

As a result, for the specified number of minutes before starting the task, Kaspersky Security Center turns on the devices and loads the operating system on them by using the Wake-on-LAN function. After the task is completed, the devices are automatically shut down if device users don't log in to the system. Note that Kaspersky Security Center automatically shuts down only the devices that are turned on by using the Wake-on-LAN function.

Kaspersky Security Center can start operating systems automatically only on the devices that support the Wake-on-LAN (WoL) standard.

Page top

[Topic 3785]

Automatically turning off a device after a task is completed

Kaspersky Security Center allows you to configure a task in such a way that the devices to which it is distributed are automatically turned off after the task completes.

To automatically turn off a device after a task is complete:

In the task properties window, select the Schedule section.
Click the Advanced link to open the window for configuring actions on devices.
In the Advanced window that opens, select the Shut down the devices after completing the task check box.

Page top

[Topic 3786]

Limiting task run time

To limit the time during which a task is run on devices:

In the task properties window, select the Schedule section.
Open the window intended for configuration of actions on client devices, by clicking Advanced.
In the Advanced window that opens, select the Stop the task if it runs longer than (min) check box and specify the time interval in minutes.

If the task is not yet complete on the device when the specified time interval expires, Kaspersky Security Center stops the task automatically.

Page top

[Topic 3789]

Exporting a task

You can export group tasks and tasks for specific devices to a file. Administration Server tasks are not available for export.

To export a task:

In the context menu of the task, select All tasks → Export.
In the Save as window that opens, specify the file name path.
Click the Save button.

The rights of local users are not exported.

Page top

[Topic 3790]

Importing a task

You can import group tasks and tasks for specific devices. Administration Server tasks are not available for import.

To import a task:

Select the list to which the task must be imported:
- If you want to import the task to the list of group tasks, in the workspace of the relevant administration group select the Tasks tab.
- If you want to import a task to the list of tasks for specific devices, select the Tasks folder in the console tree.
Select one of the following options to import the task:
- In the context menu of the list of tasks, select All tasks → Import.
- Click the Import task from file link in the task list management block.
In the window that opens, specify the path to the file from which you want to import a task.
Click the Open button.

The task is displayed in the list of tasks.

If the newly imported task has an identical name to an existing task, the name of the imported task is expanded with the (<next sequence number>) index, for example: (1), (2).

Page top

[Topic 17337]

Converting tasks

You can use Kaspersky Security Center to convert tasks from earlier versions of Kaspersky applications into those from up-to-date versions of the applications.

Conversion is available for tasks of the following applications:

Kaspersky Anti-Virus 6.0 for Windows Workstations MP4
Kaspersky Endpoint Security 8 for Windows
Kaspersky Endpoint Security 10 for Windows

To convert tasks:

In the console tree, select an Administration Server for which you want to convert tasks.
In the Administration Server context menu, select All Tasks → Policies and tasks batch conversion wizard.

The Policies and tasks batch conversion wizard starts. Follow the instructions of the wizard.

After the wizard completes its operation, new tasks are created that use the settings of tasks from earlier versions of the applications.

Page top

[Topic 3791]

Starting and stopping a task manually

You can start and stop tasks manually using either of the following methods: through the context menu of the task, or through the properties window of the client device to which that task has been assigned.

Starting group tasks from the context menu of the device is only allowed to users included in the KLAdmins group.

To start or stop a task from the context menu or the properties window of the task:

In the list of tasks, select a task.
Start or stop the task in one of the following ways:
- By selecting Start or Stop in the context menu of the task.
- By clicking Start or Stop in the General section of the task properties window.

To start or stop a task from the context menu or the properties window of the client device:

In the list of devices, select the device.
Start or stop the task in one of the following ways:
- By selecting All tasks → Run task in the context menu of the device. Select the relevant task from the list of tasks.
  The list of devices to which the task is assigned will be replaced with the device that you have selected. The task starts.
- By clicking the start button () or stop button () in the Tasks section of the device properties window.

Page top

[Topic 3792]

Pausing and resuming a task manually

To pause or resume a running task manually:

In the list of tasks, select a task.
Pause or resume the task in one of the following ways:
- By selecting Pause or Resume in the context menu of the task.
- By selecting the General section in the task properties window and clicking Pause or Resume.

Page top

[Topic 3961]

Monitoring task execution

To monitor task execution,

in the task properties window, select the General section.

In the middle part of the General section, the current task status is displayed.

Page top

[Topic 3794]

Viewing task run results stored on the Administration Server

Kaspersky Security Center allows you to view the results for group tasks, tasks for specific devices, and Administration Server tasks.

To view the task results:

In the task properties window, select the General section.
Click the Results link to open the Task results window.

To view task results for a secondary Administration Server:

In the task properties window, select the General section.
Click the Results link to open the Task results window.
Click Statistics from secondary Servers.
Select the secondary Server for which you want to display the Task results window.

Page top

[Topic 3795]

Configuring filtering of information about task run results

Kaspersky Security Center allows you to filter information about results for group tasks, tasks for specific devices, and Administration Server tasks. No filtering is available for local tasks.

To set up the filtering of information about task run results:

In the task properties window, select the General section.
Click the Results link to open the Task results window.
The upper table contains a list of all devices for which the task is assigned. The lower table displays the results of the task performed on the selected device.
Right-click the relevant table to open the context menu and select Filter.
In the Set filter window that opens, define the filter settings in the Events, Devices, and Time sections. Click OK.

The Task results window displays information that meets the settings specified in the filter.

Page top

[Topic 131027]

Modifying a task. Rolling back changes

To modify a task:

In the console tree, select the Tasks folder.
In the workspace of the Tasks folder, select a task and proceed to the task properties window using the context menu.
Make the relevant changes.
In the Exclusions from task scope section, you can set up the list of subgroups to which the task is not applied.
Click Apply.

The changes made to the task will be saved in the task properties window, in the Revision history section.

You can roll back changes made to a task, if necessary.

To roll back changes made to a task:

In the console tree, select the Tasks folder.
Select the task in which changes must be rolled back, and proceed to the task properties window using the context menu.
In the task properties window, select the Revision history section.
In the list of task revisions, select the number of the revision to which you need to roll back changes.
Click the Advanced button and select the Roll back value in the drop-down list.

Page top

[Topic 144974]

Comparing tasks

You can compare tasks of the same type: for example, you can compare two malware scan tasks, but you cannot compare a malware scan task and an update installation task. After the comparison, you have a report that displays which settings of the tasks match and which settings differ. You can print the task comparison report or save it as a file. You may need task comparison when different units within a company are assigned various tasks of the same type. For example, employees at the accounting department have a task of malware scanning only local disks on their devices, while employees at the sales department communicate with customers so they have a task of scanning both local disks and email. You do not have to view all the task settings to quickly notice such difference; you can simply compare the tasks instead.

Only tasks of the same type can be compared.

Tasks can only be compared in pairs.

You can compare tasks in one of following ways: by selecting one task and comparing it to another, or by comparing any two tasks from the list of tasks.

To select one task and compare it to another:

In the console tree, select the Tasks folder.
In the workspace of the Tasks folder, select the task that you want to compare to another.
In the context menu of the task, select All tasks → Compare to another task.
In the Select a task window, select the task for comparison.
Click OK.

A report in HTML format that compares the two tasks is displayed.

To compare any two tasks from the list of tasks:

In the console tree, select the Tasks folder.
In the Tasks folder, in the list of tasks, press the Shift or Ctrl key to select two tasks of the same type.
In the context menu, select Compare.

A report in HTML format that compares the selected tasks is displayed.

When tasks are compared, if the passwords differ, asterisks (******) are displayed in the task comparison report.

If the password has been changed in the task properties, asterisks (******) are displayed in the revision comparison report (******).

Page top

[Topic 11352]

Accounts to start tasks

You can specify an account under which the task should be run.

For example, to perform an on-demand scan task, you must have access rights to the object being scanned, and to perform an update task, you need authorized proxy server user rights. The capability to specify an account for the task run allows you to avoid problems with on-demand scan tasks and update tasks in case the user running a task does not have the required access rights.

During the execution of remote installation/uninstallation tasks, the specified account is used to download to client devices the files required to install/uninstall an application in case Network Agent is not installed or unavailable. If Network Agent is installed and available, the account is used if in accordance with task settings, file delivery is performed only by using Microsoft Windows utilities from the shared folder. In this case, the account must have the following rights on the device:

Right to start applications remotely.
Rights to use the Admin$ resource.
Right to Log On As Service.

If the files are delivered to devices through Network Agent, the account will not be used. All file copying and installation operations are then performed by the Network Agent (LocalSystem account).

Page top

[Topic 295928]

Exporting task execution history

If you encounter any issues with a task, you may need to investigate the underlying reasons. To do this, you can export and further analyze the task execution history.

To export task execution history:

Create an empty TXT file in a directory on your device.
The task execution history will be exported into this file.
Open the task results window.
In the upper part of the task results window, select the device that is experiencing issues.
In the lower part of the task results window, where the execution history for the selected device is displayed, select one or several events.
To select several events, use the Shift or Ctrl key.
Right-click the selected event(s) to open the context menu and select Export.
The Events export wizard starts.
At the Export file step of the wizard, click the Browse button, and then select the TXT file that you created for exporting the task execution history.
If you want to export only the selected event(s), enable the option Export selected events only.

If you want to export the entire history of task execution (all events), the option Export selected events only must be disabled.
Click the Next button.
At the Export format step of the wizard, enable one of the following options:
- Export as tab-delimited Unicode text
  Enable this option if the exported data includes special characters and symbols from several languages and you need to ensure that all characters are preserved accurately when the TXT file with the exported data is opened in different applications.
- Export as tab-delimited text
  Enable this option if you want to maintain compatibility with older systems or applications that may not support Unicode.
Click the Next button to finish the wizard.

The task execution history is exported to the selected TXT file.

Page top

[Topic 192305]

Change tasks password wizard

For a non-local task, you can specify an account under which the task must be run. You can specify the account during task creation or in the properties of an existing task. If the specified account is used in accordance with security instructions of the organization, these instructions might require changing the account password from time to time. When the account password expires and you set a new one, the tasks will not start until you specify the new valid password in the task properties.

The Change tasks password wizard enables you to automatically replace the old password with the new one in all tasks in which the account is specified. Alternatively, you can do it manually in the properties of each task.

To start the Change tasks password wizard:

In the console tree, select the Tasks node.
In the context menu of the node, select Change tasks password wizard.

Follow the instructions of the wizard.

In this section

Step 1. Specifying credentials

Step 2. Selecting an action to take

Step 3. Viewing the results

Page top

[Topic 192383]

Step 1. Specifying credentials

In the Account and Password fields, specify new credentials that are currently valid in your system (for example, in Active Directory). When you switch to the next step of the wizard, Kaspersky Security Center checks if the specified account name matches the account name in the properties of each non-local task. If the account names match, the password in the task properties will be automatically replaced with the new one.

If you fill in the Old password (optional) field, Kaspersky Security Center replaces the password only for those tasks in which both the account name and the old password are found. The replacement is performed automatically. In all other cases you have to choose an action to take in the next step of the wizard.

See also:

Change tasks password wizard

Step 2. Selecting an action to take

Step 3. Viewing the results

Page top

[Topic 192740]

Step 2. Selecting an action to take

If you have not specified the old password on the first step of the wizard or the specified old password has not matched the passwords in the tasks, you need to choose an action to take for the found tasks.

For each task that has the Approval required status, decide whether you want to remove the password in the task properties or replace it with the new one. If you choose to remove the password, the task is switched to run under the default account.

See also:

Change tasks password wizard

Step 1. Specifying credentials

Step 3. Viewing the results

Page top

[Topic 192752]

Step 3. Viewing the results

On the last step of the wizard, view the results for each of the found task. To complete the wizard, click the Finish button.

See also:

Change tasks password wizard

Step 1. Specifying credentials

Step 2. Selecting an action to take

Page top

[Topic 38042]

Creating a hierarchy of administration groups subordinate to a virtual Administration Server

After the virtual Administration Server is created, it contains by default an administration group named Managed devices.

The procedure for creating a hierarchy of administration groups subordinate to a virtual Administration Server is the same as the procedure for creating a hierarchy of administration groups subordinate to the physical Administration Server.

You cannot add secondary and virtual Administration Servers to administration groups subordinate to a virtual Administration Server. This is due to limitations of virtual Administration Servers.

See also:

Managing administration groups

Scenario: Configuring network protection

Page top

[Topic 165762]

Policies and policy profiles

In Kaspersky Security Center Web Console, you can create policies for Kaspersky applications. This section describes policies and policy profiles, and provides instructions for creating and modifying them.

In this section

Hierarchy of policies, using policy profiles

Managing policies

Managing policy profiles

Page top

[Topic 92432]

Hierarchy of policies, using policy profiles

This section provides information about how to apply policies to devices in administration groups. This section also provides information about policy profiles.

In this section

Hierarchy of policies

Policy profiles

Inheritance of policy settings

Page top

[Topic 92433]

Hierarchy of policies

In Kaspersky Security Center, you use policies for defining a single collection of settings to multiple devices. For example, the policy scope of application P defined for administration group G includes managed devices with application P installed that have been deployed in group G and all of its subgroups, except for subgroups where the Inherit from parent group check box is cleared in the properties.

A policy differs from any local setting by lock icons () next to its settings. If a setting (or a group of settings) is locked in the policy properties, you must, first, use this setting (or group of settings) when creating effective settings and, second, you must write the settings or group of settings to the downstream policy.

Creation of the effective settings on a device can be described as follows: the values of all settings that have not been locked are taken from the policy, then they are overwritten with the values of local settings, and then the resulting collection is overwritten with the values of locked settings taken from the policy.

Policies of the same application affect each other through the hierarchy of administration groups: Locked settings from the upstream policy overwrite the same settings from the downstream policy.

There is a special policy for out-of-office users. This policy takes effect on a device when the device switches into out-of-office mode. Out-of-office policies do not affect other policies through the hierarchy of administration groups.

Page top

[Topic 92434]

Policy profiles

Applying policies to devices only through the hierarchy of administration groups may be inconvenient in many circumstances. It may be necessary to create several instances of a single policy that differ in one or two settings for different administration groups, and synchronize the contents of those policies in the future.

To help you avoid such problems, Kaspersky Security Center supports policy profiles. A policy profile is a named subset of policy settings. This subset is distributed on target devices together with the policy, supplementing it under a specific condition called the profile activation condition. Profiles only contain settings that differ from the "basic" policy, which is active on the client device (computer or mobile device). Activation of a profile modifies the policy settings that were active on the device before the profile was activated. Those settings take values that have been specified in the profile.

The following restrictions are currently imposed on policy profiles:

A policy can include a maximum 100 profiles.
A policy profile cannot contain other profiles.
A policy profile cannot contain notification settings.

Contents of a profile

A policy profile contains the following constituent parts:

Name. Profiles with identical names affect each other through the hierarchy of administration groups with common rules.
Subset of policy settings. Unlike the policy, which contains all the settings, a profile only contains settings that are actually required (locked settings).
Activation condition is a logical expression with the device properties. A profile is active (supplements the policy) only when the profile activation condition becomes true. In all other cases, the profile is inactive and ignored. The following device properties can be included in that logical expression:
- Status of out-of-office mode.
- Properties of network environment—Name of the active rule for Network Agent connection.
- Presence or absence of specified tags on the device.
- Device location in Active Directory unit: explicit (the device is right in the specified OU), or implicit (the device is in an OU, which is within the specified OU at any nesting level).
- Device's membership in an Active Directory security group (explicit or implicit).
- Device owner's membership in an Active Directory security group (explicit or implicit).
Profile disabling check box. Disabled profiles are always ignored and their respective activation conditions are not verified.
Profile priority. The activation conditions of different profiles are independent, so several profiles can be activated simultaneously. If active profiles contain non-overlapping collections of settings, no problems will arise. However, if two active profiles contain different values of the same setting, an ambiguity will occur. This ambiguity is to be avoided through profile priorities: The value of the ambiguous variable will be taken from the profile that has the higher priority (the one that is rated higher in the list of profiles).

Behavior of profiles when policies affect each other through the hierarchy

Profiles with the same name are merged according to the policy merge rules. Profiles of an upstream policy have a higher priority than profiles of a downstream policy. If editing settings is prohibited in the upstream policy (it is locked), the downstream policy uses the profile activation conditions from the upstream one. If editing settings is allowed in the upstream policy, the profile activation conditions from the downstream policy are used.

Since a policy profile may contain the Device is offline property in its activation condition, profiles completely replace the feature of policies for out-of-office users, which will no longer be supported.

A policy for out-of-office users may contain profiles, but its profiles can only be activated after the device switches into out-of-office mode.

Page top

[Topic 179787]

Inheritance of policy settings

A policy is specified for an administration group. Policy settings can be inherited, that is, received in the subgroups (child groups) of the administration group for which they were set. Hereinafter, a policy for a parent group is also referred to as a parent policy.

You can enable or disable two options of inheritance: Inherit settings from parent policy and Force inheritance of settings in child policies:

If you enable Inherit settings from parent policy for a child policy and lock some settings in the parent policy, then you cannot change these settings for the child group. You can, however, change the settings that are not locked in the parent policy.
If you disable Inherit settings from parent policy for a child policy, then you can change all the settings in the child group, even if some settings are locked in the parent policy.
If you enable Force inheritance of settings in child policies in the parent group, this enables the Inherit settings from parent policy for each child policy. In this case, you cannot disable this option for any child policy. All the settings that are locked in the parent policy are forcibly inherited in the child groups, and you cannot change these settings in the child groups.
In policies for the Managed devices group, the Inherit settings from parent policy does not affect any settings, because the Managed devices group does not have any upstream groups and therefore does not inherit any policies.

By default, the Inherit settings from parent policy option is enabled for a new policy.

If a policy has profiles, all the child policies inherit these profiles.

Page top

[Topic 3746]

Managing policies

The applications installed on client devices are centrally configured by defining policies.

Policies created for applications in an administration group are displayed in the workspace, on the Policies tab. Before the name of each policy, an icon with its status is displayed.

After a policy is deleted or revoked, the application continues working with the settings specified in the policy. Those settings subsequently can be modified manually.

A policy is applied as follows: if a device is running resident tasks (real-time protection tasks), they keep running with the new setting values. Any periodic tasks (on-demand scan, update of application databases) that are started keep running with the values unchanged. Next time, they will be run with the new setting values.

Policies for applications with multitenancy support are inherited to lower-level administration groups as well as to upper-level administration groups: the policy is propagated to all client devices on which the application is installed.

If Administration Servers are structured hierarchically, secondary Administration Servers receive policies from the primary Administration Server and distribute them to client devices. When inheritance is enabled, policy settings can be modified on the primary Administration Server. After this, any changes made to the policy settings are propagated to inherited policies on secondary Administration Servers.

If the connection is terminated between the primary and secondary Administration Servers, the policy on the secondary Server continues, using the applied settings. Policy settings modified on the primary Administration Server are distributed to a secondary Administration Server after the connection is re-established.

If inheritance is disabled, policy settings can be modified on a secondary Administration Server independently from the primary Administration Server.

If the connection between Administration Server and a client device is interrupted, the client device starts running under the out-of-office policy (if it is defined), or the policy keeps running under the applied settings until the connection is re-established.

The results of policy distribution to the secondary Administration Server are displayed in the policy properties window of the console on the primary Administration Server.

The results of policy distribution to client devices are displayed in the policy properties window of the Administration Server to which they are connected.

Do not use private data in policy settings. For example, avoid specifying the domain administrator password.

In this section

Creating a policy

Displaying inherited policy in a subgroup

Activating a policy

Activating a policy automatically at the Virus outbreak event

Applying an out-of-office policy

Modifying a policy. Rolling back changes

Comparing policies

Viewing the policy distribution status chart

See also:

About multi-tenant applications

Page top

[Topic 3747]

Creating a policy

In Administration Console, you can create policies directly in the folder of the administration group for which a policy is to be created, or in the workspace of the Policies folder.

To create a policy in the folder of an administration group:

In the console tree, select an administration group for which you want to create a policy.
In the workspace of the group, select the Policies tab.
Run the New policy wizard by clicking the New policy button.

The New policy wizard starts. Follow the instructions of the wizard.

To create a policy in the workspace of the Policies folder:

In the console tree, select the Policies folder.
Run the New policy wizard by clicking the New policy button.

The New policy wizard starts. Follow the instructions of the wizard.

You can create several policies for one application from the group, but only one policy can be active at a time. When you create a new active policy, the previous active policy becomes inactive.

When creating a policy, you can specify a minimum set of parameters required for the application to function properly. All other values are set to the default values applied during the local installation of the application. You can change the policy after it is created.

Do not use private data in policy settings. For example, avoid specifying the domain administrator password.

Settings of Kaspersky applications that are changed after policies are applied are described in detail in their respective Guides.

After the policy is created, the settings locked from editing (marked with the lock icon ()) take effect on client devices regardless of which settings were previously specified for the application.

Page top

[Topic 3754]

Displaying inherited policy in a subgroup

To enable the display of inherited policies for a nested administration group:

In the console tree, select the administration group for which inherited policies have to be displayed.
In the workspace of the selected group, select the Policies tab.
In the context menu of the list of policies, select View → Inherited policies.

Inherited policies are displayed in the list of policies with the following icon:

—If they were inherited from a group created on the primary Administration Server.
—If they were inherited from a top-level group.

When the settings inheritance mode is enabled, inherited policies are only available for modification in the group in which they were created. Modification of inherited policies is not available in the group that inherits them.

Page top

[Topic 3755]

Activating a policy

To make a policy active for the selected group:

In the workspace of the group, on the Policies tab select the policy that you have to make active.
To activate the policy, perform one of the following actions:
- In the context menu of the policy, select Active policy.
- In the policy properties window open the General section and select Active policy from the Policy status settings group.

The policy becomes active for the selected administration group.

When a policy is applied to a large number of client devices, both the load on the Administration Server and the network traffic increase significantly for some time.

Page top

[Topic 3756]

Activating a policy automatically at the Virus outbreak event

To make a policy perform automatic activation at a Virus outbreak event:

In the Administration Server properties window, open the Virus outbreak section.
Open the Policy activation window by clicking the Configure policies to activate when a virus outbreak event occurs link and add the policy to the selected list of policies that are activated when a virus outbreak is detected.

If a policy has been activated on the Virus outbreak event, you can return to the previous policy only by using the manual mode.

See also

Scenario: Monitoring and reporting

Page top

[Topic 3757]

Applying an out-of-office policy

The out-of-office policy takes effect on a device if it is disconnected from the corporate network.

To apply an out-of-office policy:

In the policy properties window, open the General section and in the Policy status settings group, select Out-of-office policy.

The out-of-office policy will be applied to the devices if they are disconnected from the corporate network.

Page top

[Topic 130755]

Modifying a policy. Rolling back changes

To modify a policy:

In the console tree, select the Policies folder.
In the workspace of the Policies folder, select a policy and proceed to the policy properties window using the context menu.
Make the relevant changes.
Click Apply.

The changes made to the policy will be saved in the policy properties, in the Revision history section.

You can roll back changes made to the policy, if necessary.

To roll back changes made to the policy:

In the console tree, select the Policies folder.
Select the policy in which changes must to be rolled back, and proceed to the policy properties window using the context menu.
In the policy properties window, select the Revision history section.
In the list of policy revisions, select the number of the revision to which you need to roll back changes.
Click the Advanced button and select the Roll back value in the drop-down list.

Page top

[Topic 143897]

Comparing policies

You can compare two policies for a single managed application. After the comparison, you have a report that displays which policy settings match and which settings differ. For example, you may have to compare policies if different administrators in their respective offices have created multiple policies for a single managed application, or if a single top-level policy has been inherited by all local offices and modified for each office. You can compare policies in one of the following ways: by selecting one policy and comparing it to another, or by comparing any two policies from the list of policies.

You can only compare policies that have current revisions in the revision history.

To compare one policy to another:

In the console tree, select the Policies folder.
In the workspace of the Policies folder, select the policy that you require to compare to another.
In the context menu of the policy, select Compare policy to another policy.
In the Select policy window, select the policy to which your policy must be compared.
Click OK.

A report in HTML format is displayed for the comparison of the two policies for the same application.

To compare any two policies from the list of policies:

In the Policies folder, in the list of policies, use the Shift or Ctrl key to select two policies for a single managed application.
In the context menu, select Compare.

A report in HTML format is displayed for the comparison of the two policies for the same application.

The report on comparison of policy settings for Kaspersky Endpoint Security for Windows also provides details of the comparison of policy profiles. You can minimize the results of policy profile comparison. To minimize the section, click the arrow icon ( The Arrow Up icon. ) next to the section name.

Page top

[Topic 283023]

Viewing the policy distribution status chart

In Kaspersky Security Center, you can view the results of policy enforcement on each device.

To view the policy distribution status on each device:

In the workspace of the group, on the Policies tab select the policy for which you want to view the distribution status.
The chart on the right pane displays the overview of policy enforcement.
Click Details.
The Results of policy enforcement window opens.

You can export the results of policy enforcement to a CSV or TXT file.

Page top

[Topic 3758]

Deleting a policy

To delete a policy:

In the workspace of an administration group, on the Policies tab, select the policy that you want to delete.
Delete the policy in one of the following ways:
- By selecting Delete in the context menu of the policy.
- By clicking the Delete policy link in the information box for the selected policy.

Page top

[Topic 3759]

Copying a policy

To copy a policy:

In the workspace of the required group, on the Policies tab select a policy.
In the context menu of the policy, select Copy.
In the console tree, select a group to which you want to add the policy.
You can add a policy to the group from which it was copied.
From the context menu of the list of policies for the selected group, on the Policies tab select Paste.

The policy is copied with all its settings and is applied to the devices within the group to which it was copied. If you paste the policy into the same group from which it has been copied, the (<next sequence number>) index is automatically added to the policy name, for example: (1), (2).

An active policy becomes inactive while it is copied. If necessary, you can make it active.

Page top

[Topic 3762]

Exporting a policy

To export a policy:

Export a policy in one of the following ways:
- By selecting All tasks → Export in the context menu of the policy.
- By clicking the Export policy to file link in the information box for the selected policy.
In the Save as window that opens, specify the policy file name and path. Click the Save button.

Page top

[Topic 3763]

Importing a policy

To import a policy:

In the workspace of the relevant group, on the Policies tab select one of the following ways of importing policies:
- By selecting All tasks → Import in the context menu of the list of policies.
- By clicking the Import policy from file button in the management block for policy list.
In the window that opens, specify the path to the file from which you want to import a policy. Click the Open button.

The imported policy is displayed in the policy list. The settings and profiles of the policy are also imported. Regardless of the policy status that was selected during the export, the imported policy is inactive. You can change the policy status in the policy properties.

If the newly imported policy has a name identical to that of an existing policy, the name of the imported policy is expanded with the (<next sequence number>) index, for example: (1), (2).

Page top

[Topic 17335]

Converting policies

Kaspersky Security Center can convert policies from earlier versions of managed Kaspersky applications to the up-to-date versions of the same applications. Converted policies keep the current administrator's settings specified before the update, as well as include new settings from the up-to-date versions of the applications. If a policy is converted to an up-to-date version of a managed Kaspersky application, you cannot open the policy on an Administration Server that has an earlier version of the application plug-in installed. Management plug-ins for Kaspersky applications determine whether conversion is available for the policies of these applications. For information about converting policies for each supported Kaspersky application, refer to the relevant Help from the following list:

Kaspersky applications for workstations:
Kaspersky Industrial CyberSecurity:
Kaspersky applications for mobile devices:
- Kaspersky Endpoint Security for Android
- Kaspersky Security for iOS
Kaspersky applications for file servers:
Kaspersky applications for virtual machines:
- Kaspersky Security for Virtualization Light Agent
- Kaspersky Security for Virtualization Agentless
Kaspersky applications for mail systems and SharePoint / collaboration servers:
- Kaspersky Security for Linux Mail Server
- Kaspersky Security for Microsoft Exchange Servers
Kaspersky applications for detection of targeted attacks:
Kaspersky applications for KasperskyOS devices:
- Kaspersky IoT Secure Gateway
- Kaspersky Security Management Suite (plug-in for Kaspersky Thin Client)

To convert policies:

In the console tree, select the Administration Server for which you want to convert policies.
In the Administration Server context menu, select All Tasks → Policies and tasks batch conversion wizard.

The Policies and tasks batch conversion wizard starts. Follow the instructions of the wizard.

After the wizard completes, new policies are created that use the current administrator's settings of policies and the new settings from the up-to-date versions of Kaspersky applications.

Page top

[Topic 89258]

Managing policy profiles

Policy profile is a named collection of settings of a policy that is activated on a client device (computer or mobile device) when the device satisfies specified activation rules. Activation of a profile modifies the policy settings that were active on the device before the profile was activated. Those settings take values that have been specified in the profile.

Policy profiles are necessary for devices within a single administration group to run under different policy settings. For example, a situation may occur when policy settings have to be modified for some devices in an administration group. In this case, you can configure policy profiles for such a policy, which allows you to edit policy settings for selected devices in the administration group. For example, the policy prohibits running any GPS navigation software on all devices in the Users administration group. GPS navigation software is necessary only on a single device in the Users administration group—the device owned by the user employed as a courier. You can tag that device as simply "Courier" and reconfigure the policy profile so that it allows GPS navigation software to run only on the device tagged as "Courier", while preserving all the remaining policy settings. In this case, if a device tagged as "Courier" appears in the Users administration group, it will be allowed to run GPS navigation software. Running GPS navigation software will still be prohibited on other devices in the Users administration group unless they are tagged as "Courier", too.

Profiles are only supported by the following policies:

Policies of Kaspersky Endpoint Security for Windows
Policies of Kaspersky Endpoint Security for Mac
Policies of the Kaspersky Mobile Device Management plug-in ranging from version 10 Service Pack 1 to version 10 Service Pack 3 Maintenance Release 1
Policies of the Kaspersky Device Management for iOS plug-in
Policies of Kaspersky Security for Virtualization 5.1 Light Agent for Windows
Policies of Kaspersky Security for Virtualization 5.1 Light Agent for Linux

Policy profiles simplify the management of the client devices that the policies apply to:

The policy profile settings may differ from the policy settings.
You do not have to maintain and manually apply several instances of a single policy that differ only by a few settings.
You do not have to allocate a separate policy for out-of-office users.
You can export and import policy profiles, as well as create new policy profiles based on existing ones.
A single policy can have multiple active policy profiles. Only profiles that meet the activation rules effective on the device will be applied to that device.
Profiles are subject to the policy hierarchy. An inherited policy includes all profiles of the higher-level policy.

Priorities of profiles

Profiles that have been created for a policy are sorted in descending order of priority. For example, if profile X is higher in the list of profiles than profile Y, then X has a higher priority than the latter. Multiple profiles can be simultaneously applied to a single device. If values of a setting vary in different profiles, the value from the highest-priority profile will be applied on the device.

Profile activation rules

A policy profile is activated on a client device when an activation rule is triggered. Activation rules are a set of conditions that, when met, start the policy profile on a device. An activation rule can contain the following conditions:

Network Agent on a client device connects to the Administration Server that has a specified set of connection settings, such as Administration Server address, port number, and so forth.
The client device is offline.
The client device has been assigned specified tags.
The client device is explicitly (the device is immediately located in the specified unit) or implicitly (the device is located in a unit that is in the specified unit at any nesting level) located in a specific unit of Active Directory, the device or its owner is located in a security group of Active Directory.
The client device belongs to a specified owner, or the owner of the device is included in an internal security group of Kaspersky Security Center.
The owner of the client device has been assigned a specified role.

Policies in the hierarchy of administration groups

If you are creating a policy in a low-level administration group, this new policy inherits all profiles of the active policy from the higher-level group. Profiles with identical names are merged. Policy profiles for the higher-level group have the higher priority. For example, in administration group A, policy P(A) has profiles X1, X2, and X3 (in descending order of priority). In administration group B, which is a subgroup of group A, policy P(B) has been created with profiles X2, X4, X5. Then policy P(B) will be modified with policy P(A) so that the list of profiles in policy P(B) will appear as follows: X1, X2, X3, X4, X5 (in descending order of priority). The priority of profile X2 will depend on the initial state of X2 of policy P(B) and X2 of policy P(A). After the policy P(B) is created, the policy P(A) is no longer displayed in subgroup B.

The active policy is recalculated every time you run Network Agent, enable and disable offline mode, or edit the list of tags assigned to the client device. For example, the RAM size has been increased on the device, which, in turn, has activated the policy profile that is applied on devices with large RAM size.

Properties and restrictions of policy profiles

Profiles have the following properties:

Profiles of an inactive policy have no impact on client devices.
If a policy is set to the Out-of-office policy status, profiles of the policy will also be applied when a device is disconnected from the corporate network.
Profiles do not support static analysis of access to executable files.
A policy profile cannot contain any settings of event notifications.
If UDP port 15000 is used for connecting a device to Administration Server, the corresponding policy profile is activated within one minute after you assign a tag to the device.
You can use rules for Network Agent connection to the Administration Server, when you create policy profile activation rules.

Page top

[Topic 89259]

Creating a policy profile

Profile creation is available only for the policies of the following applications:

Kaspersky Endpoint Security 10 Service Pack 1 for Windows and later versions
Kaspersky Endpoint Security 10 Service Pack 1 for Mac
Kaspersky Mobile Device Management plug-in versions 10 Service Pack 1 to 10 Service Pack 3 Maintenance Release 1
Kaspersky Device Management for iOS plug-in
Kaspersky Security for Virtualization 5.1 Light Agent for Windows and Linux

To create a policy profile:

In the console tree, select the administration group for whose policy you have to create a policy profile.
In the workspace of the administration group, select the Policies tab.
Select a policy and switch to the policy properties window using the context menu.
Open the Policy profiles section in the policy properties window and click the Add button.
The New policy profile wizard starts.
In the Policy profile name window of the wizard, specify the following:
1. Name of the policy profile
  The profile name cannot include more than 100 characters.
2. Policy profile status (Enabled or Disabled)
  We recommend that you create and enable inactive policy profiles only after you are completely finished with the settings and conditions of policy profile activation.
Select the After closing the New policy profile wizard, proceed to configuring the policy profile activation rule check box to start the New policy profile activation rule wizard. Follow the wizard steps.
Edit the policy profile settings in the policy profile properties window, in the way you require.
Save the changes by clicking OK.
The profile is saved. The profile will be activated on devices that meet the activation rules.

You can create multiple profiles for a single policy. Profiles that have been created for a policy are displayed in the policy properties, in the Policy profiles section. You can modify a policy profile and change the profile priority, as well as remove the profile.

Page top

[Topic 89260]

Modifying a policy profile

Editing the settings of a policy profile

The capability to edit a policy profile is only available for policies of Kaspersky Endpoint Security for Windows.

To modify a policy profile:

In the console tree, select the administration group for which the policy profile has to be modified.
In the workspace of the group, select the Policies tab.
Select a policy and switch to the policy properties window using the context menu.
Open the Policy profiles section in the policy properties.
This section contains a list of profiles that have been created for the policy. Profiles are displayed in the list in accordance with their priorities.
Select a policy profile and click the Properties button.
Configure the profile in the properties window:
- If necessary, in the General section, change the profile name and enable or disable the profile using the Enable profile check box.
- In the Activation rules section, edit the profile activation rules.
- Edit the policy settings in the corresponding sections.
Click OK.

The modified settings will take effect either after the device is synchronized with the Administration Server (if the policy profile is active), or after an activation rule is triggered (if the policy profile is inactive).

Changing the priority of a policy profile

The priorities of policy profiles define the activation order of profiles on a client device. Priorities are used if identical activation rules are set for different policy profiles.

For example, two policy profiles have been created: Profile 1 and Profile 2 that differ by the respective values of a single setting (Value 1 and Value 2). The priority of Profile 1 is higher than that of Profile 2. Moreover, there are also profiles with priorities that are lower than that of Profile 2. The activation rules for those profiles are identical.

When an activation rule is triggered, Profile 1 will be activated. The setting on the device will take Value 1. If you remove Profile 1, then Profile 2 will have the highest priority, so the setting will take Value 2.

On the list of policy profiles, profiles are displayed in accordance with their respective priorities. The profile with the highest priority is ranked first. You can change the priority of a profile by using the up arrow The icon of an upward-directed blue arrow. and the down arrow The icon of a downward-directed blue arrow. buttons.

Page top

[Topic 89262]

Deleting a policy profile

To delete a policy profile:

In the console tree, select the administration group whose policy profile you want to delete.
In the workspace of the administration group, select the Policies tab.
Select a policy and switch to the policy properties window using the context menu.
Open the Policy profiles section in the properties of the policy of Kaspersky Endpoint Security.
Select the policy profile that you want to delete and click the Delete button.

The policy profile will be deleted. The active status will pass either to another policy profile whose activation rules are triggered on the device, or to the policy.

Page top

[Topic 144953]

Creating a policy profile activation rule

Expand all | Collapse all

To create a policy profile activation rule:

In the console tree, select the administration group for which you have to create a policy profile activation rule.
In the workspace of the group, select the Policies tab.
Select a policy and switch to the policy properties window using the context menu.
Select the Policy profiles section in the policy properties window.
Select the policy profile for which you need to create an activation rule, and click the Properties button.
The policy profile properties window opens.

If the list of policy profiles is empty, you can create a policy profile.
Select the Activation rules section, and click the Add button.
The New policy profile activation rule wizard starts.
In the Policy profile activation rules window, select the check boxes next to the conditions that must affect activation of the policy profile that you are creating:
- General rules for policy profile activation
  Select this check box to set up policy profile activation rules on the device depending on the status of the device offline mode, rule for connection to Administration Server, and tags assigned to the device.
- Rules for Active Directory usage
  Select this check box to set up rules for policy profile activation on the device depending on the presence of the device in an Active Directory organizational unit (OU), or on membership of the device (or its owner) in an Active Directory security group.
- Rules for a specific device owner
  Select this check box to set up rules for policy profile activation on the device depending on the device owner.
- Rules for hardware specifications
  Select this check box to set up rules for policy profile activation on the device depending on the memory volume and the number of logical processors.
The number of additional pages of the wizard depends on the settings that you select at the first step. You can modify policy profile activation rules later.
In the General conditions window, specify the following settings:
- In the Device is offline field, in the drop-down list specify the condition for device presence on the network:
  - Yes
    The device is in an external network, which means that the Administration Server is not available.
  - No
    The device is on the network, so the Administration Server is available.
  - No value is selected
    The criterion will not be applied.
- In the The device is in the specified network location box, use the drop-down lists to set up the policy profile activation if the Administration Server connection rule is executed / not executed on this device:
  - Executed / Not executed
    Condition of policy profile activation (whether the rule is executed or not).
  - Rule name
    Network location description of the device for connection to the Administration Server, whose conditions must be met (or must not be met) for activation of the policy profile.
    
    A network location description of devices for connection to an Administration Server can be created or configured in a Network Agent switching rule.
The General conditions window is displayed if the General rules for policy profile activation check box is selected.
In the Conditions using tags window, specify the following settings:
- Tag list
  In the list of tags, specify the rule for device inclusion in the policy profile by selecting the check boxes next to the relevant tags.
  
  You can add new tags to the list by entering them in the field over the list and clicking the Add button.
  
  The policy profile includes devices with descriptions containing all the selected tags. If check boxes are cleared, the criterion is not applied. By default, these check boxes are cleared.
- Apply to devices without the specified tags
  Enable this option if you have to invert your selection of tags.
  
