The critical update for Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 1 (version 10.3.0.6294) contains changes that make Kaspersky Endpoint Security compatible with the following Microsoft Windows operating system updates:

• Windows 10 RS3 / Windows Server 2016 RS3 (1709): KB4056892
• Windows 10 RS2 (1703): KB4056891
• Windows 10 RS1 / Windows Server 2016 RS1 (1607): KB4056890
• Windows 10 TH2 (1511): KB4056888
• Windows 10 TH1 (RTM): KB4056893
• Windows 8.1/Windows Server 2012 RS2 Monthly Rollup: KB4056895
• Windows 8.1/Windows Server 2012 RS2 Security Only: KB4056898
• Windows Server 2012 Monthly Rollup: KB4056896
• Windows Server 2012 Security Only: KB4056899
• Windows 7/Windows Server 2008 R2 Monthly Rollup: KB4056894
• Windows 7/Windows Server 2008 R2 Security Rollup: KB4056897

To install the application locally, run the setup.exe file from the full distribution package and follow the Setup Wizard instructions. For more information about installation, see the Administrator’s Guide.

During installation, Kaspersky Endpoint Security 10 for Windows detects and allows you to uninstall applications that may affect the performance of the user's computer or cause other problems (even to the point of complete inoperability) when running at the same time as the product. The full list of incompatible software is available in this article.

When installing the solution from the full installer, you can upgrade to Kaspersky Endpoint Security 10 for Windows Service Pack 2 Maintenance Release 1 (version 10.3.0.6294):

• Kaspersky Endpoint Security 10 Service Pack 1 (build 10.2.2.10535)
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 1 (build 10.2.2.10535(MR1))
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 2 (build 10.2.4.674)
• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 3 (build 10.2.5.3201)
• Kaspersky Endpoint Security 10 for Windows Service Pack 2 (build 10.3.0.6294)

Starting with Kaspersky Endpoint Security 10 for Windows Service Pack 2, the encryption module is included in the application distribution package and will be automatically installed to your computer:

1. During installation of the full disk encryption (FDE) component.
2. During installation of the file level encryption (FLE) component.
3. During installation of an upgrade on a computer with the encryption module installed. 

For automatic upgrade of an installed encryption module, use the appropriate distribution package for Kaspersky Endpoint Security 10 for Windows Service Pack 2 Maintenance Release 1:

• kes10winsp2_mr1_<localization>_aes256 – to upgrade an AES encryption module with a 256-bit effective key length.
• kes10winsp2_mr1_<localization>_aes56 – to upgrade an AES encryption module with a 56-bit effective key length.

Automatic upgrade of the encryption module will be performed only for the following configurations:

• Kaspersky Endpoint Security 10 for Windows Service Pack 1 (build 10.2.2.10535) and encryption module version 1.0.2.1068.
• Kaspersky Endpoint Security 10 Service Pack 1 for Windows Maintenance Release 1 (build 10.2.2.10535(MR1)) and encryption module version 1.0.2.1068.
• Kaspersky Endpoint Security 10 Service Pack 1 for Windows Maintenance Release 2 (build 10.2.4.674) and encryption module version 1.1.0.73.
• Kaspersky Endpoint Security 10 Service Pack 1 for Windows Maintenance Release 3 (build 10.2.5.3201) and encryption module version 1.1.0.73.

If the conditions described above are met, the application installer automatically removes the installed encryption module and installs all libraries necessary for encryption.

For a description of the methods used for updating configurations different from those listed above, as well as the actions that must be performed if you want to switch from the utilized encryption to encryption with a different effective key length, please refer to Application compatibility with AES modules and details on upgrading encryption to the Service Pack 2 version.

For the full list of known issues and limitations, follow this link.

The update for Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 1 for Windows can be installed over all private patches for the Service Pack 2 version.

Starting with Kaspersky Endpoint Security 10 for Windows Service Pack 2, the encryption module is included in the application distribution package. That is why Kaspersky Endpoint Security 10 for Windows Service Pack 2 Maintenance Release 1 (version 10.3.0.6294) is incompatible with the AES encryption modules released for earlier versions of Kaspersky Endpoint Security 10 for Windows.

When the application is installed from the distribution package, all libraries required for encryption are installed automatically when the full disk encryption (FDE) or file level encryption (FLE) component is selected.

If you want to switch from the utilized encryption to encryption with a different key length, you must delete the utilized AES encryption module before upgrading the application to the Service Pack 2 Maintenance Release 1 version.

Note that you must decrypt all hard disks that have been encrypted using full disk encryption (FDE), before removing or upgrading the Encryption Module. No access to folder level encryption (FLE) files will be provided after you remove Encryption Module.

When upgrading from the following configurations, the application installer automatically removes the installed encryption module and installs all libraries necessary for encryption:

• Kaspersky Endpoint Security 10 Service Pack 1 (build 10.2.2.10535) and encryption module version 1.0.2.1068.
• Kaspersky Endpoint Security 10 for Windows Service Pack 1 Maintenance Release 1 (build 10.2.2.10535(MR1)) and encryption module version 1.0.2.1068.
• Kaspersky Endpoint Security 10 for Windows Service Pack 1 Maintenance Release 2 (build 10.2.4.674) and encryption module version 1.1.0.73.
• Kaspersky Endpoint Security 10 for Windows Service Pack 1 Maintenance Release 3 (build 10.2.5.3201) and encryption module version 1.1.0.73.

If you are upgrading the application from the Service Pack 1 (build 10.2.2.10535) or Service Pack 1 Maintenance Release 1 (build 10.2.2.10535(MR1)) version and an encryption module of version 1.0.0.724 or 1.0.1.814 is installed on the computer, you have to upgrade the encryption module to version 1.0.2.1068 before upgrading the application.

If you are upgrading the application from the Service Pack 1 Maintenance Release 2 (build 10.2.4.674) or Service Pack 1 Maintenance Release 3 (build 10.2.5.3201) version and an encryption module of version 1.0.0.724, 1.0.1.814 or 1.0.2.1068 is installed on the computer, you have to upgrade the encryption module to version 1.1.0.73 before upgrading the application.

The application is compatible with Kaspersky Security Center 10 Service Pack 2 Maintenance Release 1.

To manage the application remotely via Kaspersky Security Center 10:

1. Install Network Agent on the computer. For detailed information, refer to the Kaspersky Security Center Administrator's Guide.
   For detailed information, refer to the Kaspersky Security Center 10 Administrator's Guide.
2. Install the Administration Plug-in of Kaspersky Endpoint Security 10 for Windows in the Kaspersky Security Center 10 console.
   The installation file of the Administration Plug-in is included in the application distribution package. You can download the required plugin version from the list of Kaspersky Security Center 10 plugins.

Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 1 for Windows can be installed via the Kaspersky Lab update service.  

You can upgrade the following applications using the Kaspersky Lab update service:

• Kaspersky Endpoint Security 10 for Windows Service Pack 2 (build 10.3.0.6294)

Please note the following special considerations when upgrading an application via the Kaspersky Lab update service:

• The update can be installed over all private patches for the Service Pack 2 version.
• After you install an update, you will not be able to roll back to the previous application version.
• Before installation of an update, you must read the text of the End User License Agreement and confirm your acceptance of its terms.
  If you do not confirm your acceptance, the update will not be installed.
  If the computer is managed by Kaspersky Security Center, you can confirm your acceptance using the Kaspersky Security Center console, in the Application Management node, in the Software Updates section.
  If the application has been installed in stand-alone mode (without management using Kaspersky Security Center), you can confirm your acceptance in the local interface of the application.
• To complete the update installation, you must restart your computer.