Installing applications using Remote installation wizard

To install Kaspersky applications, you can use the Remote installation wizard. The Remote installation wizard allows remote installation of applications either through specially created installation packages or directly from a distribution package.

For proper operation of the Remote installation task on a client device that does not have Network Agent installed, the following ports must be open: TCP 139 and 445; UDP 137 and 138. By default, these ports are open for all devices included in the domain. They are opened automatically by the remote installation preparation utility.

To install the application on selected devices by using the Remote installation wizard:

In the console tree, locate the Remote installation folder and select the Installation packages subfolder.
In the workspace of the folder, select the installation package of the application that you have to install.
In the context menu of the installation package, select Install application.
The Remote installation wizard starts.
In the Select devices for installation window, you can create a list of devices on which the application will be installed:
- Install on a group of managed devices
  If this option is selected, the remote installation task is created for a group of devices.
- Select devices for installation
  If this option is selected, the remote installation task is created for specific devices. Those specific devices can include both managed and unassigned ones.
In the Defining remote installation task settings window, specify the settings for remote installation of the application.
In the Force installation package download settings group, specify how files that are required for the application installation are distributed to client devices:
- Using Network Agent
  If this option is enabled, installation packages are delivered to client devices by Network Agent installed on those client devices.
  
  If this option is disabled, installation packages are delivered using the operating system tools of client devices.
  
  We recommend that you enable this option if the task has been assigned to devices with Network Agents installed.
  
  By default, this option is enabled.
- Using operating system resources through Administration Server
  If this option is enabled, files are transmitted to client devices by using operating system tools of client devices through the Administration Server. You can enable this option if no Network Agent is installed on the client device, but the client device is in the same network as the Administration Server.
  
  By default, this option is enabled.
- Using operating system resources through distribution points
  If this option is enabled, installation packages are transmitted to client devices using operating system tools through distribution points. You can select this option if there is at least one distribution point on the network.
  
  If the Using Network Agent option is enabled, the files are delivered using operating system tools only if Network Agent tools are unavailable.
  
  By default, this option is enabled for remote installation tasks that have been created on a virtual Administration Server.
- Number of attempts to install
  If, when running the Remote installation task, Kaspersky Security Center fails to install an application on a managed device within the number of installer runs specified by the parameter, Kaspersky Security Center stops delivering the installation package to this managed device and does not start the installer on the device anymore.
  
  The Number of attempts to install option allows you to save the resources of the managed device, as well as reduce traffic (uninstallation, MSI file run, and error messages).
  
  Recurring task start attempts may indicate a problem on the device that prevents installation. The administrator should resolve the problem within the specified number of installation attempts (for example, by allocating sufficient disk space, removing incompatible applications, or modifying the settings of other applications that prevent installation) and to restart the task (manually or by a schedule).
  
  If installation is not achieved eventually, the problem is considered unresolvable and any further task starts are seen as costly in terms of unnecessary consumption of resources and traffic.
  
  When the task is created, the counter of attempts is set to 0. Each run of the installer that returns an error on the device increments the counter reading.
  
  If the number of attempts specified in the parameter has been exceeded and the device is ready for application installation, you can increase the value of the Number of attempts to install parameter and start the task to install the application. Alternatively, you can create a new Remote installation task.
Define what to do with client devices managed by another Administration Server:
- Install on all devices
  The application will be installed even on devices managed by other Administration Servers.
  
  This option is selected by default. You do not have to change this setting if you have only one Administration Server in your network.
- Install only on devices managed through this Administration Server
  The application will be installed only on devices managed by this Administration Server. Select this option if you have more than one Administration Server in your network and want to avoid conflicts between them.
Define the additional settings:
- Do not re-install application if it is already installed
  If this option is enabled, the selected application will not be re-installed if it has already been installed on this client device.
  
  If this option is disabled, the application will be installed anyway.
  
  By default, this option is enabled.
- Assign package installation in Active Directory group policies
  If this option is enabled, an installation package is installed by using the Active Directory group policies.
  
