Deleting a file from a device
You can delete files from a device using the Delete file from device task. This may be necessary, for example, as part of threat response.
System Critical Objects (SCOs) cannot be deleted. SCOs include files that are necessary for the operation of the operating system and the Kaspersky Endpoint Security application.
You can create and run the Deleting a file from a device task, as well as edit its settings in the Web Console:
You cannot create, run, or configure the Deleting a file from a device task on the command line. You cannot view a Deleting a file from a device task created in the Web Console on the command line with the kesl-control --get-task-list command.
Deleting a file from a device task settings
Setting | Description |
|---|---|
Specify the file to be deleted | In the drop-down list, you can select how to specify the path to the file to be deleted:
|
Full path to file | Field for entering the full path to the file to be deleted. This field is displayed only if in the Specify the file to be deleted drop-down list, you selected By full path. |
Checksum type | In the drop-down list, you can select the type of the checksum of the file to be deleted:
This drop-down list appears only if you select By path to directory and checksum in the Specify the file to be deleted drop-down list. |
File checksum | Field for entering the checksum of the file to be deleted. This field is displayed only if in the Specify the file to be deleted drop-down list, you selected By path and checksum. |
Directory path | Field for entering the path to the directory of the file to be deleted. This field is displayed only if in the Specify the file to be deleted drop-down list, you selected By path and checksum. |
Include subdirectories | This check box enables or disables subdirectories. |
If the file is blocked by another process, the task is displayed with the Completed status, but the file itself is deleted only after the device is restarted. After restarting the device, make sure that the file was deleted.
If you are trying to delete a running executable file, the Deleting a file from a device task may finish with an Access denied error. Create and run the Terminating a process task for that file, then try again.
You can view the result of the task in the Assets (Devices) → Tasks → <task name> section, on the Results tab in the Description column.
