Description
You may want to allow certain users to do everything, but without giving them access to modify policies, manage users, or assign roles. However, when using default roles provided by KSC, some permissions are either too broad or unchangeable.
Steps to Create the Custom Role:
Open Kaspersky Security Center.
Go to Administration Server Properties → Users Roles.
Click “Add” to create a new role.
Enter a role name (e.g., Rule for Hospitals).
For any types of issues with tasks managed by KSC, we require export of task execution history in .txt file. Task execution history is a sequence of events generated by client computer during task execution.
Step-by-step guide
To export task execution history, follow these steps:
Open task results window.
In the upper part of the task results window, select problem computer.
Right-click some event in the lower part of the task results window,
This article is about Kaspersky Security Center for Windows (KSC for Windows)
Step-by-step guide
Make sure that System Management license is installed, otherwise KSC events won't be exported to SIEM. For more information please refer to SIEM integration: the most frequent error.
Specify Splunk Server address and port;
Login into Splunk Management console;
Press Settings → Configure data inputs;
In the o
This article is about Kaspersky Security Center for Windows (KSC for Windows)
Problem
You set up integration with SIEM but no events come up on SIEM side. In some cases there is no incoming traffic to SIEM from KSC server.
Solution
In vast majority of cases the root cause can be located in KSC server trace
Trace example #1
25.01.2017 09:56:56.855 00001320.0000015C L1 KLSPLG: There is no key for SystemM
KSC installer generates default passwords for service accounts (automatically created to run KSC service), KIPxeUser and KIScSvc.
Those passwords have 16 characters length, characters are taken randomly so that the password contain 3 out of 4 of the following groups of characters:
Lowercase characters (a – z)
Uppercase characters (A – Z)
Numbers (0-9)
Symbols (~ ! @ # $ % ^ & * - _ + = [ ] { } | \ : ' , . ? / ` ~ " < > ( )
Also the password cann
In some cases klakaut traces should be collected for diagnostics.
Step-by-step guide
To do so:
Import klakaut-on_x*.reg file.
Restart klakaut service.
net stop klakaut
net start klakaut
Enable another trace if required.
Reproduce the issue.
Impor
To troubleshoot SNMP functionality in KSC specific traces should be collected.
Step-by-step guide
To collect traces:
Download archive
Use trace-5-snmpagt.reg to start trace
Reproduce the issue
Use trace-off-snmpagt.reg to stop trace
Archive files and send to Kaspersky Support.
Description and cautions
The article is giving some use cases examples of KSC API calls to ease one's start using the API. In that KB we are looking at host isolation with KES/KEA scenario.
For the Windows version of cURL, you need to specify that the arguments need to be escaped with "\", otherwise there will be an error. For example: 'Authorization: KSCBasic user=\"YXBpLXVzZXI=\", pass=\"cGFzc3dvcmQ=\", internal=\"1\"'
Details
Prerequisites
internal use
This article is about Kaspersky Security Center for Windows (KSC for Windows)
Problem:
KSC certificate renewal or replacement is made incorrectly because the option to instantly replace the server certificate is used.
There is an article in Online help dedicated to the klsetsrvcert utility (https://support.kaspersky.com/KSC/13.2/en-US/227838.htm). Sometime people follow the instructions according to the example indicated in the article – "klsetsrvcert -t C -i <inputfile&
The problem is in the certificate - it has a 1024 bit long key. While Web Console now works only with 2048 bit long keys.
The customer needs to reissue KSC server certificate to 2048 key length.
What to do -
1. Generate reserve KSC certificate - for example by using command -
klsetsrvcert -t CR -g "dns_name" -o "RsaKeyLen:2048"
where DNS name is DNS name of KSC
2. Wait several days - hosts will connect to KSC and receive reserve cert.
The customer could check on c
Issue
An attempt to send POST request via KPSN API from a Windows client.:
curl --cert C:\\Users\\user_A\\Desktop\\kpsn_api
kpsn_api_crt.pem --key C:\\Users\\user_A\\Desktop\\kpsn_api
kpsn_api_key.pem -k -X POST -d "{\\"action
": \\"check_url\\",\\"data
": {\\"urls
": [\\"website1.com
"]}}" https://10.90.116.27:80/api/
Fails with the following error:
curl: (58) schannel: Failed to import cert file C:\\Users\\user_A\\Desktop\\kpsn_api
kpsn_api_crt.pem, last error is 0x80092002
Th
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Problem
You change the account of the administration server service via the klsrvswch tool. Note that this is the only way to change the account, manual modification (for example, via services.msc) is not supported.
