Is there a way to do this task remotely(besides remote desktop)? I dont have physical access to some of these machines as they are located in different buildings.

Thanks

You can create a .bat file which does it and...

1) Connect to the remote workstation's C$ share and copy the .bat file. Then create a scheduled task remotely to run the .bat using an AT command, OR

2) Email the .bat file to the user and request that they save it and launch it

Create a global task for Network Agent. Task type is "Change Kaspersky Administration Server Task".

Then you can change the setting for the Agent.

Hello,

I arrived at work this morning to find approx another 4 systems listed as inactive and showing out of control. Creating and running the batch file works great but, am i going to need to install the batch file on all the systems and run regularly as a task as "MrRAlan" suggested? These systems are never turned off, the ones i can easily access are up and running and DCHP is not used in this network. Thanks for all your guys help!

AC1

I have been looking through some of the system event logs as well as any possible task Global or Group that could be causing this and have found nothing. All the tasks i have are set to run manually. The only thing in event logs of the related systems is the following:

Failed to connect to the administration server

Transport level error communicating with 'http://SERVER:13000': timeout expired.

Error information: 1255/0 (Error was occurred in transport layer. Error code - '0'.), O:\CS AdminKit\development2\transport\trf\socket\transfersocket.cpp, 435

Most of the systems installs were done locally, some on the administrator account and others on the user accounts. Since being handed this task all the system installs i have done are through the admin kit and to the administrator account. I wouldn't think this could be an issue but is it possible?

Thanks,
AC1

Hello,

I am having trouble with a few systems. The computer status has dropped to the "faded red symbol" and the message i get at the admin server is "Host is out of control". I can ping the system, so i know its not off. The windows firewall is off but just in-case it is being turned on i have added KAV to exceptions and set to allow. The services are running and i restarted them just in-case. I am usually gone before most people come to work so i rarely get the opportunity to visit the workstation, but the other day i was able to get access and i looked through KAV at the workstation and all was fine. Out of approx 32 systems this has happened to 3. Thanks for any help.

AC1

That means that host is online but network agent did not connect to the Administration Server for a long time.
Run klnagchk utility on the problem computer. It is in the Network Agent installation folder.

Have any of the PCs which received the "Change Kaspersky Administration Server Task" started to fail again? If not, it's possible that once this task is run on your PCs, the problem will no longer occur. Maybe just sending the task to all PCs will correct the issue.

I do understand that, but my question is why do they randomly lose connection. The above posts show the result of the
klnagchk.exe and when running klmover.exe all works fine on some systems. As far as i can tell there is nothing in common with
the handfull of systems with this problem. I have a total of 5 servers two of which is are DC's and 30 systems in my little part
on this network. I am down to 4 systems giving me trouble. 2 are xp pro and 2 windows 2000. I think there might be an issue with
how they are joined on the network. One i know for sure is in a child domain but shows up in the parent folder in Kaspersky. I'm
suspecting this might be an issue. But the why would it work in the first place if that was the case?

I did run the "Change Kaspersky Administration Server Task" and the systems that are not communicating had no effect. The result showed the task completed sucessfully on those systems but still no connection. Like i said at some point earlier, due to the hours i work i really don't have access to the local machines and am currently trying to relay this info to my supervisor that does. I really would like to get to one of these machines and see what is going on. I have set up KAV on a virtual machine on the server i work on, joined it to the domain and wouldn't you know it...it works with no problems. Thanks for all the input, and if i figure it out i will repost here.
AC1

Look at Kaspersky EventLog on the problem workstation. All failures while connection to the Administration Server are logged
there as well as most of other problems. Unavailablity of the Administration Server for an hour results in that status "Host is out of control".

There may be following possible reasons of Error "Transport level error communicating with 'http://SERVER:13000': timeout expired.":
- There's some network device that does not pass TCP packets to the SERVER:13000
- Personal firewall does not not pass TCP packets to the SERVER:13000
- Some local traffic limiting software
- Huge administration Server load so that it is unable to handle incoming connections -- permanent 100% CPU on the administration side and the Administration Server cannot be managed with the Administration Console
- Some network problems or network is overloaded

What about the machines which recieved the .bat file I told you about? Have those failed since?