  If this option is enabled, the policy profile includes devices with descriptions that contain none of the selected tags. If this option is disabled, the criterion is not applied.
  
  By default, this option is disabled.
The Conditions using tags window is displayed if the General rules for policy profile activation check box is selected.
In the Conditions using Active Directory window, specify the following settings:
- Device owner's membership in Active Directory security group
  If this option is enabled, the policy profile is activated on the device whose owner is a member of the specified security group. If this option is disabled, the profile activation criterion is not applied. By default, this option is disabled.
- Device membership in Active Directory security group
  If this option is enabled, the policy profile is activated on the device. If this option is disabled, the profile activation criterion is not applied. By default, this option is disabled.
- Device allocation in Active Directory organizational unit
  If this option is enabled, the policy profile is activated on the device which is included in the specified Active Directory organizational unit (OU). If this option is disabled, the profile activation criterion is not applied.
  
  By default, this option is disabled.
The Conditions using Active Directory window is displayed if the Rules for Active Directory usage check box is selected.
In the Conditions using the device owner window, specify the following settings:
- Device owner
  Enable this option to configure and enable the rule for profile activation on the device according to its owner. In the drop-down list under the check box, you can select a criterion for the profile activation:
  - The device belongs to the specified owner ("=" sign).
  - The device does not belong to the specified owner ("#" sign).
    If this option is enabled, the profile is activated on the device in accordance with the criterion configured. You can specify the device owner when the option is enabled. If this option is disabled, the profile activation criterion is not applied. By default, this option is disabled.
- The device owner is included in an internal security group
  Enable this option to configure and enable the rule of profile activation on the device by the owner's membership in an internal security group of Kaspersky Security Center. In the drop-down list under the check box, you can select a criterion for the profile activation:
  - The device owner is a member of the specified security group ("=" sign).
  - The device owner is not a member of the specified security group ("#" sign).
    If this option is enabled, the profile is activated on the device in accordance with the criterion configured. You can specify a security group of Kaspersky Security Center. If this option is disabled, the profile activation criterion is not applied. By default, this option is disabled.
- Activate policy profile by specific role of device owner
  Select this option to configure and enable the rule of profile activation on the device depending on the owner's role. Add the role manually from the list of existing roles.
  
  If this option is enabled, the profile is activated on the device in accordance with the criterion configured.
The Conditions using the device owner window is displayed if the Rules for a specific device owner check box is selected.
In the Conditions using equipment specifications window, specify the following settings:
- RAM size, in MB
  Enable this option to configure and enable the rule of profile activation on the device by the RAM volume available on that device. In the drop-down list under the check box, you can select a criterion for the profile activation:
  - The device RAM size is less than the specified value ("<" sign).
  - The device RAM size is greater than the specified value (">" sign).
  If this option is enabled, the profile is activated on the device in accordance with the criterion configured. You can specify the RAM volume on the device. If this option is disabled, the profile activation criterion is not applied. By default, this option is disabled.
- Number of logical processors
  Enable this option to configure and enable the rule of profile activation on the device by the number of logical processors on that device. In the drop-down list under the check box, you can select a criterion for the profile activation:
  - The number of logical processors on the device is less than or equal to the specified value ("<" sign).
  - The number of logical processors on the device is greater than or equal to the specified value (">" sign).
  If this option is enabled, the profile is activated on the device in accordance with the criterion configured. You can specify the number of logical processors on the device. If this option is disabled, the profile activation criterion is not applied. By default, this option is disabled.
The Conditions using equipment specifications window is displayed if the Rules for hardware specifications check box is selected.
In the Name of policy profile activation rule window, in the Rule name field, specify a name for the rule.

The profile will be saved. The profile will be activated on the device when activation rules are triggered.

Policy profile activation rules created for the profile are displayed in the policy profile properties in the Activation rules section. You can modify or remove any policy profile activation rule.

Multiple activation rules can be triggered simultaneously.

Page top

[Topic 92437]

Device moving rules

We recommend that you automate the allocation of devices to administration groups by using device moving rules. A device moving rule consists of three main parts: a name, an execution condition (a logical expression with the device attributes), and a target administration group. A rule moves a device to the target administration group if the device attributes meet the rule execution condition.

All device moving rules have priorities. The Administration Server checks whether the device attributes meet the execution condition of each rule, in ascending order of priority. If the device attributes meet the execution condition of a rule, the device is moved to the target group, so the rule processing is complete for this device. If the device attributes meet the conditions of multiple rules, the device is moved to the target group of the rule with the highest priority (that is, has the highest rank in the list of rules).

Device moving rules can be created implicitly. For example, in the properties of an installation package or a remote installation task, you can specify the administration group to which the device must be moved after Network Agent is installed on it. Also, device moving rules can be created explicitly by the administrator of Kaspersky Security Center, in the list of moving rules. The list is located in Administration Console, in the properties of the Unassigned devices group.

By default, a device moving rule is intended for a one-time initial allocation of devices to administration groups. The rule moves devices from the Unassigned devices group only once. If a device once was moved by this rule, the rule will never move it again, even if you return the device to the Unassigned devices group manually. This is the recommended way of applying moving rules.

You can move devices that have already been allocated to some of the administration groups. To do this, in the properties of a rule, clear the Move only devices that do not belong to an administration group check box.

Applying moving rules to devices that have already been allocated to some of the administration groups significantly increases the load on the Administration Server.

The Move only devices that do not belong to an administration group check box is locked in the properties of automatically created moving rules. Such rules are created when you add the Install application remotely task or create a stand-alone installation package.

You can create a moving rule that would affect a single device repeatedly.

We strongly recommend that you avoid moving a single device from one group to another repeatedly (for example, in order to apply a special policy to that device, run a special group task, or update the device through a specific distribution point).

Such scenarios are not supported because they increase the load on Administration Server and network traffic to an extreme degree. These scenarios also conflict with the operating principles of Kaspersky Security Center (particularly in the area of access rights, events, and reports). Another solution must be found, for example, through the use of policy profiles, tasks for device selections, assignment of Network Agents according to the standard scenario.

See also:

Scenario: Discovering networked devices

Main installation scenario

Creating rules for moving devices to administration groups automatically

Page top

[Topic 171107]

Cloning device moving rules

When you have to create multiple device-moving rules with similar settings, you can clone an existing rule and then change the settings of the cloned rule. For example, this is useful when you must have several identical device-moving rules with different IP ranges and target groups.

To clone a device moving rule:

Open the main application window.
In the Unassigned devices folder, click Configure rules.
The Properties: Unassigned devices window opens.
In the Move devices section, select the device moving rule that you want to clone.
Click Clone rule.

A clone of the selected device moving rule will be added at the end of the list.

A new rule is created in the disabled state. You can edit and enable the rule at any time.

Page top

[Topic 92438]

Software categorization

The main tool for monitoring the running of applications are Kaspersky categories (hereinafter also referred to as KL categories). KL categories help Kaspersky Security Center administrators to simplify the support of software categorization and minimize traffic going to managed devices.

User categories must only be created for applications that cannot be classified in any of the existing KL categories (for example, for custom-made software). User categories are created on the basis of an application installation package (MSI) or a folder with installation packages.

If a large collection of software is available, which has not been categorized through KL categories, it may be useful to create an automatically updated category. The checksums of executable files will be automatically added to this category on every modification of the folder containing distribution packages.

Do not create automatically updated categories of software for the folders My Documents, %windir%, %ProgramFiles%, and %ProgramFiles(x86)%. The pool of files in these folders is subject to frequent changes, which leads to an increased load on Administration Server and increased network traffic. You must create a dedicated folder with the collection of software and periodically add new items to it.

Page top

[Topic 38045]

Prerequisites for installing applications on devices of a client organization

The process of remote installation of applications on devices of a client organization is identical to the remote installation process within an enterprise.

To install applications on devices of a client organization, the following actions must be performed:

Before installing applications on devices of the client organization for the first time, install Network Agent on them.
When configuring the Network Agent installation package by the service provider, in Kaspersky Security Center, adjust the following settings in the properties window of the installation package:
- In the Connection section, in the Administration Server string, specify the address of the same virtual Administration Server that was specified during local installation of Network Agent on the distribution point.
- In the Advanced section, select the Connect to Administration Server by using a connection gateway check box. In the Connection gateway address string, specify the distribution point address. You can use either the device IP address or device name in the Windows network.
Select Using operating system resources through distribution points as the download method for the Network Agent installation package. You can select the download method as follows:
- If you install application by using the remote installation task, you can specify the download method in one of the following ways:
  - When creating a remote installation task in the Settings window
  - In the remote installation task properties window, through the Settings section
- If you install applications using the Remote installation wizard, you can select the download method in the Settings window of this wizard.
The account used by the distribution point for authorization must have access to the Admin$ resource on all client devices.

Page top

[Topic 3764]

Viewing and editing local application settings

The Kaspersky Security Center administration system allows you to remotely manage local application settings on devices through Administration Console.

Local application settings are the settings of an application that are specific for a device. You can use Kaspersky Security Center to set local application settings for devices included in administration groups.

Detailed descriptions of settings of Kaspersky applications are provided in respective Guides.

To view or change the local settings of an application:

In the workspace of the group to which the relevant device belongs, select the Devices tab.
In the device properties window, in the Applications section, select the relevant application.
Open the application properties window by double-clicking the application name or by clicking the Properties button.

The local settings window of the selected application opens so that you can view and edit those settings.

You can change the values of settings that have not been barred from modification by a group policy (that is, those not marked with the lock icon () in a policy).

Page top

[Topic 179056]

Updating Kaspersky Security Center and managed applications

This section describes steps you must take to update Kaspersky Security Center and managed applications.

In this section

Scenario: Regular updating Kaspersky databases and applications

About updating Kaspersky databases, software modules, and applications

About using diff files for updating Kaspersky databases and software modules

Enabling the Downloading diff files feature

Creating the task for downloading updates to the repository of the Administration Server

Creating the Download updates to the repositories of distribution points task

Configuring the Download updates to the repository of the Administration Server task

Verifying downloaded updates

Configuring test policies and auxiliary tasks

Viewing downloaded updates

Automatic installation of Kaspersky Endpoint Security updates on devices

Offline model of update download

Enabling and disabling the offline model of update download

Automatic updating and patching for Kaspersky Security Center components

Enabling and disabling automatic updating and patching for Kaspersky Security Center components

Automatic distribution of updates

Deleting software updates from the repository

Patch installation for a Kaspersky application in cluster mode

Page top

[Topic 180689]

Scenario: Regular updating Kaspersky databases and applications

This section provides a scenario for regular updating of Kaspersky databases, software modules, and applications. After you complete the Configuring network protection scenario, you must maintain the reliability of the protection system to make sure that the Administration Servers and managed devices are kept protected against various threats, including viruses, network attacks, and phishing attacks.

Network protection is kept up-to-date by regular updates of the following:

Kaspersky databases and software modules
Installed Kaspersky applications, including Kaspersky Security Center components and security applications

When you complete this scenario, you can be sure of the following:

Your network is protected by the most recent Kaspersky software, including Kaspersky Security Center components and security applications.
The anti-virus databases and other Kaspersky databases critical for the network safety are always up-to-date.

Prerequisites

The managed devices must have a connection to the Administration Server. If they do not have a connection, consider updating Kaspersky databases, software modules, and applications manually or directly from the Kaspersky update servers.

Administration Server must have a connection to the internet.

Before you start, make sure that you have done the following:

Deployed the Kaspersky security applications to the managed devices according to the scenario of deploying Kaspersky applications through Kaspersky Security Center Web Console.
Created and configured all required policies, policy profiles, and tasks according to the scenario of configuring network protection.
Assigned an appropriate amount of distribution points in accordance with the number of managed devices and the network topology.

Updating Kaspersky databases and applications proceeds in stages:

Choosing an update scheme
There are several schemes that you can use to install updates to Kaspersky Security Center components and security applications. Choose the scheme or several schemes that meet the requirements of your network best.
Creating the task for downloading updates to the repository of the Administration Server
This task is created automatically by the Kaspersky Security Center quick start wizard. If you did not run the wizard, create the task now.

This task is required to download updates from Kaspersky update servers to the repository of the Administration Server, as well as to update Kaspersky databases and software modules for Kaspersky Security Center. After the updates are downloaded, they can be propagated to the managed devices.

If your network has assigned distribution points, the updates are automatically downloaded from the Administration Server repository to the repositories of the distribution points. In this case the managed devices included in the scope of a distribution point download the updates from the repository of the distribution point instead of the Administration Server repository.

How-to instructions:
- Administration Console: Creating the task for downloading updates to the repository of the Administration Server
- Kaspersky Security Center Web Console: Creating the task for downloading updates to the repository of the Administration Server
Creating the task for downloading updates to the repositories of distribution points (optional)
By default, the updates are downloaded to the distribution points from the Administration server. You can configure Kaspersky Security Center to download the updates to the distribution points directly from Kaspersky update servers. Download to the repositories of distribution points is preferable if the traffic between the Administration Server and the distribution points is more expensive than the traffic between the distribution points and Kaspersky update servers, or if your Administration Server does not have internet access.

When your network has assigned distribution points and the Download updates to the repositories of distribution points task is created, the distribution points download updates from Kaspersky update servers, and not from the Administration Server repository.

How-to instructions:
- Administration Console: Creating the task for downloading updates to the repositories of distribution points
- Kaspersky Security Center Web Console: Creating the task for downloading updates to the repositories of distribution points
Configuring distribution points
When your network has assigned distribution points, make sure that the Deploy updates option is enabled in the properties of all required distribution points. When this option is disabled for a distribution point, the devices included in the scope of the distribution point download updates from the repository of the Administration Server.

If you want the managed devices to receive updates only from the distribution points, enable the Distribute files through distribution points only option in the Network Agent policy.
Optimizing the update process by using the offline model of update download or diff files (optional)
You can optimize the update process by using the offline model of update download (enabled by default) or by using diff files. For each network segment, you have to choose which of these two features to enable, because they cannot work simultaneously.

When the offline model of update download is enabled, Network Agent downloads the required updates to the managed device once the updates are downloaded to the Administration Server repository, before the security application requests the updates. This enhances the reliability of the update process. To use this feature, enable the Download updates and anti-virus databases from Administration Server in advance (recommended) option in the Network Agent policy.

If you do not use the offline model of update download, you can optimize traffic between the Administration Server and the managed devices by using diff files. When this feature is enabled, the Administration Server or a distribution point downloads diff files instead of entire files of Kaspersky databases or software modules. A diff file describes the differences between two versions of a file of a database or software module. Therefore, a diff file occupies less space than an entire file. This results in decrease in the traffic between the Administration Server or distribution points and the managed devices. To use this feature, enable the Download diff files option in the properties of the Download updates to the Administration Server repository task and/or the Download updates to the repositories of distribution points task.

How-to instructions:
- Using diff files for updating Kaspersky databases and software modules
- Administration Console: Enabling and disabling the offline model of update download
- Kaspersky Security Center Web Console: Enabling and disabling the offline model of update download
Verifying downloaded updates (optional)
Before installing the downloaded updates, you can verify the updates through the Update verification task. This task sequentially runs the device update tasks and malware scan tasks configured through settings for the specified collection of test devices. Upon obtaining the task results, the Administration Server starts or blocks the update propagation to the remaining devices.

The Update verification task can be performed as part of the Download updates to the repository of the Administration Server task. In the properties of the Download updates to the repository of the Administration Server task, enable the Verify updates before distributing option in the Administration Console or the Run update verification option in Kaspersky Security Center Web Console.

How-to instructions:
- Administration Console: Verifying downloaded updates
- Kaspersky Security Center Web Console: Verifying downloaded updates
Approving and declining software updates
By default, the downloaded software updates have the Undefined status. You can change the status to Approved or Declined. The approved updates are always installed. If an update requires reviewing and accepting the terms of the End User License Agreement, then you first need to accept the terms. After that the update can be propagated to the managed devices. The undefined updates can only be installed on Network Agent and other Kaspersky Security Center components in accordance with the Network Agent policy settings. The updates for which you set Declined status will not be installed on devices. If a declined update for a security application was previously installed, Kaspersky Security Center will try to uninstall the update from all devices. Updates for Kaspersky Security Center components cannot be uninstalled.

How-to instructions:
- Administration Console: Approving and declining software updates
- Kaspersky Security Center Web Console: Approving and declining software updates
Configuring automatic installation of updates and patches for Kaspersky Security Center components
The downloaded updates and patches for Network Agent and other Kaspersky Security Center components are installed automatically. If you have left the Automatically install applicable updates and patches for components that have the Undefined status option enabled in the Network Agent properties, then all updates will be installed automatically after they are downloaded to the repository (or several repositories). If this option is disabled, Kaspersky patches that have been downloaded and tagged with the Undefined status will be installed only after you change their status to Approved.

How-to instructions:
- Administration Console: Enabling and disabling automatic updating and patching for Kaspersky Security Center components
- Kaspersky Security Center Web Console: Enabling and disabling automatic updating and patching for Kaspersky Security Center components
Installation of updates for the Administration Server
Software updates for the Administration Server do not depend on the update statuses. They are not installed automatically and must be preliminarily approved by the administrator on the Monitoring tab in the Administration Console (Administration Server <server name> → Monitoring) or on the Notifications section in Kaspersky Security Center Web Console (Monitoring & reporting → Notifications). After that, the administrator must explicitly run installation of the updates.
Configuring automatic installation of updates for the security applications
Create the Update tasks for the managed applications to provide timely updates to the applications, software modules and Kaspersky databases, including anti-virus databases. To ensure timely updates, we recommend that you select the When new updates are downloaded to the repository option when configuring the task schedule.

If your network includes IPv6-only devices and you want to regularly update the security applications installed on these devices, make sure that the Administration Server (version no earlier than 13.2) and the Network Agent (version no earlier than 13.2) are installed on managed devices.

By default, updates for Kaspersky Endpoint Security for Windows and Kaspersky Endpoint Security for Linux are installed only after you change the update status to Approved. You can change the update settings in the Update task.

If an update requires reviewing and accepting the terms of the End User License Agreement, then you first need to accept the terms. After that the update can be propagated to the managed devices.

How-to instructions:
- Administration Console: Automatic installation of Kaspersky Endpoint Security updates on devices
- Kaspersky Security Center Web Console: Automatic installation of Kaspersky Endpoint Security updates on devices

Results

Upon completion of the scenario, Kaspersky Security Center is configured to update Kaspersky databases and installed Kaspersky applications after the updates are downloaded to the repository of the Administration Server or to the repositories of distribution points. You can then proceed to monitoring the network status.

Page top

[Topic 46875]

About updating Kaspersky databases, software modules, and applications

To be sure that the protection of your Administration Servers and managed devices is up-to-date, you must provide timely updates of the following:

Kaspersky databases and software modules

Before downloading Kaspersky databases and software modules, Kaspersky Security Center checks if Kaspersky servers are accessible. If access to the servers using system DNS is not possible, the application uses public DNS servers. This is necessary to make sure anti-virus databases are updated and the level of security is maintained for the managed devices.

Installed Kaspersky applications, including Kaspersky Security Center components and security applications

Depending on the configuration of your network, you can use the following schemes of downloading and distributing the required updates to the managed devices:

By using a single task: Download updates to the Administration Server repository
By using two tasks:
- The Download updates to the Administration Server repository task
- The Download updates to the repositories of distribution points task
Manually through a local folder, a shared folder, or an FTP server
Directly from Kaspersky update servers to Kaspersky Endpoint Security on the managed devices
Through a local or network folder if Administration Server has no internet connection

Using the Download updates to the Administration Server repository task

In this scheme, Kaspersky Security Center downloads updates through the Download updates to the Administration Server repository task. In small networks that contain less than 300 managed devices in a single network segment or less than 10 managed devices in each network segment, the updates are distributed to the managed devices directly from the Administration Server repository (see figure below).

Downloading updates to the Administration Server repository task without distribution points.

Updating by using the Download updates to the Administration Server repository task without distribution points

By default, the Administration Server communicates with Kaspersky update servers and downloads updates by using the HTTPS protocol. You can configure the Administration Server to use the HTTP protocol instead of HTTPS.

If your network contains more than 300 managed devices in a single network segment or if your network consists of several network segments with more than 9 managed devices in each network segment, we recommend that you use distribution points to propagate the updates to the managed devices (see figure below). Distribution points reduce the load on the Administration Server and optimize traffic between the Administration Server and the managed devices. You can calculate the number and configuration of distribution points required for your network.

In this scheme, the updates are automatically downloaded from the Administration Server repository to the repositories of the distribution points. The managed devices included in the scope of a distribution point download the updates from the repository of the distribution point instead of the Administration Server repository.

The Administration server update by downloading updates to the Administration Server repository.

Updating by using the Download updates to the Administration Server repository task with distribution points

When the Download updates to the Administration Server repository task is complete, the following updates are downloaded to the Administration Server repository:

Kaspersky databases and software modules for Kaspersky Security Center
These updates are installed automatically.
Kaspersky databases and software modules for the security applications on the managed devices
These updates are installed through the Update task for Kaspersky Endpoint Security for Windows.
Updates for the Administration Server
These updates are not installed automatically. The administrator must explicitly approve and run installation of the updates.

Local administrator rights are required for installing patches on the Administration Server.
Updates for the components of Kaspersky Security Center
By default, these updates are installed automatically. You can change the settings in the Network Agent policy.
Updates for the security applications
By default, Kaspersky Endpoint Security for Windows installs only those updates that you approve. (You can approve updates via the Administration Console or via Kaspersky Security Center Web Console). The updates are installed through the Update task and can be configured in the properties of this task.

The Download updates to the repository of the Administration Server task is not available on virtual Administration Servers. The repository of the virtual Administration Server displays updates downloaded to the primary Administration Server.

You can configure the updates to be verified for operability and errors on a set of test devices. If the verification is successful, the updates are distributed to other managed devices.

Each Kaspersky application requests required updates from Administration Server. Administration Server aggregates these requests and downloads only those updates that are requested by any application. This ensures that the same updates are not downloaded multiple times and that unnecessary updates are not downloaded at all. When running the Download updates to the Administration Server repository task, Administration Server sends the following information to Kaspersky update servers automatically in order to ensure the downloading of relevant versions of Kaspersky databases and software modules:

Application ID and version
Application installation ID
Active key ID
Download updates to the repository of the Administration Server task run ID

None of the transmitted information contains personal or other confidential data. AO Kaspersky Lab protects information in accordance with requirements established by law.

Using two tasks: the Download updates to the Administration Server repository task and the Download updates to the repositories of distribution points task

You can download updates to the repositories of distribution points directly from the Kaspersky update servers instead of the Administration Server repository, and then distribute the updates to the managed devices (see figure below). Download to the repositories of distribution points is preferable if the traffic between the Administration Server and the distribution points is more expensive than the traffic between the distribution points and Kaspersky update servers, or if your Administration Server does not have internet access.

The Administration server update by downloading updates to repositories of distribution points.

Updating by using the Download updates to the Administration Server repository task and the Download updates to the repositories of distribution points task

By default, the Administration Server and distribution points communicate with Kaspersky update servers and download updates by using the HTTPS protocol. You can configure the Administration Server and/or distribution points to use the HTTP protocol instead of HTTPS.

To implement this scheme, create the Download updates to the repositories of distribution points task in addition to the Download updates to the Administration Server repository task. After that the distribution points will download updates from Kaspersky update servers, and not from the Administration Server repository.

Distribution point devices running macOS cannot download updates from Kaspersky update servers.

If one or more devices running macOS are within the scope of the Download updates to the repositories of distribution points task, the task completes with the Failed status, even if it has successfully completed on all Windows devices.

The Download updates to the Administration Server repository task is also required for this scheme, because this task is used to download Kaspersky databases and software modules for Kaspersky Security Center.

Manually through a local folder, a shared folder, or an FTP server

If the client devices do not have a connection to the Administration Server, you can use a local folder or a shared resource as a source for updating Kaspersky databases, software modules, and applications. In this scheme, you need to copy required updates from the Administration Server repository to a removable drive, then copy the updates to the local folder or the shared resource specified as an update source in the settings of Kaspersky Endpoint Security (see figure below).

Update using a local folder or a shared resource.

Updating through a local folder, a shared folder, or an FTP server

For more information about sources of updates in Kaspersky Endpoint Security, see the following Helps:

Directly from Kaspersky update servers to Kaspersky Endpoint Security on the managed devices

On the managed devices, you can configure Kaspersky Endpoint Security to receive updates directly from Kaspersky update servers (see figure below).

Direct update from update servers.

Updating security applications directly from Kaspersky update servers

In this scheme, the security application does not use the repositories provided by Kaspersky Security Center. To receive updates directly from Kaspersky update servers, specify Kaspersky update servers as an update source in the interface of the security application. For more information about these settings, see the following Helps:

Through a local or network folder if Administration Server has no internet connection

If Administration Server has no internet connection, you can configure the Download updates to the Administration Server repository task to download updates from a local or network folder. In this case, you must copy the required update files to the specified folder from time to time. For example, you can copy the required update files from one of the following sources:

Administration Server that has an internet connection (see the figure below)
Because an Administration Server downloads only the updates that are requested by the security applications, the sets of security applications managed by the Administration Servers—the one that has an internet connection and the one that does not—must match.

If the Administration Server that you use to download updates has version 13.2 or earlier, open properties of the Download updates to the Administration Server repository task, and then enable the Download updates by using the old scheme option.

Updating through a local or network folder if Administration Server has no internet connection
Kaspersky Update Utility
Because this utility uses the old scheme to download updates, open properties of the Download updates to the Administration Server repository task, and then enable the Download updates by using the old scheme option.

Page top

[Topic 175487]

About using diff files for updating Kaspersky databases and software modules

When Kaspersky Security Center downloads updates from Kaspersky update servers, it optimizes traffic by using diff files. You can also enable the usage of diff files by devices (Administration Servers, distribution points, and client devices) that take updates from other devices on your network.

About the Downloading diff files feature

A diff file describes the differences between two versions of a file of a database or software module. The usage of diff files saves traffic inside your company's network because diff files occupy less space than entire files of databases and software modules. If the Downloading diff files feature is enabled on Administration Server or a distribution point, the diff files are saved on this Administration Server or distribution point. As a result, devices that take updates from this Administration Server or distribution point can use the saved diff files to update their databases and software modules.

To optimize the usage of diff files, we recommend that you synchronize the update schedule of devices with the update schedule of the Administration Server or distribution point from which the devices take updates. However, the traffic can be saved even if devices are updated several times less often than are the Administration Server or distribution point from which the devices take updates.

The Downloading diff files feature can be enabled only on Administration Servers and distribution points of versions starting from version 11. To save diff files on Administration Servers and distribution points of earlier versions, upgrade them to version 11 or later.

The Downloading diff files feature is incompatible with the offline model of update download. This means that Network Agents that use the offline model of update download do not download diff files even if the Downloading diff files feature is enabled on the Administration Server or distribution point that delivers updates to these Network Agents.

Distribution points do not use IP multicasting for automatic distribution of diff files.

Enabling the Downloading diff files feature

Page top

[Topic 219783]

Enabling the Downloading diff files feature

Prerequisites

Prerequisites for the scenario are as follows:

Administration Servers and distribution points are upgraded to version 11 or later.
Offline model of update download is disabled in the settings of the Network Agent policy.

Stages

Enabling the feature on Administration Server
Enable the feature in the settings of a Download updates to the repository of the Administration Server task.
Enabling the feature for a distribution point
Enable the feature for a distribution point that receives updates by means of a Download updates to the repositories of distribution points task.

Then enable the feature for a distribution point that receives updates from Administration Server.

The feature is enabled in the Network Agent policy settings and—if the distribution points are assigned manually and if you want to override policy settings—in the Distribution points section of the Administration Server properties.

To check that the Downloading diff files feature is successfully enabled, you can measure the internal traffic before and after you perform the scenario.

Scenario: Regular updating Kaspersky databases and applications

About updating Kaspersky databases, software modules, and applications

Page top

[Topic 3411]

Creating the task for downloading updates to the repository of the Administration Server

Expand all | Collapse all

The Download updates to the repository of the Administration Server task of the Administration Server is created automatically by the Kaspersky Security Center quick start wizard. You can create only one Download updates to the repository of the Administration Server task. Therefore, you can create a Download updates to the repository of the Administration Server task only if this task was removed from the Administration Server tasks list.

To create a Download updates to the repository of the Administration Server task:

In the console tree, select the Tasks folder.
Start creation of the task in one of the following ways:
- In the context menu of the Tasks folder in the console tree, select New → Task.
- In the workspace of the Tasks folder, click the Create a task button.
The New task wizard starts. Follow the steps of the wizard.
On the Select the task type page of the wizard, select Download updates to the Administration Server repository.
On the Settings page of the wizard, specify the task settings as follows:
- Sources of updates
  The following resources can be used as a source of updates for the Administration Server:
  - Kaspersky update servers
    HTTP(S) servers at Kaspersky from which Kaspersky applications download database and application module updates. By default, the Administration Server communicates with Kaspersky update servers and downloads updates by using the HTTPS protocol. You can configure the Administration Server to use the HTTP protocol instead of HTTPS.
    
    Selected by default.
  - Primary Administration Server
    This resource applies to tasks created for a secondary or virtual Administration Server.
  - Local or network folder
    A local or network folder that contains the latest updates. A network folder can be an FTP or HTTP server, or an SMB share. If a network folder requires authentication, only the SMB protocol is supported. When selecting a local folder, you must specify a folder on the device that has Administration Server installed.
    
    An FTP or HTTP server or a network folder used by an update source must contain a folders structure (with updates) that matches the structure created when using Kaspersky update servers.
- Other settings:
  - Force update of secondary Administration Servers
    If this option is enabled, the Administration Server starts update tasks on the secondary Administration Servers as soon as new updates are downloaded. Update tasks are started by using the source of update that is configured in the task properties on the secondary Administration Servers.
    
    If this option is disabled, the update tasks on the secondary Administration Servers start according to their schedules.
    
    By default, this option is disabled.
  - Copy downloaded updates to additional folders
    After the Administration Server receives updates, it copies them to the specified folders. Use this option if you want to manually manage the distribution of updates on your network.
    
    For example, you may want to use this option in the following situation: the network of your organization consists of several independent subnets, and devices from each of the subnets do not have access to other subnets. However devices in all of the subnets have access to a common network share. In this case, you set Administration Server in one of the subnets to download updates from Kaspersky update servers, enable this option, and then specify this network share. In downloaded updates to the repository tasks for other Administration Servers, specify the same network share as the update source.
    
    By default, this option is disabled.
    - Do not force updating of devices and secondary Administration Servers unless copying is complete
      The tasks of downloading updates to client devices and secondary Administration Servers start only after those updates are copied from the main update folder to additional update folders.
      
      This option must be enabled if client devices and secondary Administration Servers download updates from additional network folders.
      
      By default, this option is disabled.
  - Download updates by using the old scheme
    Starting from version 14, Kaspersky Security Center downloads updates of databases and software modules by using the new scheme. For the application to download updates by using the new scheme, the update source must contain update files with metadata that is compatible with the new scheme. If the update source contains update files with metadata that is compatible with the old scheme only, enable the Download updates by using the old scheme option. Otherwise, the update download task will fail.
    
    For example, you must enable this option when a local or network folder is specified as an update source, and the update files in this folder were downloaded by one of the following applications:
    - Kaspersky Update Utility
      This utility downloads updates by using the old scheme.
    - Kaspersky Security Center 13.2 or earlier version
      For example, your Administration Server 1 does not have an internet connection. In this case, you may download updates by using an Administration Server 2 that has an internet connection, and then place the updates to a local or network folder to use it as an update source for the Administration Server 1. If the Administration Server 2 has version 13.2 or earlier, enable the Download updates by using the old scheme option in the task for the Administration Server 1.
    By default, this option is disabled.
On the Configure task schedule page of the wizard, you can create a schedule for task start. If necessary, specify the following settings:
- Scheduled start:
  Select the schedule according to which the task runs, and configure the selected schedule.
  - Every N hours
    The task runs regularly, with the specified interval in hours, starting from the specified date and time.
    
    By default, the task runs every 6 hours, starting from the current system date and time.
  - Every N days
    The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
    
    By default, the task runs every day, starting from the current system date and time.
  - Every N weeks
    The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
    
    By default, the task runs every Monday at the current system time.
  - Every N minutes
    The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
    
    By default, the task runs every 30 minutes, starting from the current system time.
  - Daily (daylight saving time is not supported)
    The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
    
    We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
    
    By default, the task starts every day at the current system time.
  - Weekly
    The task runs every week on the specified day and at the specified time.
  - By days of week
    The task runs regularly, on the specified days of the week, at the specified time.
    
    By default, the task runs every Friday at 6:00:00 PM.
  - Monthly
    The task runs regularly, on the specified day of the month, at the specified time.
    
    In months that lack the specified day, the task runs on the last day.
    
    By default, the task runs on the first day of each month, at the current system time.
  - Manually
    The task does not run automatically. You can only start it manually.
    
    By default, this option is selected.
  - Every month on specified days of selected weeks
    The task runs regularly, on the specified days of each month, at the specified time.
    
    By default, no days of month are selected. The default start time is 18:00.
  - On virus outbreak
    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
    - Anti-virus for workstations and file servers
    - Anti-virus for perimeter defense
    - Anti-virus for mail systems
    By default, all application types are selected.
    
    You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
  - On completing another task
    The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
    
    You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
    
    If necessary, you can search, sort, and filter the tasks in the table as follows:
    - Enter the task name in the search field, to search the task by its name.
    - Click the sort icon to sort the tasks by name.
      By default, the tasks are sorted in alphabetical ascending order.
    - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
- Run missed tasks
  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.
  
  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.
  
  If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.
  
  By default, this option is disabled.
- Use automatically randomized delay for task starts
  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.
  
  If this option is disabled, the task starts on client devices according to the schedule.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  If this option is disabled, the task starts on client devices according to the schedule.
  
  By default, this option is disabled. The default time interval is one minute.
On the Define the task name page of the wizard, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
On the Finish task creation page of the wizard, click the Finish button to close the wizard.
If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

After the wizard finishes, Download updates to the Administration Server repository appears in the list of Administration Server tasks in the workspace.

In addition to the settings that you specify during task creation, you can change other properties of a created task.

When Administration Server performs the Download updates to the repository of the Administration Server task, updates to databases and software modules are downloaded from the updates source and stored in the shared folder of Administration Server. If you create this task for an administration group, it will only be applied to Network Agents included in the specified administration group.

Updates are distributed to client devices and secondary Administration Servers from the shared folder of Administration Server.

See also:

Verifying downloaded updates

Download updates to the Administration Server repository task settings

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 137601]

Creating the Download updates to the repositories of distribution points task

Expand all | Collapse all

Distribution point devices running macOS cannot download updates from Kaspersky update servers.

You can create the Download updates to the repositories of distribution points task for an administration group. This task will run for distribution points included in the specified administration group.

You can use this task, for example, if the traffic between the Administration Server and the distribution point(s) is more expensive than the traffic between the distribution point(s) and Kaspersky update servers, or if your Administration Server does not have internet access.

To create the Download updates to the repositories of distribution points task for a selected administration group:

In the console tree, select the Tasks folder.
In the workspace of this folder, click the New task button.
The New task wizard starts. Follow the steps of the wizard.
On the Select the task type page of the wizard, select the Kaspersky Security Center Administration Server node, expand the Advanced folder, and then select the Download updates to the repositories of distribution points task.
On the Settings page of the wizard, specify the task settings as follows:
- Sources of updates
  The following resources can be used as a source of updates for the distribution point:
  - Kaspersky update servers
    HTTP(S) servers at Kaspersky from which Kaspersky applications download database and application module updates.
    
    This option is selected by default.
  - Primary Administration Server
    This resource applies to tasks created for a secondary or virtual Administration Server.
  - Local or network folder
    A local or network folder that contains the latest updates. A network folder can be an FTP or HTTP server, or an SMB share. If a network folder requires authentication, only the SMB protocol is supported. When selecting a local folder, you must specify a folder on the device that has Administration Server installed.
    
    An FTP or HTTP server or a network folder used by an update source must contain a folders structure (with updates) that matches the structure created when using Kaspersky update servers.
- Folder for storing updates
  The path to the specified folder for storing saved updates. You can copy the specified folder path to a clipboard. You cannot change the path to a specified folder for a group task.
- Download updates by using the old scheme
  Starting from version 14, Kaspersky Security Center downloads updates of databases and software modules by using the new scheme. For the application to download updates by using the new scheme, the update source must contain the update files with the metadata compatible with the new scheme. If the update source contains the update files with the metadata compatible with the old scheme only, enable the Download updates by using the old scheme option. Otherwise, the update download task will fail.
  
  For example, you must enable this option when a local or network folder is specified as an update source and the update files in this folder were downloaded by one of the following applications:
  - Kaspersky Update Utility
    This utility downloads updates by using the old scheme.
  - Kaspersky Security Center 13.2 or earlier version
    For example, a distribution point is configured to take the updates from a local or network folder. In this case, you may download updates by using an Administration Server that has an internet connection, and then place the updates to the local folder on the distribution point. If the Administration Server has version 13.2 or earlier, enable the Download updates by using the old scheme option in the Download updates to the repositories of distribution points task.
  By default, this option is disabled.
On the Select Administration group page of the wizard, click Browse and select the administration group to which the task applies.
On the Configure task schedule page of the wizard, you can create a schedule for task start. If necessary, specify the following settings:
- Scheduled start:
  Select the schedule according to which the task runs, and configure the selected schedule.
  - Every N hours
    The task runs regularly, with the specified interval in hours, starting from the specified date and time.
    
    By default, the task runs every 6 hours, starting from the current system date and time.
  - Every N days
    The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
    
    By default, the task runs every day, starting from the current system date and time.
  - Every N weeks
    The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
    
    By default, the task runs every Monday at the current system time.
  - Every N minutes
    The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
    
    By default, the task runs every 30 minutes, starting from the current system time.
  - Daily (daylight saving time is not supported)
    The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
    
    We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
    
    By default, the task starts every day at the current system time.
  - Weekly
    The task runs every week on the specified day and at the specified time.
  - By days of week
    The task runs regularly, on the specified days of the week, at the specified time.
    
    By default, the task runs every Friday at 6:00:00 PM.
  - Monthly
    The task runs regularly, on the specified day of the month, at the specified time.
    
    In months that lack the specified day, the task runs on the last day.
    
    By default, the task runs on the first day of each month, at the current system time.
  - Manually
    The task does not run automatically. You can only start it manually.
    
    By default, this option is selected.
  - Every month on specified days of selected weeks
    The task runs regularly, on the specified days of each month, at the specified time.
    
    By default, no days of month are selected. The default start time is 18:00.
  - On virus outbreak
    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
    - Anti-virus for workstations and file servers
    - Anti-virus for perimeter defense
    - Anti-virus for mail systems
    By default, all application types are selected.
    
    You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
  - On completing another task
    The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
    
    You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
    
    If necessary, you can search, sort, and filter the tasks in the table as follows:
    - Enter the task name in the search field, to search the task by its name.
    - Click the sort icon to sort the tasks by name.
      By default, the tasks are sorted in alphabetical ascending order.
    - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
- Run missed tasks
  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.
  
  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.
  
  If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.
  
  By default, this option is disabled.
- Use automatically randomized delay for task starts
  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.
  
