EULA=1

Acceptance of the terms of the End User License Agreement. The text of the License Agreement is included in the distribution kit of Kaspersky Endpoint Security.

Accepting the terms of the End User License Agreement is necessary for installing the application or upgrading the application version.

PRIVACYPOLICY=1

Acceptance of the Privacy Policy. The text of the Privacy Policy is included in the Kaspersky Endpoint Security distribution kit.

To install the application or upgrade the application version, you must accept the Privacy Policy.

KSN

Agreement or refusal to participate in Kaspersky Security Network (KSN). If no value is set for this parameter, Kaspersky Endpoint Security will prompt to confirm your consent or refusal to participate in KSN when Kaspersky Endpoint Security is first started. Available values:

• 1 – agreement to participate in KSN.
• 0 – refusal to participate in KSN (default value).

The Kaspersky Endpoint Security distribution package is optimized for use with Kaspersky Security Network. If you opted not to participate in Kaspersky Security Network, you should update Kaspersky Endpoint Security immediately after the installation is complete.

ALLOWREBOOT=1

Automatic restart of the computer, if required after installation or upgrade of the application. If no value is set for this parameter, automatic computer restart is blocked.

Restart is not required when installing Kaspersky Endpoint Security. Restart is required only if you have to remove incompatible applications prior to installation. Restart may also be required when updating the application version.

SKIPPRODUCTCHECK=1

Disable the check for incompatible software. The list of incompatible software is available in the incompatible.txt file that is included in the distribution kit. If no value is set for this parameter and incompatible software is detected, the installation of Kaspersky Endpoint Security will be terminated.

SKIPPRODUCTUNINSTALL=1

Disable automatic removal of detected incompatible software. If no value is set for this parameter, Kaspersky Endpoint Security attempts to remove incompatible software.

Automatic removal of incompatible software cannot be enabled when installing Kaspersky Endpoint Security using the msiexec installer. Use setup_kes.exe to enable the automatic removal of incompatible software.

CLEANERSIGNCHECK=0|1

Verification of digital signatures of detected incompatible software files. To remove incompatible software, Kaspersky Endpoint Security runs the installer file of the software. If the installer file does not have a digital signature, Kaspersky Endpoint Security considers the file untrusted and halts the removal of incompatible software to avoid running potentially malicious code. If the application cannot verify the digital signature of the incompatible software file that was detected, Kaspersky Endpoint Security installation is stopped with an error.

The default value is different depending on the software installation method:

• 0 means that digital signature verification is disabled (default value if deployed through Kaspersky Security Center).
• 1 means that digital signature verification is enabled (default value if the application is being installed locally).

STANDALONEMODE=1

Installing the application in the Endpoint Detection and Response Agent (EDR Agent) configuration for integration with the Kaspersky Endpoint Detection and Response (KATA) solution. This configuration is needed if a third-party Endpoint Protection Platform (EPP) is deployed in your organization alongside the Kaspersky Endpoint Detection and Response (KATA) solution. This makes Kaspersky Endpoint Security in the Endpoint Detection and Response Agent configuration compatible with third-party EPP applications.

You can also use EDR Agent for integration with the Kaspersky Managed Detection and Response solution. To do so, you must change the selection of application components.

KLLOGIN

Set the user name for accessing the features and settings of Kaspersky Endpoint Security (the Password protection component). The user name is set together with the KLPASSWD and KLPASSWDAREA parameters. The user name KLAdmin is used by default.

KLPASSWD

Specify a password for accessing Kaspersky Endpoint Security features and settings (the password is specified together with the KLLOGIN and KLPASSWDAREA parameters).

If you specified a password but did not specify a user name with the KLLOGIN parameter, the KLAdmin user name is used by default.

KLPASSWDAREA

Specify the scope of the password for accessing Kaspersky Endpoint Security. When a user attempts to perform an action that is included in this scope, Kaspersky Endpoint Security prompts for the user's account credentials (KLLOGIN and KLPASSWD parameters). Use the ";" character to specify multiple values. Available values:

• SET – modifying application settings.
• EXIT – exiting the application.
• DISPROTECT – disabling protection components and stopping scan tasks.
• DISPOLICY – disabling the Kaspersky Security Center policy.
• UNINST – removing the application from the computer.
• DISCTRL – disabling control components.
• REMOVELIC – removing the key.
• REPORTS – viewing reports.
• For example, KLPASSWDAREA=SET;KLPASSWDAREA=UNINST;KLPASSWDAREA=EXIT.

ENABLETRACES

Enabling or disabling application tracing. After Kaspersky Endpoint Security starts, it saves trace files in the folder %ProgramData%\Kaspersky Lab\KES.21.16\Traces. Available values:

• 1 – tracing is enabled.
• 0 – tracing is disabled (default value).