C:\Program Files\Kaspersky Lab\NetworkAgent>klnagchk
Starting utility 'klnagchk'...
Checking command line options...OK
Initializing basic libraries...OK
Current host is CORVEX\MIDA


Reading the settings...OK
Settings verification...OK
Network Agent settings:
Administration Server address: '192.168.100.29'
Use SSL connection: 1
Numbers of the Administration server SSL ports: '13000'
Numbers of the Administration server ports: '14000'
Administration Server certificate: available
Use proxy server: 0
Open UDP port: 1
Numbers of UDP ports: '15000'
Synchronization period, min.: 15
Connection timeout, sec.: 30
Send/receive timeout, sec.: 180

Attempt to connect to the Administration server...OK
Attempt to connect to the Network Agent...OK
Administration Agent is running
Receiving the Network Agent's statistical data...OK
Network Agent's statistical data:
Total number of synchronization requests: 1
The number of successful synchronization requests: 1
Total number of synchronizations: 0
The number of successful syncrhonizations: 0
Date/time of the last request for synchronization:2008.10.16. 15:23:59 GMT (2008
.10.16. 17:23:59)


Deinitializing basic libraries...OK

C:\Program Files\Kaspersky Lab\NetworkAgent>ping theia

theia.budapest.infor.hu [192.168.100.29] pingelése 32 bájt méretu adatokkal:

Válasz 192.168.100.29: bájt=32 ido<10 ezredmp. TTL=128
Válasz 192.168.100.29: bájt=32 ido<10 ezredmp. TTL=128
Válasz 192.168.100.29: bájt=32 ido<10 ezredmp. TTL=128
Válasz 192.168.100.29: bájt=32 ido<10 ezredmp. TTL=128

192.168.100.29 ping-statisztikája:
Csomagok: küldött = 4, fogadott = 4, elveszett = 0 (0% veszteség),
Oda-vissza út ideje közelítolegesen, milliszekundumban:
minimum = 0ms, maximum = 0ms, átlag = 0ms

C:\Program Files\Kaspersky Lab\NetworkAgent>klmover -address 192.168.100.29
Starting utility 'klmover'...
Initializing basic libraries...OK
Checking command line options...OK
Opening the list of services...OK
Stopping service 'KLNagent'...OK
Settings verification...OK
Reading the settings...OK
Preparing settings...OK
Writing settings...OK
Starting service 'KLNagent'...OK


Operation completed successfully.


C:\Program Files\Kaspersky Lab\NetworkAgent>

Hi all,

I have the same problem as AC1. I have an NT4 network, a couple of servers and lots of workstations (desktops and mobil notebooks also). Desktop machines are connected with fix IP address, notebooks are using DHCP because they are often outside of network. Each one works well, but two notebooks appear faded red symbol in the group list on admin server. Both have got a fresh OS (XP) install and then the KAV (version 6.0.3.837) with networkagent and the problem persists from the begining. They are sometimes connected to the network, in this case they are able to download the fresh antivirus packages from the admin server, they get the fresh policies (if I modify something) and everything seems to be OK when I sit by the workstation. But admin server says that this computer was visible last one month ago and last update was FIVE months ago. (This notebook used to connect to the network at least 2 times a week).
I've tried your advice, ran the network agent utilities and everything was succesful like this: (corvex is my domain, theia is admin server and mida is workstation with problem)
So, workstation and the server can 'talk' with ping packets. I have no idea what can cause this effect (there's no active firewall).
Do you have any suggestions ?

Hi all,

I have the same problem as AC1. I have an NT4 network, a couple of servers and lots of workstations (desktops and mobil notebooks also). Desktop machines are connected with fix IP address, notebooks are using DHCP because they are often outside of network. Each one works well, but two notebooks appear faded red symbol in the group list on admin server. Both have got a fresh OS (XP) install and then the KAV (version 6.0.3.837) with networkagent and the problem persists from the begining. They are sometimes connected to the network, in this case they are able to download the fresh antivirus packages from the admin server, they get the fresh policies (if I modify something) and everything seems to be OK when I sit by the workstation. But admin server says that this computer was visible last one month ago and last update was FIVE months ago. (This notebook used to connect to the network at least 2 times a week).
I've tried your advice, ran the network agent utilities and everything was succesful like this: (corvex is my domain, theia is admin server and mida is workstation with problem)
So, workstation and the server can 'talk' with ping packets. I have no idea what can cause this effect (there's no active firewall).
Do you have any suggestions ?