  If this option is disabled, the task starts on client devices according to the schedule.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  If this option is disabled, the task starts on client devices according to the schedule.
  
  By default, this option is disabled. The default time interval is one minute.
On the Define the task name page of the wizard, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
On the Finish task creation page of the wizard, click the Finish button to close the wizard.
If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

When the wizard completes its operation, Download updates to the repositories of distribution points appears in the list of Network Agent tasks in the target administration group and in the Tasks workspace of the console.

In addition to the settings that you specify during task creation, you can change other properties of a created task.

When the Download updates to the repositories of distribution points task is performed, updates for databases and software modules are downloaded from the update source and stored in the shared folder. Downloaded updates will only be used by distribution points that are included in the specified administration group and that have no update download task explicitly set for them.

In the Administration Server properties window, in the Sections pane select Distribution points. In the properties of each distribution point, in the Update source section you can specify the update source (Retrieve from Administration Server or Use task for forced download of updates). By default, Retrieve from Administration Server is selected for a distribution point that is assigned manually or automatically. These distribution points will use the results of the Download updates to the repositories of distribution points task.

The properties of each distribution point specify the network folder that has been set up for that distribution point individually. The names of folders may vary for different distribution points. For this reason, we do not recommend that you change the network folder in the task properties if the task is created for a group of devices.

You can change the network folder with updates in the properties of the Download updates to the repositories of distribution points task if you are creating a local task for a device.

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 13191]

Configuring the Download updates to the repository of the Administration Server task

To configure the Download updates to the repository of the Administration Server task:

In the workspace of the Tasks console tree folder, select Download updates to the Administration Server repository in the task list.
Open the task properties window in one of the following ways:
- By selecting Properties in the context menu of the task.
- By clicking the Configure task link in the information box for the selected task.

The Download updates to the repository of the Administration Server task properties window opens. In this window, you can configure how the updates are downloaded to the Administration Server repository.

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 5251]

Verifying downloaded updates

Before installing updates to the managed devices, you can first check the updates for operability and errors through the Update verification task. The Update verification task is performed automatically as part of the Download updates to the Administration Server repository task. The Administration Server downloads updates from the source, saves them in the temporary repository, and runs the Update verification task. If the task completes successfully, the updates are copied from the temporary repository to the Administration Server shared folder (<Kaspersky Security Center installation folder>\Share\Updates). They are distributed to all client devices for which the Administration Server is the source of updates.

If, as a result of the Update verification task, updates located in the temporary repository are incorrect or if the Update verification task completes with an error, such updates are not copied to the shared folder. The Administration Server retains the previous set of updates. Also, the tasks that have the When new updates are downloaded to the repository schedule type are not started then. These operations are performed at the next start of the Download updates to the Administration Server repository task if scanning of the new updates completes successfully.

A set of updates is considered invalid if any of the following conditions is met on at least one test device:

An update task error occurred.
The real-time protection status of the security application changed after the updates were applied.
An infected object was detected during running of the on-demand scan task.
A runtime error of a Kaspersky application occurred.

If none of the listed conditions is true for any test device, the set of updates is considered valid, and the Update verification task is considered to have completed successfully.

Before you start to create the Update verification task, perform the prerequisites:

Create an administration group with several test devices. You will need this group to verify updates on it.
We recommend using devices with the most reliable protection and the most popular application configuration across the network. This approach increases the quality and probability of virus detection during scans, and minimizes the risk of false positives. If viruses are detected on test devices, the Update verification task is considered unsuccessful.
Create the Update and Malware scan tasks for an application supported by Kaspersky Security Center, for example, Kaspersky Endpoint Security for Windows or Kaspersky Security for Windows Server. When creating the Update and Malware scan tasks, specify the administration group with the test devices.
The Update verification task sequentially runs the Update and Malware scan tasks on test devices to check that all updates are valid. In addition, when creating the Update verification task, you need to specify the Update and Malware scan tasks.
Create the Download updates to the Administration Server repository task.

To make Kaspersky Security Center verify downloaded updates before distributing them to client devices:

In the workspace of the Tasks folder, select the Download updates to the Administration Server repository task in the list of tasks.
Open the task properties window in one of the following ways:
- By selecting Properties in the context menu of the task.
- By clicking the Configure task link in the information box for the selected task.
If the Update verification task exists, click the Browse button. In the window that opens, select the Update verification task in the administration group with test devices.
If you did not create the Update verification task earlier, click the Create button.
The Update verification task wizard starts. Follow the instructions of the wizard.
Click OK to close the properties window of the Download updates to the Administration Server repository task.

The automatic update verification is enabled. Now, you can run the Download updates to the Administration Server repository task and it will start from update verification.

Page top

[Topic 52515]

Configuring test policies and auxiliary tasks

When creating an Update verification task, the Administration Server generates test policies, auxiliary group update tasks, and on-demand scan tasks.

Auxiliary group update and on-demand scan tasks take some time. These tasks are performed when the Update verification task is executed. The Update verification task is performed during execution of the Download updates to the repository task. The duration of the Download updates to the repository task includes auxiliary group update and on-demand scan tasks.

You can change the settings of test policies and auxiliary tasks.

To change settings of a test policy or an auxiliary task:

In the console tree, select a group for which the Update verification task is created.
In the group workspace, select one of the following tabs:
- Policies, if you want to edit the test policy settings.
- Tasks, if you want to change auxiliary task settings.
In the tab workspace, select a policy or a task, whose settings you want to change.
Open the policy (task) properties window in one of the following ways:
- By selecting Properties in the context menu of the policy (task).
- By clicking the Configure policy (Configure task) link in the information box for the selected policy (task).

To verify updates correctly, set the following restrictions on the modification of test policies and auxiliary tasks:

In the auxiliary task settings:
- Save all tasks with the Critical event and Functional failure importance levels on Administration Server. Using the events of these types, the Administration Server analyzes the operation of applications.
- Use Administration Server as the source of updates.
- Specify the task schedule type: Manually.
In the settings of test policies:
- Disable the iChecker and iSwift scanning acceleration technologies (Essential Threat Protection → File Threat Protection → Settings → Additional → Scan technologies).
- Select actions on infected objects: Disinfect; delete if disinfection fails / Disinfect; block if disinfection fails / Block. (Essential Threat Protection → File Threat Protection → Action on threat detection).
In the settings of test policies and auxiliary tasks:
If the device requires a restart after installation of updates for software modules, it must be performed immediately. If the device is not restarted, it is not possible to test this type of updates. For some applications, installation of updates that require a restart may be prohibited or configured to prompt the user for confirmation first. These restrictions should be disabled in the settings of test policies and auxiliary tasks.

Page top

[Topic 3413]

Viewing downloaded updates

To view the list of downloaded updates,

In the console tree, in the Repositories folder, select the Updates for Kaspersky databases and software modules subfolder.

The workspace of the Updates for Kaspersky databases and software modules folder shows the list of updates that have been saved on the Administration Server.

Page top

[Topic 89280]

Automatic installation of Kaspersky Endpoint Security updates on devices

You can configure automatic updates of databases and software modules of Kaspersky Endpoint Security on client devices.

To configure download and automatic installation of Kaspersky Endpoint Security updates on devices:

In the console tree, select the Tasks folder.
Create an Update task in one of the following ways:
- By selecting New → Task in the context menu of the Tasks folder in the console tree.
- By clicking the New task button in the workspace of the Tasks folder.
The New task wizard starts. Follow the steps of the wizard.
On the Select the task type page of the wizard, select Kaspersky Endpoint Security as the task type, and then select Update as the task subtype.
Follow the rest of the wizard instructions.
After the wizard finishes, an update task for Kaspersky Endpoint Security is created. The newly created task is displayed in the list of tasks in the workspace of the Tasks folder.
In the workspace of the Tasks folder, select the update task that you have created.
In the context menu of the task, select Properties.
In the task properties window that opens, in the Sections pane select Options.
In the Options section, you can define the update task settings in local or mobile mode:
- Update settings for local mode: Connection is established between the device and the Administration Server.
- Update settings for mobile mode: No connection is established between Kaspersky Security Center and the device (for example, when the device is not connected to the internet).
Click the Settings button to select the update source.
Select the Download updates of application modules option to download and install software module updates together with the application databases.
If the check box is selected, Kaspersky Endpoint Security notifies the user about available software module updates and includes software module updates in the update package when running the update task. Configure the use of update modules:
- Install critical and approved updates. If any updates are available for software modules, Kaspersky Endpoint Security automatically installs those that have Critical status; the remaining updates will be installed after you approve them.
- Install approved updates only. If any software module updates are available, Kaspersky Endpoint Security installs them after their installation is approved; they will be installed locally through the application interface or through Kaspersky Security Center.
If updating the software module requires reviewing and accepting the terms of the License Agreement and Privacy Policy, the application installs updates after the terms of the License Agreement and Privacy Policy have been accepted by the user.
Select the Copy updates to folder option in order for the application to save downloaded updates to a folder, and then click the Browse button to specify the folder.
Click OK.

When the Update task is running, the application sends requests to Kaspersky update servers.

Some updates require installation of the latest versions of management plug-ins.

Page top

[Topic 101873]

Offline model of update download

Network Agent on managed devices may sometimes not connect to the Administration Server to receive updates. For example, Network Agent may have been installed on a laptop that sometimes has no internet connection and no local network access. Moreover, the administrator may limit the time for connecting devices to the network. In such cases, devices with Network Agent installed cannot receive updates from the Administration Server according to the existing schedule. If you have configured the updating of managed applications (such as Kaspersky Endpoint Security) using Network Agent, each update requires a connection to the Administration Server. When no connection is established between Network Agent and the Administration Server, updating is not possible. You can configure the connection between Network Agent and the Administration Server so that Network Agent connects to the Administration Server at specified time intervals. At worst, if the specified connection intervals are overlaid with periods when no connection is available, the databases will never be updated. In addition, issues may occur when multiple managed applications simultaneously attempt to access the Administration Server to receive updates. In this case, the Administration Server may stop responding to requests (similarly to a DDoS attack).

To avoid such problems as those described above, an offline model for downloading updates and modules of managed applications is implemented in Kaspersky Security Center. This model provides a mechanism for distribution of updates, regardless of temporary problems caused by inaccessibility of Administration Server communication channels. The model also reduces load on the Administration Server.

How the offline model of update download works

When the Administration Server receives updates, it notifies Network Agent (on devices where it is installed) of the updates that will be required for managed applications. When Network Agent receives information about these updates, it downloads the relevant files from the Administration Server in advance. At the first connection with Network Agent, the Administration Server initiates an update download. After Network Agent downloads all the updates to a client device, the updates become available for applications on that device.

When a managed application on a client device attempts to access Network Agent for updates, Network Agent checks whether it has all required updates. If the updates are received from the Administration Server not more than 25 hours before they were requested by the managed application, Network Agent does not connect to the Administration Server but supplies the managed application with updates from the local cache instead. Connection with the Administration Server may not be established when Network Agent provides updates to applications on client devices, but connection is not required for updating.

To distribute the load on the Administration Server, Network Agent on a device connects to the Administration Server and download updates in random order during the time interval specified by the Administration Server. This time interval depends on the number of devices with Network Agent installed that download updates and on the size of those updates. To reduce the load on the Administration Server, you can use Network Agent as distribution points.

If the offline model of update download is disabled, updates are distributed according to the schedule of the update download task.

By default, the offline model of update download is enabled.

The offline model of update download is only used with managed devices on which the task for retrieving updates by managed applications has When new updates are downloaded to the repository selected as the schedule type. For other managed devices, the standard scheme is used for retrieving updates from the Administration Server in real-time mode.

We recommend that you disable the offline model of update download by using the settings of the Network Agent policies of relevant administration groups in these cases: if managed applications have the retrieval of updates set not from the Administration Server, but from Kaspersky servers or a network folder, and if the update download task has When new updates are downloaded to the repository selected as the schedule type.

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 102163]

Enabling and disabling the offline model of update download

We recommend that you avoid disabling the offline model of update download. Disabling it may cause failures in update delivery to devices. In certain cases, a Kaspersky Technical Support specialist may recommend that you clear the Download updates and anti-virus databases from Administration Server in advance check box. Then, you will have to make sure that the task for receiving updates for Kaspersky applications has been set up.

To enable or disable the offline model of update download for an administration group:

In the console tree, select the administration group for which you need to enable the offline model of update download.
In the group workspace, open the Policies tab.
On the Policies tab, select the Network Agent policy.
In the context menu of the policy, select Properties.
Open the properties window of the Network Agent policy.
In the policy properties window, select the Manage patches and updates section.
Select or clear the Download updates and anti-virus databases from Administration Server in advance (recommended) check box to enable or disable, respectively, the offline model of update download.
By default, the offline model of update download is enabled.

The offline model of update download will be enabled or disabled.

See also:

Offline model of update download

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 154857]

Automatic updating and patching for Kaspersky Security Center components

By default, any updates and patches that have been downloaded are installed automatically for the following application components:

Network Agent for Windows
Administration Console
iOS MDM Server

Automatic updating and patching for Kaspersky Security Center components is available only for devices running Windows. You can disable automatic updating and patching for these components. In this case, any updates and patches that have been downloaded will be installed only after you change their status to Approved. Updates and patches with Undefined status will not be installed.

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 154853]

Enabling and disabling automatic updating and patching for Kaspersky Security Center components

Automatic installation of updates and patches for Kaspersky Security Center components is enabled by default during Network Agent installation on the device. You can disable it during Network Agent installation, or disable it later by using a policy.

To disable automatic updating and patching for Kaspersky Security Center components during local installation of Network Agent on a device:

Start local installation of Network Agent on the device.
At the Advanced settings step, clear the Automatically install applicable updates and patches for components that have Undefined status check box.
Follow the instructions of the wizard.

Network Agent with disabled automatic updating and patching for Kaspersky Security Center components will be installed on the device. You can enable automatic updating and patching later by using a policy.

To disable automatic updating and patching for Kaspersky Security Center components during Network Agent installation on the device through an installation package:

In the console tree, select the Remote installation → Installation packages folder.
In the context menu of the Kaspersky Security Center Network Agent <version number> package, select Properties.
In the installation package properties, in the Settings section clear the Automatically install applicable updates and patches for components that have the Undefined status check box.

Network Agent with disabled automatic updating and patching for Kaspersky Security Center components will be installed from this package. You can enable automatic updating and patching later by using a policy.

If this check box was selected (or cleared) during Network Agent installation on the device, you can subsequently enable (or disable) automatic updating by using the Network Agent policy.

To enable or disable automatic updating and patching for Kaspersky Security Center components by using the Network Agent policy:

In the console tree, select the administration group for which you have to enable or disable automatic updating and patching.
In the group workspace, open the Policies tab.
On the Policies tab, select the Network Agent policy.
In the context menu of the policy, select Properties.
Open the properties window of the Network Agent policy.
In the policy properties window, select the Manage patches and updates section.
Select or clear the Automatically install applicable updates and patches for components that have the Undefined status check box to enable or disable, respectively, automatic updating and patching.
Set the lock for this check box.

The policy will be applied to the selected devices, and automatic updating and patching for Kaspersky Security Center components will be enabled (or disabled) on these devices.

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 3415]

Automatic distribution of updates

Kaspersky Security Center allows automatic distribution and installation of updates on client devices and secondary Administration Servers.

In this section

Distributing updates to client devices automatically

Distributing updates to secondary Administration Servers automatically

Assigning distribution points automatically

Assigning a device a distribution point manually

Removing a device from the list of distribution points

Downloading updates by distribution points

Page top

[Topic 3416]

Distributing updates to client devices automatically

To distribute updates of the selected application to client devices automatically immediately after they are downloaded to the Administration Server repository:

Connect to the Administration Server, which manages the client devices.
Create an update deployment task for the selected client devices in one of the following ways:
- If you need to distribute updates to client devices that belong to a selected administration group, create a task for the selected group.
- If you need to distribute updates to client devices that belong to different administration groups or belong to none of the administration groups, create a task for specific devices.
The New task wizard starts. Follow its instructions and perform the following actions:
1. In the Task type wizard window, in the node of the required application select the updates deployment task.
  The name of the updates deployment task displayed in the Task type window depends on the application for which you create this task. For detailed information about names of update tasks for the selected Kaspersky applications, see the corresponding Guides.
2. In the Schedule wizard window, in the Scheduled start field, select When new updates are downloaded to the repository.

The newly created update distribution task will start for the selected devices every time any updates are downloaded to the Administration Server repository.

If an update distribution task for the required application has already been created for the selected devices, to automatically distribute updates to client devices, in the task properties window, in the Schedule section, select When new updates are downloaded to the repository as the start option in the Scheduled start field.

Page top

[Topic 3418]

Distributing updates to secondary Administration Servers automatically

To distribute the updates of the selected application to secondary Administration Servers immediately after the updates are downloaded to the primary Administration Server repository:

In the console tree, in the primary Administration Server node, select the Tasks folder.
In the list of tasks in the workspace, select the Download updates to the repository of the Administration Server task of the Administration Server.
Open the Settings section of the selected task in one of the following ways:
- By selecting Properties in the context menu of the task.
- By clicking the Edit settings link in the information box for the selected task.
In the Settings section of the task properties window, select the Other settings subsection, and then click the Configure link.
In the Other settings window that opens, select the Force update of secondary Administration Servers check box.
In the settings of the updates download task of the Administration Server, on the Settings tab of the task properties window, select the Force update of secondary Administration Servers check box.

After the primary Administration Server retrieves the updates, the update download tasks automatically start on secondary Administration Servers, regardless of their schedule.

The primary Administration Server updates anti-virus databases, according to the applications installed on secondary Administration Servers. Installation of additional plug-ins and creation of installation packages on the primary Administration Server is not required.

Page top

[Topic 193351]

Assigning distribution points automatically

We recommend that you assign distribution points automatically. Kaspersky Security Center will then select on its own which devices must be assigned distribution points.

To assign distribution points automatically:

Open the main application window.
In the console tree, select the node with the name of the Administration Server for which you want to assign distribution points automatically.
In the context menu of the Administration Server, click Properties.
In the Administration Server properties window, in the Sections pane select Distribution points.
In the right part of the window, select the Automatically assign distribution points option.
If automatic assignment of devices as distribution points is enabled, you cannot configure distribution points manually or edit the list of distribution points.
Click OK.

Administration Server assigns and configures distribution points automatically.

Page top

[Topic 3420]

Assigning a device a distribution point manually

Expand all | Collapse all

Kaspersky Security Center allows you to assign devices to act as distribution points.

We recommend that you assign distribution points automatically. In this case, Kaspersky Security Center will select on its own which devices must be assigned distribution points. However, if you have to opt out of assigning distribution points automatically for any reason (for example, if you want to use exclusively assigned servers), you can assign distribution points manually after you calculate their number and configuration.

Devices functioning as distribution points must be protected, including physical protection, against any unauthorized access.

To manually assign a device to act as distribution point:

In the console tree, select the Administration Server node.
In the context menu of the Administration Server, select Properties.
In the Administration Server properties window, select the Distribution points section and click the Add button. This button is available if Manually assign distribution points has been selected.
The Add distribution point window opens.
In the Add distribution point window, perform the following actions:
1. Select a device that will act as distribution point (select one in an administration group, or specify the IP address of a device). When selecting a device, keep in mind the operation features of distribution points and the requirements set for the device that acts as distribution point.
2. Indicate the specific devices to which the distribution point will distribute updates. You can specify an administration group or a network location description.
Click OK.
The distribution point that you have added will be displayed in the list of distribution points, in the Distribution points section.
Select the newly added distribution point in the list and click the Properties button to open its properties window.
Configure the distribution point in the properties window:
- The General section contains the settings of interaction between the distribution point and client devices.
  - SSL port
    The number of the SSL port for encrypted connection between client devices and the distribution point using SSL.
    
    By default, port 13000 is used.
  - Use multicast
    If this option is enabled, IP multicasting will be used for automatic distribution of installation packages to client devices within the group.
    
    IP multicasting decreases the time required to install an application from an installation package to a group of client devices, but increases the installation time when you install an application to a single client device.
  - IP multicast address
    IP address that will be used for multicasting. You can define an IP address in the range of 224.0.0.0 – 239.255.255.255
    
    By default, Kaspersky Security Center automatically assigns a unique IP multicast address within the given range.
  - IP multicast port number
    Number of the port for IP multicasting.
    
    By default, the port number is 15001. If the device with Administration Server installed is specified as the distribution point, port 13001 is used for SSL connection by default.
  - Deploy updates
    Updates are distributed to managed devices from the following sources:
    - This distribution point, if this option is enabled.
    - Other distribution points, Administration Server, or Kaspersky update servers, if this option is disabled.
    If you use distribution points to deploy updates, you can save traffic because you reduce the number of downloads. Also, you can relieve the load on the Administration Server and relocate the load between the distribution points. You can calculate the number of distribution points for your network to optimize the traffic and load.
    
    If you disable this option, the number of update downloads and load on the Administration Server may increase. By default, this option is enabled.
  - Deploy installation packages
    Installation packages are distributed to managed devices from the following sources:
    - This distribution point, if this option is enabled.
    - Other distribution points, Administration Server, or Kaspersky update servers, if this option is disabled.
    If you use distribution points to deploy installation packages, you can save traffic because you reduce the number of downloads. Also, you can relieve the load on the Administration Server and relocate the load between the distribution points. You can calculate the number of distribution points for your network to optimize the traffic and load.
    
    If you disable this option, the number of installation package downloads and load on the Administration Server may increase. By default, this option is enabled.
  - Use this distribution point as a push server
    In Kaspersky Security Center, a distribution point can work as a push server for the devices managed through the mobile protocol. For example, a push server must be enabled if you want to be able to force synchronization of KasperskyOS devices with Administration Server. A push server has the same scope of managed devices as the distribution point on which the push server is enabled. If you have several distribution points assigned for the same administration group, you can enable push server on each of the distribution points. In this case, Administration Server balances the load between the distribution points.
    
    If you manage devices with KasperskyOS installed, or plan to do so, you must use a distribution point as a push server. You can also use a distribution point as a push server if you want to send push notifications to client devices.
  - Push server port
    The port on the distribution point that client devices will use for connection. By default, port 13295 is used.
- In the Scope section, specify the scope to which the distribution point will distribute updates (administration groups and / or network location).
- In the KSN Proxy section, you can configure the application to use the distribution point to forward KSN requests from the managed devices.
  - Enable KSN Proxy on distribution point side
    The KSN proxy service is run on the device that is used as a distribution point. Use this feature to redistribute and optimize traffic on the network.
    
    The distribution point sends the KSN statistics, which are listed in the Kaspersky Security Network statement, to Kaspersky. By default, the KSN statement is located in %ProgramFiles%\Kaspersky Lab\Kaspersky Security Center\ksneula.
    
    By default, this option is disabled. Enabling this option takes effect only if the Use Administration Server as a proxy server and I agree to use Kaspersky Security Network options are enabled in the Administration Server properties window.
    
    You can assign a node of an active-passive cluster to a distribution point and enable KSN proxy server on this node.
  - Forward KSN requests to Administration Server
    The distribution point forwards KSN requests from the managed devices to the Administration Server.
    
    By default, this option is enabled.
  - Access KSN Cloud/KPSN directly over the internet
    The distribution point forwards KSN requests from managed devices to the KSN Cloud or KPSN. The KSN requests generated on the distribution point itself are also sent directly to the KSN Cloud or KPSN.
    
    The distribution points that have Network Agent version 11 (or earlier) installed cannot access KPSN directly. If you want to reconfigure the distribution points to send KSN requests to KPSN, enable the Forward KSN requests to Administration Server option for each distribution point.
    
    The distribution points that have Network Agent version 12 (or later) installed can access KPSN directly.
  - Ignore proxy server settings when connecting to KPSN
    Enable this option, if you have the proxy server settings configured in the distribution point properties or in the Network Agent policy, but your network architecture requires that you use KPSN directly. Otherwise, requests from the managed applications cannot reach KPSN.
    
    This option is available if you select the Access KSN Cloud/KPSN directly over the internet option.
  - TCP port
    The number of the TCP port that the managed devices will use to connect to KSN proxy server. The default port number is 13111.
  - UDP port
    If you need Network Agent to connect to Administration Server through a UDP port, enable the Use UDP port option and specify a UDP port number. By default, this option is enabled. The default UDP port to connect to Administration Server is 15000.
  - HTTPS port
    If you need the managed devices to connect to KSN proxy server through an HTTPS port, enable the Use HTTPS option and specify an HTTPS through port number. The default HTTPS port to connect to the KSN proxy server is 17111.
- In the Device discovery section, configure the polling of Windows domains, Active Directory, and IP ranges by the distribution point.
  - Windows domains
    You can enable device discovery for Windows domains and set the schedule for the discovery.
  - Active Directory
    You can enable network polling for Active Directory and set the schedule for the poll.
    
    If you use a Windows distribution point, you can select one of the following options:
    - Poll current Active Directory domain.
    - Poll Active Directory domain forest.
    - Poll selected Active Directory domains only. If you select this option, add one or more Active Directory domains to the list.
    If you use a Linux distribution point with installed Network Agent version 15, you can poll only Active Directory domains for which you specify the address and user credentials. Polling of the current Active Directory domain and the Active Directory domain forest is not available.
  - IP ranges
    You can enable device discovery for IPv4 ranges and IPv6 networks.
    
    If you enable the Enable range polling option, you can add scanned ranges and set the schedule for them. You can add IP ranges to the list of scanned ranges.
    
    If you enable the Use Zeroconf to poll IPv6 networks option, the distribution point automatically polls the IPv6 network by using zero-configuration networking (also referred to as Zeroconf). In this case, the specified IP ranges are ignored because the distribution point polls the whole network. The Use Zeroconf to poll IPv6 networks option is available if the distribution point runs Linux. To use Zeroconf IPv6 polling, you must install the avahi-browse utility on the distribution point.
- In the Advanced section, specify the folder that the distribution point must use to store distributed data.
  - Use default folder
    If you select this option, the application uses the Network Agent installation folder on the distribution point.
  - Use specified folder
    If you select this option, in the field below, you can specify the path to the folder. It can be a local folder on the distribution point, or it can be a folder on any device on the corporate network.
    
    The user account used on the distribution point to run Network Agent must have read/write access to the specified folder.

The selected devices act as distribution points.

Only devices running a Windows operating system can determine their network location. Network location cannot be determined for devices running other operating systems.

Page top

[Topic 101498]

Removing a device from the list of distribution points

To remove a device from the list of distribution points:

In the console tree, select the Administration Server node.
In the context menu of the Administration Server, select Properties.
In the Administration Server properties window, in the Distribution points section, select the device that acts as distribution point, and click the Remove button.

The device will be removed from the list of distribution points and will stop acting as distribution point.

You cannot remove a device from the list of distribution points if it was assigned by the Administration Server automatically.

Page top

[Topic 13460]

Downloading updates by distribution points

Kaspersky Security Center allows distribution points to receive updates from the Administration Server, Kaspersky servers, or from a local or network folder.

If you do not need to specify an update source, we recommend that you use the Download updates to the repositories of distribution points task for an administration group. Refer to the following topic for details: Creating the Download updates to the repositories of distribution points task.

To configure update download for a distribution point:

In the console tree, select the Administration Server node.
In the context menu of the Administration Server, select Properties.
In the Administration Server properties window, in the Distribution points section, select the distribution point through which updates will be delivered to client devices in the group.
Click the Properties button to open the properties window of the selected distribution point.
In the distribution point properties window, select the Sources of updates section.
Select an update source for the distribution point:
- To allow the distribution point to receive updates from the Administration Server, select Retrieve from Administration Server:
  - Download diff files
    This option enables the downloading diff files feature.
    
    By default, this option is enabled.
- To allow the distribution point to receive updates by using a task, select Use task for forced download of updates:
  - Click the Browse button if such a task already exists on the device, and select the task in the list that appears.
  - Click the New task button to create a task if no such task yet exists on the device. The New task wizard starts. Follow the instructions of the wizard.
  The Download updates to the repositories of distribution points task is a local task. You have to create a new task for each device that acts as distribution point.

The distribution point will receive updates from the specified source.

Page top

[Topic 91260]

Deleting software updates from the repository

To delete software updates from the Administration Server repository:

In the Advanced → Application management folder in the console tree, select the Software updates subfolder.
In the workspace of the Software updates folder, select the update that you want to delete.
In the context menu of the update, select Delete update files.

Software updates will be deleted from the Administration Server repository.

Page top

[Topic 138256]

Patch installation for a Kaspersky application in cluster mode

Kaspersky Security Center only supports manual installation of patches for Kaspersky applications in cluster mode.

To install a patch for a Kaspersky application:

Download the patch to each node of the cluster.
Run patch installation on the active node.
Wait for the patch to be successfully installed.
Run the patch on all subnodes of the cluster consecutively.
If you are running the patch from the command line, use the -CLUSTER_SECONDARY_NODE key.

The patch is now installed on all nodes of the cluster.
Run the Kaspersky cluster services manually.

Every node of the cluster is displayed in Administration Console as a device with Network Agent installed.

For information about installed patches, see the Software updates folder or the report on the versions of updates for software modules of Kaspersky applications.

Scenario: Regular updating Kaspersky databases and applications

Page top

[Topic 52336]

Managing third-party applications on client devices

Kaspersky Security Center allows you to manage applications by Kaspersky and other vendors installed on client devices.

The administrator can perform the following actions:

Create application categories based on specified criteria.
Manage application categories using specially created rules.
Manage applications run on devices.
Perform inventories and maintain a registry of software installed on devices.
Fix vulnerabilities in software installed on devices.
Install updates from Windows Update and other software makers on devices.
Monitor the use of license keys for licensed applications groups.

In this section

Installing third-party software updates

Fixing third-party software vulnerabilities

Groups of applications

Page top

[Topic 52464]

Installing third-party software updates

Kaspersky Security Center allows you to manage updates of software installed on client devices and fix vulnerabilities in Microsoft applications and other software makers' products through installing required updates.

Kaspersky Security Center searches for updates through the update search task and downloads them to the updates repository. After completing the search of updates, the application provides the administrator with information about available updates and vulnerabilities in applications that can be fixed using those updates.

Information about available updates for Microsoft Windows is provided by Windows Update service. Administration Server can be used as Windows Server Update Services (WSUS) server. To use Administration Server as WSUS server, you should configure synchronization of updates with Windows Update. After you have configured data synchronization with Windows Update, Administration Server provides updates to Windows Update services on devices in centralized mode and with the set frequency.

You can also manage software updates through a Network Agent policy. To do this, you should create a Network Agent policy and configure software updating in the corresponding windows of the New policy wizard.

The administrator can view a list of available updates in the Software updates subfolder included in the Application management folder. This folder contains a list of updates for Microsoft applications and other software makers' products retrieved by Administration Server that can be distributed to devices. After viewing information about available updates, the administrator can install them to devices.

Kaspersky Security Center updates some applications by removing the previous version of the application and installing the new one.

A user interaction may be required when you update a third-party application or fix a vulnerability in a third-party application on a managed device. For example, the user may be prompted to close the third-party application if it is currently open.

Ensure that the Display Vulnerability and Patch Management option is enabled in the Configure interface window for the primary and secondary Administration Servers. Otherwise, the update search task handles only WSUS updates.

For security reasons, any third-party software updates that you install by using the Vulnerability and patch management feature are automatically scanned for malware by Kaspersky technologies. These technologies are used for automatic file checks and include virus scanning, static analysis, dynamic analysis, behavior analysis in the sandbox environment, and machine learning.

Kaspersky experts do not perform manual analysis of third-party software updates that can be installed by using the Vulnerability and patch management feature. In addition, Kaspersky experts do not search for vulnerabilities (known or unknown) or undocumented features in such updates, nor do they perform other types of analysis of the updates other than those specified in the paragraph above.

Before installing the updates to all of the devices, you can perform a test installation to make sure installed updates will cause no failures to the operation of applications on the devices.

You can find the details of third-party software that can be updated through Kaspersky Security Center by visiting the Technical Support website, on the Kaspersky Security Center page, in the Server Management section.

In this section

Scenario: Updating third-party software

Viewing information about available updates for third-party applications

Approving and declining software updates

Synchronizing updates from Windows Update with Administration Server

Installing updates on devices manually

Configuring Windows updates in a Network Agent policy

Page top

[Topic 183968]

Scenario: Updating third-party software

This section provides a scenario for updating third-party software installed on the client devices. The third-party software includes applications from Microsoft and other software vendors. Updates for Microsoft applications are provided by the Windows Update service.

Prerequisites

Administration Server must have a connection to the internet to install updates of third-part software other than Microsoft software.

By default, internet connection is not required for Administration Server to install Microsoft software updates on the managed devices. For example, the managed devices can download the Microsoft software updates directly from Microsoft Update servers or from Windows Server with Microsoft Windows Server Update Services (WSUS) deployed in your organization's network. Administration Server must be connected to the internet when you use Administration Server as WSUS server.

Stages

Updating third-party software proceeds in stages:

Searching for required updates
To find the third-party software updates required for the managed devices, run the Find vulnerabilities and required updates task. When this task is complete, Kaspersky Security Center receives the lists of detected vulnerabilities and required updates for the third-party software installed on the devices that you specified in the task properties.

The Find vulnerabilities and required updates task is created automatically by the Administration Server quick start wizard. If you did not run the wizard, create the task or run the quick start wizard now.

How-to instructions:
- Administration Console: Scanning applications for vulnerabilities, Scheduling the Find vulnerabilities and required updates task
- Kaspersky Security Center Web Console: Creating the Find vulnerabilities and required updates task, Find vulnerabilities and required updates task settings
Analyzing the list of found updates
View the Software updates list and decide which updates you want to install. To view detailed information about each update, click the update name in the list. For each update in the list, you can also view the statistics on the update installation on client devices.

How-to instructions:
- Administration Console: Viewing information about available updates
- Kaspersky Security Center Web Console: Viewing information about available third-party software updates
Configuring installation of updates
When Kaspersky Security Center received the list of the third-party software updates, you can install them on client devices by using the Install required updates and fix vulnerabilities task or the Install Windows Update updates task. Create one of these tasks. You can create these tasks on the Tasks tab or by using the Software updates list.

The Install required updates and fix vulnerabilities task is used to install updates for Microsoft applications, including the updates provided by the Windows Update service, and updates of other vendors' software. Note that this task can be created only if you have the license for the Vulnerability and patch management feature.

The Install Windows Update updates task does not require a license, but it can be used to install Windows Update updates only.

To install some software updates you must accept the End User License Agreement (EULA) for the installation software. If you decline the EULA, the software update will not be installed.

You can start an update installation task by schedule. When specifying the task schedule, make sure that the update installation task starts after the Find vulnerabilities and required updates task is complete.

How-to instructions:
- Administration Console: Fixing vulnerabilities in applications, Viewing information about available updates
- Kaspersky Security Center Web Console: Creating the Install required updates and fix vulnerabilities task, Creating the Install Windows Update updates task, Viewing information about available third-party software updates
Scheduling the tasks
To be sure that the update list is always up-to-date, schedule the Find vulnerabilities and required updates task to run the task automatically from time to time. By default, the Find vulnerabilities and required updates task is set to start manually.

If you have created the Install required updates and fix vulnerabilities task, you can schedule it to run with the same frequency as the Find vulnerabilities and required updates task or less often. When scheduling the Install Windows Update updates task, note that for this task you must define the list of updates every time before starting this task.

When scheduling the tasks, make sure that an update installation task starts after the Find vulnerabilities and required updates task is complete.
Approving and declining software updates (optional)
If you have created the Install required updates and fix vulnerabilities task, you can specify rules for update installation in the task properties. If you have created the Install Windows Update updates task, skip this step.

For each rule, you can define the updates to install depending on the update status: Undefined, Approved or Declined. For example, you may want to create a specific task for servers and set a rule for this task to allow installation of only Windows Update updates and only those ones that have Approved status. After that you manually set the Approved status for those updates that you want to install. In this case the Windows Update updates that have the Undefined or Declined status will not be installed on the servers that you specified in the task.

The usage of the Approved status to manage update installation is efficient for a small amount of updates. To install multiple updates, use the rules that you can configure in the Install required updates and fix vulnerabilities task. We recommend that you set the Approved status for only those specific updates that do not meet the criteria specified in the rules. When you manually approve a large amount of updates, performance of Administration Server decreases and may lead to Administration Server overload.

By default, the downloaded software updates have the Undefined status. You can change the status to Approved or Declined in the Software updates list (Operations → Patch management → Software updates).

How-to instructions:
- Administration Console: Approving and declining software updates
- Kaspersky Security Center Web Console: Approving and declining third-party software updates
Configuring Administration Server to work as Windows Server Update Services (WSUS) server (optional)
By default, Windows Update updates are downloaded to the managed devices from Microsoft servers. You can change this setting to use the Administration Server as WSUS server. In this case, the Administration Server synchronizes the update data with Windows Update at the specified frequency and provides updates in centralized mode to Windows Update on networked devices.

To use the Administration Server as WSUS server, create the Perform Windows Update synchronization task and select the Use Administration Server as WSUS server check box in the Network Agent policy.

How-to instructions:
- Administration Console: Synchronizing updates from Windows Update with Administration Server, Configuring Windows updates in a Network Agent policy
- Kaspersky Security Center Web Console: Creating the Perform Windows Update synchronization task
Running an update installation task
Start the Install required updates and fix vulnerabilities task or the Install Windows Update updates task. When you start these tasks, updates are downloaded and installed on managed devices. After the task is complete, make sure that it has the Completed successfully status in the task list.
Create the report on results of update installation of third-party software (optional)
To view detailed statistics on the update installation, create the Report on results of installation of third-party software updates.

How-to instructions:
- Administration Console: Creating and viewing a report
- Kaspersky Security Center Web Console: Generating and viewing a report

Results

If you have created and configured the Install required updates and fix vulnerabilities task, the updates are installed on the managed devices automatically. When new updates are downloaded to the Administration Server repository, Kaspersky Security Center checks whether they meet the criteria specified in the update rules. All new updates that meet the criteria will be installed automatically at the next task run.

If you have created the Install Windows Update updates task, only those updates specified in the Install Windows Update updates task properties are installed. In future, if you want to install new updates downloaded to the Administration Server repository, you must add the required updates to the list of updates in the existing task or create a new Install Windows Update updates task.

Approving and declining software updates

Synchronizing updates from Windows Update with Administration Server

Installing updates on devices manually

Configuring Windows updates in a Network Agent policy

Page top

[Topic 61490]

Viewing information about available updates for third-party applications

To view a list of available updates for third-party applications installed on client devices,

In the Advanced → Application management folder in the console tree, select the Software updates subfolder.

In the workspace of the folder, you can view a list of available updates for applications installed on devices.

To view the properties of an update,

In the workspace of the Software updates folder, in the context menu of the update, select Properties.

The following information is available for viewing in the properties window of the update:

On the General section you can view the Update approval status:
- Undefined—the update is available in the list of updates, but is not approved for installation.
- Approved—the update is available in the list of updates and approved for installation.
- Declined—the update is declined for installation.
On the Attributes section you can view the values of the Installed automatically field:
- The Automatically value is displayed if the Install required updates and fix vulnerabilities task can install updates for the application. The task automatically installs new updates from the web address provided by the vendor of third-party software.
- The Manually value is displayed if Kaspersky Security Center cannot install updates for the application automatically. You can install updates manually.
The Installed automatically field is not displayed for Windows application updates.
List of client devices for which the update is intended.
List of system components (prerequisites) that have to be installed before the update (if any).
Software vulnerabilities that the update will fix.

