About permissions to manage registered services
During installation, Kaspersky Embedded Systems Security for Windows registers in Windows the Kaspersky Security Service (KAVFS), the Kaspersky Security Management Service (KAVFSGT) and Kaspersky Security Exploit Prevention Service (KAVFSSLP).
The Kaspersky Security Service can be registered as a Protected Process Light using the ELAM driver on Microsoft Windows 10 and higher operating systems. When a process is started as a PPL, it cannot be managed by a user regardless of the assigned user permissions. If you install Kaspersky Embedded Systems Security for Windows on a protected device running an operating system that supports PPL, permission management will not be available for the Kaspersky Security Service (KAVFS).
Kaspersky Security Service
By default, access permissions for managing the Kaspersky Security Service are granted to users in the Administrators group on the protected device, as well as to the SERVICE and INTERACTIVE groups with read permissions and to the SYSTEM group with read and execute permissions.
Users who have the Edit permissions level access can grant access permissions for managing Kaspersky Security Service to other users registered on the protected device or included in the domain.
Kaspersky Security Management Service
To manage the application via the Application Console installed on a different protected device, the account whose permissions are used to connect to Kaspersky Embedded Systems Security for Windows must have full access to the Kaspersky Security Management Service on the protected device.
By default, access to the Kaspersky Security Management Service is granted to users in the "Administrators" group on the protected device and users in the ESS Administrators group created on the protected device during installation of Kaspersky Embedded Systems Security for Windows.
You can only manage the Kaspersky Security Management Service via the Microsoft Windows Services snap-in.
Kaspersky Security Exploit Prevention Service
By default, access permissions for managing the Kaspersky Security Exploit Prevention Service are granted to users in the Administrators group on the protected device, as well as to the SYSTEM group with read and execute permissions.
