Changing the caching duration

The Device Control component registers events related to monitored devices, such as connection and disconnection of a device, reading a file from a device, writing a file to a device, and other events. Device Control then either allows or blocks the action according to the Kaspersky Endpoint Security settings.

Device Control saves information about events for a specific period of time called the caching period. If information about an event is cached and this event is repeated, there is no need to notify Kaspersky Endpoint Security about it or to show another prompt for granting access to the corresponding action, such as connecting a device. This makes it more convenient to work with a device.

An event is considered a duplicate event if all of the following event settings match the record in the cache:

• device ID
• SID of the user account attempting access
• Device category
• Action taken with the device
• Application permission verdict for this action: allowed or denied
• Path to the process used to take the action
• File that is being accessed

Prior to changing the caching period, disable Kaspersky Endpoint Security Self-Defense. After changing the caching period, enable Self-Defense.

To change the caching period:

1. Open the registry editor on the computer.
2. In the registry editor, go to the following section:
   • For 64-bit operating systems: [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\protected\KES\environment]
   • For 32-bit operating systems: [HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\protected\KES\environment]
3. Open DeviceControlEventsCachePeriod for editing.
4. Define the number of minutes that Device Control must save information about an event before this information is deleted.