See also:

Scenario: Updating third-party software

Page top

[Topic 155093]

Approving and declining software updates

The settings of an update installation task may require approval of updates that are to be installed. You can approve updates that must be installed and decline updates that must not be installed.

For example, you may want to first check the installation of updates in a test environment and make sure that they do not interfere with the operation of devices, and only then allow the installation of these updates on client devices.

The usage of the Approved status to manage third-party update installation is efficient for a small amount of updates. To install multiple third-party updates, use the rules that you can configure in the Install required updates and fix vulnerabilities task. We recommend that you set the Approved status for only those specific updates that do not meet the criteria specified in the rules. When you manually approve a large amount of updates, performance of Administration Server decreases and may lead to Administration Server overload.

To approve or decline one or several updates:

In the console tree, select the Advanced → Application management → Software updates node.
In the workspace of the Software updates folder, click the Refresh button in the upper right corner. A list of updates appears.
Select the updates that you want to approve or decline.
The information box for the selected objects appears on the right side of the workspace.
In the Update approval status drop-down list, select Approved to approve the selected updates or Declined to decline the selected updates.
The default value is Undefined.

The updates for which you set the Approved status are placed in a queue for installation.

The updates for which you set the Declined status are uninstalled (if possible) from all devices on which they were previously installed. Also, they will not be installed on other devices in future.

Some updates for Kaspersky applications cannot be uninstalled. If you set the Declined status for them, Kaspersky Security Center will not uninstall these updates from the devices on which they were previously installed. However, these updates will never be installed on other devices in future. If an update for Kaspersky applications cannot be uninstalled, this property is displayed in the update properties window: in the Sections pane select General, and in the workspace the property will appear under Installation requirements. If you set the Declined status for third-party software updates, these updates will not be installed on devices for which they were planned but have not yet been installed. Updates will still remain on devices on which they were already installed. If you have to delete them, you can manually delete them locally.

Scenario: Updating third-party software

Page top

[Topic 61470]

Synchronizing updates from Windows Update with Administration Server

If you have selected Use Administration Server as a WSUS server in the Update management settings window of the quick start wizard, the Windows Update synchronization task is created automatically. You can run the task in the Tasks folder. The functionality of a Microsoft software update is only available after the Perform Windows Update synchronization task is successfully completed.

Microsoft software updates may exceed 10 GB. Ensure that the Administration Server database is capable of accommodating such volumes; otherwise, the Perform Windows Update synchronization task will fail. The Microsoft SQL Express database is not supported for the Perform Windows Update synchronization task.

The Perform Windows Update synchronization task only downloads metadata from Microsoft servers. If the network does not use a WSUS server, each client device downloads Microsoft updates from external servers independently.

To create a task for synchronizing Windows Updates with Administration Server:

In the Advanced → Application management folder in the console tree, select the Software updates subfolder.
Click the Additional actions button and select Configure Windows Update synchronization in the drop-down list.
The wizard creates the Perform Windows Update synchronization task displayed in the Tasks folder.

The Windows update center data retrieval task creation wizard starts. Follow the instructions of the wizard.

You can also create the Windows Update synchronization task in the Tasks folder by clicking Create a task.

Microsoft regularly deletes outdated updates from the company's servers so the number of current updates is always between 200,000 and 300,000. To reduce disk space usage and database size, Kaspersky Security Center deletes the outdated updates that are no longer present on Microsoft update servers.

When running the Perform Windows Update synchronization task, the application receives a list of current updates from a Microsoft update server. Next, Kaspersky Security Center compiles a list of updates that have become outdated. At the next start of the Find vulnerabilities and required updates task, Kaspersky Security Center flags all outdated updates and sets the deletion time for them. At the next start of the Perform Windows Update synchronization task, all updates flagged for deletion 30 days ago are deleted. Kaspersky Security Center also checks for outdated updates that were flagged for deletion more than 180 days ago, and then deletes those older updates.

When the Perform Windows Update synchronization task completes and outdated updates are deleted, the database may still have the hash codes pertaining to the files of deleted updates, as well as corresponding files in the %AllUsersProfile%\Application Data\KasperskyLab\adminkit\1093\.working\wusfiles files (if they were downloaded earlier). You can run the Administration Server maintenance task to delete these outdated records from the database and corresponding files.

In this section

Step 1. Defining whether to reduce traffic

Step 2. Applications

Step 3. Update categories

Step 4. Updates languages

Step 5. Selecting the account to start the task

Step 6. Configuring a task start schedule

Step 7. Defining the task name

Step 8. Completing creation of the task

See also:

Scenario: Updating third-party software

Page top

[Topic 150232]

Step 1. Defining whether to reduce traffic

When Kaspersky Security Center synchronizes updates with Microsoft Windows Update Servers, information about all files is saved in the Administration Server database. All files required for an update are also downloaded to the drive during interaction with the Windows Update Agent. In particular, Kaspersky Security Center saves information about express update files to the database and downloads them when necessary. Downloading express update files leads to decreased free space on the drive.

To avoid a decrease in disk space volume and to reduce traffic, you can disable the Download express installation files option.

If this option is selected, express update files are downloaded when running the task. By default, this option is not selected.

Scenario: Updating third-party software

Page top

[Topic 150233]

Step 2. Applications

In this section you can select applications for which updates will be downloaded.

If the All applications check box is selected, updates will be downloaded for all existing applications, and for all applications that may be released in the future.

By default, the All applications check box is selected.

Scenario: Updating third-party software

Page top

[Topic 150238]

Step 3. Update categories

In this section, you can select categories of updates that will be downloaded to the Administration Server.

If the All categories check box is selected, updates will be downloaded for all existing updates categories, and for all categories that may appear in the future.

By default, the All categories check box is selected.

Scenario: Updating third-party software

Page top

[Topic 150240]

Step 4. Updates languages

Expand all | Collapse all

In this window you can select localization languages of updates that will be downloaded to Administration Server. Select one of the following options for downloading localization languages of updates:

Download all languages, including new ones
If this option is selected, all the available localization languages of updates will be downloaded to Administration Server. By default, this option is selected.
Download selected languages
If this option is selected, you can select from the list localization languages of updates that should be downloaded to Administration Server.

Scenario: Updating third-party software

Page top

[Topic 150258]

Step 5. Selecting the account to start the task

Expand all | Collapse all

In the Selecting an account to run the task window, you can specify which account to use when running the task. Select one of the following options:

Default account
The task will be run under the same account as the application that performs this task.

By default, this option is selected.
Specify account
Fill in the Account and Password fields to specify the details of an account under which the task is run. The account must have sufficient rights for this task.
- Account
  Account under which the task is run.
- Password
  Password of the account under which the task will be run.

Scenario: Updating third-party software

Page top

[Topic 150260]

Step 6. Configuring a task start schedule

Expand all | Collapse all

On the Configure task schedule wizard page, you can create a schedule for task start. If necessary, specify the following settings:

Scheduled start:
Select the schedule according to which the task runs, and configure the selected schedule.
- Every N hours
  The task runs regularly, with the specified interval in hours, starting from the specified date and time.
  
  By default, the task runs every 6 hours, starting from the current system date and time.
- Every N days
  The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
  
  By default, the task runs every day, starting from the current system date and time.
- Every N weeks
  The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
  
  By default, the task runs every Monday at the current system time.
- Every N minutes
  The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
  
  By default, the task runs every 30 minutes, starting from the current system time.
- Daily (daylight saving time is not supported)
  The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
  
  We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
  
  By default, the task starts every day at the current system time.
- Weekly
  The task runs every week on the specified day and at the specified time.
- By days of week
  The task runs regularly, on the specified days of the week, at the specified time.
  
  By default, the task runs every Friday at 6:00:00 PM.
- Monthly
  The task runs regularly, on the specified day of the month, at the specified time.
  
  In months that lack the specified day, the task runs on the last day.
  
  By default, the task runs on the first day of each month, at the current system time.
- Manually
  The task does not run automatically. You can only start it manually.
  
  By default, this option is selected.
- Once
  The task runs once, on the specified date and time (by default, on the day when the task was created).
- Every month on specified days of selected weeks
  The task runs regularly, on the specified days of each month, at the specified time.
  
  By default, no days of month are selected. The default start time is 18:00.
- On virus outbreak
  The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
  - Anti-virus for workstations and file servers
  - Anti-virus for perimeter defense
  - Anti-virus for mail systems
  By default, all application types are selected.
  
  You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
- On completing another task
  The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
  
  You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
  
  If necessary, you can search, sort, and filter the tasks in the table as follows:
  - Enter the task name in the search field, to search the task by its name.
  - Click the sort icon to sort the tasks by name.
    By default, the tasks are sorted in alphabetical ascending order.
  - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
Run missed tasks
This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.

If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.

If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.

By default, this option is disabled.
Use automatically randomized delay for task starts
If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.

If this option is disabled, the task starts on client devices according to the schedule.
Use randomized delay for task starts within an interval of (min)
If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

If this option is disabled, the task starts on client devices according to the schedule.

By default, this option is disabled. The default time interval is one minute.

Scenario: Updating third-party software

Page top

[Topic 150263]

Step 7. Defining the task name

In the Define the task name window, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).The default value is Perform Windows Update synchronization.

Scenario: Updating third-party software

Page top

[Topic 150264]

Step 8. Completing creation of the task

In the Finish task creation window, click the Finish button to finish the wizard.

If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

The newly created Windows Update synchronization task will appear in the list of tasks in the Tasks folder of the console tree.

Scenario: Updating third-party software

Page top

[Topic 61471]

Installing updates on devices manually

Expand all | Collapse all

If you have selected Find and install required updates on the Update management settings page of the quick start wizard, the Install required updates and fix vulnerabilities task is created automatically. You can run or stop the task in the Managed devices folder on the Tasks tab.

If you have selected Search for required updates in the quick start wizard, you can install software updates on client devices through the Install required updates and fix vulnerabilities task.

You can do any of the following:

Create a task for installing updates.
Add a rule for installing an update to an existing update installation task.
In the settings of an existing update installation task, configure a test installation of updates.

Installing updates by creating an installation task

You can do any of the following:

Create a task for installing certain updates.
Select an update and create a task for installing it and similar updates.

To install specific updates:

In the Advanced → Application management folder in the console tree, select the Software updates subfolder.
In the workspace, select the updates that you want to install.
Do any of the following:
- Right-click one of the selected updates in the list, and then select Install update → New task.
- Click the Install update (create task) link in the information box for the selected updates.
Make your choice in the displayed prompt about installing all previous application updates. Click Yes if you agree to the installation of successive application versions incrementally if this is required for installing the selected updates. Click No if you want to update applications in a straightforward fashion, without installing successive versions. If installing the selected updates is not possible without installing previous versions of applications, the updating of the application fails.
The Updates installation and vulnerabilities fix task creation wizard starts. Follow the steps of the wizard.
On the Selecting an operating system restart option page of the wizard, select the action to perform when the operating system on client devices must be restarted after the operation:
- Do not restart the device
  Client devices are not restarted automatically after the operation. To complete the operation, you must restart a device (for example, manually or through a device management task). Information about the required restart is saved in the task results and in the device status. This option is suitable for tasks on servers and other devices where continuous operation is critical.
- Restart the device
  Client devices are always restarted automatically if a restart is required for completion of the operation. This option is useful for tasks on devices that provide for regular pauses in their operation (shutdown or restart).
- Prompt user for action
  The restart reminder is displayed on the screen of the client device, prompting the user to restart it manually. Some advanced settings can be defined for this option: text of the message for the user, the message display frequency, and the time interval after which a restart will be forced (without the user's confirmation). This option is most suitable for workstations where users must be able to select the most convenient time for a restart.
  
  By default, this option is selected.
  - Repeat prompt every (min)
    If this option is enabled, the application prompts the user to restart the operating system with the specified frequency.
    
    By default, this option is enabled. The default interval is 5 minutes. Available values are between 1 and 1440 minutes.
    
    If this option is disabled, the prompt is displayed only once.
  - Restart after (min)
    After prompting the user, the application forces restart of the operating system upon expiration of the specified time interval.
    
    By default, this option is enabled. The default delay is 30 minutes. Available values are between 1 and 1440 minutes.
- Force closure of applications in blocked sessions
  Running applications may prevent a restart of the client device. For example, if a document is being edited in a word processing application and is not saved, the application does not allow the device to restart.
  
  If this option is enabled, such applications on a locked device are forced to close before the device restart. As a result, users may lose their unsaved changes.
  
  If this option is disabled, a locked device is not restarted. The task status on this device states that a device restart is required. Users have to manually close all applications running on locked devices and restart these devices.
  
  By default, this option is disabled.
On the Configure task schedule page of the wizard, you can create a schedule for task start. If necessary, specify the following settings:
- Scheduled start:
  Select the schedule according to which the task runs, and configure the selected schedule.
  - Every N hours
    The task runs regularly, with the specified interval in hours, starting from the specified date and time.
    
    By default, the task runs every 6 hours, starting from the current system date and time.
  - Every N days
    The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
    
    By default, the task runs every day, starting from the current system date and time.
  - Every N weeks
    The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
    
    By default, the task runs every Monday at the current system time.
  - Every N minutes
    The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
    
    By default, the task runs every 30 minutes, starting from the current system time.
  - Daily (daylight saving time is not supported)
    The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
    
    We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
    
    By default, the task starts every day at the current system time.
  - Weekly
    The task runs every week on the specified day and at the specified time.
  - By days of week
    The task runs regularly, on the specified days of the week, at the specified time.
    
    By default, the task runs every Friday at 6:00:00 PM.
  - Monthly
    The task runs regularly, on the specified day of the month, at the specified time.
    
    In months that lack the specified day, the task runs on the last day.
    
    By default, the task runs on the first day of each month, at the current system time.
  - Manually
    The task does not run automatically. You can only start it manually.
    
    By default, this option is selected.
  - Every month on specified days of selected weeks
    The task runs regularly, on the specified days of each month, at the specified time.
    
    By default, no days of month are selected. The default start time is 18:00.
  - On virus outbreak
    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
    - Anti-virus for workstations and file servers
    - Anti-virus for perimeter defense
    - Anti-virus for mail systems
    By default, all application types are selected.
    
    You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
  - On completing another task
    The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
    
    You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
    
    If necessary, you can search, sort, and filter the tasks in the table as follows:
    - Enter the task name in the search field, to search the task by its name.
    - Click the sort icon to sort the tasks by name.
      By default, the tasks are sorted in alphabetical ascending order.
    - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
- Run missed tasks
  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.
  
  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.
  
  If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.
  
  By default, this option is disabled.
- Use automatically randomized delay for task starts
  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.
  
  If this option is disabled, the task starts on client devices according to the schedule.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  If this option is disabled, the task starts on client devices according to the schedule.
  
  By default, this option is disabled. The default time interval is one minute.
On the Define the task name page of the wizard, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
On the Finish task creation page of the wizard, click the Finish button to close the wizard.
If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

After the wizard completes its operation, Install required updates and fix vulnerabilities appears in the Tasks folder.

You can enable automatic installation of system components (prerequisites) prior to installation of an update in the Install required updates and fix vulnerabilities task properties. When this option is enabled, all required system components are installed before the update. A list of the required components can be found in properties of the update.

In the properties of Install required updates and fix vulnerabilities task, you can allow installation of updates that upgrade application to a new version.

If the task settings provide rules for installation of third-party updates, the Administration Server downloads all relevant updates from their vendors' websites. Updates are saved to the Administration Server repository and then distributed and installed on devices where they are applicable.

If the task settings provide rules for installation of Microsoft updates and the Administration Server acts as a WSUS server, the Administration Server downloads all relevant updates to the repository and then distributes them to managed devices. If the network does not use a WSUS server, each client device downloads Microsoft updates from external servers independently.

To install a certain update and similar ones:

In the Advanced → Application management folder in the console tree, select the Software updates subfolder.
In the workspace, select the update that you want to install.
Click the Run Update installation wizard button.
The Update installation wizard starts.

The Update installation wizard features are only available under the Vulnerability and patch management license.

Follow the steps of the wizard.
On the Search for existing update installation tasks page, specify the following settings:
- Search for tasks that install this update
  If this option is enabled, the Update installation wizard searches for existing tasks that install the selected update.
  
  If this option is disabled or if the search retrieves no applicable tasks, the Update installation wizard prompts you to create a rule or task for installing the update.
  
  By default, this option is enabled.
- Approve update installation
  The selected update will be approved for installation. Enable this option if some applied rules of update installation allow installation of approved updates only.
  
  By default, this option is disabled.
If you choose to search for existing update installation tasks and if the search retrieves some tasks, you can view properties of these tasks or start them manually. No further actions are required.
Otherwise, click the New update installation task button.
Select the type of the installation rule to be added to the new task, and then click the Finish button.
Make your choice in the displayed prompt about installing all previous application updates. Click Yes if you agree to the installation of successive application versions incrementally if this is required for installing the selected updates. Click No if you want to update applications in a straightforward fashion, without installing successive versions. If installing the selected updates is not possible without installing previous versions of applications, the updating of the application fails.
The Updates installation and vulnerabilities fix task creation wizard starts. Follow the steps of the wizard.
On the Selecting an operating system restart option page of the wizard, select the action to perform when the operating system on client devices must be restarted after the operation:
- Do not restart the device
  Client devices are not restarted automatically after the operation. To complete the operation, you must restart a device (for example, manually or through a device management task). Information about the required restart is saved in the task results and in the device status. This option is suitable for tasks on servers and other devices where continuous operation is critical.
- Restart the device
  Client devices are always restarted automatically if a restart is required for completion of the operation. This option is useful for tasks on devices that provide for regular pauses in their operation (shutdown or restart).
- Prompt user for action
  The restart reminder is displayed on the screen of the client device, prompting the user to restart it manually. Some advanced settings can be defined for this option: text of the message for the user, the message display frequency, and the time interval after which a restart will be forced (without the user's confirmation). This option is most suitable for workstations where users must be able to select the most convenient time for a restart.
  
  By default, this option is selected.
  - Repeat prompt every (min)
    If this option is enabled, the application prompts the user to restart the operating system with the specified frequency.
    
    By default, this option is enabled. The default interval is 5 minutes. Available values are between 1 and 1440 minutes.
    
    If this option is disabled, the prompt is displayed only once.
  - Restart after (min)
    After prompting the user, the application forces restart of the operating system upon expiration of the specified time interval.
    
    By default, this option is enabled. The default delay is 30 minutes. Available values are between 1 and 1440 minutes.
- Force closure of applications in blocked sessions
  Running applications may prevent a restart of the client device. For example, if a document is being edited in a word processing application and is not saved, the application does not allow the device to restart.
  
  If this option is enabled, such applications on a locked device are forced to close before the device restart. As a result, users may lose their unsaved changes.
  
  If this option is disabled, a locked device is not restarted. The task status on this device states that a device restart is required. Users have to manually close all applications running on locked devices and restart these devices.
  
  By default, this option is disabled.
On the Select devices to which the task will be assigned page of the wizard, select one of the following options:
- Select networked devices detected by Administration Server
  The task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
  
  For example, you may want to use this option in a task of installing Network Agent on unassigned devices.
- Specify device addresses manually or import addresses from a list
  You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
  
  You may want to use this option to execute a task for a specific subnet. For example, you may want to install a certain application on devices of accountants or to scan devices in a subnet that is probably infected.
- Assign task to a device selection
  The task is assigned to devices included in a device selection. You can specify one of the existing selections.
  
  For example, you may want to use this option to run a task on devices with a specific operating system version.
- Assign task to an administration group
  The task is assigned to devices included in an administration group. You can specify one of the existing groups or create a new one.
  
  For example, you may want to use this option to run a task of sending a message to users if the message is specific for devices included in a specific administration group.
  
  If a task is assigned to an administration group, the Security tab is not displayed in the task properties window because group tasks are subject to the security settings of the groups to which they apply.
On the Configure task schedule page of the wizard, you can create a schedule for task start. If necessary, specify the following settings:
- Scheduled start:
  Select the schedule according to which the task runs, and configure the selected schedule.
  - Every N hours
    The task runs regularly, with the specified interval in hours, starting from the specified date and time.
    
    By default, the task runs every 6 hours, starting from the current system date and time.
  - Every N days
    The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
    
    By default, the task runs every day, starting from the current system date and time.
  - Every N weeks
    The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
    
    By default, the task runs every Monday at the current system time.
  - Every N minutes
    The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
    
    By default, the task runs every 30 minutes, starting from the current system time.
  - Daily (daylight saving time is not supported)
    The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
    
    We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
    
    By default, the task starts every day at the current system time.
  - Weekly
    The task runs every week on the specified day and at the specified time.
  - By days of week
    The task runs regularly, on the specified days of the week, at the specified time.
    
    By default, the task runs every Friday at 6:00:00 PM.
  - Monthly
    The task runs regularly, on the specified day of the month, at the specified time.
    
    In months that lack the specified day, the task runs on the last day.
    
    By default, the task runs on the first day of each month, at the current system time.
  - Manually (selected by default)
    The task does not run automatically. You can only start it manually.
    
    By default, this option is selected.
  - Every month on specified days of selected weeks
    The task runs regularly, on the specified days of each month, at the specified time.
    
    By default, no days of month are selected. The default start time is 18:00.
  - On virus outbreak
    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
    - Anti-virus for workstations and file servers
    - Anti-virus for perimeter defense
    - Anti-virus for mail systems
    By default, all application types are selected.
    
    You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
  - On completing another task
    The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
    
    You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
    
    If necessary, you can search, sort, and filter the tasks in the table as follows:
    - Enter the task name in the search field, to search the task by its name.
    - Click the sort icon to sort the tasks by name.
      By default, the tasks are sorted in alphabetical ascending order.
    - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
- Run missed tasks
  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.
  
  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.
  
  If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.
  
  By default, this option is disabled.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.
  
  If this option is disabled, the task starts on client devices according to the schedule.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  If this option is disabled, the task starts on client devices according to the schedule.
  
  By default, this option is disabled. The default time interval is one minute.
On the Define the task name page of the wizard, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
On the Finish task creation page of the wizard, click the Finish button to close the wizard.
If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

When the wizard finishes, the Install required updates and fix vulnerabilities task is created and displayed in the Tasks folder.

In addition to the settings that you specify during task creation, you can change other properties of a created task.

Upgrading to a new version of the application may cause a malfunction of dependent applications on devices.

Installing an update by adding a rule to an existing installation task

To install an update by adding a rule to an existing installation task:

In the Advanced → Application management folder in the console tree, select the Software updates subfolder.
In the workspace, select the update that you want to install.
Click the Run Update installation wizard button.
The Update installation wizard starts.

The Update installation wizard features are only available under the Vulnerability and patch management license.

Follow the steps of the wizard.
On the Search for existing update installation tasks page, specify the following settings:
- Search for tasks that install this update
  If this option is enabled, the Update installation wizard searches for existing tasks that install the selected update.
  
  If this option is disabled or if the search retrieves no applicable tasks, the Update installation wizard prompts you to create a rule or task for installing the update.
  
  By default, this option is enabled.
- Approve update installation
  The selected update will be approved for installation. Enable this option if some applied rules of update installation allow installation of approved updates only.
  
  By default, this option is disabled.
If you choose to search for existing update installation tasks and if the search retrieves some tasks, you can view properties of these tasks or start them manually. No further actions are required.
Otherwise, click the Add an update installation rule button.
Select the task to which you want to add a rule, and then click the Add rule button.
Also, you can view properties of the existing tasks, start them manually, or create a new task.
Select the type of the rule to be added to the selected task, and then click the Finish button.
Make your choice in the displayed prompt about installing all previous application updates. Click Yes if you agree to the installation of successive application versions incrementally if this is required for installing the selected updates. Click No if you want to update applications in a straightforward fashion, without installing successive versions. If installing the selected updates is not possible without installing previous versions of applications, the updating of the application fails.

A new rule for installing the update is added to the existing Install required updates and fix vulnerabilities task.

Configuring a test installation of updates

To configure a test installation of updates:

In the console tree, select the Install required updates and fix vulnerabilities task in the Managed devices folder on the Tasks tab.
In the context menu of the task, select Properties.
The properties window of the Install required updates and fix vulnerabilities task opens.
In the properties window of the task, in the Test installation section select one of the available options for test installation:
- Do not scan. Select this option if you do not want to perform a test installation of updates.
- Run scan on selected devices. Select this option if you want to test updates installation on selected devices. Click the Add button and select devices on which you need to perform test installation of updates.
- Run scan on devices in the specified group. Select this option if you want to test updates installation on a group of devices. In the Specify a test group field, specify a group of devices on which you want to perform a test installation.
- Run scan on specified percentage of devices. Select this option if you want to test updates installation on some portion of devices. In the Percentage of test devices out of all target devices field, specify the percentage of devices on which you want to perform a test installation of updates.
Upon selecting any option except Do not scan, in the Amount of time to make the decision if the installation is to be continued, in hours field specify the number of hours that must elapse from the test installation of updates until the start of installation of the updates on all devices.

See also:

Scenario: Updating third-party software

Page top

[Topic 61495]

Configuring Windows updates in a Network Agent policy

Expand all | Collapse all

To configure Windows Updates in a Network Agent policy:

In the console tree, select Managed devices.
In the workspace, select the Policies tab.
Select a Network Agent policy.
In the context menu of the policy, select Properties.
The properties window for the Network Agent policy opens.
In the Sections pane, select Software updates and vulnerabilities.
Select the Use Administration Server as a WSUS server option to download Windows updates to the Administration Server and then distribute them to client devices through Network Agent.
If this option is not selected, Windows updates are not downloaded to the Administration Server. In this case, client devices receive Windows updates directly from Microsoft servers.
Select the set of updates that the users can install on their devices manually by using Windows Update.
On devices running Windows 10, if Windows Update has already found updates for the device, the new option that you select under Allow users to manage installation of Windows Update updates will be applied only after the updates found are installed.

Select an item in the drop-down list:
- Allow users to install all applicable Windows Update updates
  Users can install all of the Microsoft Windows Update updates that are applicable to their devices.
  
  Select this option if you do not want to interfere in the installation of updates.
  
  When the user installs Microsoft Windows Update updates manually, the updates may be downloaded from Microsoft servers rather than from Administration Server. This is possible if Administration Server has not yet downloaded these updates. Downloading updates from Microsoft servers results in extra traffic.
- Allow users to install only approved Windows Update updates
  Users can install all of the Microsoft Windows Update updates that are applicable to their devices and that are approved by you.
  
  For example, you may want to first check the installation of updates in a test environment and make sure that they do not interfere with the operation of devices, and only then allow the installation of these approved updates on client devices.
  
  When the user installs Microsoft Windows Update updates manually, the updates may be downloaded from Microsoft servers rather than from Administration Server. This is possible if Administration Server has not yet downloaded these updates. Downloading updates from Microsoft servers results in extra traffic.
- Do not allow users to install Windows Update updates
  Users cannot install Microsoft Windows Update updates on their devices manually. All of the applicable updates are installed as configured by you.
  
  Select this option if you want to manage the installation of updates centrally.
  
  For example, you may want to optimize the update schedule so that the network does not become overloaded. You can schedule after-hours updates, so that they do not interfere with user productivity.
Select the Windows Update search mode:
- Active
  If this option is selected, Administration Server with support from Network Agent initiates a request from Windows Update Agent on the client device to the update source: Windows Update Servers or WSUS. Next, Network Agent passes information received from Windows Update Agent to Administration Server.
  
  The option takes effect only if Connect to the update server to update data option of the Find vulnerabilities and required updates task is selected.
  
  By default, this option is selected.
- Passive
  If you select this option, Network Agent periodically passes Administration Server information about updates retrieved at the last synchronization of Windows Update Agent with the update source. If no synchronization of Windows Update Agent with an update source is performed, information about updates on Administration Server becomes out-of-date.
  
  Select this option if you want to get updates from the memory cache of the update source.
- Disabled
  If this option is selected, Administration Server does not request any information about updates.
  
  Select this option if, for example, you want to test the updates on your local device first.
Select the Scan executable files for vulnerabilities when running them option if you want to scan executable files for vulnerabilities while the files are being run.
Make sure that editing is locked for all the settings that you have changed. Otherwise, the changes do not apply.
Click Apply.

See also:

Scenario: Updating third-party software

Page top

[Topic 52462]

Fixing third-party software vulnerabilities

This section describes the features of Kaspersky Security Center that relate to fixing vulnerabilities in the software installed on managed devices.

In this section

Scenario: Finding and fixing third-party software vulnerabilities

About finding and fixing software vulnerabilities

Viewing information about software vulnerabilities

Viewing statistics of vulnerabilities on managed devices

Scanning applications for vulnerabilities

Fixing vulnerabilities in applications

Fixing vulnerabilities in an isolated network

Ignoring software vulnerabilities

Selecting user fixes for vulnerabilities in third-party software

Rules for update installation

Page top

[Topic 184124]

Scenario: Finding and fixing third-party software vulnerabilities

This section provides a scenario for finding and fixing vulnerabilities on the managed devices running Windows. You can find and fix software vulnerabilities in the operating system and in third-party software, including Microsoft software.

Prerequisites

Kaspersky Security Center is deployed in your organization.
There are managed devices running Windows in your organization.
Internet connection is required for Administration Server to perform the following tasks:
- To make a list of recommended fixes for vulnerabilities in Microsoft software. The list is created and regularly updated by Kaspersky specialists.
- To fix vulnerabilities in third-part software other than Microsoft software.

Stages

Finding and fixing software vulnerabilities proceeds in stages:

Scanning for vulnerabilities in the software installed on the managed devices
To find vulnerabilities in the software installed on the managed devices, run the Find vulnerabilities and required updates task. When this task is complete, Kaspersky Security Center receives the lists of detected vulnerabilities and required updates for the third-party software installed on the devices that you specified in the task properties.

The Find vulnerabilities and required updates task is created automatically by Kaspersky Security Center quick start wizard. If you did not run the wizard, start it now or create the task manually.

How-to instructions:
- Administration Console: Scanning applications for vulnerabilities, Scheduling the Find vulnerabilities and required updates task
- Kaspersky Security Center Web Console: Creating the Find vulnerabilities and required updates task, Find vulnerabilities and required updates task settings
Analyzing the list of detected software vulnerabilities
View the Software vulnerabilities list and decide which vulnerabilities are to be fixed. To view detailed information about each vulnerability, click the vulnerability name in the list. For each vulnerability in the list, you can also view the statistics on the vulnerability on managed devices.

How-to instructions:
- Administration Console: Viewing information about software vulnerabilities, Viewing statistics of vulnerabilities on managed devices
- Kaspersky Security Center Web Console: Viewing information about software vulnerabilities, Viewing statistics of vulnerabilities on managed devices
Configuring vulnerabilities fix
When the software vulnerabilities are detected, you can fix the software vulnerabilities on the managed devices by using the Install required updates and fix vulnerabilities task or the Fix vulnerabilities task.

The Install required updates and fix vulnerabilities task is used to update and fix vulnerabilities in third-party software, including Microsoft software, installed on the managed devices. This task allows you to install multiple updates and fix multiple vulnerabilities according to certain rules. Note that this task can be created only if you have the license for the Vulnerability and patch management feature. To fix software vulnerabilities the Install required updates and fix vulnerabilities task uses recommended software updates.

The Fix vulnerabilities task does not require the license option for the Vulnerability and patch management feature. To use this task, you must manually specify user fixes for vulnerabilities in third-party software listed in the task settings. The Fix vulnerabilities task uses recommended fixes for Microsoft software and user fixes for third-party software.

You can start Vulnerability fix wizard that creates one of these tasks automatically, or you can create one of these tasks manually.

How-to instructions:
- Administration Console: Selecting user fixes for vulnerabilities in third-party software, Fixing vulnerabilities in applications
- Kaspersky Security Center Web Console: Selecting user fixes for vulnerabilities in third-party software, Fixing vulnerabilities in third-party software, Creating the Install required updates and fix vulnerabilities task
Scheduling the tasks
To be sure that the vulnerabilities list is always up-to-date, schedule the Find vulnerabilities and required updates task to run it automatically from time to time. The recommended average frequency is once a week.

If you have created the Install required updates and fix vulnerabilities task, you can schedule it to run with the same frequency as the Find vulnerabilities and required updates task or less often. When scheduling the Fix vulnerabilities task, note that you have to select fixes for Microsoft software or specify user fixes for third-party software every time before starting the task.

When scheduling the tasks, make sure that a task to fix vulnerability starts after the Find vulnerabilities and required updates task is complete.
Ignoring software vulnerabilities (optional)
If you want, you can ignore software vulnerabilities to be fixed on all managed devices or only on the selected managed devices.

How-to instructions:
- Administration Console: Ignoring software vulnerabilities
- Kaspersky Security Center Web Console: Ignoring software vulnerabilities
Running a vulnerability fix task
Start the Install required updates and fix vulnerabilities task or the Fix vulnerability task. When the task is complete, make sure that it has the Completed successfully status in the task list.
Create the report on results of fixing software vulnerabilities (optional)
To view detailed statistics on the vulnerabilities fix, generate the Report on vulnerabilities. The report displays information about software vulnerabilities that are not fixed. Thus you can have an idea about finding and fixing vulnerabilities in third-party software, including Microsoft software, in your organization.

How-to instructions:
- Administration Console: Creating and viewing a report
- Kaspersky Security Center Web Console: Generating and viewing a report
Checking configuration of finding and fixing vulnerabilities in third-party software
Be sure that you have done the following:
- Obtained and reviewed the list of software vulnerabilities on managed devices
- Ignored software vulnerabilities if you wanted
- Configured the task to fix vulnerabilities
- Scheduled the tasks to find and to fix software vulnerabilities so that they start sequentially
- Checked that the task to fix software vulnerabilities was run

Results

If you have created and configured the Install required updates and fix vulnerabilities task, the vulnerabilities are fixed on the managed devices automatically. When the task is run, it correlates the list of available software updates to the rules specified in the task settings. All software updates that meet the criteria in the rules will be downloaded to the Administration Server repository and will be installed to fix software vulnerabilities.

If you have created the Fix vulnerabilities task, only software vulnerabilities in Microsoft software are fixed.

Page top

[Topic 183975]

About finding and fixing software vulnerabilities

Kaspersky Security Center detects and fixes software

vulnerabilities

on managed devices running Microsoft Windows families operating systems. Vulnerabilities are detected in the operating system and in third-party software, including Microsoft software.

Updates functionality (including providing anti-virus signature updates and codebase updates), as well as KSN functionality may not be available in the software in the U.S.

Finding software vulnerabilities

To find software vulnerabilities, Kaspersky Security Center uses characteristics from the database of known vulnerabilities. This database is created by Kaspersky specialists. It contains information about vulnerabilities, such as vulnerability description, vulnerability detect date, vulnerability severity level. You can find the details of software vulnerabilities on Kaspersky website.

Kaspersky Security Center uses the Find vulnerabilities and required updates task to find software vulnerabilities.

In certain cases vulnerabilities detected in a Microsoft Windows operating system can be fixed using either of the following methods:

Installing an update for the OS.
Upgrading the OS to a newer version (for example, from Windows 10 to Windows 11).

In this scenario KSC displays two entries for the same vulnerability.

Fixing software vulnerabilities

To fix software vulnerabilities Kaspersky Security Center uses software updates issued by the software vendors. The software updates metadata is downloaded to the Administration Server repository as a result of the following tasks run:

Download updates to the Administration Server repository. This task is intended to download updates metadata for Kaspersky and third-party software. This task is created automatically by the Kaspersky Security Center quick start wizard. You can create the Download updates to the Administration Server repository task manually.
Perform Windows Update synchronization. This task is intended to download updates metadata for Microsoft software.

Software updates to fix vulnerabilities can be represented as full distribution packages or patches. Software updates that fix software vulnerabilities are named fixes. Recommended fixes are those that are recommended for installation by Kaspersky specialists. User fixes are those that are manually specified for installation by users. To install a user fix, you have to create an installation package containing this fix.

If you have the Kaspersky Security Center license with the Vulnerability and patch management feature, to fix software vulnerabilities you can use Install required updates and fix vulnerabilities task. This task automatically fixes multiple vulnerabilities installing recommended fixes. For this task, you can manually configure certain rules to fix multiple vulnerabilities.

If you do not have the Kaspersky Security Center license with the Vulnerability and patch management feature, to fix software vulnerabilities, you can use the Fix vulnerabilities task. By means of this task, you can fix vulnerabilities by installing recommended fixes for Microsoft software and user fixes for other third-party software.

To fix some software vulnerabilities, you must accept the End User License Agreement (EULA) for installing the software if EULA acceptance is requested. If you decline the EULA, the software vulnerability is not fixed.

Page top

[Topic 61501]

Viewing information about software vulnerabilities

To view a list of vulnerabilities detected on client devices,

In the Advanced → Application management folder in the console tree, select the Software vulnerabilities subfolder.

The page displays a list of vulnerabilities in applications detected on managed devices.

To obtain information about a selected vulnerability,

Select Properties from the context menu of the vulnerability.

The properties window of the vulnerability opens, displaying the following information:

Application in which the vulnerability has been detected.
List of devices on which the vulnerability has been detected.
Information on whether the vulnerability has been fixed.

To view the report on all detected vulnerabilities,

In the Software vulnerabilities folder, click the View report on vulnerabilities link.

A report on vulnerabilities in applications installed on devices will be generated. You can view this report in the node with the name of the relevant Administration Server, by opening the Reports tab.

Page top

[Topic 191658]

Viewing statistics of vulnerabilities on managed devices

You can view statistics for each software vulnerability on managed devices. Statistics are represented as a diagram. The diagram displays the number of devices with the following statuses:

Ignored on: <number of devices>. This status is assigned if, in the vulnerability properties, you have manually set the option to ignore the vulnerability.
Fixed on: <number of devices>. This status is assigned if the task to fix the vulnerability has successfully completed.
Fix scheduled on: <number of devices>. This status is assigned if you have created the task to fix the vulnerability, but the task is not performed yet.
Patch applied on: <number of devices>. This status is assigned if you have manually selected a software update to fix the vulnerability, but this software update has not fixed the vulnerability.
Fix required on: <number of devices>. This status is assigned if the vulnerability was fixed only on some managed devices, and the vulnerability is required to be fixed on more managed devices.

To view the statistics of a vulnerability on managed devices:

In the Advanced → Application management folder in the console tree, select the Software vulnerabilities subfolder.
The page displays a list of vulnerabilities in applications detected on managed devices.
Select a vulnerability for which you want to view the statistics.
In the block for working with a selected object, a diagram of the vulnerability statuses is displayed. Clicking a status opens a list of devices on which the vulnerability has the selected status.

Page top

[Topic 61502]

Scanning applications for vulnerabilities

Expand all | Collapse all

If you have configured the application through the quick start wizard, the Vulnerability scan task is created automatically. You can view the task in the Managed devices folder, on the Tasks tab.

To create a task for vulnerability scanning in applications installed on client devices:

In the console tree, select Advanced → Application management, and then select the Software vulnerabilities subfolder.
In the workspace, select Additional actions → Configure vulnerability scan.
If a task for vulnerability scanning already exists, the Tasks tab of the Managed devices folder is displayed, with the existing task selected. Otherwise, the Find vulnerabilities and required updates task creation wizard starts. Follow the steps of the wizard.
In the Select the task type window, select Find vulnerabilities and required updates.
On the Settings page of the wizard, specify the task settings as follows:
- Search for vulnerabilities and updates listed by Microsoft
  When searching for vulnerabilities and updates, Kaspersky Security Center uses the information about applicable Microsoft updates from the source of Microsoft updates, which are available at the present moment.
  
