Verify the following:

• Whether the account password specified in the remote installation task is correct. Re-enter this password.
• Whether the account is neither locked nor expired. Make sure that no password change is required.
• Whether the account has administrator rights on the target device.
• Whether the basic authentication method is set for the accounts:
  1. Press  + R on the keyboard.
  2. Type secpol.msc and click OK.
  3. In the Local Security Policy window that opens, go to Local Policies → Security Options and make sure that Network access: Sharing and security model for local accounts is set to Classic - local users authenticate as themselves. For details, see the Microsoft website.

1. Check the trust relation between the domain device, a distribution point, or the Administration Server and the Active Directory domain.
   To do this, open the command prompt as administrator and run the commands:

If the command result is True, then the device is trusted by the domain. For more details about the command, see the Microsoft website.

2. Install Network Agent using Kerberos (for custom installation on a few number of devices) or using NTLM if the domain account for device connection is not included to the Protected Users group in Active Directory (i.e. using NTML is prohibited), and Kerberos is used on the domain.

1. Enter Service Principal Name for each domain target device:
   1. Open the command prompt as administrator with rights to write Active Directory attributes.
   2. Run the command for each device:
   setspn -s cifs/<target_host_ip> <target_pc_hostname>

   Where <target_host_ip> is an IP address of connection to the Administration Server network or to a distribution point of the target device for Network Agent installation. <target_pc_hostname> is a device name.

   For example:

   setspn -s cifs/192.0.2.45 mytestpc
2. Engage support of Kerberos through IP in the OS of the Administration Server.
   1. Open the command prompt as an administrator.
   2. Run the following command:
   reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" /v TryIPSPN /t REG_DWORD /d 1 /f
3. Deploy Network Agent on devices.
4. Delete previously created SPN records if the IP addresses of the devices are temporary. For details, see the Microsoft website.

1. Change the Active Directory domain policy security settings to provide the operation of the NTLM protocol during deploying Network Agent.
   1. On the target domain devices, set Network Security: Restrict NTLM: Incoming NTLM traffic to Allow all.
      The Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers policy setting can be set to Deny all.
   2. Set the Network security: Restrict NTLM: NTLM authentication in this domain setting to Disable on domain controllers.
   3. On the Administration Server, set the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers policy setting to Allow all.
   4. Deploy Network Agent on devices.
   5. Only for Kerberos: reset the domain security settings to initial mode.
2. If the issue persists, review additional diagnostic data of all the listed devices through the OS snap-in: open Event Viewer → Application and Services Logs → Microsoft → Windows → NTLM → the Operational log. You can also use the installation methods specified in the fourth item from the What to do if the issue persists block.

• Use additional recommendations on troubleshooting the network access and configuring the OS.
• If the installation task completes successfully and the message "Remote installation has completed successfully on this device." appears, but the Network Agent is not available or doesn’t appear on the device object, see the recommendations in the article.
• Try to exclude checking the connection of the target device to the Administration Server if Deep Packet Inspection (DPI) or decryption and traffic analysis technologies (SSL inspection) are used as part of third-party protection software.
• Use additional centralized tools for deploying Network Agent:
  • Using Active Directory group policies
  • Integration into a reference OS installation image
  • Third-party tools for centralized application deployment

If the issue still persists, submit a request to Kaspersky Technical Support via Kaspersky CompanyAccount. In your request:

• Describe the problem: attach screenshots of the installation error, specify which steps from the instructions you have performed, and provide the output of the diagnostic commands from this article.
• Collect the diagnostic information and attach the created files to your request.