  This option is available if the Network Agent installation package is selected.
  
  By default, this option is disabled.
In the Selecting a license key window, select a license key and a method for its distribution:
- Do not place license key in installation package (recommended)
  The key is automatically distributed to all devices with which it is compatible:
  - If automatic distribution has been enabled in the key properties.
  - If the Add key task has been created.
- Place license key in installation package
  The key is distributed to devices together with the installation package.
  
  We do not recommend that you distribute the key using this method because the shared Read access rights are enabled to the repository of installation packages.
The Selecting a license key window is displayed if the installation package does not include a license key.

If the installation package includes a license key, the License key properties window is displayed, containing the license key details.
In the Selecting an operating system restart option window, specify whether the devices must be restarted if the operating system has to be restarted during installation of applications on them:
- Do not restart the device
  If this option is selected, the device will not be restarted after the security application installation.
- Restart the device
  If this option is selected, the device will be restarted after the security application installation.
- Prompt user for action
  If this option is selected, after the security application installation, a notification is displayed to the user, informing that the device needs to be restarted. By using the Modify link you can modify message text, the period of message display, and the time of automatic restart.
  
  By default, this option is selected.
- Force closure of applications in blocked sessions
  If this option is enabled, applications on blocked devices are forced to close before the restart.
  
  By default, this option is disabled.
In the Select accounts to access devices window, you can add the accounts that will be used to start the Remote installation task:
- No account required (Network Agent installed)
  If this option is selected, you do not have to specify the account under which the application installer will be run. The task will run under the account under which the Administration Server service is running.
  
  If Network Agent has not been installed on client devices, this option is unavailable.
- Account required (Network Agent is not used)
  Select this option if Network Agent is not installed on the devices for which you assign the remote installation task. In this case, you can specify a user account or an SSH certificate to install the application.
  - Local Account. If this option is selected, specify the user account under which the application installer will be run. Click the Add button, select Local Account, and then specify the user account credentials.
    You can specify multiple user accounts if, for example, none of them have all the required rights on all devices for which you assign the task. In this case, all added accounts are used for running the task, in consecutive order, top-down.
  - SSH certificate. If you want to install an application on a Linux-based client device, you can specify an SSH certificate instead of a user account. Click the Add button, select SSH certificate, and then specify the private and public keys of the certificate.
    To generate a private key, you can use the ssh-keygen utility. Note that Kaspersky Security Center supports the PEM format of private keys, but the ssh-keygen utility generates SSH keys in the OPENSSH format by default. The OPENSSH format is not supported by Kaspersky Security Center. To create a private key in the supported PEM format, add the -m PEM option in the ssh-keygen command. For example:
    
    ssh-keygen -m PEM -t rsa -b 4096 -C "<user email>"
In the Starting installation window, click the Next button to create and start a Remote installation task on the selected devices.
If the Starting installation window has the Do not run the task after the Remote installation wizard finishes option selected, the remote installation task will not start. You can start this task manually later. The task name corresponds to the name of the installation package for the application: Installation of <Installation package name>.

To install the application on devices in an administration group by using the Remote installation wizard:

Establish a connection with the Administration Server that controls the relevant administration group.
Select an administration group in the console tree.
In the workspace of the group, click the Perform action button and select Install application in the drop-down list.
This will start the Remote installation wizard. Follow the instructions of the wizard.
At the final step of the wizard, click Next to create and run a remote installation task on the selected devices.

When the Remote installation wizard finishes, Kaspersky Security Center performs the following actions:

Creates an installation package for application installation (if it was not created earlier). The installation package is located in the Remote installation folder, in the Installation packages subfolder, under a name that corresponds to the application name and version. You can use this installation package for the application installation in the future.
Creates and runs a remote installation task for specific devices or for an administration group. The newly created remote installation task is stored in the Tasks folder or added to the tasks of the administration group for which it has been created. You can start this task manually later. The task name corresponds to the name of the installation package for the application: Installation of <Installation package name>.

Page top