  For example, you may want to disable this option if you have different tasks with different settings for Microsoft updates and updates of third-party applications.
  
  By default, this option is enabled.
  - Connect to the update server to update data
    Windows Update Agent on a managed device connects to the source of Microsoft updates. The following servers can act as a source of Microsoft updates:
    - Kaspersky Security Center Administration Server (see the settings of Network Agent policy)
    - Windows Server with Microsoft Windows Server Update Services (WSUS) deployed in your organization's network
    - Microsoft Updates servers
    If this option is enabled, Windows Update Agent on a managed device connects to the source of Microsoft updates to refresh the information about applicable Microsoft Windows updates.
    
    If this option is disabled, Windows Update Agent on a managed device uses the information about applicable Microsoft Windows updates that was received from the source of Microsoft updates earlier.
    
    Connecting to the source of Microsoft updates can be resource-consuming. You might want to disable this option if you set regular connection to this source of updates in another task or in the properties of Network Agent policy, in the section Software updates and vulnerabilities. If you do not want to disable this option, then, to reduce the Server overload, you can configure the task schedule to randomize delay for task starts within 360 minutes.
    
    By default, this option is enabled.
    
    Combination of the following options of the settings of Network Agent policy defines the mode of getting updates:
    - Windows Update Agent on a managed device connects to the Update Server to get updates only if the Connect to the update server to update data option is enabled in the properties of the Find vulnerabilities and required updates task and the Windows Update search mode option is set to Active in the settings of Network Agent policy.
    - If you do not need Network Agent to initiate a connection to the Microsoft Windows update source and download updates when performing the Vulnerability scan task, you can set the Windows Update search mode option to Passive, while the Connect to the update server to update data option must remain enabled. This allows for you to save resources and use previously received Windows updates to scan for vulnerabilities. You can use the passive mode if you configure receiving Microsoft Windows updates in a different way. If receiving Microsoft Windows updates is not configured in another way, do not set the Windows Update search mode option to Passive, because in this case, information about updates will never be received.
    - Irrespective of the Connect to the update server to update data option's status (enabled or disabled), if the Windows Update search mode option is set to Disabled, Kaspersky Security Center does not request any information about updates.
- Search for third-party vulnerabilities and updates listed by Kaspersky
  If this option is enabled, Kaspersky Security Center searches for vulnerabilities and required updates for third-party applications (applications made by software vendors other than Kaspersky and Microsoft) in Windows Registry and in the folders specified under Specify paths for advanced search of applications in file system. The full list of supported third-party applications is managed by Kaspersky.
  
  If this option is disabled, Kaspersky Security Center does not search for vulnerabilities and required updates for third-party applications. For example, you may want to disable this option if you have different tasks with different settings for Microsoft Windows updates and updates of third-party applications.
  
  By default, this option is enabled.
- Specify paths for advanced search of applications in file system
  The folders in which Kaspersky Security Center searches for third-party applications that require vulnerability fix and update installation. You can use system variables.
  
  Specify the folders to which applications are installed. By default, the list contains system folders to which most of the applications are installed.
- Enable advanced diagnostics
  If this feature is enabled, Network Agent writes traces even if tracing is disabled for Network Agent in Kaspersky Security Center Remote Diagnostics Utility. Traces are written to two files in turn; the total size of both files is determined by the Maximum size, in MB, of advanced diagnostics files value. When both files are full, Network Agent starts writing to them again. The files with traces are stored in the %WINDIR%\Temp folder. These files are accessible in the remote diagnostics utility, you can download or delete them there.
  
  If this feature is disabled, Network Agent writes traces according to the settings in Kaspersky Security Center Remote Diagnostics Utility. No additional traces are written.
  
  When creating a task, you do not have to enable advanced diagnostics. You may want to use this feature later if, for example, a task run fails on some of the devices and you want to get additional information during another task run.
  
  By default, this option is disabled.
- Maximum size, in MB, of advanced diagnostics files
  The default value is 100 MB, and available values are between 1 MB and 2048 MB. You may be asked to change the default value by Kaspersky Technical Support specialists when information in the advanced diagnostics files sent by you is not enough to troubleshoot the problem.
On the Configure task schedule page of the wizard, you can create a schedule for task start. If necessary, specify the following settings:
- Scheduled start:
  Select the schedule according to which the task runs, and configure the selected schedule.
  - Every N hours
    The task runs regularly, with the specified interval in hours, starting from the specified date and time.
    
    By default, the task runs every 6 hours, starting from the current system date and time.
  - Every N days
    The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
    
    By default, the task runs every day, starting from the current system date and time.
  - Every N weeks
    The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
    
    By default, the task runs every Monday at the current system time.
  - Every N minutes
    The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
    
    By default, the task runs every 30 minutes, starting from the current system time.
  - Daily (daylight saving time is not supported)
    The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
    
    We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
    
    By default, the task starts every day at the current system time.
  - Weekly
    The task runs every week on the specified day and at the specified time.
  - By days of week
    The task runs regularly, on the specified days of the week, at the specified time.
    
    By default, the task runs every Friday at 6:00:00 PM.
  - Monthly
    The task runs regularly, on the specified day of the month, at the specified time.
    
    In months that lack the specified day, the task runs on the last day.
    
    By default, the task runs on the first day of each month, at the current system time.
  - Manually
    The task does not run automatically. You can only start it manually.
    
    By default, this option is selected.
  - Every month on specified days of selected weeks
    The task runs regularly, on the specified days of each month, at the specified time.
    
    By default, no days of month are selected. The default start time is 18:00.
  - When new updates are downloaded to the repository
    The task runs after updates are downloaded to the repository. For example, you may want to use this schedule for the find vulnerabilities and required updates task.
  - On virus outbreak
    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
    - Anti-virus for workstations and file servers
    - Anti-virus for perimeter defense
    - Anti-virus for mail systems
    By default, all application types are selected.
    
    You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
  - On completing another task
    The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
    
    You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
    
    If necessary, you can search, sort, and filter the tasks in the table as follows:
    - Enter the task name in the search field, to search the task by its name.
    - Click the sort icon to sort the tasks by name.
      By default, the tasks are sorted in alphabetical ascending order.
    - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
- Run missed tasks
  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.
  
  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.
  
  If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.
  
  By default, this option is disabled.
- Use automatically randomized delay for task starts
  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.
  
  If this option is disabled, the task starts on client devices according to the schedule.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  If this option is disabled, the task starts on client devices according to the schedule.
  
  By default, this option is disabled. The default time interval is one minute.
On the Define the task name page of the wizard, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
On the Finish task creation page of the wizard, click the Finish button to close the wizard.
If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

After the wizard completes its operation, the Find vulnerabilities and required updates task appears in the list of tasks in the Managed devices folder, on the Tasks tab.

In addition to the settings that you specify during task creation, you can change other properties of a created task.

When the Find vulnerabilities and required updates task is complete, Administration Server displays a list of vulnerabilities found in applications installed on the device; it also displays all software updates required to fix the vulnerabilities detected.

If you encounter the 0x80240033 "Windows Update Agent error 80240033 ("License terms could not be downloaded.")", you can resolve this issue through the Windows Registry.

Administration Server does not display the list of required software updates when you sequentially run two tasks—the Perform Windows Update synchronization task that has the Download express installation files option disabled, and then the Find vulnerabilities and required updates task. In order to view the list of required software updates, you must run the Find vulnerabilities and required updates task again.

Network Agent receives information about any available Windows updates and other Microsoft product updates from Windows Update or the Administration Server, if the Administration Server acts as the WSUS server. Information is transmitted when applications are started (if this is provided for by the policy) and at each routine run of the Find vulnerabilities and required updates task on client devices.

Scenario: Finding and fixing third-party software vulnerabilities

Scenario: Updating third-party software

Page top

[Topic 61947]

Fixing vulnerabilities in applications

Expand all | Collapse all

If you have selected Find and install required updates on the Update management settings page of the quick start wizard, the Install required updates and fix vulnerabilities task is created automatically. The task is displayed in the workspace of the Managed devices folder, on the Tasks tab.

Otherwise, you can do any of the following:

Create a task for fixing vulnerabilities by installing available updates.
Add a rule for fixing a vulnerability to an existing vulnerability fix task.

Fixing vulnerabilities by creating a vulnerability fix task

You can do any of the following:

Create a task for fixing multiple vulnerabilities that meet certain rules.
Select a vulnerability and create a task for fixing it and similar vulnerabilities.

To fix vulnerabilities that meet certain rules:

In the console tree, select Administration Server on devices for which you want to fix vulnerabilities.
In the View menu of the main application window, select Configure interface.
In the window that opens, select the Display Vulnerability and Patch Management check box, and then click OK.
In the window with the application message, click OK.
Restart the Administration Console, so the changes take effect.
In the console tree, select the Managed devices folder.
In the workspace, select the Tasks tab.
Click the Create a task button to run the New task wizard. Follow the steps of the wizard.
On the Select the task type page of the wizard, select Install required updates and fix vulnerabilities.
If the task is not displayed, check whether your account has the Read, Modify, and Execute rights for the System management: Vulnerability and patch management functional area. You cannot create and configure the Install required updates and fix vulnerabilities task without these access rights.
On the Settings page of the wizard, specify the task settings as follows:
- Specify rules for installing updates
  These rules are applied to installation of updates on client devices. If rules are not specified, the task has nothing to perform. For information about operations with rules, refer to Rules for update installation.
- Start installation at device restart or shutdown
  If this option is enabled, updates are installed when the device is restarted or shut down. Otherwise, updates are installed according to a schedule.
  
  Use this option if installing the updates might affect the device performance.
  
  By default, this option is disabled.
- Install required general system components
  If this option is enabled, before installing an update the application automatically installs all general system components (prerequisites) that are required to install the update. For example, these prerequisites can be operating system updates.
  
  If this option is disabled, you may have to install the prerequisites manually.
  
  By default, this option is disabled.
- Allow installation of new application versions during updates
  If this option is enabled, updates are allowed when they result in installation of a new version of a software application.
  
  If this option is disabled, the software is not upgraded. You can then install new versions of the software manually or through another task. For example, you may use this option if your company infrastructure is not supported by a new software version or if you want to check an upgrade in a test infrastructure.
  
  By default, this option is enabled.
  
  Upgrading an application may cause malfunction of dependent applications installed on client devices.
- Download updates to the device without installing them
  If this option is enabled, the application downloads updates to the device but does not install them automatically. You can then Install downloaded updates manually.
  
  Microsoft updates are downloaded to the system Windows storage. Updates of third-party applications (applications made by software vendors other than Kaspersky and Microsoft) are downloaded to the folder specified in the Download updates to field.
  
  If this option is disabled, the updates are installed to the device automatically.
  
  By default, this option is disabled.
  - Download updates to
    This folder is used to download updates of third-party applications (applications made by software vendors other than Kaspersky and Microsoft).
- Enable advanced diagnostics
  If this feature is enabled, Network Agent writes traces even if tracing is disabled for Network Agent in Kaspersky Security Center Remote Diagnostics Utility. Traces are written to two files in turn; the total size of both files is determined by the Maximum size, in MB, of advanced diagnostics files value. When both files are full, Network Agent starts writing to them again. The files with traces are stored in the %WINDIR%\Temp folder. These files are accessible in the remote diagnostics utility, you can download or delete them there.
  
  If this feature is disabled, Network Agent writes traces according to the settings in Kaspersky Security Center Remote Diagnostics Utility. No additional traces are written.
  
  When creating a task, you do not have to enable advanced diagnostics. You may want to use this feature later if, for example, a task run fails on some of the devices and you want to get additional information during another task run.
  
  By default, this option is disabled.
  - Maximum size, in MB, of advanced diagnostics files
    The default value is 100 MB, and available values are between 1 MB and 2048 MB. You may be asked to change the default value by Kaspersky Technical Support specialists when information in the advanced diagnostics files sent by you is not enough to troubleshoot the problem.
On the Selecting an operating system restart option page of the wizard, select the action to perform when the operating system on client devices must be restarted after the operation:
- Do not restart the device
  Client devices are not restarted automatically after the operation. To complete the operation, you must restart a device (for example, manually or through a device management task). Information about the required restart is saved in the task results and in the device status. This option is suitable for tasks on servers and other devices where continuous operation is critical.
- Restart the device
  Client devices are always restarted automatically if a restart is required for completion of the operation. This option is useful for tasks on devices that provide for regular pauses in their operation (shutdown or restart).
- Prompt user for action
  The restart reminder is displayed on the screen of the client device, prompting the user to restart it manually. Some advanced settings can be defined for this option: text of the message for the user, the message display frequency, and the time interval after which a restart will be forced (without the user's confirmation). This option is most suitable for workstations where users must be able to select the most convenient time for a restart.
  
  By default, this option is selected.
  - Repeat prompt every (min)
    If this option is enabled, the application prompts the user to restart the operating system with the specified frequency.
    
    By default, this option is enabled. The default interval is 5 minutes. Available values are between 1 and 1440 minutes.
    
    If this option is disabled, the prompt is displayed only once.
  - Restart after (min)
    After prompting the user, the application forces restart of the operating system upon expiration of the specified time interval.
    
    By default, this option is enabled. The default delay is 30 minutes. Available values are between 1 and 1440 minutes.
- Force closure of applications in blocked sessions
  Running applications may prevent a restart of the client device. For example, if a document is being edited in a word processing application and is not saved, the application does not allow the device to restart.
  
  If this option is enabled, such applications on a locked device are forced to close before the device restart. As a result, users may lose their unsaved changes.
  
  If this option is disabled, a locked device is not restarted. The task status on this device states that a device restart is required. Users have to manually close all applications running on locked devices and restart these devices.
  
  By default, this option is disabled.
On the Configure task schedule page of the wizard, you can create a schedule for task start. If necessary, specify the following settings:
- Scheduled start:
  Select the schedule according to which the task runs, and configure the selected schedule.
  - Every N hours
    The task runs regularly, with the specified interval in hours, starting from the specified date and time.
    
    By default, the task runs every 6 hours, starting from the current system date and time.
  - Every N days
    The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
    
    By default, the task runs every day, starting from the current system date and time.
  - Every N weeks
    The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
    
    By default, the task runs every Monday at the current system time.
  - Every N minutes
    The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
    
    By default, the task runs every 30 minutes, starting from the current system time.
  - Daily (daylight saving time is not supported)
    The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
    
    We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
    
    By default, the task starts every day at the current system time.
  - Weekly
    The task runs every week on the specified day and at the specified time.
  - By days of week
    The task runs regularly, on the specified days of the week, at the specified time.
    
    By default, the task runs every Friday at 6:00:00 PM.
  - Monthly
    The task runs regularly, on the specified day of the month, at the specified time.
    
    In months that lack the specified day, the task runs on the last day.
    
    By default, the task runs on the first day of each month, at the current system time.
  - Manually
    The task does not run automatically. You can only start it manually.
    
    By default, this option is selected.
  - Every month on specified days of selected weeks
    The task runs regularly, on the specified days of each month, at the specified time.
    
    By default, no days of month are selected. The default start time is 18:00.
  - On virus outbreak
    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
    - Anti-virus for workstations and file servers
    - Anti-virus for perimeter defense
    - Anti-virus for mail systems
    By default, all application types are selected.
    
    You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
  - On completing another task
    The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
    
    You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
    
    If necessary, you can search, sort, and filter the tasks in the table as follows:
    - Enter the task name in the search field, to search the task by its name.
    - Click the sort icon to sort the tasks by name.
      By default, the tasks are sorted in alphabetical ascending order.
    - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
- Run missed tasks
  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.
  
  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.
  
  If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.
  
  By default, this option is disabled.
- Use automatically randomized delay for task starts
  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.
  
  If this option is disabled, the task starts on client devices according to the schedule.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  If this option is disabled, the task starts on client devices according to the schedule.
  
  By default, this option is disabled. The default time interval is one minute.
On the Define the task name page of the wizard, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
On the Finish task creation page of the wizard, click the Finish button to close the wizard.
If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

After the wizard completes its operation, the Install required updates and fix vulnerabilities task is created and displayed in the Tasks folder.

In addition to the settings that you specify during task creation, you can change other properties of a created task.

If the task results contain the 0x80240033 "Windows Update Agent error 80240033 ("License terms could not be downloaded.")" error, you can resolve this issue through the Windows Registry.

To fix a specific vulnerability and similar ones:

In the Advanced → Application management folder in the console tree, select the Software vulnerabilities subfolder.
Select the vulnerability that you want to fix.
Click the Run Vulnerability fix wizard button.
The Vulnerability fix wizard starts.

The Vulnerability fix wizard features are only available under the Vulnerability and patch management license.

Follow the steps of the wizard.
In the Search for existing vulnerability fix tasks window, specify the following parameters:
- Show only tasks that fix this vulnerability
  If this option is enabled, the Vulnerability fix wizard searches for existing tasks that fix the selected vulnerability.
  
  If this option is disabled or if the search yields no applicable tasks, the Vulnerability fix wizard prompts you to create a rule or task for fixing the vulnerability.
  
  By default, this option is enabled.
- Approve updates that fix this vulnerability
  Updates that fix a vulnerability will be approved for installation. Enable this option if some applied rules of update installation only allow the installation of approved updates.
  
  By default, this option is disabled.
If you choose to search for existing vulnerability fix tasks and if the search retrieves some tasks, you can view properties of these tasks or start them manually. No further actions are required.
Otherwise, click the New vulnerability fix task button.
Select the type of the vulnerability fix rule to be added to the new task, and then click the Finish button.
Make your choice in the displayed prompt about installing all previous application updates. Click Yes if you agree to the installation of successive application versions incrementally if this is required for installing the selected updates. Click No if you want to update applications in a straightforward fashion, without installing successive versions. If installing the selected updates is not possible without installing previous versions of applications, the updating of the application fails.
The Updates installation and vulnerabilities fix task creation wizard starts. Follow the steps of the wizard.
On the Selecting an operating system restart option page of the wizard, select the action to perform when the operating system on client devices must be restarted after the operation:
- Do not restart the device
  Client devices are not restarted automatically after the operation. To complete the operation, you must restart a device (for example, manually or through a device management task). Information about the required restart is saved in the task results and in the device status. This option is suitable for tasks on servers and other devices where continuous operation is critical.
- Restart the device
  Client devices are always restarted automatically if a restart is required for completion of the operation. This option is useful for tasks on devices that provide for regular pauses in their operation (shutdown or restart).
- Prompt user for action
  The restart reminder is displayed on the screen of the client device, prompting the user to restart it manually. Some advanced settings can be defined for this option: text of the message for the user, the message display frequency, and the time interval after which a restart will be forced (without the user's confirmation). This option is most suitable for workstations where users must be able to select the most convenient time for a restart.
  
  By default, this option is selected.
  - Repeat prompt every (min)
    If this option is enabled, the application prompts the user to restart the operating system with the specified frequency.
    
    By default, this option is enabled. The default interval is 5 minutes. Available values are between 1 and 1440 minutes.
    
    If this option is disabled, the prompt is displayed only once.
  - Restart after (min)
    After prompting the user, the application forces restart of the operating system upon expiration of the specified time interval.
    
    By default, this option is enabled. The default delay is 30 minutes. Available values are between 1 and 1440 minutes.
- Force closure of applications in blocked sessions
  Running applications may prevent a restart of the client device. For example, if a document is being edited in a word processing application and is not saved, the application does not allow the device to restart.
  
  If this option is enabled, such applications on a locked device are forced to close before the device restart. As a result, users may lose their unsaved changes.
  
  If this option is disabled, a locked device is not restarted. The task status on this device states that a device restart is required. Users have to manually close all applications running on locked devices and restart these devices.
  
  By default, this option is disabled.
On the Select devices to which the task will be assigned page of the wizard, select one of the following options:
- Select networked devices detected by Administration Server
  The task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
  
  For example, you may want to use this option in a task of installing Network Agent on unassigned devices.
- Specify device addresses manually or import addresses from a list
  You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
  
  You may want to use this option to execute a task for a specific subnet. For example, you may want to install a certain application on devices of accountants or to scan devices in a subnet that is probably infected.
- Assign task to a device selection
  The task is assigned to devices included in a device selection. You can specify one of the existing selections.
  
  For example, you may want to use this option to run a task on devices with a specific operating system version.
- Assign task to an administration group
  The task is assigned to devices included in an administration group. You can specify one of the existing groups or create a new one.
  
  For example, you may want to use this option to run a task of sending a message to users if the message is specific for devices included in a specific administration group.
  
  If a task is assigned to an administration group, the Security tab is not displayed in the task properties window because group tasks are subject to the security settings of the groups to which they apply.
On the Configure task schedule page of the wizard, you can create a schedule for task start. If necessary, specify the following settings:
- Scheduled start:
  Select the schedule according to which the task runs, and configure the selected schedule.
  - Every N hours
    The task runs regularly, with the specified interval in hours, starting from the specified date and time.
    
    By default, the task runs every 6 hours, starting from the current system date and time.
  - Every N days
    The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
    
    By default, the task runs every day, starting from the current system date and time.
  - Every N weeks
    The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
    
    By default, the task runs every Monday at the current system time.
  - Every N minutes
    The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
    
    By default, the task runs every 30 minutes, starting from the current system time.
  - Daily (daylight saving time is not supported)
    The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
    
    We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
    
    By default, the task starts every day at the current system time.
  - Weekly
    The task runs every week on the specified day and at the specified time.
  - By days of week
    The task runs regularly, on the specified days of the week, at the specified time.
    
    By default, the task runs every Friday at 6:00:00 PM.
  - Monthly
    The task runs regularly, on the specified day of the month, at the specified time.
    
    In months that lack the specified day, the task runs on the last day.
    
    By default, the task runs on the first day of each month, at the current system time.
  - Manually
    The task does not run automatically. You can only start it manually.
    
    By default, this option is selected.
  - Every month on specified days of selected weeks
    The task runs regularly, on the specified days of each month, at the specified time.
    
    By default, no days of month are selected. The default start time is 18:00.
  - On virus outbreak
    The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
    - Anti-virus for workstations and file servers
    - Anti-virus for perimeter defense
    - Anti-virus for mail systems
    By default, all application types are selected.
    
    You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
  - On completing another task
    The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
    
    You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
    
    If necessary, you can search, sort, and filter the tasks in the table as follows:
    - Enter the task name in the search field, to search the task by its name.
    - Click the sort icon to sort the tasks by name.
      By default, the tasks are sorted in alphabetical ascending order.
    - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
- Run missed tasks
  This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.
  
  If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.
  
  If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.
  
  By default, this option is disabled.
- Use automatically randomized delay for task starts
  If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.
  
  If this option is disabled, the task starts on client devices according to the schedule.
- Use randomized delay for task starts within an interval of (min)
  If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.
  
  If this option is disabled, the task starts on client devices according to the schedule.
  
  By default, this option is disabled. The default time interval is one minute.
On the Define the task name page of the wizard, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
On the Finish task creation page of the wizard, click the Finish button to close the wizard.
If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

When the wizard completes, the Install required updates and fix vulnerabilities task is created and displayed in the Tasks folder.

In addition to the settings that you specify during task creation, you can change other properties of a created task.

Fixing a vulnerability by adding a rule to an existing vulnerability fix task

To fix a vulnerability by adding a rule to an existing vulnerability fix task:

In the Advanced → Application management folder in the console tree, select the Software vulnerabilities subfolder.
Select the vulnerability that you want to fix.
Click the Run Vulnerability fix wizard button.
The Vulnerability fix wizard starts.

The Vulnerability fix wizard features are only available under the Vulnerability and patch management license.

Follow the steps of the wizard.
In the Search for existing vulnerability fix tasks window, specify the following parameters:
- Show only tasks that fix this vulnerability
  If this option is enabled, the Vulnerability fix wizard searches for existing tasks that fix the selected vulnerability.
  
  If this option is disabled or if the search yields no applicable tasks, the Vulnerability fix wizard prompts you to create a rule or task for fixing the vulnerability.
  
  By default, this option is enabled.
- Approve updates that fix this vulnerability
  Updates that fix a vulnerability will be approved for installation. Enable this option if some applied rules of update installation only allow the installation of approved updates.
  
  By default, this option is disabled.
If you choose to search for existing vulnerability fix tasks and if the search retrieves some tasks, you can view properties of these tasks or start them manually. No further actions are required.
Otherwise, click the Add vulnerability fix rule to existing task button.
Select the task to which you want to add a rule, and then click the Add rule button.
Also, you can view properties of the existing tasks, start them manually, or create a new task.
Select the type of rule to be added to the selected task, and then click the Finish button.
Make your choice in the displayed prompt about installing all previous application updates. Click Yes if you agree to the installation of successive application versions incrementally if this is required for installing the selected updates. Click No if you want to update applications in a straightforward fashion, without installing successive versions. If installing the selected updates is not possible without installing previous versions of applications, the updating of the application fails.

A new rule for fixing the vulnerability is added to the existing Install required updates and fix vulnerabilities task.

See also:

Scenario: Updating third-party software

Scenario: Finding and fixing third-party software vulnerabilities

Page top

[Topic 230885]

Fixing vulnerabilities in an isolated network

This section describes the steps that you can take to fix third-party software vulnerabilities on managed devices connected to Administration Servers that do not have internet access.

In this section

Scenario: Fixing third-party software vulnerabilities in an isolated network

About fixing third-party software vulnerabilities in an isolated network

Configuring the Administration Server with internet access to fix vulnerabilities in an isolated network

Configuring isolated Administration Servers to fix vulnerabilities in an isolated network

Transmitting patches and installing updates in an isolated network

Disabling the option to transmit patches and install updates in an isolated network

Page top

[Topic 230670]

Scenario: Fixing third-party software vulnerabilities in an isolated network

You can install updates and fix vulnerabilities of the third-party software installed on managed devices in an isolated network. Such networks include Administration Servers and managed devices connected to them that have no internet access. To fix vulnerabilities in this kind of network, you need an Administration Server connected to the internet. Then, you will be able to download patches (required updates) by using the Administration Server with internet access, and then transmit the patches to isolated Administration Servers.

You can download the third-party software updates issued by software vendors, but you cannot download updates for Microsoft software on isolated Administration Servers by using Kaspersky Security Center.

To find out how the process of fixing vulnerabilities in an isolated network works, see the description and scheme of this process.

Prerequisites

Before you start, do the following:

Allocate one device for connecting to the internet and downloading patches. This device will be counted as the Administration Server with internet access.
Install Kaspersky Security Center, no earlier than version 14, on the following devices:
- Allocated device, which will act as the Administration Server with internet access
- Isolated devices, which will act as the Administration Servers isolated from the internet (hereinafter referred to as isolated Administration Servers)
Make sure that every Administration Server has enough disk space for downloading and storing updates and patches.

Stages

Installing updates and fixing third-party software vulnerabilities on managed devices of isolated Administration Servers has the following stages:

Configuring the Administration Server with internet access
Prepare your Administration Server with internet access to handle requests on required third-party software updates and to download patches.
Configuring isolated Administration Servers
Prepare your isolated Administration Servers so they can regularly form lists of required updates and handle patches downloaded by the Administration Server with internet access. After configuring, isolated Administration Servers do not try to download patches from the internet anymore. Instead, they get updates through patches.
Transmitting patches and installing updates on isolated Administration Servers
After you finished configuring Administration Servers, you can transmit the required updates lists and patches between the Administration Server with internet access and isolated Administration Servers. Next, updates from patches will be installed on managed devices by using the Install required updates and fix vulnerabilities task.

Results

Thus, the third-party software updates are transmitted to isolated Administration Servers and installed on connected managed devices by using Kaspersky Security Center. It is enough to configure Administration Servers once, and after that you can get updates as often as you need, for example, once or several times per day.

Page top

[Topic 231854]

About fixing third-party software vulnerabilities in an isolated network

The process of fixing third-party software vulnerabilities in an isolated network is shown in the figure and described below. You can repeat this process periodically.

An isolated Server creates a list of updates for managed devices, which is transferred to the allocated Server.

The process of transmitting patches and the list of required updates between the Administration Server with internet access and isolated Administration Servers

Every Administration Server isolated from the internet (hereinafter referred to as an isolated Administration Server) generates a list of updates that are required to be installed on managed devices connected to this Administration Server. The list of required updates is stored in a specific folder and presents a set of binary files. Each file has a name that contains the ID of the patch with the required update. As a result, every file in the list points to a specific patch.

By using an external device, you transfer the list of required updates from the isolated Administration Server to the allocated Administration Server with internet access. After that, the allocated Administration Server downloads patches from the internet and puts them in a separate folder.

When all patches are downloaded and located in the special folder for them, you move the patches to every isolated Administration Server from which you took a list of required updates. You save patches to the folder created especially for them on the isolated Administration Server. As a result, the Install required updates and fix vulnerabilities task runs patches and installs updates on managed devices of the isolated Administration Servers.

Transmitting patches and installing updates in an isolated network

Page top

[Topic 230729]

Configuring the Administration Server with internet access to fix vulnerabilities in an isolated network

To prepare for fixing vulnerabilities and transmitting patches in an isolated network, first configure an Administration Server with internet access, and then configure the isolated Administration Servers.

To configure an Administration Server with internet access:

Create two folders on a disk where Administration Server is installed:
- Folder for the list of required updates
- Folder for patches
You can name these folders whatever you like.
Grant the Modify access rights to the KLAdmins group in the created folders, by using the standard administrative tools of the operating system.
Use the klscflag utility to write the paths to the folders in the Administration Server properties.
Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
Enter the following commands at the Windows command prompt:
- To set the path to the folder for patches:
  klscflag -fset -pv klserver -n VAPM_DATA_EXPORT_PATH -t s -v "<path to the folder>"
- To set the path to the folder for the list of required updates:
  klscflag -fset -pv klserver -n VAPM_REQ_IMPORT_PATH -t s -v "<path to the folder>"
Example: klscflag -fset -pv klserver -n VAPM_DATA_EXPORT_PATH -t s -v "C:\FolderForPatches"
If necessary, use the klscflag utility to specify how often the Administration Server should check for new patch requests:
klscflag -fset -pv klserver -n VAPM_DATA_EXPORT_PERIOD_SEC -t d -v <value in seconds>

The default value is 120 seconds.

Example: klscflag -fset -pv klserver -n VAPM_DATA_EXPORT_PERIOD_SEC -t d -v 150
Create the Find vulnerabilities and required updates task to obtain information about patches for the third-party software installed on the managed devices, and then set the task schedule.
Create the Fix vulnerabilities task to specify patches for the third-party software used to fix vulnerabilities, and then set the task schedule.
Run tasks manually if you want them to run earlier than it is specified in the schedule. The order in which tasks are started is important. The Fix vulnerabilities task must be run after finishing the Find vulnerabilities and required updates task.
Restart the Administration Server service.

Now, the Administration Server with internet access is ready to download and transmit updates to isolated Administration Servers. Before you start fixing vulnerabilities, configure the isolated Administration Servers.

About fixing third-party software vulnerabilities in an isolated network

Page top

[Topic 230777]

Configuring isolated Administration Servers to fix vulnerabilities in an isolated network

After you finished configuring the Administration Server with internet access, prepare every isolated Administration Server in your network, so you can fix vulnerabilities and install updates on managed devices connected to isolated Administration Servers.

To configure isolated Administration Servers, perform the following actions on every Administration Server:

Activate a license key for the Vulnerability and patch management (VAPM) feature.
Create two folders on a disk where Administration Server is installed:
- Folder where the list of required updates will appear
- Folder for patches
You can name these folders whatever you like.
Grant the Modify permission to the KLAdmins group in the created folders, by using the standard administrative tools of the operating system.
Use the klscflag utility to write the paths to the folders in the Administration Server properties.
Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.
Enter the following commands at the Windows command prompt:
- To set the path to the folder for patches:
  klscflag -fset -pv klserver -n VAPM_DATA_IMPORT_PATH -t s -v "<path to the folder>"
- To set the path to the folder for the list of required updates:
  klscflag -fset -pv klserver -n VAPM_REQ_EXPORT_PATH -t s -v "<path to the folder>"
Example: klscflag -fset -pv klserver -n VAPM_DATA_IMPORT_PATH -t s -v "C:\FolderForPatches"
If necessary, use the klscflag utility to specify how often the isolated Administration Server should check for new patches:
klscflag -fset -pv klserver -n VAPM_DATA_IMPORT_PERIOD_SEC -t d -v <value in seconds>

The default value is 120 seconds.

Example: klscflag -fset -pv klserver -n VAPM_DATA_IMPORT_PERIOD_SEC -t d -v 150
If necessary, use the klscflag utility to calculate the SHA256 hashes of patches:
klscflag -fset -pv klserver -n VAPM_DATA_IMPORT_VERIFY_HASH -t d -v 1

If you enter this command, you can make sure that the patches have not been modified during their transfer to the isolated Administration Server and that you have received the correct patches containing the required updates.

By default, Kaspersky Security Center does not calculate the SHA256 hashes of patches. If you enable this option, after the isolated Administration Server receives patches, Kaspersky Security Center computes their hashes and compares the acquired values with the hashes stored in the Administration Server database. If the calculated hash does not match the hash in the database, an error occurs and you have to replace the incorrect patches.
Create the Find vulnerabilities and required updates task to obtain information about patches for the third-party software installed on the managed devices, and then set the task schedule.
Create the Fix vulnerabilities task to specify patches for the third-party software used to fix vulnerabilities, and then set the task schedule.
Run tasks manually if you want them to run earlier than it is specified in the schedule. The order in which tasks are started is important. The Fix vulnerabilities task must be run after finishing the Find vulnerabilities and required updates task.
Restart the Administration Server service.

After configuring all Administration Servers, you can move patches and lists of required updates, and fix third-party software vulnerabilities on managed devices in the isolated network.

About fixing third-party software vulnerabilities in an isolated network

Page top

[Topic 230781]

Transmitting patches and installing updates in an isolated network

After you have finished configuring Administration Servers, you can transfer patches containing the required updates from the Administration Server with internet access to isolated Administration Servers. You can transmit and install updates as often as you need, for example, once or several times per day.

You need an external device, such as a removable drive, to transfer patches and the list of required updates between Administration Servers. Therefore, make sure that the external device has enough disk space for downloading and storing patches.

The process of transmitting patches and the list of required updates is shown in the figure and described below:

An isolated Server creates a list of updates for managed devices, which is transferred to the allocated Server.

The process of transmitting patches and the list of required updates between the Administration Server with internet access and isolated Administration Servers

To install updates and fix vulnerabilities on managed devices connected to isolated Administration Servers:

Start the Install required updates and fix vulnerabilities task if it is not yet running.
Connect an external device to any isolated Administration Server.
Create two folders on the external device: one for the list of required updates and one for patches. You can name these folders whatever you like.
If you created these folders earlier, clear them.
Copy the list of required updates from every isolated Administration Server and paste this list into the folder for the list of required updates on the external device.
As a result, you unite all lists acquired from all isolated Administration Servers into one folder. This folder contains binary files with the IDs of patches required for all isolated Administration Servers.
Connect the external device to the Administration Server with internet access.
Copy the list of required updates from the external device and paste this list into the folder for the list of required updates on the Administration Server with internet access.
All required patches are automatically downloaded from the internet to the folder for patches on the Administration Server. This can take several hours.
Make sure that all required patches are downloaded. For this purpose, you can do one of the following:
- Check the folder for patches on the Administration Server with internet access. All patches that were specified in the list of required updates should be downloaded to the necessary folder. This is more convenient if a small number of patches is required.
- Prepare a special script, for example, a shell script. If you get a large number of patches, this will be difficult to check on your own that all patches have been downloaded. In such cases, it is better to automate the check.
Copy the patches from the Administration Server with internet access and paste them into the corresponding folder on your external device.
Transfer the patches to every isolated Administration Server. Put the patches into a specific folder for them.

As a result, every isolated Administration Server creates an actual list of updates that are required for managed devices connected to the current Administration Server. After the Administration Server with internet access receives the list of required updates, the Administration Server downloads patches from the internet. When these patches appear on isolated Administration Servers, the Install required updates and fix vulnerabilities task handles the patches. Thus, updates are installed on managed devices and third-party software vulnerabilities are fixed.

When the Install required updates and fix vulnerabilities task is running, do not reboot the Administration Server device and do not run the Backup of Administration Server data task (it will also cause a reboot). As a result, the Install required updates and fix vulnerabilities task is interrupted, and updates are not installed. In this case, you have to restart this task manually or wait for the task to start according to the configured schedule.

About fixing third-party software vulnerabilities in an isolated network

Page top

[Topic 230869]

Disabling the option to transmit patches and install updates in an isolated network

You can disable transmitting patches on isolated Administration Servers, for example, if you decided to take one or more Administration Servers out of an isolated network. Thus, you can reduce the number of patches and time to download them.

To disable the option to transmit patches on isolated Administration Servers:

If you want to take all Administration Servers out of isolation, in the properties of the Administration Server with internet access, delete the paths to the folders for patches and the list of required updates. If you want to keep some Administration Servers in an isolated network, skip this step.
Run the Windows command prompt by using administrator rights, and then change your current directory to the directory with the klscflag utility. The klscflag utility is located in the folder where Administration Server is installed. The default installation path is <Disk>:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center.

Enter the following commands at the command prompt:
- To delete the path to the folder for patches:
  klscflag -fset -pv klserver -n VAPM_DATA_EXPORT_PATH -t s -v ""
- To delete the path to the folder for the list of required updates:
  klscflag -fset -pv klserver -n VAPM_REQ_IMPORT_PATH -t s -v ""
Restart the Administration Server service if you deleted the paths to the folders on this Administration Server.
In the properties of every Administration Server that you want to take out of isolation, delete the paths to the folders for patches and the list of required updates.
Enter the following commands at the Windows command prompt, using administrator rights:
- To delete the path to the folder for patches:
  klscflag -fset -pv klserver -n VAPM_DATA_IMPORT_PATH -t s -v ""
- To delete the path to the folder for the list of required updates:
  klscflag -fset -pv klserver -n VAPM_REQ_EXPORT_PATH -t s -v ""
Restart the service of every Administration Server on which you deleted the paths to the folders.

As a result, if you reconfigured the Administration Server with internet access, you will no longer receive patches through Kaspersky Security Center. If you reconfigured only some isolated Administration Servers, for example, taking some of them out of the isolated network, you will get patches only for the remaining isolated Administration Servers.

If you want to start fixing vulnerabilities on disabled isolated Administration Servers in the future, you have to configure these Administration Servers and the Administration Server with internet access once again.

About fixing third-party software vulnerabilities in an isolated network

Page top

[Topic 191582]

Ignoring software vulnerabilities

You can ignore software vulnerabilities to be fixed. The reasons to ignore software vulnerabilities might be, for example, the following:

You do not consider the software vulnerability to be critical to your organization.
You understand that the software vulnerability fix can damage data related to the software that required the vulnerability fix.
You are sure that the software vulnerability is not dangerous for your organization's network because you use other measures to protect your managed devices.

You can ignore a software vulnerability on all managed devices or only on selected managed devices.

To ignore a software vulnerability on all managed devices:

In the Advanced → Application management folder in the console tree, select the Software vulnerabilities subfolder.
The workspace of the folder displays a list of vulnerabilities in applications detected on devices by the Network Agent installed on them.
Select the vulnerability you want to ignore.
Select Properties from the context menu of the vulnerability.
The properties window of the vulnerability opens.
On the General section, select the Ignore vulnerability option.
Click OK.
The software vulnerability properties window is closed.

