Registering the Kaspersky Security Service as a protected service

Protected Process Light ("PPL") technology ensures that the operating system only loads trusted services and processes. For a service to run as a protected service, an Early Launch Antimalware driver must be installed on the device.

An Early Launch Antimalware ("ELAM") driver provides protection for the device in your network when they start and before third-party drivers are initialized.

An ELAM driver is automatically installed during Kaspersky Security for Windows Server installation and is used for registering the Kaspersky Security Service as a PPL when the operating system starts. When the Kaspersky Security Service (KAVFS) is started as a system protected process, other non-protected processes on the system are not able to inject threads, write into the virtual memory of the protected process, or stop the service.

When a process is started as a PPL, it cannot be managed by a user regardless of the assigned user permissions. The Kaspersky Security Service can be registered as PPL using the ELAM driver on Microsoft Windows Server 2016 RS3 build 16299 and higher operating systems. If you install Kaspersky Security for Windows Server on a protected device running an operating system that supports PPL, permission management will not be available for the Kaspersky Security Service (KAVFS).

To install Kaspersky Security as a PPL, run the following command:

msiexec /i ks4ws_x64.msi NOPPL=0 EULA=1 PRIVACYPOLICY=1 /qn