TRACESLEVEL

Level of detail of traces. Available values:

• 100 (critical). Only messages about fatal errors.
• 200 (high). Messages about all errors, including fatal errors.
• 300 (diagnostic). Messages about all errors, as well as warnings.
• 400 (important). All error messages, warnings, and additional information.
• 500 (normal). Messages about all errors and warnings, as well as detailed information about the operation of the application in normal mode (default).
• 600 (low). All messages.

ENABLEAZURESUPPORT

Enabling or disabling Azure WVD compatibility mode. Available values:

• 1 – Azure WVD compatibility mode is enabled.
• 0 – Azure WVD compatibility mode is disabled (default value).

This feature allows correctly displaying the state of the Azure virtual machine in the Kaspersky Anti Targeted Attack Platform console. To monitor the performance of the computer, Kaspersky Endpoint Security sends telemetry to KATA servers. Telemetry includes an ID of the computer (Sensor ID). Azure WVD compatibility mode allows assigning a permanent unique Sensor ID to these virtual machines. If the compatibility mode is turned off, the Sensor ID can change after the computer is restarted because of how Azure virtual machines work. This can cause duplicates of virtual machines to appear on the console.

AMPPL

Enables or disables protection of the Kaspersky Endpoint Security processes using AM-PPL technology (Antimalware Protected Process Light). For more details about AM-PPL technology, please visit the Microsoft website.

AM-PPL technology is available for Windows 10 version 1703 (RS2) or later, and Windows Server 2019 operating systems.

Available values:

• 1 – protection of the Kaspersky Endpoint Security processes using AM-PPL technology is enabled.
• 0 – protection of the Kaspersky Endpoint Security processes using AM-PPL technology is disabled.

UPGRADEMODE

Application upgrade mode:

• Seamless means upgrading the application with a computer restart (default value).
• Force means upgrading the application without a restart.

You can upgrade the application without a restart starting with version 11.10.0. To upgrade an earlier version of the application, you must restart the computer. You can also install patches without a restart starting with version 11.11.0.

Restart is not required when installing Kaspersky Endpoint Security. So, the upgrade mode of the application will be specified in the application settings. You can change this parameter in the application settings or in the policy.

When upgrading already installed application, the priority of the command line parameter is lower than that of the parameter specified in the application settings or in the setup.ini file. For example, if Force upgrade mode is specified in the command line and Seamless mode is specified in the application settings, the upgrade will be installed with a computer restart (Seamless).

RESTAPI

Managing the application through the REST API. To manage the application through the REST API, you must specify the user name (RESTAPI_User parameter).

Available values:

• 1 – management via REST API is allowed.
• 0 – management via REST API is blocked (default value).

To manage the application through the REST API, management using administrative systems must be allowed. To do so, set the AdminKitConnector=1 parameter. If you manage the application through the REST API, it is impossible to manage the application using the administration systems of Kaspersky.

RESTAPI_User

User name of the Windows domain account used for managing the application through the REST API. Management of the application through the REST API is available only to this user. Enter the user name in the format <DOMAIN>\<UserName> (for example, RESTAPI_User=COMPANY\Administrator). You can select only one user to work with the REST API.

Adding a user name is a prerequisite for managing the application through the REST API.

RESTAPI_Port

Port used for managing the application through the REST API. Port 6782 is used by default. Make sure that the port is free.

RESTAPI_Certificate

Certificate for identifying requests (for example, RESTAPI_Certificate=C:\cert.pem). Secure interaction of Kaspersky Endpoint Security with the REST client requires configuring request identification. To do so, you must install a certificate and subsequently sign the payload of each request.

ADMINKITCONNECTOR

Application management using administration systems. Administration systems include, for example, Kaspersky Security Center. In addition to Kaspersky administration systems, you can use third-party solutions. Kaspersky Endpoint Security provides an API for this purpose.

Available values:

• 1 – application management with the help of administration systems is allowed (default value).
• 0 – application management is allowed only through the local interface.

Example:

setup_kes.exe /pEULA=1 /pPRIVACYPOLICY=1 /pKSN=1 /pALLOWREBOOT=1

msiexec /i kes_win.msi EULA=1 PRIVACYPOLICY=1 KSN=1 KLLOGIN=Admin KLPASSWD=Password KLPASSWDAREA=EXIT;DISPOLICY;UNINST /qn

setup_kes.exe /pEULA=1 /pPRIVACYPOLICY=1 /pKSN=1 /pENABLETRACES=1 /pTRACESLEVEL=600 /s