The software vulnerability is ignored on all managed devices.

To ignore a software vulnerability on the selected managed device:

Open the properties window of the selected managed device and select the Software vulnerabilities section.
Select a software vulnerability.
Ignore selected vulnerability.

The software vulnerability is ignored on the selected device.

The ignored software vulnerability will not be fixed after the completion of the Fix vulnerabilities task or Install required updates and fix vulnerabilities task. You can exclude ignored software vulnerabilities from the list of vulnerabilities by using a filter.

Page top

[Topic 191616]

Selecting user fixes for vulnerabilities in third-party software

To use the Fix vulnerabilities task, you must manually specify the software updates to fix the vulnerabilities in third-party software listed in the task settings. The Fix vulnerabilities task uses recommended fixes for Microsoft software and user fixes for other third-party software. User fixes are software updates to fix vulnerabilities that the administrator manually specifies for installation.

To select user fixes for vulnerabilities in third-party software:

In the Advanced → Application management folder in the console tree, select the Software vulnerabilities subfolder.
The workspace of the folder displays a list of vulnerabilities in applications detected on devices by the Network Agent installed on them.
Select the vulnerability for which you want to specify a user fix.
Select Properties from the context menu of the vulnerability.
The properties window of the vulnerability opens.
In the User fixes and other fixes section, click the Add button.
The list of available installation packages is displayed. The list of displayed installation packages corresponds to the Remote installation → Installation packages list. If you have not created an installation package containing a user fix for selected vulnerability, you can create the package now by starting the New package wizard.
Select an installation package (or packages) containing a user fix (or user fixes) for the vulnerability in third-party software.
Click OK.

The installation packages containing user fixes for the software vulnerability are specified. When the Fix vulnerabilities task is started, the installation package will be installed, and the software vulnerability will be fixed.

Scenario: Finding and fixing third-party software vulnerabilities

Page top

[Topic 172909]

Rules for update installation

Expand all | Collapse all

When fixing vulnerabilities in applications, you must specify rules for update installation. These rules determine updates to install and vulnerabilities to fix.

The exact settings depend on whether you create a rule for updates of Microsoft applications, of third-party applications (applications made by software vendors other than Kaspersky and Microsoft), or of all applications. When creating a rule for Microsoft applications or third-party applications, you can select specific applications and application versions for which you want to install updates. When creating a rule for all applications, you can select specific updates that you want to install and vulnerabilities that you want to fix by means of installing updates.

To create a new rule for updates of all applications:

On the Settings page of the New task wizard, click the Add button.
The Rule creation wizard starts. Follow the steps of the wizard.
On the Rule type page, select Rule for all updates.
On the General criteria page, use the drop-down lists to specify the following settings:
- Set of updates to install
  Select the updates that must be installed on client devices:
  - Install approved updates only. This installs only approved updates.
  - Install all updates (except declined). This installs updates with the Approved or Undefined approval status.
  - Install all updates (including declined). This installs all updates, regardless of their approval status. Select this option with caution. For example, use this option if you want to check installation of some declined updates in a test infrastructure.
- Fix vulnerabilities with a severity level equal to or higher than
  Sometimes software updates may impair the user experience with the software. In such cases, you may decide to install only those updates that are critical for the software operation and to skip other updates.
  
  If this option is enabled, the updates fix only those vulnerabilities for which the severity level set by Kaspersky is equal to or higher than the value selected in the list (Medium, High, or Critical). Vulnerabilities with a severity level lower than the selected value are not fixed.
  
  If this option is disabled, the updates fix all vulnerabilities regardless of their severity level.
  
  By default, this option is disabled.
On the Updates page, select the updates to be installed:
- Install all suitable updates
  Install all software updates that meet the criteria specified on the General criteria page of the wizard. Selected by default.
- Install only updates from the list
  Install only software updates that you select manually from the list. This list contains all available software updates.
  
  For example, you may want to select specific updates in the following cases: to check their installation in a test environment, to update only critical applications, or to update only specific applications.
  - Automatically install all previous application updates that are required to install the selected updates
    Keep this option enabled if you agree with the installation of interim application versions when this is required for installing the selected updates.
    
    If this option is disabled, only the selected versions of applications are installed. Disable this option if you want to update applications in a straightforward manner, without attempting to install successive versions incrementally. If installing the selected updates is not possible without installing previous versions of applications, the updating of the application fails.
    
    For example, you have version 3 of an application installed on a device and you want to update it to version 5, but version 5 of this application can be installed only over version 4. If this option is enabled, the software first installs version 4, and then installs version 5. If this option is disabled, the software fails to update the application.
    
    By default, this option is enabled.
On the Vulnerabilities page, select vulnerabilities that will be fixed by installing the selected updates:
- Fix all vulnerabilities that match other criteria
  Fix all vulnerabilities that meet the criteria specified on the General criteria page of the wizard. Selected by default.
- Fix only vulnerabilities from the list
  Fix only vulnerabilities that you select manually from the list. This list contains all detected vulnerabilities.
  
  For example, you may want to select specific vulnerabilities in the following cases: to check their fix in a test environment, to fix vulnerabilities only in critical applications, or to fix vulnerabilities only in specific applications.
On the Name page, specify the name for the rule that you are creating. You can later change this name in the Settings section of the properties window of the created task.

After the Rule creation wizard completes its operation, the new rule is created and displayed in the Specify rules for installing updates field of the New task wizard.

To create a new rule for updates of Microsoft applications:

On the Settings page of the New task wizard, click the Add button.
The Rule creation wizard starts. Follow the steps of the wizard.
On the Rule type page, select Rule for Windows Update.
On the General criteria page, specify the following settings:
- Set of updates to install
  Select the updates that must be installed on client devices:
  - Install approved updates only. This installs only approved updates.
  - Install all updates (except declined). This installs updates with the Approved or Undefined approval status.
  - Install all updates (including declined). This installs all updates, regardless of their approval status. Select this option with caution. For example, use this option if you want to check installation of some declined updates in a test infrastructure.
- Fix vulnerabilities with a severity level equal to or higher than
  Sometimes software updates may impair the user experience with the software. In such cases, you may decide to install only those updates that are critical for the software operation and to skip other updates.
  
  If this option is enabled, the updates fix only those vulnerabilities for which the severity level set by Kaspersky is equal to or higher than the value selected in the list (Medium, High, or Critical). Vulnerabilities with a severity level lower than the selected value are not fixed.
  
  If this option is disabled, the updates fix all vulnerabilities regardless of their severity level.
  
  By default, this option is disabled.
- Fix vulnerabilities with an MSRC severity level equal to or higher than
  Sometimes software updates may impair the user experience with the software. In such cases, you may decide to install only those updates that are critical for the software operation and to skip other updates.
  
  If this option is enabled, the updates fix only those vulnerabilities for which the severity level set by Microsoft Security Response Center (MSRC) is equal to or higher than the value selected in the list (Low, Medium, High, or Critical). Vulnerabilities with a severity level lower than the selected value are not fixed.
  
  If this option is disabled, the updates fix all vulnerabilities regardless of their severity level.
  
  By default, this option is disabled.
On the Applications page, select the applications and application versions for which you want to install updates. By default, all applications are selected.
On the Categories of updates page, select the categories of updates to be installed. These categories are the same as in Microsoft Update Catalog. By default, all categories are selected.
On the Name page, specify the name for the rule that you are creating. You can later change this name in the Settings section of the properties window of the created task.

After the Rule creation wizard completes its operation, the new rule is created and displayed in the Specify rules for installing updates field of the New task wizard.

To create a new rule for updates of third-party applications:

On the Settings page of the New task wizard, click the Add button.
The Rule creation wizard starts. Follow the steps of the wizard.
On the Rule type page, select Rule for third-party updates.
On the General criteria page, specify the following settings:
- Set of updates to install
  Select the updates that must be installed on client devices:
  - Install approved updates only. This installs only approved updates.
  - Install all updates (except declined). This installs updates with the Approved or Undefined approval status.
  - Install all updates (including declined). This installs all updates, regardless of their approval status. Select this option with caution. For example, use this option if you want to check installation of some declined updates in a test infrastructure.
- Fix vulnerabilities with a severity level equal to or higher than
  Sometimes software updates may impair the user experience with the software. In such cases, you may decide to install only those updates that are critical for the software operation and to skip other updates.
  
  If this option is enabled, the updates fix only those vulnerabilities for which the severity level set by Kaspersky is equal to or higher than the value selected in the list (Medium, High, or Critical). Vulnerabilities with a severity level lower than the selected value are not fixed.
  
  If this option is disabled, the updates fix all vulnerabilities regardless of their severity level.
  
  By default, this option is disabled.
On the Applications page, select the applications and application versions for which you want to install updates. By default, all applications are selected.
On the Name page, specify the name for the rule that you are creating. You can later change this name in the Settings section of the properties window of the created task.

After the Rule creation wizard completes its operation, the new rule is created and displayed in the Specify rules for installing updates field of the New task wizard.

Scenario: Finding and fixing third-party software vulnerabilities

Page top

[Topic 62749]

Groups of applications

This section describes how to manage groups of applications installed on devices.

Creating application categories

Kaspersky Security Center allows you to create categories of applications installed on devices.

Application categories can be created in one of the following ways:

The administrator specifies a folder in which executable files have been included in the selected category.
The administrator specifies a device from which executable files are to be included in the selected category.
The administrator sets criteria to be used to include applications in the selected category.

When an application category is created, the administrator can set rules for the application category. Rules define the behavior of applications included in the specified category. For example, you can block or allow startup of applications included in the category.

Managing applications run on devices

Kaspersky Security Center allows you to manage startup of applications on devices in Allowlist mode. For detailed description see Kaspersky Endpoint Security for Windows Online Help. While in Allowlist mode, on selected devices you can only start applications included in the specified categories. The administrator can view results of static analysis applied to rules of applications run on devices for each user.

Inventory of software installed on devices

Kaspersky Security Center allows you to perform inventory of software on devices running Windows and Linux. Network Agent retrieves information about all applications installed on devices. Information retrieved during inventory is displayed in the workspace of the Applications registry folder. The administrator can view detailed information about any application, including its version and manufacturer.

The number of executable files received from a single device cannot exceed 150,000. Having reached this limit, Kaspersky Security Center cannot receive any new files.

Licensed applications group management

Kaspersky Security Center allows you to create licensed applications groups. A licensed applications group includes applications that meet criteria set by the administrator. The administrator can specify the following criteria for licensed applications groups:

Application name
Application version
Manufacturer
Application tag

Applications that meet one or several criteria are automatically included in a group. To create a licensed applications group, you must set at least one criterion for including applications in this group.

Each licensed applications group has its own license key. The license key of a licensed applications group defines the maximum allowed number of installations for applications included in this group. If the number of installations has exceeded the limit set by the license key, an informational event is logged on Administration Server. The administrator can specify an expiration date for the license key. When this date arrives, an informational event is logged on Administration Server.

Viewing information about executable files

Kaspersky Security Center retrieves all information about executable files that have been run on devices since the operating system was installed on them. Information about executable files is displayed in the main application window, in the workspace of the Executable files folder.

In this section

Using Application Control to manage executable files

Obtaining and viewing a list of executable files stored on client devices

Creating application categories for Kaspersky Endpoint Security for Windows policies

Creating an application category with content added manually

Creating an application category that includes executable files from selected devices

Creating an application category that includes executable files from a specific folder

Configuring application startup management on client devices

Viewing the results of static analysis of startup rules applied to executable files

Viewing the applications registry

Changing the software inventory start time

About license key management of third-party applications

Creating licensed applications groups

Managing license keys for licensed applications groups

Inventory of executable files

Viewing information about executable files

Page top

[Topic 183681]

Using Application Control to manage executable files

You can use the Application Control component to allow or block startup of executable files on user devices. The Application Control component supports Windows-based and Linux-based operating systems.

For Linux-based operating systems, the Application Control component is available starting from Kaspersky Endpoint Security 11.2 for Linux.Also, the component is available for Kaspersky Embedded Systems Security for Windows 3.0 or later.

Prerequisites

Kaspersky Security Center is deployed in your organization.
The policy of Kaspersky Endpoint Security for Windows or Kaspersky Endpoint Security for Linux is created and is active.
The policy of Kaspersky Embedded Systems Security for Windows or Kaspersky Embedded Systems Security for Linux is created and is active.

Stages

The Application Control usage scenario proceeds in stages:

Forming and viewing the list of executable files on client devices
This stage helps you find out what executable files are found on managed devices. View the list of executable files and compare it with the lists of allowed and prohibited executable files. The restrictions on executable files usage can be related to the information security polices in your organization.

How-to instructions:
- Administration Console: Inventory of executable files
- Kaspersky Security Center Web Console: Obtaining and viewing a list of executable files stored on client devices
Creating categories for executable files used in your organization
Analyze the lists of executable files stored on managed devices. Based on the analysis, create categories for executable files. It is recommended to create a "Work applications" category that covers the standard set of executable files that are used at your organization. If different security groups use their own sets of executable files in their work, a separate category can be created for each security group.

How-to instructions:
- Administration Console: Creating an application category with content added manually, Creating an application category that includes executable files from selected devices, Creating application category that includes executable files from a specific folder.
- Kaspersky Security Center Web Console: Creating application category with content added manually, Creating application category that includes executable files from selected devices, Creating application category that includes executable files from a specific folder.
Configuring Application Control in the Kaspersky Endpoint Security policy
Configure the Application Control component in the Kaspersky Endpoint Security policy using the categories you have created on the previous stage.

How-to instructions:
- Administration Console: Configuring application startup management on client devices
- Kaspersky Security Center Web Console: Configuring Application Control in the Kaspersky Endpoint Security for Windows policy
Configuring Application Control in the Kaspersky Embedded Systems Security application policy
Configure the Application Control component in the Kaspersky Embedded Systems Security for Windows policy by using the categories you have created. For more information about Application Control component, refer to Kaspersky Embedded Systems Security for Windows Help or Kaspersky Embedded Systems Security for Linux Help.

If you use a large number of rules, an error may occur when loading the policy. You can increase the maximum request size in bytes by using the following commands:
- For the JSON request:
  klscflag -fset -pv ".core/.independent" -s KLLIM -n LP_KLOAPI_MaxSizeOfJsonRequestInBytes -v <max_request_size> -t d
- For the HTTP request:
  klscflag -fset -pv ".core/.independent" -s KLLIM -n LP_KLOAPI_MaxSizeOfHttpRequestInBytes -v <max_request_size> -t d
  
  Where <max_request_size> is a maximum request size in bytes (for example, 200000000).
Turning on Application Control component in test mode
To ensure that Application Control rules do not block executable files required for user's work, it is recommended to enable testing of Application Control rules and analyze their operation after creating new rules. When testing is enabled, Kaspersky Endpoint Security for Windows or Kaspersky Embedded Systems Security will not block executable files whose startup is forbidden by Application Control rules, but will instead send notifications about their startup to the Administration Server.

When testing Application Control rules, it is recommended to perform the following actions:
- Determine the testing period. Testing period can vary from several days to two months.
- Examine the events resulting from testing the operation of Application Control.
How-to instructions for Kaspersky Security Center Web Console: Configuring Application Control component in the Kaspersky Endpoint Security for Windows policy. Follow this instruction and enable the Test Mode option in configuration process.
Changing the categories settings of Application Control component
If necessary, make changes to the Application Control settings. Based on the test results, you can add executable files related to events of the Application Control component to a category with content added manually.

How-to instructions:
- Administration Console: Adding event-related executable files to the application category
- Kaspersky Security Center Web Console: Adding event-related executable files to the application category
Applying the rules of Application Control in operation mode
After Application Control rules are tested and configuration of categories is complete, you can apply the rules of Application Control in operation mode.

How-to instructions for Kaspersky Security Center Web Console: Configuring Application Control component in the Kaspersky Endpoint Security for Windows policy. Follow this instruction and disable the Test Mode option in configuration process.
Verifying Application Control configuration
Be sure that you have done the following:
- Created categories for executable files.
- Configured Application Control using the categories.
- Applied the rules of Application Control in operation mode.

Results

When the scenario is complete, startup of executable files on managed devices is controlled. The users can run only those executable files that are allowed in your organization and cannot run executable files that are prohibited in your organization.

For detailed information about Application Control, refer to the following Help topics:

Page top

[Topic 295859]

Obtaining and viewing a list of executable files stored on client devices

You can obtain the list of executable files stored on client devices in one of the following ways:

Enabling notifications about applications startup in Kaspersky Endpoint Security policy.
Creating an inventory task.

Enabling notifications about applications startup in Kaspersky Endpoint Security policy

To enable notifications about applications startup:

Open the Kaspersky Endpoint Security policy settings, and then go to General settings → Reports and Storage.
In the Data transfer to Administration Server settings group, select the About started applications check box, and save the changes.

When a user attempts to start executable files, information about these files is added to the list of executable files on a client device. Kaspersky Endpoint Security sends this information to Network Agent, and then Network Agent sends it to Administration Server.

Creating an inventory task

The feature of inventorying executable files is available for the following applications:

Kaspersky Endpoint Security for Windows
Kaspersky Endpoint Security for Linux version 11.2 and later
Kaspersky Security for Virtualization 4.0 Light Agent and later versions

You can reduce load on the database while obtaining information about the installed applications. To save a space, run an inventory task on reference devices on which a standard set of software is installed. The preferable number of devices is 1-3.

We strongly do not recommend running the inventory task when using the following databases: MySQL, PostgreSQL, SQL Server Express Edition, MariaDB (all editions).

To create an inventory task for executable files on client devices:

In the console tree, select the Tasks folder.
Click the New task button in the workspace of the Tasks folder.
The New task wizard starts.
In the Select the task type window of the wizard, select Kaspersky Endpoint Security as the task type, and then select Inventory as the task subtype, and click Next.
Follow the rest of the wizard instructions.

After the New task wizard has finished, the Inventory task is created and configured. If you want, you can change the settings for the created task. The newly created task is displayed in the list of tasks. If you want, you can change the settings for the created task.

For a detailed description of the inventory task, refer to the following Helps:

After the Inventory task is performed, the list of executable files stored on managed devices is formed, and you can view the list.

During inventory, executable files in the following formats can be detected (depending on the option that you select in the inventory task properties): MZ, COM, PE, NE, SYS, CMD, BAT, PS1, JS, VBS, REG, MSI, CPL, DLL, JAR, and HTML.

Viewing the list of executable files stored on managed devices

To view the list of executable files stored on client devices:

In the console tree, go to Advanced → Application management → Executable files.

If necessary, you can send an executable file from a managed device to the device with Administration console installed.

To send an executable file:

In the console tree, go to Advanced → Application management → Executable files.
Click the link of the executable file that you want to send to the device with Administration console installed.
In the window that opens, go to the Devices section, and then select the check box of the managed device from which you want to send the executable file.
Before you send the executable file, make sure that the managed device has a direct connection to the Administration Server, by selecting the Do not disconnect from the Administration Server check box.
Click the Send button, select the destination folder, and then click OK.

The selected executable file is downloaded for further sending to the device with Administration console installed.

Page top

[Topic 52459]

Creating application categories for Kaspersky Endpoint Security for Windows policies

You can create application categories for Kaspersky Endpoint Security for Windows policies from the Application categories folder and from the Properties window of a Kaspersky Endpoint Security for Windows policy.

To create an application category for a Kaspersky Endpoint Security policy from the Application categories folder:

In the console tree, select Advanced → Application management → Application categories.
In the workspace of the Application categories folder, click the New category button.
The New category wizard starts.
On the Category type page, select the type of user category:
- Category with content added manually. Specify the criteria that will be used to assign executable files to the category that is being created.
- Category with content added automatically. Specify the folder from which executable files will be automatically assigned to the created category.
  When you create a category with content added automatically, the application inventories the following file types: EXE, COM, DLL, SYS, BAT, PS1, CMD, JS, VBS, REG, MSI, MSC, CPL, HTML, HTM, DRV, OCX, and SCR.
- Category, which includes executable files from the selected devices. Specify a device whose executable files must be automatically assigned to the category.
Follow the instructions of the wizard.

When the wizard finishes, a custom application category is created. You can view newly created categories by using the list of categories in the workspace of the Application categories folder.

If you want to export an application category to a KLC file, right-click the name of the category, select Export in the menu, and then in the window that opens, specify the file name and click Save.

You can also create an application category from the Policies folder.

To create an application category from the Properties window of a Kaspersky Endpoint Security for Windows policy:

In the console tree, select the Policies folder.
In the workspace of the Policies folder, select a Kaspersky Endpoint Security policy for which you want to create a category.
Right-click and select Properties.
In the Properties window that opens, in the left Sections pane select Security Controls → Application control.
In the Application control section, in the Control mode and Action drop-down lists make selections for the Allowlist or Denylist, and then click the Add button.
The Application Control rule window containing a list of categories opens.
Click the Create new button.
Enter the name of the new category and click OK.
The New category wizard starts.
On the Category type page, select the type of user category:
- Category with content added manually. Specify the criteria that will be used to assign executable files to the category that is being created.
- Category with content added automatically. Specify the folder from which executable files will be automatically assigned to the created category.
  When you create a category with content added automatically, the application inventories the following file types: EXE, COM, DLL, SYS, BAT, PS1, CMD, JS, VBS, REG, MSI, MSC, CPL, HTML, HTM, DRV, OCX, and SCR.
- Category, which includes executable files from the selected devices. Specify a device whose executable files must be automatically assigned to the category.
Follow the instructions of the wizard.

When the wizard finishes, a custom application category is created. You can view newly created categories in the list of categories.

Application categories are used by the Application Control component included in Kaspersky Endpoint Security for Windows. Application Control allows the administrator to impose restrictions on the startup of applications on client devices—for example, restricting the startups to applications in a specified category.

Using Application Control to manage executable files

Page top

[Topic 154440]

Creating an application category with content added manually

Expand all | Collapse all

You can specify a set of criteria as a template of executable files for which you want to allow or block a start in your organization. On the basis of executable files corresponding to the criteria, you can create an application category and use it in the Application Control component configuration.

To create an application category with content added manually:

In the console tree, in the Advanced → Application management folder select the Application categories subfolder.
Click the New category button.
The New category wizard starts. Proceed through the wizard by using the Next button.
On the Category type wizard page, select Category with content added manually as the user category type.
On the Enter the application category name wizard page, enter the new application category name.
On the Configuring conditions for inclusion of applications in categories page, click the Add button.
In the drop-down list, specify the relevant settings:
- From the list of executable files
  If this option is selected, you can use the list of executable files on the client device to select and add applications to the category.
- From file properties
  If this option is selected, you can specify the detailed data for the executable files that will be added to the user application category.
- Metadata from files in folder
  Specify a folder on the client device that contains executable files. The metadata in the executable files that are included in the specified folder will be sent to Administration Server. Executable files that contain the same metadata will be added to the user application category.
- Checksums of the files in the folder
  If this option is selected, you can select or create a folder on the client device. The MD5 hash of the files in a specified folder will be sent to Administration Server. The applications that have the same hash as the files in the specified folder are added to the user application category.
- Certificates for the files from the folder
  If this option is selected, you can specify the folder on the client device, which contains executable files signed with certificates. Certificates of executable files are read and added to the category's conditions. Executable files that have been signed in accordance with the specified certificates will be added to the user category.
- MSI installer files metadata
  If this option is selected, you can specify an MSI installer file as the condition of adding applications to the user category. The application installer metadata will be sent to Administration Server. The applications for which the installer metadata is the same as for the specified MSI installer are added to the user application category.
- Checksums of the files from the MSI installer of the application
  If this option is selected, you can specify an MSI installer file as the condition of adding applications to the user category. The hash of the application installer files will be sent to Administration Server. The applications for which the hash of MSI installer files is identical to the specified hash are added to the user application category.
- From KL category
  If this option is selected, you can specify a Kaspersky application category as the condition of adding applications to the user category. The applications from the specified Kaspersky category will be added to the user application category.
- Specify path to application (masks supported)
  If this option is selected, you can specify the path to the file or folder on the client device containing the executable files that are to be added to the user application category. You can use regular expressions such as C:\path_to_exe\*, for example: C:\Program Files\Internet Explorer\*.
- Select certificate from repository
  If this option is selected, you can specify certificates from the storage. Executable files that have been signed in accordance with the specified certificates will be added to the user category.
- Drive type
  If this option is selected, you can specify the type of the medium (any drive or removable drive) on which the application is run. Applications that have been run on the selected drive type are added to the user application category.
On the Creating the application category wizard page, click the Finish button.
Kaspersky Security Center only handles metadata from digitally signed files. No category can be created on the basis of metadata from files that do not contain a digital signature.

When the wizard has completed, a user application category is created, with content added manually. You can view the newly created category using the list of categories in the workspace of the Application categories folder.

If you want to export an application category to a KLC file, right-click the name of the category, select Export in the menu, and then in the window that opens, specify the file name and click Save.

Page top

[Topic 245879]

Creating an application category that includes executable files from selected devices

Expand all | Collapse all

You can use executable files from selected devices as a template of executable files that you want to allow or block. Based on executable files from selected devices, you can create an application category and use it in the Application Control component configuration.

To retrieve the list of executable files from devices:

Ensure that the policy of Kaspersky Endpoint Security for Windows or Kaspersky Endpoint Security for Linux is created and is active. Enable the Application Control component in the policy.
Obtain a list of executable files stored on client devices.

To create application category that includes executable files from selected devices:

In the console tree, in the Advanced → Application management folder select the Application categories subfolder.
Click the New category button.
The New category wizard starts. Proceed through the wizard by using the Next button.
On the Category type wizard page, select Category that includes executable files from selected devices as the user category type.
On the Enter the application category name wizard page, enter the new application category name.
On the Settings wizard page, click the Add button.
Select a device or devices whose executable files will be used to create the application category.
Specify the following settings:
- Hash value computing algorithm
  Depending on the version of the security application installed on devices on your network, you must select an algorithm for hash value computing by Kaspersky Security Center for files in this category. Information about computed hash values is stored in the Administration Server database. Storage of hash values does not increase the database size significantly.
  
  SHA256 is a cryptographic hash function: no vulnerabilities have been found in its algorithm, and so it is considered the most reliable cryptographic function nowadays. Kaspersky Endpoint Security 10 Service Pack 2 for Windows and later versions support SHA256 computing. Computing of the MD5 hash function is supported by all versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows.
  
  Select either of the options of hash value computing by Kaspersky Security Center for files in the category:
  - If all instances of security applications installed on your network are Kaspersky Endpoint Security 10 Service Pack 2 for Windows or later versions, select the SHA256 check box. We do not recommend that you add any categories created according to the criterion of the SHA256 hash of an executable file for versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows. This may result in failures in the security application operation. In this case, you can use the MD5 cryptographic hash function for files of the category.
  - If any versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows are installed on your network, select the MD5 hash. You cannot add a category that was created based on the criterion of the MD5 checksum of an executable file for Kaspersky Endpoint Security 10 Service Pack 2 for Windows or later versions. In this case, you can use the SHA256 cryptographic hash function for files of the category.
  If different devices on your network use both earlier and later versions of Kaspersky Endpoint Security 10, select both the SHA256 check box and the MD5 hash check box.
  
  The Calculate SHA256 for files in this category (supported by Kaspersky Endpoint Security 10 Service Pack 2 for Windows and any later versions) check box is selected by default.
  
  The Calculate MD5 for files in this category (supported by versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows) is cleared by default.
- Synchronize data with Administration Server repository
  Select this option if you want that Administration Server periodically to check changes in the specified folder (or folders).
  
  By default, this option is disabled.
  
  If you enable this option, specify the period (in hours) to check changes in the specified folder (folders). By default, scan interval is 24 hours.
On the Filter wizard page, specify the following settings:
- File type
  In this section, you can specify file type that is used to create the application category.
  
  All files. All files are taken into consideration when creating the category. By default, this option is selected.
  
  Only files outside the application categories. Only files outside the application categories are taken into consideration when creating the category.
- Folders
  In this section you can specify which folders from the selected device (devices) contain files that are used to create the application category.
  
  All folders. All folders are taken into consideration for the creating category. By default, this option is selected.
  
  Specified folder. Only specified folder is taken into consideration for the creating category. If you select this option you must specify path to the folder.
On the Creating the application category wizard page, click the Finish button.

When the wizard has completed, a user application category is created. You can view the newly created category using the list of categories in the workspace of the Application categories folder.

If you want to export an application category to a KLC file, right-click the name of the category, select Export in the menu, and then in the window that opens, specify the file name and click Save.

Page top

[Topic 245886]

Creating an application category that includes executable files from a specific folder

Expand all | Collapse all

You can use executable files from a selected folder as a standard of executable files that you want to allow or block in your organization. On the basis of executable files from the selected folder, you can create an application category and use it in the Application Control component configuration.

To create an application category that includes executable files from a specific folder:

In the console tree, in the Advanced → Application management folder select the Application categories subfolder.
Click the New category button.
The New category wizard starts. Proceed through the wizard by using the Next button.
On the Category type wizard page, select Category that includes executable files from specific folder as the user category type.
On the Enter the application category name wizard page, enter the new application category name.
On the Repository folder wizard page, click the Browse button.
Specify the folder whose executable files will be used to create the application category.
Define the following settings:
- Include dynamic-link libraries (DLL) in this category
  The application category includes dynamic-link libraries (files in DLL format), and the Application Control component logs the actions of such libraries running in the system. Including DLL files in the category may lower the performance of Kaspersky Security Center.
  
  By default, this check box is cleared.
- Include script data in this category
  The application category includes data on scripts, and scripts are not blocked by Web Threat Protection. Including the script data in the category may lower the performance of Kaspersky Security Center.
  
  By default, this check box is cleared.
- Hash value computing algorithm: Calculate SHA256 for files in this category (supported by Kaspersky Endpoint Security 10 Service Pack 2 for Windows and later versions) / Calculate MD5 for files in this category (supported by versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows)
  Depending on the version of the security application installed on devices on your network, you must select an algorithm for hash value computing by Kaspersky Security Center for files in this category. Information about computed hash values is stored in the Administration Server database. Storage of hash values does not increase the database size significantly.
  
  SHA256 is a cryptographic hash function: no vulnerabilities have been found in its algorithm, and so it is considered the most reliable cryptographic function nowadays. Kaspersky Endpoint Security 10 Service Pack 2 for Windows and later versions support SHA256 computing. Computing of the MD5 hash function is supported by all versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows.
  
  Select either of the options of hash value computing by Kaspersky Security Center for files in the category:
  - If all instances of security applications installed on your network are Kaspersky Endpoint Security 10 Service Pack 2 for Windows or later versions, select the SHA256 check box. We do not recommend that you add any categories created according to the criterion of the SHA256 hash of an executable file for versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows. This may result in failures in the security application operation. In this case, you can use the MD5 cryptographic hash function for files of the category.
  - If any versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows are installed on your network, select the MD5 hash. You cannot add a category that was created based on the criterion of the MD5 checksum of an executable file for Kaspersky Endpoint Security 10 Service Pack 2 for Windows or later versions. In this case, you can use the SHA256 cryptographic hash function for files of the category.
  If different devices on your network use both earlier and later versions of Kaspersky Endpoint Security 10, select both the SHA256 check box and the MD5 hash check box.
  
  The Calculate SHA256 for files in this category (supported by Kaspersky Endpoint Security 10 Service Pack 2 for Windows and any later versions) check box is selected by default.
  
  The Calculate MD5 for files in this category (supported by versions earlier than Kaspersky Endpoint Security 10 Service Pack 2 for Windows) is cleared by default.
- Force folder scan for changes
  If this option is enabled, the application regularly checks the folder of category content addition for changes. You can specify the frequency of checks (in hours) in the entry field next to the check box. By default, the time interval between forced checks is 24 hours.
  
  If this option is disabled, the application does not force any checks of the folder. The Server attempts to access files if they have been modified, added, or deleted.
  
  By default, this option is disabled.
On the Creating the application category wizard page, click the Finish button.

When the wizard has completed, a user application category is created. You can view the newly created category using the list of categories in the workspace of the Application categories folder.

If you want to export an application category to a KLC file, right-click the name of the category, select Export in the menu, and then in the window that opens, specify the file name and click Save.

Page top

[Topic 158577]

Adding event-related executable files to the application category

Expand all | Collapse all

You can add executable files related to the Application startup prohibited and Application startup prohibited in test mode events to an existing application category with content added manually or to a new application category.

To add executable files related to Application Control events to the application category:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
On the Events tab, select the required events.
In the context menu of one of the selected events, select Add to category.
In the Action on executable file related to the event window that opens, specify the relevant settings:
Select one of the following:
- Add to a new application category
  Select this option if you want to create a new application category.
  
  Click the OK button to start the New category wizard. When the wizard completes, the category with the specified settings is created.
  
  By default, this option is not selected.
- Add to an existing application category
  Select this option if you have to add rules to an existing application category. Select the relevant category in the list of application categories.
  
  This option is selected by default.
In the Rule type section, select one of the following settings:
- Add to category
  Select this option if you have to add rules to the conditions of the application category.
  
  This option is selected by default.
- Rules for adding to exclusions
  Select this option if you want to add rules to the exclusions of the application category.
In the File info type section, select one of the following settings:
- Certificate details (or SHA256 hashes for files without certificate)
  Files may be signed with a certificate. Multiple files may be signed with the same certificate. For example, different versions of the same application may be signed with the same certificate, or several different applications from the same vendor may be signed with the same certificate. When you select a certificate, several versions of an application or several applications from the same vendor may end up in the category.
  
  Each file has its own unique SHA256 hash function. When you select an SHA256 hash function, only one corresponding file, for example, the defined application version, ends up in the category.
  
  Select this option if you want to add to the category rules the certificate details of an executable file (or the SHA256 hash function for files without a certificate).
  
  By default, this option is selected.
- Certificate details (files without a certificate will be skipped)
  Files may be signed with a certificate. Multiple files may be signed with the same certificate. For example, different versions of the same application may be signed with the same certificate, or several different applications from the same vendor may be signed with the same certificate. When you select a certificate, several versions of an application or several applications from the same vendor may end up in the category.
  
  Select this option if you want to add the certificate details of an executable file to the category rules. If the executable file has no certificate, this file will be skipped. No information about this file will be added to the category.
- Only SHA256 (files without hash will be skipped)
  Each file has its own unique SHA256 hash function. When you select an SHA256 hash function, only one corresponding file, for example, the defined application version, ends up in the category.
  
  Select this option if you want to add only the details of the SHA256 hash function of the executable file.
- Only MD5 (discontinued mode, only for Kaspersky Endpoint Security 10 Service Pack 1 version)
  Each file has its own unique MD5 hash function. When you select an MD5 hash function, only one corresponding file, for example, the defined application version, ends up in the category.
  
  Select this option if you want to add only the details of the MD5 hash function of the executable file. Computing of the MD5 hash function is supported by Kaspersky Endpoint Security 10 Service Pack 1 for Windows and all earlier versions.
Click OK.

Page top

[Topic 62745]

Configuring application startup management on client devices

Categorization of applications allows you to optimize management of application runs on devices. You can create an application category and configure Application Control for a policy so only applications from the specified category will be started on devices to which that policy is applied. For example, you have created a category that includes applications named Application_1 and Application_2. After you add this category to a policy, only two applications are allowed to start on devices to which that policy is applied: Application_1 and Application_2. If a user attempts to start an application that has not been included in that category, for example, Application_3, this application is blocked from being started. The user is shown a notification stating that Application_3 is blocked from starting, in accordance with an Application Control rule. You can create a category with content added automatically based on various criteria from a specific folder. In this case, files are automatically added to the category from the specified folder. Executable files of applications are copied to the specified folder and processed automatically; their metrics are added to the category.

To configure the applications run management on client devices:

In the Advanced → Application management folder in the console tree, select the Application categories subfolder.
In the workspace of the Application categories folder, create a category of applications that you want to manage while they are being started.
In the Managed devices folder, on the Policies tab click the New policy button to create a new policy for Kaspersky Endpoint Security for Windows, and follow the instructions of the wizard.
If such a policy already exists, you can skip this step. You can configure management of the startup of applications in a specified category through the settings of this policy. The newly created policy is displayed in the Managed devices folder on the Policies tab.
Select Properties from the context menu of the policy for Kaspersky Endpoint Security for Windows.
The properties window of the policy for Kaspersky Endpoint Security for Windows opens.
In the properties window of the Kaspersky Endpoint Security for Windows policy, in the Security Controls → Application Control section, select the Application Control check box.
Click the Add button.
The Application Control rule window opens.
In the Application Control rule window, in the Category drop-down list select the application category that the startup rule will cover. Configure the startup rule for the selected application category.
For Kaspersky Endpoint Security 10 Service Pack 2 and later, no categories are displayed if they were created upon the criterion of the MD5 hash of an executable file.

We do not recommend that you add any categories created according to the criterion of the SHA256 hash of an executable file for versions earlier than Kaspersky Endpoint Security 10 Service Pack 2. This may result in application failures.

Detailed instructions on configuring control rules are provided in the Kaspersky Endpoint Security for Windows Online Help.
Click OK.

Applications will be run on devices included in the specified category according to the rule that you created. The newly created rule is displayed in the properties window of the Kaspersky Endpoint Security for Windows policy, in the Application Control section.

Page top

[Topic 67884]

Viewing the results of static analysis of startup rules applied to executable files

To view information about which executable files are prohibited for users to run:

In the Managed devices folder in the console tree, select the Policies tab.
Select Properties from the context menu of the policy for Kaspersky Endpoint Security for Windows.
The properties window of the application policy opens.
In the Sections pane, select Security Controls and then select the Application Control subsection.
Click the Static analysis button.
The Analysis of the access rights list window opens. In the left part of the window a user list based on Active Directory data is displayed.
Select a user from the list.
The right part of the window displays categories of applications assigned to this user.
To view executable files that the user is not allowed to run, in the Analysis of the access rights list window click the View files button.
A window opens, displaying a list of prohibited executable files.
To view a list of executable files included in a category, select the application category and click the View files in category button.
A window opens, displaying a list of executable files included in the application category.

Page top

[Topic 3659]

Viewing the applications registry

Kaspersky Security Center inventories all software installed on managed devices.

Network Agent compiles a list of applications installed on a Windows or Linux device, and then transmits this list to Administration Server. For Windows-based client devices, Network Agent receives most of the information about installed applications from the Windows registry. For Linux-based client devices, package managers provide information about installed applications to Network Agent.

To view the registry of applications installed on client devices,

In the Advanced → Application management folder in the console tree, select the Applications registry subfolder.

The workspace of the Applications registry folder displays a list of applications installed on client devices and the Administration Server.

You can view the details of any application by opening its context menu and selecting Properties. The application properties window displays the application details and information about its executable files, as well as a list of devices on which the application is installed.

In the context menu of any application in the list you can:

Add this application to an application category.
Assign a tag to the application.
Export the list of applications to a CSV file or TXT file.
View the application properties, for example, vendor name, version number, list of executable files, list of devices on which the application is installed, list of available software updates, or list of detected software vulnerabilities.

To view applications that meet specific criteria, you can use filtering fields in the workspace of the Applications registry folder.

In the properties window of the selected device, in the Applications registry section, you can view the list of applications installed on the device.

