About permissions to manage registered services
During installation, Kaspersky Security for Windows Server registers in Windows the Kaspersky Security Service (KAVFS), the Kaspersky Security Management Service (KAVFSGT) and Kaspersky Security Exploit Prevention (KAVFSSLP).
The Kaspersky Security Service can be registered as a Protected Process Light using the ELAM driver on Microsoft Windows 10 and higher operating systems. When a process is started as a PPL, it cannot be managed by a user regardless of the assigned user permissions. If you install Kaspersky Security for Windows Server on a protected device running an operating system that supports PPL, permission management will not be available for the Kaspersky Security Service (KAVFS).
Kaspersky Security Service
By default, access permissions for managing the Kaspersky Security Service are granted to users in the Administrators group on the protected device, as well as to the SERVICE and INTERACTIVE groups with read permissions and to the SYSTEM group with read and execute permissions.
Users who have the Edit permissions level access can grant access permissions for managing Kaspersky Security Service to other users registered on the protected device or included in the domain.
Kaspersky Security Management Service
To manage the application via the Application Console installed on a different protected device, the account whose permissions are used to connect to Kaspersky Security for Windows Server must have full access to the Kaspersky Security Management Service on the protected device.
By default, access to the Kaspersky Security Management Service is granted to users of the Administrators group on the protected device and users of the KAVWSEE Administrators group created on the protected device during Kaspersky Security for Windows Server installation.
You can only manage the Kaspersky Security Management Service via the Microsoft Windows Services snap-in.
Kaspersky Security Exploit Prevention
By default, access permissions for managing the Kaspersky Security Exploit Prevention service are granted to users in the Administrators group on the protected device, as well as to the SYSTEM group with read and execute permissions.