Then, the you run the Install required updates and fix vulnerabilities task.
As a result, the task is cancelled and updates are not installed.
Diagnostics
The following
In NAgent 15, klmover was updated and now requires NAgent uninstallation password, if it is set in NAgent's policy. Right now the password can't be passed to klmover as an argument, but it can be supplied via echo:
echo <password>|klmover -address <administration server ip>
Because cmd doesn't parse quotes and spaces in echo properly, if klmover is star
Scenario
After the deployment of KSC in the environment, the Backup task fails with the following error using the KSC Backup task or klbackup utility (screenshot is below).
All the permissions were correctly assigned on the shared folder, and ports were opened, but still the backup was failing. There were no blocking events in the Firewall traffic logs.
Error -1963 ('Database connection is broken " 'Connection failure{08S01};' LastStataement='select type from sys.system_object whe
Problem Description, Symptoms & Impact
The installation of the Network Agent isn't possible on a device because of the error System error 0x1F (A device attached to the system is not functioning.)
Diagnostics
In the MSI Log and Application Eventlog can be found the following line:
(1192/0x0 ("System container 'LOC-PUB-6EEB50F8D2EB46029DB4CCB77E0DA651' is corrupt")
Workaround & Solution
The issue comes from a corrupt cryptostorage in the OS. It's not a KL rel
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Product: Any KSC version
Problem Description, Symptoms & Impact
Network Agent local installation errors: "Setup Wizard cannot process the command line", "Setup wizard cannot process the internal error."
Diagnostics
Error can be found on the screenshots or in the installation log.
Workaro
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Product: KSC 11 and more recent versions
Consider the following problematic scenario:
You use a caching proxy server to download updates for the KSC Server, for example, Squid. KSC is configured to download updates via https (default config).
$up2date-1103-eka.log analysis
KL uses the HTT
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Product: KSC 11+
Applies also to the update utility version 4.1 and more recent.
Consider the following problematic scenarios:
You have installed KSWS on the KSC server and enabled Traffic Security component and Traffic Security uses MITM mechanism to analyze traffic.
You use a 3rd party sof
Description and cautions
You may experience low time to live value set in ICMP network packets sent by klnagents.
The following can be seen in wire shark traffic dump:
Explanation:
There are two modes of distribution point search:
0 - search of the nearest DP using a tool similar to traceroute. It generates a number of ICMP packets to find out the neatest route to DP - this is the default mode.
1 - selection of random DP without sending such amount of ICMP p
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Consider the following scenario:
You have a large local area network 10.36.0.0/16. There is a managed device with the following IP config: IPv4 address: 10.36.35.10 and Subnet Mask: 255.255.255.0. You create a new subnet condition for klnagent connection profile: 10.36.0.0/16.
Actual result:
The connection profile is not applied to the managed device.
The reason of this behavior is equali
The best practice is to back up your current Administration Server and then install the new version of Kaspersky Security Center.
To do so, follow these steps:
Back up the data of Kaspersky Security Center using one of the methods described below:
Backup and Restore Wizard
Backup task
Check if you can install Kaspersky Security Center on your current server. For system requirements, see Online Help.
Then export the list of currently inst
Description and cautions
That article is describing KSC rel. 13.2 to rel. 14.x SW upgrade procedure.
Prerequisites
KSC 13.2 on MS Windows
S/N
Action
Online-Help
1
Download the KSC 14 Version
2
Take the backup of KSC Administration
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
The article is giving a working configuration instructions for domain authentication by using NTLM and Kerberos protocols.
NOTE: Domain authentication in OpenAPI over Kerberos protocol has the following restrictions:
Administration Server address must be specified exactly as the address for which the Service Principal Name (SPN) is registered for domain account name.
In the domain, yo
Description and cautions
The article shares working examples of using KSC API calls for one of the available scenarios - retrieving tasks results and statistics data for Dashboards and Reports.
For the Windows version of cURL, you need to specify that the arguments need to be escaped with "\", otherwise there will be an error. For example: 'Authorization: KSCBasic user=\"YXBpLXVzZXI=\", pass=\"cGFzc3dvcmQ=\", internal=\"1\"'
Details
Prerequisites
internal
Description and cautions
The article shares working examples of using KSC API calls for one of the available scenarios - publishing KSC virtual server Administration Agent package.
For the Windows version of cURL, you need to specify that the arguments need to be escaped with "\", otherwise there will be an error. For example: 'Authorization: KSCBasic user=\"YXBpLXVzZXI=\", pass=\"cGFzc3dvcmQ=\", internal=\"1\"'
Details
Prerequisites
Make sure