Generating a report on installed applications

In the Applications registry workspace, you can also click the View report on installed applications button to generate a report containing detailed statistics on the installed applications, including the number of devices on which each application is installed. This report, which opens on the Report on Installed applications page, contains information about both the Kaspersky applications and third-party software. If you want information only on Kaspersky applications installed on client devices, in the Summary list, select AO Kaspersky Lab.

Information about Kaspersky applications and third-party software installed on devices that are connected to secondary and virtual Administration Servers is also stored in the applications registry of the primary Administration Server. After you add data from secondary and virtual Administration Servers, click the View report on installed applications button, and on the Report on installed applications page that opens, you can view this information.

To add information from secondary and virtual Administration Servers to the report on installed applications:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
On the Reports tab, select Report on installed applications.
Select Properties from the context menu of the report.
The Properties: Report on installed applications window opens.
In the Hierarchy of Administration Servers section, select the Include data from secondary and virtual Administration Servers check box.
Click OK.

Information from secondary and virtual Administration Servers will be included in the Report on installed applications.

Using Application Control to manage executable files

Main installation scenario

Page top

[Topic 102270]

Changing the software inventory start time

Kaspersky Security Center inventories all software installed on managed client devices running Windows.

Network Agent compiles a list of applications installed on a device, and then transmits this list to Administration Server. Network Agent automatically receives information about installed applications from the Windows registry.

To save the device resources, Network Agent by default starts receiving information about installed applications 10 minutes after the Network Agent service starts.

To change the software inventory start time, which elapses after the Network Agent service runs on a device:

Open the system registry of the device on which Network Agent is installed (for example, locally, using the regedit command in the Start → Run menu).
Go to the following hive:
- For 32-bit systems:
  HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\1103\1.0.0.0\NagentFlags
- For 64-bit systems:
  HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\1103\1.0.0.0\NagentFlags
For the KLINV_INV_COLLECTOR_START_DELAY_SEC key, set the required value in seconds.
The default value is 600 seconds.
Restart the Network Agent service.

The software inventory start time, which elapses after the Network Agent service runs, is changed.

Page top

[Topic 62835]

About license key management of third-party applications

Kaspersky Security Center allows you to track license key usage for third-party applications installed on the managed devices. The list of applications for which you can track license key usage is taken from the applications registry. For each license key, you can specify and track violation of the following restrictions:

Maximum number of devices on which the application using this license key can be installed
Expiration date of the license key

Kaspersky Security Center does not check whether or not you specify a real license key. You can only track the restrictions that you specify. If one of the restrictions that you impose on a license key is violated, Administration Server registers an informational, warning, or functional failure event.

License keys are bound to applications groups. An applications group is a group of third-party applications that you combine on a basis of a criterion or several criteria. You can define applications by the name of the application, its version, vendor, and tag. An application is added to the group if at least one of the criteria is met. To each applications group, you can bind several license keys, but each license key can be bound to a single applications group only.

One more tool that you can use to track license key usage is Report on status of licensed applications groups. This report provides information about the current status of licensed applications groups, including:

Number of installations of license keys on each applications group
Number of license keys in use and vacant license keys
Detailed list of licensed applications installed on managed devices

The tools for license key management of third-party applications are located in the Third-party licenses usage subfolder (Advanced → Application management → Third-party licenses usage). In this subfolder, you can create applications groups, add license keys, and generate the Report on statuses on licensed application groups.

The tools for license key management of third-party applications are available only if you enabled Vulnerability and patch management option in the Configure interface window.

Page top

[Topic 62748]

Creating licensed applications groups

Expand all | Collapse all

To create a licensed applications group:

In the Advanced → Application management folder in the console tree, select the Third-party licenses usage subfolder.
Click the Add a licensed applications group button to run Licensed application group addition wizard.
Licensed application group addition wizard starts.
On the Details of licensed applications group step, specify which applications you want to include into the applications group:
- Name of licensed applications group
- Track violated restrictions
  If one of the restrictions that you impose on a license key of the applications group is violated, Administration Server registers an informational, warning, or functional failure event:
  - Informational event: Limit of installations will soon be exceeded (more than 95% is used up) for one of the licensed applications groups
  - Warning event: Limit of installations will soon be exceeded for one of the licensed applications groups
  - Functional failure event: Limit of installations has been exceeded for one of the licensed applications groups
    An event is registered only once, when the stated condition is met. Next time, the same event can be registered only when the number of installations is returned to a normal level, and then the event happens again. An event cannot be registered more than once per hour.
- Criteria for adding detected applications to this licensed applications group
  Specify criteria to define which applications you want to include into the applications group. You can define applications by the name of the application, its version, vendor, and tag. You must specify at least one criterion. An application is added to the group if at least one of the criteria is met.
On the Enter data about existing license keys step, specify the license keys that you want to track. Select the Control if license limit is exceeded option, and then add the license keys:
1. Click the Add button.
2. Select the license key that you want to add, and then click the OK button. If the required license key is not listed, click the Add button, and then specify the license key properties.
On the Add licensed applications group step, click the Finish button.

A licensed applications group is created and displayed in the Third-party licenses usage folder.

Page top

[Topic 62754]

Managing license keys for licensed applications groups

To create a license key for a licensed applications group:

In the Advanced → Application management folder in the console tree, select the Third-party licenses usage subfolder.
In the workspace of the Third-party licenses usage folder, click the Manage license keys of licensed applications button.
The License Key Management in licensed applications window opens.
In the License Key Management in licensed applications window, click the Add button.
The License key window opens.
In the License key window, specify the properties of the license key and restrictions that the license key imposes on the licensed applications group.
- Name. The name of the license key.
- Comment. Notes on the selected license key.
- Restriction. The number of devices on which the application using this license key can be installed.
- Expires. The expiration date of the license key.

Created license keys are displayed in the License Key Management in licensed applications window.

To apply a license key to a licensed applications group:

In the Advanced → Application management folder in the console tree, select the Third-party licenses usage subfolder.
In the Third-party licenses usage folder, select a licensed applications group to which you want to apply a license key.
Select Properties from the context menu of the licensed applications group.
This opens the properties window of the licensed applications group.
In the properties window of the licensed applications group, in the License keys section, select Control if license limit is exceeded.
Click the Add button.
The Selecting a license key window opens.
In the Selecting a license key window, select a license key that you want to apply to a licensed applications group.
Click OK.

Restrictions imposed on a licensed applications group and specified in the license key will also apply to the selected licensed applications group.

Page top

[Topic 102357]

Inventory of executable files

You can obtain a list of executable files stored on managed devices. To inventory executable files, you must create an inventory task.

The feature of inventorying executable files is available for the following applications:

Kaspersky Endpoint Security for Windows
Kaspersky Endpoint Security for Linux
Kaspersky Security for Virtualization 4.0 Light Agent and later versions

The number of executable files received from a single device cannot exceed 150,000. Having reached this limit, Kaspersky Security Center cannot receive any new files.

Before you begin, enable notifications about the applications startup in the Kaspersky Endpoint Security policy and the Network Agent policy, so you can transfer data to Administration Server.

To enable notifications about applications startup:

Open the Kaspersky Endpoint Security policy settings and do the following:
1. Go to General settings → Reports and Storage.
2. In the Data transfer to Administration Server section, select the About started applications check box.
3. Save your changes.
Open the Network Agent policy settings and do the following:
1. Go to the Repositories section.
2. Select the Details of installed applications check box.
3. Save your changes.

To create an inventory task for executable files on client devices:

In the console tree, select the Tasks folder.
Click the New task button in the workspace of the Tasks folder.
The New task wizard starts.
In the Select the task type window of the wizard, select Kaspersky Endpoint Security as the task type, and then select Inventory as the task subtype, and click Next.
Follow the rest of the wizard instructions.

After the wizard is done, an inventory task for Kaspersky Endpoint Security is created. The newly created task is displayed in the list of tasks in the workspace of the Tasks folder.

A list of executable files that have been detected on devices during inventory is displayed in the workspace of the Executable files folder.

During inventory, the application detects executable files of the following formats: MZ, COM, PE, NE, SYS, CMD, BAT, PS1, JS, VBS, REG, MSI, CPL, DLL, JAR, and HTML files.

Page top

[Topic 52460]

Viewing information about executable files

To view a list of all executable files detected on client devices,

In the Application management folder of the console tree, select the Executable files subfolder.

The workspace of the Executable files folder displays a list of executable files that have been run on devices or have been detected while running the inventory task of Kaspersky Endpoint Security for Windows.

To view details of executable files that match specific criteria, you can use filtering.

To view the properties of an executable file,

From the context menu of the file, select Properties.

A window opens displaying information about the executable file and a list of devices on which this executable file can be found.

Page top

[Topic 179074]

Monitoring and reporting

This section describes the monitoring and reporting capabilities of Kaspersky Security Center. These capabilities give you an overview of your infrastructure, protection statuses, and statistics.

After Kaspersky Security Center deployment or during the operation, you can configure the monitoring and reporting features to best suit your needs.

Traffic lights
Administration Console allows you to quickly assess the current status of Kaspersky Security Center and managed devices by checking traffic lights.
Statistics
Statistics on the status of the protection system and managed devices are displayed in information panels that can be customized.
Reports
The Reports feature allows you to get detailed numerical information about the security of your organization's network, save this information to a file, send it by email, and print it.
Events
Event selections provide an onscreen view of named sets of events that are selected from the Administration Server database. These sets of events are grouped according to the following categories:
- By importance level—Critical events, Functional failures, Warnings, and Info events
- By time—Recent events
- By type—User requests and Audit events

You can create and view user-defined event selections based on the settings available, in the Kaspersky Security Center Web Console interface, for configuration.

In this section

Scenario: Monitoring and reporting

Monitoring traffic lights and logged events in Administration Console

Working with reports, statistics, and notifications

Monitoring of applications installation and uninstallation

Events of Kaspersky Security Center components

Blocking frequent events

Controlling changes in the status of virtual machines

Monitoring the anti-virus protection status using information from the system registry

Viewing and configuring the actions when devices show inactivity

Disabling Kaspersky announcements

Page top

[Topic 214326]

Scenario: Monitoring and reporting

This section provides a scenario for configuring the monitoring and reporting feature in Kaspersky Security Center.

Prerequisites

After you deploy Kaspersky Security Center in an organization's network you can start to monitor it and generate reports on its functioning.

Stages

Monitoring and reporting in an organization's network proceeds in stages:

Configuring the switching of device statuses
Get acquainted with the settings that define the assignment of device statuses depending on specific conditions. By changing these settings, you can change the number of events with Critical or Warning importance levels.

When configuring the switching of device statuses, be sure that the new settings do not conflict with the information security policies of your organization and that you are able to react to important security events in your organization's network in a timely manner.
Configuring notifications about events on client devices
Configure notification (by email, by SMS, or by running an executable file) of events on client devices in accordance with your organization's needs.
Changing the response of your security network to the Virus outbreak event
To adjust the network's response to new events, you can change the specific thresholds in the Administration Server properties. You can also create a stricter policy that will be activated, or create a task that will be run at the occurrence of this event.
Managing statistics
Configure the display of statistics in accordance with your organization's needs.
Reviewing the security status of your organization's network
To review the security status of your organization's network, you can do any of the following:
- In the workspace of the Administration Server node, on the Statistics tab open the Protection status second-level tab (page) and review the Real-time protection status information panel
- Generate and review the Report on protection status
- Generate and review the Report on errors
Locating client devices that are not protected
To locate client devices that are not protected, go the workspace of the Administration Server node, on the Statistics tab open the Protection status second-level tab (page), and review the History of discovery of new networked devices information panel. You can also generate and review the Report on protection deployment.
Checking protection of client devices
To check protection of client devices, go to the workspace of the Administration Server node, on the Statistics tab open the Deployment or Threat statistics second-level tab (page), and review the relevant information panels. You can also start and review the Critical events event selection.
Evaluating and limiting the event load on the database
Information about events that occur during operation of managed applications is transferred from a client device and registered in the Administration Server database. To reduce the load on the Administration Server, evaluate and limit the maximum number of events that can be stored in the database.

To evaluate the event load on the database, calculate the database space. You can also limit the maximum number of events to avoid database overflow.
Reviewing license information
To review license information, go to the workspace of the Administration Server node, on the Statistics tab open the Deployment second-level tab (page), and review the License key usage information panel. You can also generate and review the Report on usage of license keys.

Results

Upon completion of the scenario, you are informed about protection of your organization's network and, thus, can plan actions for further protection.

Page top

[Topic 92536]

Monitoring traffic lights and logged events in Administration Console

Administration Console allows you to quickly assess the current status of Kaspersky Security Center and managed devices by checking traffic lights. The traffic lights are shown in the workspace of the Administration Server node, on the Monitoring tab. The tab provides six information panels with traffic lights and logged events. A traffic light is a colored vertical bar on the left side of a panel. Each panel with a traffic light corresponds to a specific functional scope of Kaspersky Security Center (see the table below).

Scopes covered by traffic lights in Administration Console

Panel name	Traffic light scope
Deployment	Installing Network Agent and security applications on devices on an organization's network
Management scheme	Structure of administration groups. Network scanning. Device moving rules
Protection settings	Security application functionality: protection status, malware scanning
Update	Updates and patches
Monitoring	Protection status
Administration Server	Administration Server features and properties

Each traffic light can be any of these five colors (see the table below). The color of a traffic light depends on the current status of Kaspersky Security Center and on events that were logged.

Color codes of traffic lights

Status	Traffic light color	Traffic light color meaning
Informational	Green	Administrator's intervention is not required.
Warning	Yellow	Administrator's intervention is required.
Critical	Red	Serious problems have been encountered. Administrator's intervention is required to solve them.
Informational	Light blue	Events have been logged that are unrelated to potential or actual threats to the security of managed devices.
Informational	Gray	The details of events are not available or have not yet been retrieved.

The administrator's goal is to keep traffic lights on all of the information panels on the Monitoring tab green.

The information panels also show logged events that affect traffic lights and the status of Kaspersky Security Center (see the table below).

Name, description, and traffic light colors of logged events

Traffic light color	Event type display name	Event type	Description
Red	License expired on %1 device(s)	IDS_AK_STATUS_LIC_EXPAIRED	Events of this type occur when the commercial license has expired. Once a day Kaspersky Security Center checks whether the license has expired on the devices. When the commercial license expires, Kaspersky Security Center provides only basic functionality. To continue using Kaspersky Security Center, renew your commercial license.
Red	Security application is not running on: %1 device(s)	IDS_AK_STATUS_AV_NOT_RUNNING	Events of this type occur when the security application installed on the device is not running. Make sure that Kaspersky Endpoint Security is running on the device.
Red	Protection is disabled on: %1 device(s)	IDS_AK_STATUS_RTP_NOT_RUNNING	Events of this type occur when the security application on the device has been disabled for longer than the specified time interval. Check the current status of real-time protection on the device and make sure that all the protection components that you need are enabled.
Red	A software vulnerability has been detected on devices	IDS_AK_STATUS_VULNERABILITIES_FOUND	Events of this type occur when the Find vulnerabilities and required updates task has detected vulnerabilities with the severity level specified in applications installed on the device. Check the list of available updates in the Software updates subfolder included in the Application management folder. This folder contains a list of updates for Microsoft applications and other software vendors products retrieved by Administration Server, which can be distributed to devices. After viewing information about available updates, install them on the device.
Red	Critical events have been registered on the Administration Server	IDS_AK_STATUS_EVENTS_OCCURED	Events of this type occur when Administration Server critical events are detected. Check the list of events stored on the Administration Server, and then fix the critical events one by one.
Red	Errors have been logged in events on the Administration Server	IDS_AK_STATUS_ERROR_EVENTS_OCCURED	Events of this type occur when unexpected errors are logged on the Administration Server side. Check the list of events stored on the Administration Server, and then fix the errors one by one.
Red	Lost connection to %1 device(s)	IDS_AK_STATUS_ADM_LOST_CONTROL1	Events of this type occur when the connection between the Administration Server and the device is lost. View the list of disconnected devices and try to reconnect them.
Red	%1 device (s) have not connected to the Administration Server in a long time	IDS_AK_STATUS_ADM_NOT_CONNECTED1	Events of this type occur when the device has not connected to the Administration Server within the specified time interval, because the device was turned off. Make sure that the device is turned on and that Network Agent is running.
Red	%1 device(s) have a status other than OK	IDS_AK_STATUS_HOST_NOT_OK	Events of this type occur when the OK status of the device connected to the Administration Server changes to Critical or Warning. You can troubleshoot the problem by using the Kaspersky Security Center remote diagnostics utility.
Red	Databases are outdated on: %1 device(s)	IDS_AK_STATUS_UPD_HOSTS_NOT_UPDATED	Events of this type occur when the anti-virus databases have not been updated on the device within the specified time interval. Follow the instructions to update Kaspersky databases.
Red	Device(s) where check for Windows Update updates has not been performed in a long time: %1	IDS_AK_STATUS_WUA_DATA_OBSOLETE	Events of this type occur when the Perform Windows Update synchronization task has not been run within the specified time interval. Follow the instructions to synchronize updates from Windows Update with Administration Server.
Red	%1 plug-in(s) for Kaspersky Security Center must be installed	IDS_AK_STATUS_PLUGINS_REQUIRED2	Events of this type occur when you need to install additional plug-ins for Kaspersky applications. Download and install the required management plug-ins for the Kaspersky application from the Kaspersky Technical Support webpage.

Page top

[Topic 3635]

Working with reports, statistics, and notifications

This section provides information about how to work with reports, statistics, and selections of events and devices in Kaspersky Security Center, as well as how to configure Administration Server notifications.

In this section

Working with reports

Managing statistics

Configuring event notification

Creating a certificate for an SMTP server

Event selections

Device selections

Page top

[Topic 52059]

Working with reports

Reports in Kaspersky Security Center contain information about the status of managed devices. Reports are generated based on information stored on Administration Server. You can create reports for the following types of objects:

For device selections created according to specific settings.
For administration groups.
For specific devices from different administration groups.
For all devices on the network (in the deployment report).

The application has a selection of standard report templates. It is also possible to create custom report templates. Reports are displayed in the main application window, in the Administration Server folder in the console tree.

In this section

Creating a report template

Viewing and editing report template properties

Extended filter format in report templates

Creating and viewing a report

Saving a report

Creating a report delivery task

Page top

[Topic 3636]

Creating a report template

To create a report template:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
Click the New report template button.

The New report template wizard starts. Follow the instructions of the wizard.

After the wizard finishes its operation, the newly created report template is added to the selected Administration Server folder in the console tree. You can use this template for generating and viewing reports.

Page top

[Topic 174017]

Viewing and editing report template properties

Expand all | Collapse all

You can view and edit basic properties of a report template, for example, the report template name or the fields displayed in the report.

To view and edit properties of a report template:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
In the list of report templates, select the required report template.
In the context menu of the selected report template, select Properties.
As an alternative, you can first generate the report, and then click either the Open report template properties button or the Configure report columns button.
In the window that opens, edit the report template properties. Properties of each report may contain only some of the sections described below.
- General section:
  - Report template name
  - Maximum number of entries to display
    If this option is enabled, the number of entries displayed in the table with detailed report data does not exceed the specified value.
    
    Report entries are first sorted according to the rules specified in the Fields → Details fields section of the report template properties, and then only the first of the resulting entries are kept. The heading of the table with detailed report data shows the displayed number of entries and the total available number of entries that match other report template settings.
    
    If this option is disabled, the table with detailed report data displays all available entries. We do not recommend that you disable this option. Limiting the number of displayed report entries reduces the load on the database management system (DBMS) and reduces the time required for generating and exporting the report. Some of the reports contain too many entries. If this is the case, you may find it difficult to read and analyze them all. Also, your device may run out of memory while generating such a report and, consequently, you will not be able to view the report.
    
    By default, this option is enabled. The default value is 1000.
  - Print version
    The report output is optimized for printing: space characters are added between some values for better visibility.
    
    By default, this option is enabled.
- Fields section.
  Select the fields that will be displayed in the report, and the order of these fields, and configure whether the information in the report must be sorted and filtered by each of the fields.
- Time interval section.
  Modify the report period. Available values are as follows:
  - Between the two specified dates
  - From the specified date to the report creation date
  - From the report creation date, minus the specified number of days, to the report creation date
- Group, Device selection, or Devices section.
  Change the set of client devices for which the report creates. Only one of these sections may be present, depending on the settings specified during the report template creation.
- Settings section.
  Change the settings of the report. The exact set of settings depends on the specific report.
- Security section. Inherit settings from Administration Server
  If this option is enabled, security settings of the report are inherited from the Administration Server.
  
  If this option is disabled, you can configure security settings for the report. You can assign a role to a user or a group of users or assign permissions to a user or a group of users, as applied to the report.
  
  By default, this option is enabled.
  
  The Security section is available if the Display security settings sections check box is selected in the interface settings window.
- Hierarchy of Administration Servers section:
  - Include data from secondary and virtual Administration Servers
    If this option is enabled, the report includes the information from the secondary and virtual Administration Servers that are subordinate to the Administration Server for which the report template is created.
    
    Disable this option if you want to view data only from the current Administration Server.
    
    By default, this option is enabled.
  - Up to nesting level
    The report includes data from secondary and virtual Administration Servers that are located under the current Administration Server on a nesting level that is less than or equal to the specified value.
    
    The default value is 1. You may want to change this value if you have to retrieve information from secondary Administration Servers located at lower levels in the tree.
  - Data wait interval (min)
    Before generating the report, the Administration Server for which the report template is created waits for data from secondary Administration Servers during the specified number of minutes. If no data is received from a secondary Administration Server at the end of this period, the report runs anyway. Instead of the actual data, the report shows data taken from the cache (if the Cache data from secondary Administration Servers option is enabled), or N/A (not available) otherwise.
    
    The default value is 5 (minutes).
  - Cache data from secondary Administration Servers
    Secondary Administration Servers regularly transfer data to the Administration Server for which the report template is created. There, the transferred data is stored in the cache.
    
    If the current Administration Server cannot receive data from a secondary Administration Server while generating the report, the report shows data taken from the cache. The date when the data was transferred to the cache is also displayed.
    
    Enabling this option allows you to view the information from secondary Administration Servers even if the up-to-date data cannot be retrieved. However, the displayed data can be obsolete.
    
    By default, this option is disabled.
  - Cache update frequency (h)
    Secondary Administration Servers at regular intervals transfer data to the Administration Server for which the report template is created. You can specify this period in hours. If you specify 0 hours, data is transferred only when the report is generated.
    
    The default value is 0.
  - Transfer detailed information from secondary Administration Servers
    In the generated report, the table with detailed report data includes data from secondary Administration Servers of the Administration Server for which the report template is created.
    
    Enabling this option slows the report generation and increases traffic between Administration Servers. However, you can view all data in one report.
    
    Instead of enabling this option, you may want to analyze detailed report data to detect a faulty secondary Administration Server, and then generate the same report only for that faulty Administration Server.
    
    By default, this option is disabled.

Page top

[Topic 189575]

Extended filter format in report templates

In Kaspersky Security Center 15.1, you can apply the extended filter format to a report template. The extended filter format provides more flexibility in comparison with the default format. You can create complex filtering conditions by using a set of filters, which will be applied to the report by means of the OR logical operator during report creation, as shown below:

Filter[1](Field[1] AND Field[2]... AND Field[n]) OR Filter[2](Field[1] AND Field[2]... AND Field[n]) OR... Filter[n](Field[1] AND Field[2]... AND Field[n])

Additionally, with the extended filter format you can set a time interval value in a relative time format (for example, by using a "For last N days" condition) for specific fields in a filter. The availability and the set of time interval conditions depend on the type of the report template.

In this section

Converting the filter into the extended format

Configuring the extended filter

Page top

[Topic 189734]

Converting the filter into the extended format

The extended filter format for report templates is supported only in Kaspersky Security Center 12 and later versions. After conversion of the default filter into the extended format, the report template becomes incompatible with Administration Servers on your network that have earlier versions of Kaspersky Security Center installed. Information from these Administration Servers will not be received for the report.

To convert the report template default filter into the extended format:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
In the list of report templates, select the required report template.
In the context menu of the selected report template, select Properties.
In the properties window that opens, select the Fields section.
In the Details fields tab click the Convert filter link.
In the window that opens, click the OK button.
Conversion into the extended filter format is irreversible for the report template to which it is applied. If you clicked the Convert filter link accidentally, you can cancel the changes by clicking the Cancel button in the report template properties window.
To apply the changes, close the report template properties window by clicking the OK button.
When the report template properties window opens again, the newly available Filters section is displayed. In this section you can configure the extended filter.

Page top

[Topic 189735]

Configuring the extended filter

To configure the extended filter in the report template properties:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
In the list of report templates, select the report template that was previously converted to extended filter format.
In the context menu of the selected report template, select Properties.
In the properties window that opens, select the Filters section.
The Filters section is not displayed if the report template was not previously converted to extended filter format.

In the Filters section of the report template properties window you can review and modify the list of filters applied to the report. Each filter in the list has a unique name and represents a set of filters for corresponding fields in the report.
Open the filter settings window in one of the following ways:
- To create a new filter, click the Add button.
- To modify the existing filter, select the required filter and click the Modify button.
In the window that opens, select and specify the values of the required fields of the filter.
Click the OK button to save changes and close the window.
If you are creating a new filter, the filter name must be specified in the Filter name field before clicking the OK button.
Close the report template properties window by clicking the OK button.
The extended filter in the report template is configured. Now you can create reports by using this report template.

Page top

[Topic 3638]

Creating and viewing a report

To create and view a report:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
In the list of report templates, double-click the report template that you need.
A report for the selected template is displayed.

The report displays the following data:

The name and type of report, a brief description and the reporting period, as well as information about the group of devices for which the report is generated.
Graph chart showing the most representative report data.
Consolidated table with calculated report indicators.
Table with detailed report data.

See also:

Scenario: Updating third-party software

Scenario: Monitoring and reporting

Page top

[Topic 52064]

Saving a report

To save a created report:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
In the list of report templates, select the report template that you need.
In the context menu of the selected report template, select Save.

The Report saving wizard starts. Follow the instructions of the wizard.

After the wizard finishes, the folder opens to which you have saved the report file.

When you save a report as an XLS file, all related images, such as the logo and datagram, are saved as separate files.

Page top

[Topic 3639]

Creating a report delivery task

Reports can be emailed. Delivery of reports in Kaspersky Security Center is carried out using the report delivery task.

To create a delivery task for a single report:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Reports tab.
In the list of report templates, select the report template that you need.
In the context menu of the selected report template, select Deliver reports.

The Report delivery task creation wizard starts. Follow the instructions of the wizard.

To create a delivery task for multiple reports:

In the console tree, under the node with the name of the required Administration Server, select the Tasks folder.
In the workspace of the Tasks folder, click the Create a task button.

The New task wizard starts. Follow the instructions of the wizard.

The newly created report delivery task is displayed in the Tasks folder in the console tree.

The report delivery task is created automatically if the email settings were specified during Kaspersky Security Center installation.

In this section

Step 1. Selecting the task type

Step 2. Selecting the report type

Step 3. Actions on a report

Step 4. Selecting the account to start the task

Step 5. Configuring a task schedule

Step 6. Defining the task name

Step 7. Completing creation of the task

Page top

[Topic 151874]

Step 1. Selecting the task type

In the Select the task type window, in the list of tasks select Deliver reports as the task type.

Click Next to proceed to the next step.

Page top

[Topic 151875]

Step 2. Selecting the report type

In the Select report type window, in the list of task creation templates, select the type of report.

Click Next to proceed to the next step.

Page top

[Topic 151876]

Step 3. Actions on a report

Expand all | Collapse all

In the Action to apply to reports window, specify the following settings:

Send reports by email
If this option is enabled, the application sends generated reports by email.

You can configure the report sending by email by clicking the Email notification settings link. The link is available if this option is enabled.

If this option is disabled, the application saves reports in the specified folder to store them.

By default, this option is disabled.
Save reports to shared folder
If this option is enabled, the application saves reports to the folder that is specified in the field under the check box. To save reports to a shared folder, specify the UNC path to the folder. In this case, in the Selecting an account to run the task window, you must specify the user account and password for accessing this folder.

If this option is disabled, the application does not save reports to the folder and sends them by email instead.

By default, this option is disabled.
Overwrite older reports of the same type
If this option is enabled, the new report file at each task startup overwrites the file that was saved in the reports folder at the previous task startup.

If this option is disabled, report files will not be overwritten. A new report file is stored in the reports folder at each task run.

The check box is available, if the Save report to folder is selected.

By default, this option is disabled.
Specify account for access to shared folder
If this option is enabled, you can specify the account under which the report will be saved to the folder. If a UNC path to a shared folder is specified as the Save report to folder setting in the Action to be applied to report window, you must specify the user account and password for accessing this folder.

If this option is disabled, the report is saved to the folder under the account of Administration Server.

The check box is available, if the Save report to folder is selected.

By default, this option is disabled.

When you save or send a report as an XLS file, all related images, such as the logo and datagram, are saved as separate files.

Click Next to proceed to the next step.

Page top

[Topic 151877]

Step 4. Selecting the account to start the task

Expand all | Collapse all

In the Selecting an account to run the task window, you can specify which account to use when running the task. Select one of the following options:

Default account
The task will be run under the same account as the application that performs this task.

By default, this option is selected.
Specify account
Fill in the Account and Password fields to specify the details of an account under which the task is run. The account must have sufficient rights for this task.
- Account
  Account under which the task is run.
- Password
  Password of the account under which the task will be run.

Click Next to proceed to the next step.

Page top

[Topic 151878]

Step 5. Configuring a task schedule

Expand all | Collapse all

On the Configure task schedule wizard page, you can create a schedule for task start. If necessary, define the following settings:

Scheduled start:
Select the schedule according to which the task runs, and configure the selected schedule.
- Every N hours
  The task runs regularly, with the specified interval in hours, starting from the specified date and time.
  
  By default, the task runs every 6 hours, starting from the current system date and time.
- Every N days
  The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.
  
  By default, the task runs every day, starting from the current system date and time.
- Every N weeks
  The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.
  
  By default, the task runs every Monday at the current system time.
- Every N minutes
  The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.
  
  By default, the task runs every 30 minutes, starting from the current system time.
- Daily (daylight saving time is not supported)
  The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.
  
  We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.
  
  By default, the task starts every day at the current system time.
- Weekly
  The task runs every week on the specified day and at the specified time.
- By days of week
  The task runs regularly, on the specified days of the week, at the specified time.
  
  By default, the task runs every Friday at 6:00:00 PM.
- Monthly
  The task runs regularly, on the specified day of the month, at the specified time.
  
  In months that lack the specified day, the task runs on the last day.
  
  By default, the task runs on the first day of each month, at the current system time.
- Manually
  The task does not run automatically. You can only start it manually.
  
  By default, this option is selected.
- Every month on specified days of selected weeks
  The task runs regularly, on the specified days of each month, at the specified time.
  
  By default, no days of month are selected. The default start time is 18:00.
- On virus outbreak
  The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:
  - Anti-virus for workstations and file servers
  - Anti-virus for perimeter defense
  - Anti-virus for mail systems
  By default, all application types are selected.
  
  You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.
- On completing another task
  The current task starts after another task completes. This option only works if both tasks are assigned to the same devices. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task as a triggering task.
  
  You have to select the triggering task from the table and the status with which this task must complete (Completed successfully or Failed).
  
  If necessary, you can search, sort, and filter the tasks in the table as follows:
  - Enter the task name in the search field, to search the task by its name.
  - Click the sort icon to sort the tasks by name.
    By default, the tasks are sorted in alphabetical ascending order.
  - Click the filter icon, and in the window that opens, filter the tasks by group, and then click the Apply button.
Run missed tasks
This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.

If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.

If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.

By default, this option is disabled.
Use automatically randomized delay for task starts
If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.

If this option is disabled, the task starts on client devices according to the schedule.
Use randomized delay for task starts within an interval of (min)
If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

If this option is disabled, the task starts on client devices according to the schedule.

By default, this option is disabled. The default time interval is one minute.

Page top

[Topic 151879]

Step 6. Defining the task name

In the Define the task name window, specify the name for the task that you are creating. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).

Click Next to proceed to the next step.

Page top

[Topic 151880]

Step 7. Completing creation of the task

In the Finish task creation window, click the Finish button to finish the wizard.

If you want the task to start as soon as the wizard finishes, select the Run the task after the wizard finishes check box.

Page top

[Topic 10592]

Managing statistics

Statistics on the status of the protection system and managed devices are displayed in information panels that can be customized. Statistics are displayed in the workspace of the Administration Server node on the Statistics tab. The tab contains some second-level tabs (pages). Each tabbed page displays information panels with statistics, as well as links to corporate news and other materials from Kaspersky. The statistical information is displayed in information panels as a table or chart (pie or bar). The data in the information panels is updated while the application is running and reflects the current state of the protection application.

You can modify the set of second-level tabs on the Statistics tab, the number of information panels on each tabbed page, and the data display mode in information panels.

To add a new second-level tab with information panels on the Statistics tab:

Click the Customize view button in the upper right corner of the Statistics tab.
The statistics properties window opens. This window contains a list of tabbed pages that are currently shown on the Statistics tab. In this window, you can change the display order for the pages on the tab, add and remove pages, and proceed to configuration of page properties by clicking the Properties button.
Click the Add button.
This opens the properties window of a new page.
Configure the new page:
- In the General section, specify the page name.
- In the Information panels section, click the Add button to add information panels that must be displayed on the page.
  Click the Properties button in the Information panels section to set up the properties of information panels that you added: name, type, and appearance of the chart in the panel, as well as data required to plot the chart.
Click OK.

The tabbed page with information panels that you have added appears on the Statistics tab. Click the settings icon ( The settings icon. ) to proceed instantly to configuration of the page or a selected information panel on that page.

See also

Scenario: Monitoring and reporting

Page top

[Topic 4944_1]

Configuring event notification

Expand all | Collapse all

Kaspersky Security Center allows you to select a method of notifying the administrator of events on client devices and to configure notification:

Email. When an event occurs, the application sends a notification to email addresses specified. You can edit the text of the notification.
SMS. When an event occurs, the application sends a notification to the phone numbers specified. You can configure SMS notifications to be sent through the mail gateway.
Executable file. When an event occurs on a device, the executable file is started on the administrator's workstation. Using the executable file, the administrator can receive the parameters of any event that has occurred.

To configure notification of events occurring on client devices:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
Click the Configure notifications and event export link and select the Configure notifications value in the drop-down list.
This opens the Properties: Events window.
In the Notification section, select a notification method (by email, by SMS, or by running an executable file) and define the notification settings:
- Email
  The Email tab allows you to configure email notifications for events.
  
  In the Recipients (email addresses) field, specify the email addresses to which the application will send notifications. You can specify multiple addresses in this field, by separating them with semicolons.
  
  In the SMTP servers field, specify mail server addresses, separating them with semicolons. You can use the following values:
  - IPv4 or IPv6 address
  - Windows network name (NetBIOS name) of the device
  - DNS name of the SMTP server
  In the SMTP server port field, specify the number of an SMTP server communication port. The default port number is 25.
  
  If you enable the Use DNS MX lookup option, you can use several MX records of the IP addresses for the same DNS name of the SMTP server. The same DNS name may have several MX records with different values of priority of receiving email messages. Administration Server attempts to send email notifications to the SMTP server in ascending order of MX records priority. By default, this option is disabled.
  
  If you enable the Use DNS MX lookup option and do not enable usage of TLS settings, we recommend that you use the DNSSEC settings on your server device as an additional measure of protection for sending email notifications.
  
  Click the Settings link to define additional notification settings:
  - Subject name (subject name of an email message)
  - Sender email address
  - ESMTP authentication settings
  You have to specify an account for authentication on an SMTP server if the ESMTP authentication option is enabled for the SMTP server.
  - TLS settings for the SMTP server:
    - Do not use TLS
    You can select this option if you want to disable encryption of email messages.
    - Use TLS if supported by SMTP server
    You can select this option if you want to use a TLS connection to an SMTP server. If the SMTP server does not support TLS, Administration Server connects the SMTP server without using TLS.
    - Always use TLS, check the server certificate for validity
    You can select this option if you want to use TLS authentication settings. If the SMTP server does not support TLS, Administration Server cannot connect the SMTP server.
  We recommend that you use this option for better protection of the connection with an SMTP server. If you select this option, you can set authentication settings for a TLS connection.
  
  If you choose Always use TLS, check the server certificate for validity value, you can specify a certificate for authentication of the SMTP server and choose whether you want to enable communication through any version of TLS or only through TLS 1.2 or later versions. Also, you can specify a certificate for client authentication on the SMTP server.
  
  You can specify TLS settings for an SMTP server:
  - Browse for an SMTP server certificate file:
  You can receive a file with the list of certificates from a trusted certification authority and upload the file to Administration Server. Kaspersky Security Center checks whether the certificate of an SMTP server is also signed by a trusted certification authority. Kaspersky Security Center cannot connect to an SMTP server if the certificate of the SMTP server is not received from a trusted certification authority.
  - Browse for a client certificate file:
  You can use a certificate that you received from any source, for example, from any trusted certification authority. You must specify the certificate and its private key by using one of the following certificate types:
  - X-509 certificate:
  You must specify a file with the certificate and a file with the private key. Both files do not depend on each other and the order of loading of the files is not significant. When both files are loaded, you must specify the password for decoding the private key. The password can have an empty value if the private key is not encoded.
  - pkcs12 container:
  You must upload a single file that contains the certificate and its private key. When the file is loaded, you must then specify the password for decoding the private key. The password can have an empty value if the private key is not encoded.
  
  The Notification message field contains standard text with information about the event that the application sends when an event occurs. This text includes substitute parameters, such as event name, device name, and domain name. You can edit the message text by adding other substitute parameters with more relevant details of the event. The list of substitute parameters is available by clicking the button to the right of the field.
  
  If the notification text contains a percent sign (%), you have to type it twice in a row to allow message sending. For example, "CPU load is 100%%".
  
  Click the Configure numeric limit of notifications link to specify the maximum number of notifications that the application can send during the specified time interval.
  
  Click the Send test message button to check if you have configured notifications properly. The application should send a test notification to the email addresses that you specified.
- SMS
  The SMS tab allows you to configure the transmission of SMS notifications of various events to a cell phone. SMS messages are sent through a mail gateway.
  
  In the Recipients (email addresses) field, specify the email addresses to which the application will send notifications. You can specify multiple addresses in this field, by separating them with semicolons. The notifications will be delivered to the phone numbers associated with the specified email addresses.
  
  In the SMTP servers field, specify mail server addresses, separating them with semicolons. You can use the following values:
  - IPv4 or IPv6 address
  - Windows network name (NetBIOS name) of the device
  - DNS name of the SMTP server
  In the SMTP server port field, specify the number of an SMTP server communication port. The default port number is 25.
  
  Click the Settings link to define additional notification settings:
  - Subject name (subject name of an email message)
  - Sender email address
  - ESMTP authentication settings
  If necessary, you can specify an account for authentication on an SMTP server if the option of ESMTP authentication is enabled for the SMTP server.
  - TLS settings for an SMTP server
  You can disable usage of TLS, use TLS if the SMTP server supports this protocol, or you can force usage of TLS only. If you choose to use only TLS, you can specify a certificate for authentication of the SMTP server and choose whether you want to enable communication through any version of TLS or only through TLS 1.2 or later versions. Also, if you choose to use only TLS, you can specify a certificate for client authentication on the SMTP server.
  - Browse for an SMTP server certificate file
  You can receive a file with the list of certificates from a trusted certification authority and upload the file to Kaspersky Security Center. Kaspersky Security Center checks whether the certificate of the SMTP server is also signed by a trusted certification authority. Kaspersky Security Center cannot connect to the SMTP server if the certificate of the SMTP server is not received from a trusted certification authority.
  