Hi all,

I have the same problem as AC1. I have an NT4 network, a couple of servers and lots of workstations (desktops and mobil notebooks also). Desktop machines are connected with fix IP address, notebooks are using DHCP because they are often outside of network. Each one works well, but two notebooks appear faded red symbol in the group list on admin server. Both have got a fresh OS (XP) install and then the KAV (version 6.0.3.837) with networkagent and the problem persists from the begining. They are sometimes connected to the network, in this case they are able to download the fresh antivirus packages from the admin server, they get the fresh policies (if I modify something) and everything seems to be OK when I sit by the workstation. But admin server says that this computer was visible last one month ago and last update was FIVE months ago. (This notebook used to connect to the network at least 2 times a week).
I've tried your advice, ran the network agent utilities and everything was succesful like this: (corvex is my domain, theia is admin server and mida is workstation with problem)
So, workstation and the server can 'talk' with ping packets. I have no idea what can cause this effect (there's no active firewall).
Do you have any suggestions ?

Are there any errors in the Kaspersky EventLog on those problem workstations ?

Hello Corvex,

I did have an issue like you explained within all of this, 1 system would not connect to the Admin server and all was well with the network agent and Antivirus at the workstation. After checking everything i could think of, while reviewing one of the reports i found that system had an expired license. Once license was updated i didn't have another issue with that system. Hope this helps and good luck with it!

AC1

Hello,

Well i think i finally figured out the issue. The last system this has happened to i ran the klagchk.exe and received the same transport layer error as before and all the others. This has all been due to a DNS issue. The server i'm running the Admin kit on used to be a back up Domain Controller and DNS server that has been removed from that role. Upon rebuilding this system, the naming convention was not changed but the ip address was. All the DNS records in the top level Domain Controller still exist. The klmover has always corrected the condition because i use the ip address of the Admin Server. Hopefully updating the Domain Controller will correct this issue. Thank you all for the help in this matter, it is greatly appreciated.

AC1

Hi,

I don't know what you're thinkin of exactly. In my case the Kasp Admin Server runs on a win2003 terminal server, so i think this wouldn't solve my problem.

Hi,

I don't know what you're thinkin of exactly. In my case the Kasp Admin Server runs on a win2003 terminal server, so i think this wouldn't solve my problem.

Please, do following.
1. Reproduce the problem with computer MIDA
2. Unpack attached archive on the computer with Administration Server installed
3. Run start.cmd
4. Archive resulting XML file and send it to me.

hi andkaz,

thank you for trying to help me. I cant understand exactly what you instruct for me.
I ran the cmd file on the client (Mida) computer but it returns like this:
Connecting database server...FAILED - error code 1125 ('Parameter with name "87"
not exist.')
... as any other host also.
I made deployment packages in the admin server both with to install the klsql2.exe or start.cmd with remote install, but the problem was as the same above. it gave me no result.xml.

Hi andkaz,

thank you so much!
As you said there are three computers by the name of MIDA, however the last connection times are not obvious: [right click+properties]

1. MIDA (red coloured)
   • Last Update Date: 2008. 05. 30. 09:29:30
   • Last Visible Time: 2008. 12. 01. 17:44:45
   • Connecting to Server: 2008. 05. 30. 09:40:26
2. MIDA~13 (grey)
   • Last Update Date: <Unknown>
   • Last Visible Time: 2008. 12. 02. 18:31:37
   • Connecting to Server: <Unknown>
3. MIDA~17 (grey)
   • Last Update Date: 2008. 12. 02. 17:08:06
   • Last Visible Time: 2008. 12. 02. 18:51:56
   • Connecting to Server: 2008. 12. 02. 18:51:56

Is it ok, that I'm importing a host for example Mida~17 to the regular group ? It doesn't seem so elegant name for me...
I hope when host comes online one of these computers going to become green, but how could I prevent to get more aliases in this list as the same name ?

thank you

regards
corvex

Hi All,

I'm currently having the same problem as corvex. Two of our workstations has this problem. the first one was ahving this problem for some days now, the other just today, yesterday it was green color. now all of a sudden its blank red. I have tried to re-install the anti-virus and agent, run scan and updates, but they cannnot still be detected.

I want to tr and update the certificate, maybe that can help me, but may I ask how to I do this.

Also I tried to run the start.cmd on the machine with the admin server, but it did not produce any xml file. The results areall OK though.

Thanks for your help. OUr heads are already busting about this one