Best practices for optimizing Kaspersky Endpoint Security performance

When deploying Kaspersky Endpoint Security for Windows, you can use the following recommendations to configure computer protection and optimize performance.

General

Configure general settings of the application in accordance with the following recommendations:

1. Upgrade Kaspersky Endpoint Security to the latest version.

   Newer versions of the application have errors fixed, stability improved, and performance optimized.

2. Enable protection components with default settings.

   Default settings are considered optimal. This settings are recommended by Kaspersky experts. Default settings provide recommended protection level and optimal resource use. If necessary, you can restore the default application settings.

3. Enable application performance optimization features.

   The application has performance optimization features: energy conservation mode and conceding of resources to other applications. Make sure these options are enabled.

Malware Scan on workstations

Enabling Background scan is recommended for Malware Scan of workstations. Background scan is a scan mode of Kaspersky Endpoint Security that does not display notifications for the user. Background scan requires less computer resources than other types of scans (such as a full scan). In this mode, Kaspersky Endpoint Security scans startup objects, the boot sector, system memory, and the system partition. Background scan settings are considered optimal. This settings are recommended by Kaspersky experts. Thus for performing a Malware Scan of the computer, you can use just the background scan mode without using other scan tasks.

If background scanning does not suit your needs, configure the Malware Scan task in accordance with the following recommendations:

1. Configure the optimal computer scan schedule.

   You can configure the task to run when the computer is operating under minimum load. For example, you can configure the task to run at night or on weekends.

   If users turn off their computers at the end of the day, you can configure the scan task as follows:

   • Enable Wake-on-LAN. The Wake-on-LAN feature allows remotely powering on the computer by sending a special signal over the local network. To use this feature, you must enable Wake-on-LAN in BIOS settings. You can also have the computer automatically turned off after the scan finishes.
   • Disable the "Run missed tasks" feature. Kaspersky Endpoint Security will skip missed tasks when the user turns on the computer. Running tasks after the computer is turned on can inconvenience the user because the scan requires a big commitment of resources.

   If you could not configure an optimal scan schedule, set tasks to run only when the computer is idle. Kaspersky Endpoint Security starts the scan task if the computer is locked or if the screen saver is on. If you have interrupted the execution of the task, for example by unlocking the computer, Kaspersky Endpoint Security automatically runs the task, continuing from the point where it was interrupted.

2. Define a scan scope.

   Select the following objects to scan:

   • Kernel memory;
   • Running processes and Startup Objects;
   • Boot sectors;
   • System drive (%systemdrive%).
3. Turn on iSwift and iChecker technologies.
   • iSwift technology.

     This technology allows increasing scan speed by excluding certain files from scanning. Files are excluded from scanning by using a special algorithm that takes into account the release date of Kaspersky Endpoint Security databases, the date that the file was last scanned on, and any modifications to the scanning settings. The iSwift technology is an advancement of the iChecker technology for the NTFS file system.

   • iChecker technology.

     This technology allows increasing scan speed by excluding certain files from scanning. Files are excluded from scans by using a special algorithm that takes into account the release date of Kaspersky Endpoint Security databases, the date when the file was last scanned, and any modifications to the scan settings. There are limitations to iChecker Technology: it does not work with large files and applies only to files with a structure that the application recognizes (for example, EXE, DLL, LNK, TTF, INF, SYS, COM, CHM, ZIP, and RAR).

   You can only turn on iSwift and iChecker technologies in the Administration Console (MMC) and Kaspersky Endpoint Security interface. You cannot turn on these technologies in Kaspersky Security Center Web Console.

4. Disable the scanning of password-protected archives.

   If the scanning of password-protected archives is enabled, a password prompt is displayed before the archive is scanned. Because the task is recommended to be scheduled during out-of-office hours, the user cannot enter the password. You can scan password-protected archives manually.

Malware Scan on the servers

Configure the Malware Scan task in accordance with the following recommendations:

1. Configure the optimal computer scan schedule.

   You can configure the task to run when the computer is operating under minimum load. For example, you can configure the task to run at night or on weekends.

2. Turn on iSwift and iChecker technologies.
   • iSwift technology.

     This technology allows increasing scan speed by excluding certain files from scanning. Files are excluded from scanning by using a special algorithm that takes into account the release date of Kaspersky Endpoint Security databases, the date that the file was last scanned on, and any modifications to the scanning settings. The iSwift technology is an advancement of the iChecker technology for the NTFS file system.

   • iChecker technology.

     This technology allows increasing scan speed by excluding certain files from scanning. Files are excluded from scans by using a special algorithm that takes into account the release date of Kaspersky Endpoint Security databases, the date when the file was last scanned, and any modifications to the scan settings. There are limitations to iChecker Technology: it does not work with large files and applies only to files with a structure that the application recognizes (for example, EXE, DLL, LNK, TTF, INF, SYS, COM, CHM, ZIP, and RAR).

   You can only turn on iSwift and iChecker technologies in the Administration Console (MMC) and Kaspersky Endpoint Security interface. You cannot turn on these technologies in Kaspersky Security Center Web Console.

3. Disable the scanning of password-protected archives.

   If the scanning of password-protected archives is enabled, a password prompt is displayed before the archive is scanned. Because the task is recommended to be scheduled during out-of-office hours, the user cannot enter the password. You can scan password-protected archives manually.

Kaspersky Security Network

To protect your computer more effectively, Kaspersky Endpoint Security uses data that is received from users around the globe. Kaspersky Security Network is designed for obtaining this data.

Kaspersky Security Network (KSN) is an infrastructure of cloud services providing access to the online Kaspersky Knowledge Base that contains information about the reputation of files, web resources, and software. The use of data from Kaspersky Security Network ensures faster responses by Kaspersky Endpoint Security to new threats, improves the performance of some protection components, and reduces the likelihood of false positives. If you are participating in Kaspersky Security Network, KSN services provide Kaspersky Endpoint Security with information about the category and reputation of scanned files, as well as information about the reputation of scanned web addresses.

Edit Kaspersky Security Network settings in accordance with the following recommendations:

1. Disable extended KSN mode.

   Extended KSN mode is a mode in which Kaspersky Endpoint Security sends additional data to Kaspersky.

2. Configure Private KSN.

   Private KSN is a solution that enables users of computers hosting Kaspersky Endpoint Security or other Kaspersky applications to obtain access to reputation databases of Kaspersky Security Network, and to other statistical data without sending data to KSN from their own computers.

3. Enable Cloud mode.

   Cloud mode refers to the application operating mode in which Kaspersky Endpoint Security uses a light version of anti-virus databases. Kaspersky Security Network supports the operation of the application when light anti-virus databases are being used. The light version of anti-virus databases lets you use approximately half of the computer RAM that would otherwise be used with the usual databases. If you do not participate in Kaspersky Security Network or if cloud mode is disabled, Kaspersky Endpoint Security downloads the full version of anti-virus databases from Kaspersky servers.