  You must upload a single file that contains the certificate and its private key. When the file is loaded, you must then specify the password for decoding the private key. The password can have an empty value if the private key is not encoded.The Notification message field contains standard text with information about the event that the application sends when an event occurs. This text includes substitute parameters, such as event name, device name, and domain name. You can edit the message text by adding other substitute parameters with more relevant details of the event. The list of substitute parameters is available by clicking the button to the right of the field.
  
  If the notification text contains a percent sign (%), you have to type it twice in a row to allow message sending. For example, "CPU load is 100%%".
  
  Click the Configure numeric limit of notifications link to specify the maximum number of notifications that the application can send during the specified time interval.
  
  Click the Send test message button to check whether you configured notifications properly. The application should send a test notification to the recipient that you specified.
- Executable file to be run
  If this notification method is selected, in the entry field you can specify the application that will start when an event occurs.
  
  Clicking the Configure numeric limit of notifications link allows you to specify the maximum number of notifications that the application can send during the specified time interval.
  
  Clicking the Send test message button allows you to check whether you configured notifications properly: the application sends a test notification to the email addresses that you specified.
In the Notification message field, enter the text that the application will send when an event occurs.
You can use the drop-down list to the right of the text field to add substitution settings with event details (for example, event description, or time of occurrence).

If the notification text contains a percent (%), you must specify it twice in succession to allow message sending. For example, "CPU load is 100%%".
Click the Send test message button to check whether notification has been configured correctly.
The application sends a test notification to the specified user.
Click OK to save the changes.

The re-adjusted notification settings are applied to all events that occur on client devices.

You can override notification settings for certain events in the Event configuration section of the Administration Server settings, of a policy settings, or of an application settings.

Scenario: Monitoring and reporting

Page top

[Topic 110329]

Creating a certificate for an SMTP server

To create a certificate for an SMTP server:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
Click the Configure notifications and event export link and select the Configure notifications value in the drop-down list.
The event properties window opens.
On the Email tab, click the Settings link to open the Settings window.
In the Settings window click the Specify certificate link to open the Certificate for signing window.
In the Certificate for signing window, click the Browse button.
The Certificate window opens.
In the Certificate type drop-down list, specify the public or private type of certificate:
- If the private type of certificate (PKCS #12 container) is selected, specify the certificate file and the password.
- If the public type of certificate (X.509 certificate) is selected:
  1. Specify the private key file (one with the *.prk or *.pem extension).
  2. Specify the private key password.
  3. Specify the public key file (one with the *.cer extension).
Click OK.

The certificate for the SMTP server is issued.

Page top

[Topic 3628]

Event selections

Information about events in the operation of Kaspersky Security Center and managed applications is saved both in the Administration Server database and in the Microsoft Windows system log. You can view information from the Administration Server database in the workspace of the Administration Server node, on the Events tab.

Information on the Events tab is represented as a list of event selections. Each selection includes events of a specific type only. For example, the "Device status is Critical" selection contains only records about changes of device statuses to "Critical". After application installation, the Events tab contains some standard event selections. You can create additional (custom) event selections or export event information to a file.

In this section

Viewing an event selection

Customizing an event selection

Creating an event selection

Exporting an event selection to a text file

Deleting events from a selection

Adding applications to exclusions by user requests

Page top

[Topic 3629]

Viewing an event selection

To view the event selection:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
In the Event selections drop-down list, select the relevant event selection.
If you want events from this selection to be continuously displayed in the workspace, click the star icon () next to the selection.

The workspace will display a list of events, stored on the Administration Server, of the selected type.

You can sort information in the list of events in ascending or descending order in any column.

See also

Scenario: Monitoring and reporting

Page top

[Topic 3632]

Customizing an event selection

To customize an event selection:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
Open the relevant event selection on the Events tab.
Click the Selection properties button.

In the event selection properties window that opens you can configure the event selection.

See also:

Scenario: Monitoring and reporting

Page top

[Topic 3631]

Creating an event selection

To create an event selection:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
Click the Create a selection button.
In the New event selection window that opens, enter the name of the new selection and click OK.

A selection with the name that you specified is created in the Event selections drop-down list.

By default, a created event selection contains all events stored on the Administration Server. To cause a selection to display only the events you want, you must customize the selection.

See also:

Scenario: Monitoring and reporting

Page top

[Topic 3633]

Exporting an event selection to a text file

To export an event selection to a text file:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
Click the Import/Export button.
In the drop-down list, select Export events to file.

The Events export wizard starts. Follow the instructions of the wizard.

See also:

Scenario: Monitoring and reporting

Page top

[Topic 3634]

Deleting events from a selection

To delete events from a selection:

In the console tree, select the node with the name of the relevant Administration Server.
In the workspace of the node, select the Events tab.
Select the events that you want to delete by using a mouse, the Shift key, or the Ctrl key.
Delete the selected events in one of the following ways:
- By selecting Delete in the context menu of any of the selected events.
  If you select the Delete All item from the context menu, all displayed events will be deleted from the selection, regardless of your choice of events to delete.
- By clicking the Delete event link (if one event is selected) or the Delete events link (if several events are selected) in the information box for these events.

The selected events are deleted.

See also:

Scenario: Monitoring and reporting

Page top

[Topic 173819]

Adding applications to exclusions by user requests

When you receive user requests to unblock erroneously blocked applications, you can create an exclusion from the Adaptive Security rules for these applications. Consequently, the applications will no longer be blocked on users' devices. You can track the number of user requests on the Monitoring tab of Administration Server.

To add applications blocked by Kaspersky Endpoint Security to exclusions by user requests:

In the console tree, select the node with the name of the required Administration Server.
In the workspace of the node, select the Events tab.
In the Event selections drop-down list, select User requests.
Right-click the user request (or several user requests) containing applications that you want to add to exclusions, and then select Add exclusion.
This starts the Add exclusion wizard. Follow its instructions.

The selected applications will be excluded from the Rule triggers in Smart Training state list (under Repositories in the console tree) after the next synchronization of the client device with the Administration Server, and will no longer appear in the list.

See also:

Scenario: Monitoring and reporting

Page top

[Topic 3652]

Device selections

Information about the status of devices is displayed in the Device selections folder in the console tree.

Information in the Device selections folder is displayed as a list of device selections. Each selection contains devices that meet specific conditions. For example, the Devices with Critical status selection contains only devices with the Critical status. After application installation, the Device selections folder contains some standard selections. You can create additional (custom) device selections, export selection settings to file, or create selections with settings imported from another file.

In this section

Viewing a device selection

Configuring a device selection

Exporting the settings of a device selection to a file

Creating a device selection

Creating a device selection according to imported settings

Removing devices from administration groups in a selection

Page top

[Topic 3654]

Viewing a device selection

To view a device selection:

In the console tree, select the Device selections folder.
In the workspace of the folder, in the Devices in this selection list, select the relevant device selection.
Click the Run selection button.
Click the Selection results tab.

The workspace will display a list of devices that meet the selection criteria.

You can sort the information in the list of devices in ascending or descending order, in any column.

Page top

[Topic 150668]

Configuring a device selection

Expand all | Collapse all

To configure a device selection:

In the console tree, select the Device selections folder.
In the workspace, click the Selection tab, and then click the relevant device selection in the list of user selections.
Click the Selection properties button.
In the properties window that opens, specify the following settings:
- General selection properties.
- Conditions that must be met for including devices in this selection. You can configure the conditions after selecting a condition name and clicking the Properties button.
- Security settings.
Click OK.

The settings are applied and saved.

Below are descriptions of the conditions for assigning devices to a selection. Conditions are combined by using the OR logical operator: the selection will contain devices that comply with at least one of the listed conditions.

General

In the General section, you can change the name of the selection condition and specify whether that condition must be inverted:

Invert selection condition

If this option is enabled, the specified selection condition will be inverted. The selection will include all devices that do not meet the condition.

By default, this option is disabled.

Network

In the Network section, you can specify the criteria that will be used to include devices in the selection according to their network data:

Device name or IP address
Windows network name (NetBIOS name) of the device, or the IPv4 or IPv6 address.
Windows domain
Displays all devices included in the specified Windows domain.
Administration group
Displays devices included in the specified administration group.
Description
Text in the device properties window: In the Description field of the General section.

To describe text in the Description field, you can use the following characters:
- Within a word:
  - *. Replaces any string with any number of characters.
  Example:
  
  To describe words such as Server or Server's, you can enter Server*.
  - ?. Replaces any single character.
  Example:
  
  To describe words such as Window or Windows, you can enter Windo?.
  
  Asterisk (*) or question mark (?) cannot be used as the first character in the query.
- To find several words:
  - Space. Displays all the devices whose descriptions contain any of the listed words.
  Example:
  
  To find a phrase that contains Secondary or Virtual words, you can include Secondary Virtual line in your query.
  - +. When a plus sign precedes a word, all search results will contain this word.
  Example:
  
  To find a phrase that contains both Secondary and Virtual, enter the +Secondary+Virtual query.
  - -. When a minus sign precedes a word, no search results will contain this word.
  Example:
  
  To find a phrase that contains Secondary and does not contain Virtual, enter the +Secondary-Virtual query.
  - "<some text>". Text enclosed in quotation marks must be present in the text.
  Example:
  
  To find a phrase that contains Secondary Server word combination, you can enter "Secondary Server" in the query.
IP range
If this option is enabled, you can enter the initial and final IP addresses of the IP range in which the relevant devices must be included.

By default, this option is disabled.

Tags

In the Tags section, you can configure criteria for including devices into a selection based on key words (tags) that were previously added to the descriptions of managed devices:

Apply if at least one specified tag matches
If this option is enabled, the search results will show devices with descriptions that contain at least one of the selected tags.

If this option is disabled, the search results will only show devices with descriptions that contain all the selected tags.

By default, this option is disabled.
Tag must be included
If this option is selected, the search results will display the devices whose descriptions contain the selected tag. To find devices, you can use the asterisk, which stands for any string with any number of characters.

By default, this option is selected.
Tag must be excluded
If this option is selected, the search results will display the devices whose descriptions do not contain the selected tag. To find devices, you can use the asterisk, which stands for any string with any number of characters.

Active Directory

In the Active Directory section, you can configure criteria for including devices into a selection based on their Active Directory data:

Device is in an Active Directory organizational unit
If this option is enabled, the selection includes devices from the Active Directory organizational unit specified in the entry field.

By default, this option is disabled.
Include child organizational units
If this option is enabled, the selection includes devices from all child organizational units of the specified domain organizational unit.

By default, this option is disabled.
This device is a member of an Active Directory group
If this option is enabled, the selection includes devices from the Active Directory group specified in the entry field.

By default, this option is disabled.

Network activity

In the Network activity section, you can specify the criteria that will be used to include devices in the selection according to their network activity:

This device is a distribution point
In the drop-down list, you can set up the criterion for including devices in the selection when performing search:
- Yes. The selection includes devices that act as distribution points.
- No. Devices that act as distribution points are not included in the selection.
- No value is selected. The criterion will not be applied.
Do not disconnect from the Administration Server
In the drop-down list, you can set up the criterion for including devices in the selection when performing search:
- Enabled. The selection will include devices on which the Do not disconnect from the Administration Server check box is selected.
- Disabled. The selection will include devices on which the Do not disconnect from the Administration Server check box is cleared.
- No value is selected. The criterion will not be applied.
Connection profile switched
In the drop-down list, you can set up the criterion for including devices in the selection when performing search:
- Yes. The selection will include devices that connected to the Administration Server after the connection profile was switched.
- No. The selection will not include devices that connected to the Administration Server after the connection profile was switched.
- No value is selected. The criterion will not be applied.
Last connected to Administration Server
You can use this check box to set a search criterion for devices according to the time they last connected to the Administration Server.

If this check box is selected, in the entry fields you can specify the time interval (date and time) during which the last connection was established between Network Agent installed on the client device and the Administration Server. The selection will include devices that fall within the specified interval.

If this check box is cleared, the criterion will not be applied.

By default, this check box is cleared.
New devices detected by network poll
Searches for new devices that have been detected by network polling over the last few days.

If this option is enabled, the selection only includes new devices that have been detected by device discovery over the number of days specified in the Detection period (days) field.

If this option is disabled, the selection includes all devices that have been detected by device discovery.

By default, this option is disabled.
Device is visible
In the drop-down list, you can set up the criterion for including devices in the selection when performing search:
- Yes. The application includes in the selection devices that are currently visible in the network.
- No. The application includes in the selection devices that are currently invisible in the network.
- No value is selected. The criterion will not be applied.

Application

In the Application section, you can configure criteria for including devices in a selection based on the selected managed application:

Application name
In the drop-down list, you can set a criterion for including devices in a selection when search is performed by the name of a Kaspersky application.

The list provides only the names of applications with management plug-ins installed on the administrator's workstation.

If no application is selected, the criterion will not be applied.
Application version
In the entry field, you can set a criterion for including devices in a selection when search is performed by the version number of a Kaspersky application.

If no version number is specified, the criterion will not be applied.
Critical update name
In the entry field, you can set a criterion for including devices in a selection when search is performed by application name or by update package number.

If the field is left blank, the criterion will not be applied.
Modules last updated
You can use this option to set a criterion for searching devices by time of the last update of modules of applications installed on those devices.

If this check box is selected, in the entry fields you can specify the time interval (date and time) during which the last update of modules of applications installed on those devices was performed.

If this check box is cleared, the criterion will not be applied.

By default, this check box is cleared.
Device is managed through Kaspersky Security Center
In the drop-down list, you can include in the selection the devices managed through Kaspersky Security Center:
- Yes. The application includes in the selection devices managed through Kaspersky Security Center.
- No. The application includes devices in the selection if they are not managed through Kaspersky Security Center.
- No value is selected. The criterion will not be applied.
Security application is installed
In the drop-down list, you can include in the selection all devices with the security application installed:
- Yes. The application includes in the selection all devices with the security application installed.
- No. The application includes in the selection all devices with no security application installed.
- No value is selected. The criterion will not be applied.

Operating system

In the Operating system section, you can specify the criteria that will be used to include devices in the selection according to their operating system type.

Operating system version
If the check box is selected, you can select an operating system from the list. Devices with the specified operating systems installed are included in the search results.
Operating system bit size
In the drop-down list, you can select the architecture for the operating system, which will determine how the moving rule is applied to the device (Unknown, x86, AMD64, or IA64). By default, no option is selected in the list so that the operating system's architecture is not defined.
Operating system service pack version
In this field, you can specify the package version of the operating system (in the X.Y format), which will determine how the moving rule is applied to the device. By default, no version value is specified.
Operating system build
This setting is applicable to Windows operating systems only.

The build number of the operating system. You can specify whether the selected operating system must have an equal, earlier, or later build number. You can also configure searching for all build numbers except the specified one.
Operating system release ID
This setting is applicable to Windows operating systems only.

The release identifier (ID) of the operating system. You can specify whether the selected operating system must have an equal, earlier, or later release ID. You can also configure searching for all release ID numbers except the specified one.

Device status

In the Device status section, you can configure criteria for including devices into a selection based on the description of the devices status from a managed application:

Device status
Drop-down list in which you can select one of the device statuses: OK, Critical, or Warning.
Device status description
In this field, you can select the check boxes next to conditions that, if met, assign one of the following statuses to the device: OK, Critical, or Warning.
Device status defined by application
Drop-down list, in which you can select the real-time protection status. Devices with the specified real-time protection status are included in the selection.

Protection components

In the Protection components section, you can set up the criteria for including devices in a selection based on their protection status:

Databases released
If this option is selected, you can search for client devices by anti-virus database release date. In the entry fields you can set the time interval, on the basis of which the search is performed.

By default, this option is disabled.
Last scanned
If this check option is enabled, you can search for client devices by time of the last malware scan. In the entry fields you can specify the time period within which the last malware scan was performed.

By default, this option is disabled.
Total number of threats detected
If this option is enabled, you can search for client devices by number of viruses detected. In the entry fields you can set the lower and upper threshold values for the number of viruses found.

By default, this option is disabled.

Applications registry

In the Applications registry section, you can set up the criteria to search for devices according to applications installed on them:

Application name
Drop-down list in which you can select an application. Devices on which the specified application is installed, are included in the selection.
Application version
Entry field in which you can specify the version of selected application.
Vendor
Drop-down list in which you can select the manufacturer of an application installed on the device.
Application status
A drop-down list in which you can select the status of an application (Installed, Not installed). Devices on which the specified application is installed or not installed, depending on the selected status, will be included in the selection.
Find by update
If this option is enabled, search will be performed using the details of updates for applications installed on the relevant devices. After you select the check box, the Application name, Application version, and Application status fields change to Update name, Update version, and Status respectively.

By default, this option is disabled.
Incompatible security application name
Drop-down list in which you can select third-party security applications. During the search, devices on which the specified application is installed, are included in the selection.
Application tag
In the drop-down list, you can select the application tag. All devices that have installed applications with the selected tag in the description are included in the device selection.
Apply to devices without the specified tags
If this option is enabled, the selection includes devices with descriptions that contain none of the selected tags.

If this option is disabled, the criterion is not applied.

By default, this option is disabled.

Hardware registry

In the Hardware registry section, you can configure criteria for including devices into a selection based on their installed hardware:

Device
In the drop-down list, you can select a unit type. All devices with this unit are included in the search results.

The field supports the full-text search.
Vendor
In the drop-down list, you can select the name of a unit manufacturer. All devices with this unit are included in the search results.

The field supports the full-text search.
Device name
Name of the device in the Windows network. The device with the specified name is included in the selection.
Description
Description of the device or hardware unit. Devices with the description specified in this field are included in the selection.

A device's description in any format can be entered in the properties window of that device. The field supports the full-text search.
Device vendor
Name of the device manufacturer. Devices produced by the manufacturer specified in this field are included in the selection.

You can enter the manufacturer's name in the properties window of a device.
Serial number
All hardware units with the serial number specified in this field will be included in the selection.
Inventory number
Equipment with the inventory number specified in this field will be included in the selection.
User
All hardware units of the user specified in this field will be included in the selection.
Location
Location of the device or hardware unit (for example, at the HQ or a branch office). Computers or other devices that are deployed at the location specified in this field will be included in the selection.

You can describe the location of a device in any format in the properties window of that device.
CPU frequency, in MHz
The frequency range of a CPU. Devices with CPUs that match the frequency range in these fields (inclusive) will be included in the selection.
Virtual CPU cores
Range of the number of virtual cores in a CPU. Devices with CPUs that match the range in these fields (inclusive) will be included in the selection.
Hard drive volume, in GB
Range of values for the size of the hard drive on the device. Devices with hard drives that match the range in these entry fields (inclusive) will be included in the selection.
RAM size, in MB
Range of values for the size of the device RAM. Devices with RAMs that match the range in these entry fields (inclusive) will be included in the selection.

Virtual machines

In the Virtual machines section, you can set up the criteria to include devices in the selection according to whether these are virtual machines or part of virtual desktop infrastructure (VDI):

This is a virtual machine
In the drop-down list, you can select the following options:
- Not important.
- No. Find devices that are not virtual machines.
- Yes. Find devices that are virtual machines.
Virtual machine type
In the drop-down list, you can select the virtual machine manufacturer.

This drop-down list is available if the Yes or Not important value is selected in the This is a virtual machine drop-down list.
Part of Virtual Desktop Infrastructure
In the drop-down list, you can select the following options:
- Not important.
- No. Find devices that are not part of Virtual Desktop Infrastructure.
- Yes. Find devices that are part of the Virtual Desktop Infrastructure (VDI).

Vulnerabilities and updates

In the Vulnerabilities and updates section, you can specify the criteria that will be used to include devices in the selection according to their Windows Update source:

WUA is switched to Administration Server

You can select one of the following search options from the drop-down list:

Yes. If this option is selected, the search results will include devices that receive updates through Windows Update from the Administration Server.
No. If this option is selected, the results will include devices that receive updates through Windows Update from another sources.

Users

In the Users section, you can set up the criteria to include devices in the selection according to the accounts of users who have logged in to the operating system.

Last user who logged in to the system
If this option is enabled, click the Browse button to specify a user account. The search results include devices on which the specified user performed the last login to the system.
User who logged in to the system at least once
If this option is enabled, click the Browse button to specify a user account. The search results include devices on which the specified user logged in to the system at least once.

Status-affecting problems in managed applications

In the Status-affecting problems in managed applications section, you can specify the criteria that will be used to include devices in the selection according to the list of possible problems detected by a managed application. If at least one problem that you select exists on a device, the device will be included in the selection. When you select a problem listed for several applications, you have the option to select this problem in all of the lists automatically.

Device status description

You can select check boxes for descriptions of statuses from the managed application; upon receipt of these statuses, the devices will be included in the selection. When you select a status listed for several applications, you have the option to select this status in all of the lists automatically.

Statuses of components in managed applications

In the Statuses of components in managed applications section, you can configure criteria for including devices in a selection according to the statuses of components in managed applications:

Data Leakage Prevention status
Search for devices by the status of Data Leakage Prevention (Unknown, Stopped, Starting, Paused, Running, Failed).
Collaboration servers protection status
Search for devices by the status of server collaboration protection (Unknown, Stopped, Starting, Paused, Running, Failed).
Anti-virus protection status of mail servers
Search for devices by the status of Mail Server protection (Unknown, Stopped, Starting, Paused, Running, Failed).
Endpoint Sensor status
Search for devices by the status of the Endpoint Sensor component (Unknown, Stopped, Starting, Paused, Running, Failed).

Encryption

Encryption algorithm

Advanced Encryption Standard (AES) symmetrical block cipher algorithm. In the drop-down list, you can select the encryption key size (56-bit, 128-bit, 192-bit, or 256-bit).

Available values: AES56, AES128, AES192, and AES256.

Cloud segments

In the Cloud segments section, you can configure criteria for including devices in a selection according to their respective cloud segments:

Device is in a cloud segment
If this option is enabled, you can click the Browse button to specify the segment to search.

If the Include child objects option is also enabled, the search is run on all child objects of the specified segment.

Search results include only devices from the selected segment.
Device discovered by using the API
In the drop-down list, you can select whether a device is detected by API tools:
- AWS. The device is discovered by using the AWS API, that is, the device is definitely in the AWS cloud environment.
- Azure. The device is discovered by using the Azure API, that is, the device is definitely in the Azure cloud environment.
- Google Cloud. The device is discovered by using the Google API, that is, the device is definitely in the Google Cloud environment.
- No. The device cannot be detected by using the AWS, Azure, or Google API, that is, it is either outside the cloud environment or it is in the cloud environment but it cannot be detected by using an API.
- No value. This condition does not apply.

Application components

This section contains the list of components of those applications that have corresponding management plug-ins installed in Administration Console.

In the Application components section, you can specify criteria for including devices in a selection according to the statuses and version numbers of the components that refer to the application that you select:

Status
Search for devices according to the component status sent by an application to the Administration Server. You can select one of the following statuses: No data from device, Stopped, Starting, Paused, Running, Malfunction, or Not installed. If the selected component of the application installed on a managed device has the specified status, the device is included in the device selection.

Statuses sent by applications:
- Starting—The component is currently in the process of initialization.
- Running—The component is enabled and working properly.
- Paused—The component is suspended, for example, after the user has paused protection in the managed application.
- Malfunction—An error has occurred during the component operation.
- Stopped—The component is disabled and not working at the moment.
- Not installed—The user did not select the component for installation when configuring custom installation of the application.
Unlike other statuses, the No data from device status is not sent by applications. This option shows that the applications have no information about the selected component status. For example, this can happen when the selected component does not belong to any of the applications installed on the device, or when the device is turned off.
Version
Search for devices according to the version number of the component that you select in the list. You can type a version number, for example 3.4.1.0, and then specify whether the selected component must have an equal, earlier, or later version. You can also configure searching for all versions except the specified one.

Page top

[Topic 52127]

Exporting the settings of a device selection to a file

To export the settings of a device selection to a text file:

In the console tree, select the Device selections folder.
In the workspace, on the Selection tab, click the relevant device selection in the list of user selections.
Settings can be exported only from the device selections created by a user.
Click the Run selection button.
On the Selection results tab, click the Export settings button.
In the Save as window that opens, specify a name for the selection settings export file, select a folder to save it to, and click the Save button.

The settings of the device selection will be saved to the specified file.

Page top

[Topic 3655]

Creating a device selection

To create a device selection:

In the console tree, select the Device selections folder.
In the workspace of the folder, click Advanced and select the Create a selection in the drop-down list.
In the New device selection window that opens, enter the name of the new selection and click OK.

A new folder with the name you entered will appear in the console tree in the Device selections folder. By default, the new device selection contains all devices included in administration groups of the Administration Server on which the selection was created. To cause a selection to display only the devices you are particularly interested in, configure the selection by clicking the Selection properties button.

Page top

[Topic 52128]

Creating a device selection according to imported settings

To create a device selection according to imported settings:

In the console tree, select the Device selections folder.
In the workspace of the folder, click the Advanced button and select Import selection from file in the drop-down list.
In the window that opens, specify the path to the file from which you want to import the selection settings. Click the Open button.

A New selection entry is created in the Device selections folder. The settings of the new selection are imported from the file that you specified.

If a selection named New selection already exists in the Device selections folder, an index in (<next sequence number>) format is added to the name of the created selection, for example: (1), (2).

Page top

[Topic 52130]

Removing devices from administration groups in a selection

When working with a device selection, you can remove devices from administration groups right in this selection, without switching to the administration groups from which these devices must be removed.

To remove devices from administration groups:

In the console tree, select the Device selections folder.
Select the devices that you want to remove by using the Shift or Ctrl keys.
Remove the selected devices from administration groups in one of the following ways:
- Select Delete in the context menu of any of the selected devices.
- Click the Perform action button and select Remove from group in the drop-down list.

The selected devices are removed from their respective administration groups.

Page top

[Topic 191308]

Monitoring of applications installation and uninstallation

You can monitor installation and uninstallation of specific applications on managed devices (for example, a specific browser). To use this function, you can add applications from the Application registry to the list of monitored applications. When a monitored application is installed or uninstalled, Network Agent publishes respective events: Monitored application has been installed or Monitored application has been uninstalled. You can monitor these events using, for example, event selections or reports.

You can monitor these events only if they are stored in Administration Server database.

To add an application to the list of monitored applications:

In the Advanced → Application management folder in the console tree, select the Applications registry subfolder.
Above the list of application, that is displayed, click the Show applications registry properties window button.
In the Monitored Applications window, that is displayed, click the Add button.
In the Select application name window, that is displayed, select the applications from the Application registry whose installation or uninstallation you want to monitor.
In the Select application name window, click the OK button.

After you have configured the list of monitored applications, and a monitored application is installed or uninstalled on managed devices in your organization, you can monitor the respective events, for example using the Recent events event selection.

Page top

[Topic 151336]

Events of Kaspersky Security Center components

Each Kaspersky Security Center component has its own set of event types. This section lists types of events that occur in Kaspersky Security Center Administration Server, Network Agent, and iOS MDM Server. Types of events that occur in Kaspersky applications are not listed in this section.

For each event that can be generated by an application, you can specify notification settings and storage settings on the Event configuration tab in the application policy. For Administration Server, you can additionally view and configure the event list in the Administration Server properties. If you want to configure notification settings for all the events at once, configure general notification settings in the Administration Server properties.

In this section

Data structure of event type description

Administration Server events

Network Agent events

iOS MDM Server events

Page top

[Topic 181756]

Data structure of event type description

For each event type, its display name, identifier (ID), alphabetic code, description, and the default storage term are provided.

Event type display name. This text is displayed in Kaspersky Security Center when you configure events and when they occur.
Event type ID. This numerical code is used when you process events by using third-party tools for event analysis.
Event type (alphabetic code). This code is used when you browse and process events by using public views that are provided in the Kaspersky Security Center database and when events are exported to a SIEM system.
Description. This text contains the situations when an event occurs and what you can do in such a case.
Default storage term. This is the number of days during which the event is stored in the Administration Server database and is displayed in the list of events on Administration Server. After this period elapses, the event is deleted. If the event storage term value is 0, such events are detected but are not displayed in the list of events on Administration Server. If you configured to save such events to the operating system event log, you can find them there.
You can change the storage term for events:
- Administration Console: Setting the storage term for an event
- Kaspersky Security Center Web Console: Setting the storage term for an event

Other data may include the following fields:

event_id: unique number of the event in the database, generated and assigned automatically; not to be confused with Event type ID.
task_id: the ID of the task that caused the event (if any)
severity: one of the following severity levels (in the ascending order of severity):
0) Invalid severity level

1) Info

2) Warning

3) Error

4) Critical

Page top

[Topic 184666]

Administration Server events

This section contains information about the events related to the Administration Server.

In this section

Administration Server critical events

Administration Server functional failure events

Administration Server warning events

Administration Server informational events

Page top

[Topic 177080]

Administration Server critical events

The table below shows the event types of Kaspersky Security Center Administration Server that have the Critical importance level.

If you specified the port in the Administration Server properties window in the Administration Console, Kaspersky Security Center publishes its metrics and critical events to be obtained by Prometheus, a system for monitoring and alerting. Prometheus obtains the metrics and critical events, and then generates alerts for each event.

// KL.KSC.Common—Kaspersky Security Center common counters

"xdr_klserver_errors", "counter", "klserver errors"

"xdr_klserver_api_calls_time", "counter", "klserver api calls time"

// KL.KSC.Transport—Transport counters set

"ksc_Transport__Number_of_all_connections", "counter", "number of all connections"

"ksc_Transport__Number_of_all_nagent_connection", "counter", "number of all Network Agent connection"

"ksc_Transport__Number_of_controlled_nagent_connections", "counter", "number of controlled Network Agent connections"

"ksc_Transport__Total_active_hosts_count", "gauge", "total active devices count"

"ksc_Transport__Number_of_pings_processed", "counter", "number of pings processed"

"ksc_Transport__Number_of_pings_rejected", "counter", "number of pings rejected"

"ksc_Transport__Number_of_ping_processing_errors", "counter", "number of ping processing errors"

"ksc_Transport__Number_of_TCP_connections_accepted", "counter", "number of TCP connections accepted"

"ksc_Transport__Number_of_failed_TCP_connections", "counter", "number of failed TCP connections"

"ksc_Transport__Bytes_sent_by_TCP", "counter", "bytes sent by TCP"

"ksc_Transport__Bytes_received_by_TCP", "counter", "bytes received by TCP"

"ksc_Transport__Number_of_GetNextFileChunk_requests", "counter", "number of GetNextFileChunk requests"

"ksc_Transport__Number_of_GetNextFileChunk_rejected", "counter", "number of GetNextFileChunk rejected"

"ksc_Transport__Bytes_transmitted_through_GetNextFileChunk", "counter", "bytes transmitted through GetNextFileChunk"

// KL.KSC.Events—Events delivery counters set

"ksc_Events__Number_of_event_bulks_processed", "counter", "number of event bulks processed"

"ksc_Events__Number_of_event_bulks_rejected", "counter", "number of event bulks rejected"

"ksc_Events__Number_of_event_bulks_processing_errors", "counter", "number of event bulks processing errors"

"ksc_Events__Number_of_event_bulks_processing_just_now", "gauge", "number of event bulks processing just now"

"ksc_Events__Number_of_events_processed", "counter", "number of events processed"

"ksc_Events__Number_of_events_rejected", "counter", "number of events rejected"

"ksc_Events__Number_of_events_processing_errors", "counter", "number of events processing errors"

"ksc_Events__Number_of_events_processing_just_now", "gauge", "number of events processing just now"

// KL.KSC.Resources—Kaspersky Security Center resources usage

"ksc_Resources__CPU_time_in_user_mode", "counter", "CPU time in user mode"

"ksc_Resources__CPU_time_in_kernel_mode", "counter", "CPU time in kernel mode"

"ksc_Resources__PID_of_klserver_process", "gauge", "process ID of klserver"

"ksc_Resources__PID_of_klnagent_process", "gauge", "process ID of klnagent"

"ksc_Resources__Available_disk_user_quota_for_server_data", "gauge", "available disk user quota for server data"

"ksc_Resources__Available_disk_user_quota_for_packages", "gauge", "available disk user quota for packages"

"ksc_Resources__Current_OpenAPI_threads_count", "counter", "current OpenAPI threads count"

"ksc_Resources__Maximum_OpenAPI_threads_count", "counter", "maximum OpenAPI threads count"

// KL.KSC.NLST

// KL.KSC.NLST.Trans.Common—List of server transactions

"ksc_NLST__Common__Current_transactions_count", "gauge", "current transactions count"

"ksc_NLST__Common__Transactions_queue_ful", "gauge", "transactions queue full"

"ksc_NLST__Common__Transactions_queue_near_to_ful", "gauge", "transactions queue near to full"

// KL.KSC.NLST.InvAppCtrlLink—Application Control link

"ksc_NLST__Application_inventory__items_changed", "gauge", "items changed"

"ksc_NLST__Application_inventory__items_deleted", "gauge", "items deleted"

"ksc_NLST__Application_inventory__DeleteAll_items", "gauge", "DeleteAll() items"

"ksc_NLST__Application_inventory__change_item_operations", "gauge", "change item operations"

"ksc_NLST__Application_inventory__list_is_disabled_due_to_oversize", "gauge", "list is disabled due to oversize"

"ksc_NLST__Application_inventory__transactions_queue_full", "gauge", "transactions queue full"

"ksc_NLST__Application_inventory__transactions_queue_near_to_full", "gauge", "transactions queue near to full"

"ksc_NLST__Application_inventory__list_is_pending", "gauge", "list is pending"

"ksc_NLST__Application_inventory__transactions_in_queue", "gauge", "transactions in queue"

// KL.KSC.NLST.InvSoft—Software Inventory

"ksc_NLST__Software_inventory__items_changed", "gauge", "items changed"

"ksc_NLST__Software_inventory__items_deleted", "gauge", "items deleted"

"ksc_NLST__Software_inventory__DeleteAll_items", "gauge", "DeleteAll() items"

"ksc_NLST__Software_inventory__change_item_operations", "gauge", "change item operations"

"ksc_NLST__Software_inventory__list_is_disabled_due_to_oversize", "gauge", "list is disabled due to oversize"

"ksc_NLST__Software_inventory__transactions_queue_full", "gauge", "transactions queue full"

"ksc_NLST__Software_inventory__transactions_queue_near_to_full", "gauge", "transactions queue near to full"

"ksc_NLST__Software_inventory__list_is_pending", "gauge", "list is pending"

"ksc_NLST__Software_inventory__transactions_in_queue", "gauge", "transactions in queue"

// KL.KSC.NLST.InvHard—Hardware Inventory

"ksc_NLST__Hardware_inventory__items_changed", "gauge", "items changed"

"ksc_NLST__Hardware_inventory__items_deleted", "gauge", "items deleted"

"ksc_NLST__Hardware_inventory__DeleteAll_items", "gauge", "DeleteAll() items"

"ksc_NLST__Hardware_inventory__change_item_operations", "gauge", "change item operations"

"ksc_NLST__Hardware_inventory__list_is_disabled_due_to_oversize", "gauge", "list is disabled due to oversize"

"ksc_NLST__Hardware_inventory__transactions_queue_full", "gauge", "transactions queue full"

"ksc_NLST__Hardware_inventory__transactions_queue_near_to_full", "gauge", "transactions queue near to full"

"ksc_NLST__Hardware_inventory__list_is_pending", "gauge", "list is pending"

"ksc_NLST__Hardware_inventory__transactions_in_queue", "gauge", "transactions in queue"

// KL.KSC.NLST.DevCtrl—Device Control

"ksc_NLST__Device_control__items_changed", "gauge", "items changed"

"ksc_NLST__Device_control__items_deleted", "gauge", "items deleted"

"ksc_NLST__Device_control__DeleteAll_items", "gauge", "DeleteAll() items"

"ksc_NLST__Device_control__change_item_operations", "gauge", "change item operations"

"ksc_NLST__Device_control__list_is_disabled_due_to_oversize", "gauge", "list is disabled due to oversize"

"ksc_NLST__Device_control__transactions_queue_full", "gauge", "transactions queue full"

"ksc_NLST__Device_control__transactions_queue_near_to_full", "gauge", "transactions queue near to full"

"ksc_NLST__Device_control__list_is_pending", "gauge", "list is pending"

"ksc_NLST__Device_control__transactions_in_queue", "gauge", "transactions in queue"

// KL.KSC.NLST.MDM—Mobile Device Management

"ksc_NLST__Mobile_device_management__items_changed", "gauge", "items changed"

"ksc_NLST__Mobile_device_management__items_deleted", "gauge", "items deleted"

"ksc_NLST__Mobile_device_management__DeleteAll_items", "gauge", "DeleteAll() items"

"ksc_NLST__Mobile_device_management__change_item_operations", "gauge", "change item operations"

"ksc_NLST__Mobile_device_management__list_is_disabled_due_to_oversize", "gauge", "list is disabled due to oversize"

"ksc_NLST__Mobile_device_management__transactions_queue_full", "gauge", "transactions queue full"

"ksc_NLST__Mobile_device_management__transactions_queue_near_to_full", "gauge", "transactions queue near to full"

"ksc_NLST__Mobile_device_management__list_is_pending", "gauge", "list is pending"

"ksc_NLST__Mobile_device_management__transactions_in_queue", "gauge", "transactions in queue"

// KL.KSC.NLST.MDMmails—Device management emails

"ksc_NLST__Device_management_emails__items_changed", "gauge", "items changed"

"ksc_NLST__Device_management_emails__items_deleted", "gauge", "items deleted"

"ksc_NLST__Device_management_emails__DeleteAll_items", "gauge", "DeleteAll() items"

"ksc_NLST__Device_management_emails__change_item_operations", "gauge", "change item operations"

"ksc_NLST__Device_management_emails__list_is_disabled_due_to_oversize", "gauge", "list is disabled due to oversize"

"ksc_NLST__Device_management_emails__transactions_queue_full", "gauge", "transactions queue full"

"ksc_NLST__Device_management_emails__transactions_queue_near_to_full", "gauge", "transactions queue near to full"

"ksc_NLST__Device_management_emails__list_is_pending", "gauge", "list is pending"

"ksc_NLST__Device_management_emails__transactions_in_queue", "gauge", "transactions in queue"

// KL.KSC.NLST.AppCtrl—Application Control

"ksc_NLST__Application_control__items_changed", "gauge", "items changed"

"ksc_NLST__Application_control__items_deleted", "gauge", "items deleted"

"ksc_NLST__Application_control__DeleteAll_items", "gauge", "DeleteAll() items"

"ksc_NLST__Application_control__change_item_operations", "gauge", "change item operations"

"ksc_NLST__Application_control__list_is_disabled_due_to_oversize", "gauge", "list is disabled due to oversize"

"ksc_NLST__Application_control__transactions_queue_full", "gauge", "transactions queue full"

"ksc_NLST__Application_control__transactions_queue_near_to_full", "gauge", "transactions queue near to full"

"ksc_NLST__Application_control__list_is_pending", "gauge", "list is pending"

"ksc_NLST__Application_control__transactions_in_queue", "gauge", "transactions in queue"