What policy setting do I set in the Admin Kit to allow users to manually update from KL servers when they want to. Right now, if they click "Update Now" on their laptops, the message "Update is Controlled by Administrator" just comes up. I've enabled both Admin Kit and KL Update sources in the policy and unlocked it, but it doesn't seem to have made a difference.

Go into the properties of the remote installation package from the workstation. Check the Update under "task to be installed". Create a new installation task and install the product again.

Read this FAQ.

For i know, this is not necessary. if you are using Admin Kit you can change or unlock stetting in workstation policy.

What settings you say?
I think the best way to do this... is reinstall the application with updater local task, like Helmut said.

Just go to the admin kit, then on the group that the computers are, and chek "policies" , make a new one if you don't have any, and then go to "Settings" on the policie you have, there you are, now you can manage the configuration of all computers in the group you created the policie, there must be a "update" section on the policie's settings

Hope it helps

I do have a "Kaspersky Anti-Virus for Windows Workstations policy (version 6)" in the top-level policies.
The policy is active and the settings generally seem to be propagated.
There are no other workstation policies between this one and the laptops
The policy does have an "Update" section under Settings
"Update Settings" is unlocked
Under "Configure" - both source update boxes are checked

What I don't understand is: what am I getting wrong?

If somebody under this policy clicks "Update now", they still get the error: "Update is controlled by Administrator". Then >> I << get a dozen 4AM phone calls because they read in the newspaper of the latest 'horrible Internet security problem' that presumably has to be fixed right away by updating their antivirus. Which of course they can't do.

If this is the expected behavior, I don't understand why the user even sees the option to update.

I re-read the FAQ, but I don't see what applies. I have the Admin Kit and the antivirus deployed and working; I don't see anything specific to this problem. I definitely do NOT want to install it unmanaged (ie outside the admin kit).

I am having the exact same problem. Furthermore, the updates are not automatically rolling out except to another server I have on the system.

I'm a new user, so I'm willing to admit it may be ( my error.

This problem will happen if you do the installation remotely from Administration Kit. In order to overcome this, you need to check again the installation package under remote installation in the admin kit. Go to the properties of the workstation anti-virus. Under Properties tab, you can see 'Tasks to be installed'. Make sure you tick all option under it including update, to make sure user will be given access to update signature manually. If the option is untick, all user that been deployed with the package, cannot control update manually and will be getting error "Update is controlled by Administrator". Refer the option in the attachment.

So, to fix the problem with user already installed, you need to change the remote package properties, and re-deploy the package to the user. With this, user will be getting the new setting and can do the update manually.

Thanks for that write-up namh!

It solved my issue, but a warning to anyone else reading this...if you choose to allow the end user to delay the reboot which will probably be needed think twice. All but one of my users who chose the "delay" option was essentially knocked off the LAN until they rebooted. Everything was fine once they did, problem of the "controlled by admin" message solved.

I considered opening a new thread for my other problem but a search by topic put this one at the top so here goes...

Any ideas why some who choose the update now link/button get all the files downloaded and installed successfuly and after a reboot still show the old signature date with the update now link?

where are you updating from your adminkit or KL update server (internet)?
if you are updating from adminkit and still it shows old signature in your workstation, better check if adminkit is updating properly, update adminkit manually, click download updates.

I have them set to use the adminkit server first and the intardnet as a second choice. Most of the machines are getting the updates just fine, I have about 8 of them that are not. I have tried running the update task from the adminkit, it says it worked, meaning the task completed successfully. I have tried it from the client (got that fixed by following this thread) and it shows all green (with the few light blue informational log entries), but as soon as the job finishes it reports that the definitions are out of date (they all show 7-24-2008 right now if that means anything).

I'm lucky that one of the machines exhibiting this behavior is my laptop, so i can be more aggressive with trying things. I have removed and reinstalled KAV-WKS more than once, it fixed two of them but the other 8 are still a problem, I've done it four times now on my laptop to no avail so I decided that wasn't it. In fact i reinstalled the client across my enterprise last week using the instructions in this thread, so I don't think that is the issue. The workstations (not my laptop) are all the same brand/model, built using ghost images, so I don't think there's any hardware/firmware issue either.

I just figured there was some article here about clients that were not receiving scheduled updates but haven't found it.

Playing with it some more, I just told the client to not use the adminkit as a source and ran a manual update. I noticed that in addition to the files that start with 'bases' it also downloaded a number of them that start with 'diff'. That seems to have done the trick, at least on this one machine. I can go around to the others and do this manually but it does not explain why all the other clients are up to date using the adminkit as their source.

Any ideas?

Please check your KAK update list, scroll to date column to check your server is downloaded the newest def.
Then check your network agent setting, these clients may not able to synchronize as well.
It happened once in my environment while switching KAK server, just reinstall NA directly from server it solved.
If so, just redeploy your NA to problem clients.

But sometime, you may find clients are not able to communicate with server, add server name with IP in %system32\drivers\etc\hosts, may solve.

hmmm.. it seems that your KAK is not updating properly because it still has old database signature. before you do anything else please check your Kaspersky Admin Kit (your 1st update source) if its downloading the latest database signature, view its updating report.