Configuring process memory protection settings

To configure settings to protect the memory of processes added to the list of protected processes, perform the following actions:

1. In the main window of the Web Console, select Devices → Policies & profiles.
2. Click the policy name you want to configure.
3. In the <Policy name> window that opens select the Application settings tab.
4. Select the Real-time server protection section.
5. Click Settings in the Exploit Prevention subsection.
6. Open the Exploit Prevention settings tab.
7. In the Exploit prevention mode block, configure the following settings:
   • Prevent vulnerable processes exploit.
     

     If this check box is selected, Kaspersky Security for Windows Server reduces the risks that vulnerabilities will be exploited in processes in the list of protected processes.

     If this check box is cleared, Kaspersky Security for Windows Server does not protect device processes from exploits.

     The check box is cleared by default.

     • Terminate on exploit.
       

       If this mode is selected, Kaspersky Security for Windows Server terminates a protected process upon detecting an exploit attempt if an active impact reduction technique has been applied to the process.

     • Notify only.
       

       If this mode is selected, Kaspersky Security for Windows Server reports exploits by displaying a terminal window. The compromised process continues to run.

       If Kaspersky Security for Windows Server detects an exploit in a critical process while the application is running in Terminate on exploit mode, the component switches to Notify only mode.

8. In the Preventing actions block, configure the following settings:
   • Notify about abused processes via Terminal Service.
     

     If this check box is selected, Kaspersky Security for Windows Server displays a terminal window with an explanation of why protection was activated and an indication of the process in which an exploit attempt was detected.

     If the check box is cleared, Kaspersky Security for Windows Server displays a terminal window when an exploit attempt or termination of a compromised process is detected. A terminal window is displayed regardless of the status of the Kaspersky Security Exploit Prevention Service. The check box is selected by default.

   • Prevent vulnerable processes exploit even if Kaspersky Security Service is disabled.
     

     If this check box is selected, Kaspersky Security for Windows Server will reduce the risk of vulnerabilities being exploited in processes that have already been started, regardless of whether the Kaspersky Security Service is running. Kaspersky Security for Windows Server will not protect processes added after the Kaspersky Security Service is stopped. If the service is restarted, exploit impact reduction will be stopped for all processes.

     If this check box is cleared, Kaspersky Security for Windows Server does not protect processes from exploits when the Kaspersky Security Service is stopped.

     The check box is selected by default.

9. Click OK in the Exploit Prevention window.

Kaspersky Security for Windows Server saves and applies the configured process memory protection settings.