Verify the following:

1. The policy is active.
2. The locks next to the policy setting and component are closed in the MMC-based Administration Console or set to Enforce in the Web Console.
3. The target settings are set correctly and have not been overwritten by the parent policy due to configuration errors in the Settings inheritance block.
4. If the Out-of-office policy option is selected, make sure that a connection profile for out-of-office users is created in the Network Agent policy and the Enable out-of-office mode when Administration Server is not available option is enabled. These conditions must be met at the time of verification.
5. If the policy conditions use data from Active Directory about the placement of objects in groups or organizational unit (OU), make sure that Active Directory polling works:
   1. Create a new computer object in Active Directory.
   2. Start a forced Active Directory polling.
   3. Check the synchronization result via a device search from the Administration Server node.
      If the test object does not appear, follow the instructions.

If you are using a policy profile, check the following:

1. The Enable profile check box and the lock is closed.
2. The activation rules are specified and the lock next to them is closed. Make sure that the affected device complies with the specified rules. To do so, use the device search by policy profile conditions.
3. There are no parent policy profiles that overwrite the affected policy settings of the same name.

Verify the following:

1. The device is part of a group or subgroup that is covered by the policy.
2. A child policy or policy profile that overwrites the same-named settings of an affected policy is not applied to the group. To do this, open the properties of the managed device in the Kaspersky Security Center Administration Console (KSC) and check that:
   1. The policy is displayed in the Active policies section.
   2. The policy profile is displayed in the Active policy profiles section.

After changing the policy and synchronizing the managed device again, wait for the synchronization period to end. Check the status of the policy distribution in the Policy distribution results window of the KSC Administration Console:

• The Finished status means that communication between KSC and KESW is intact and KESW has received the policy settings. Check that the parameters and conditions in the policies settings and profiles are specified correctly.
• The Pending status means that communication between KSC and KESW is interrupted and KESW has not received the policy settings. Possible causes and recommendations:
  • The device or KESW are disabled.
  • The device is not available for the Administration Server or distribution point that acts as a connection gateway.
  • The device does not receive notifications from the notifying server and applies the policy only after the synchronization period ends (by default every 15 minutes).
    Configure the multicast to the Network Agents using the instructions.
  • The distribution point is not functioning properly.
    Move the device away from the current point and check that the synchronization runs.
  • The Network Agent service has been disrupted or the Agent's connection to the Administration Server has been configured incorrectly.
    Resolve this issue using the instructions. Pay special attention to the klnagchk utility scan.
  • The operation of KESW or any of its components has been disrupted due to a violation of the application integrity.
    Restore the KESW integrity.

Verify the following:

1. Make sure that KESW is activated.
   If KESW is not activated or does not automatically accept the new license key, follow the instructions.
2. The KESW component is installed and enabled on the device, the operation of which is determined by the policy.
3. The KESW task or component is included in your license.
   If the component is included in the license but not activated, follow the instructions.
4. The Network Agent Connector is installed as part of KESW if the installation was performed locally.
5. The device does not have the critical status “Your device is connected to an untrusted Administration Server”.
   To fix this issue, follow the instructions.

If the issue persists, reinstall the KESW management plug-in:

1. Remove and install the latest version of the management plug-in using the instructions.
2. Export the affected policy. After that, disable or remove it.
3. Create a new policy, reconfigure it, and consistently distribute this policy to the managed devices.

1. Follow the recommendations for diagnosing hardware and operating system problems in the device.
2. Follow the instructions to ensure that the KSC is not overloaded with the Administration Server events.

If the issue persists, submit a request to Kaspersky Technical Support via Kaspersky CompanyAccount. In your request, provide the following:

• Diagnostic information collected on the device with KESW.
• Diagnostic information collected on the device with KSC.