Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Scenario:
When login to KSC Web Console, it shows the following error:
Administration Server uses an untrusted self-signed certificate. Please modify the application configuration by specifying a valid certificate for Administration Server.
Alternative wording (for older KSC versions):
Administration Server has untrusted self signed certificate. Please, reconfigure the application with corre
Windows
Unpack the archive (add_category.rar) on any device that has access to the Administration Console port of the Administration Server.
Create a text file with needed hashes, by default the script expects it to be sha256.txt in script's working directory.
Edit add_category.cmd with specified KSC username, password, server address, name of the text file with hashes (file should be saved in UTF-8 encoding)
If a category with the specified name already exists, it k
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Dynamic hosts require more KSC resources than regular hosts.
When a new host is connected to KSC (and the dynamic host is considered new), an icon and a new entry in the database are created, full synchronization with the agent is performed, and the host moved to a group. When the host is deleted, all information about it is deleted as well.
These operations consume a lot of KSC resources, while static
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
If two different update agents on a PC are assigned in different ways:
To an administration group.
Based on a network location.
Which one will have a higher priority for the PC?
Among the update agents assigned to administration groups, the one assigned to the administration group, that is closest to the target host in the group hierarchy, has the higher priority. If the upd
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
When troubleshooting typical KSC issues, you will likely need to check the availability of TCP port 13000 on the KSC Server. Both telnet and akconnect tools can be used to achieve this. Syntax is very simple:
akconnect host port
Examples:
akconnect.exe 192.168.1.19 13000 >akconnectoutput.txt
telnet 192.168.1.19 13000 >telnetoutput.txt
Where 192.168.1.19 is the IP address or DN
Description
If you need to know the name of the standard KSC service account (KL-AK...) that has been created during installation, it is stored in the registry key.
This information can be viewed in the registry, using the following paths:
for 64-bit systems:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\1093\1.0.0.0
for 32-bit systems:
HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\1093\1.0.0.0
this key is called AutoCreatedS
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
This is a small guide about Chrome Developer tools for collecting logs.
1. Open the Chrome menu and select More tools → Developer tools or press Ctrl+Shift+I.
2. Temporarily ignore the opened sidebar and open KSC Web Console.
3. Sign in using correct credentials. Wait until the page loads. If the loading of the page takes too long, wait a minute before moving on to the
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
These errors appear when the remote installation task of NAgent or KES with NAgent was created with the Assign package installation in Active Directory group policies option selected.
At the first startup they start under the account specified in the New Task Wizard. If that user has access for creating domain policies and groups, the task will be completed successfully, and "GPO" and "Security Group" w
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
KSC13 introduced a feature that limits the frequent publication of events. In the event that the event storage overflows on the Server, the most common event in the storage is calculated, and such events are blocked when published on hosts.
Problem:
Machines have status "Virus scan wasn't performed for a long time" but the "Virus scan" task was started recently.
Events that oc
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Which task is responsible for downloading third party Application updates?
Updates metadata is downloaded by Download Updates to the repository task. Updates themselves are downloaded by Install updates and fix Vulnerability task.
What is a source folder containing the third party application updates on the administration server?
3rd party updates are downloaded into the folder C:\ProgramData\Kasper
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Problem Description
Error "Error 1181/0x91 ('System error 0x91 (The directory is not empty.)') occured while deleting directory 'C:\ProgramData\KasperskyLab\adminkit\1103''" when installing Network Agent.
The error can be found on a screenshot.
How To Fix
Make sure that the folder ‘C:\ProgramData\KasperskyLab\adminkit\1103’ actually exists.
If you can navigate to this fo
Description and cautions
That article is describing a specific scenario: HA Cluster KSC with 4 CGWs between two different and geographical isolation DC (Data Center).
High level procedure:
KLAdmins group: ksc, rightless / gmsa-ksc-server, gmsa-ksc-nwc; $KSC-NODE-1, $KSC-NODE-2, $SQL-SRV / sql / gmsa-sql-server
SMB shares: data, state, sc_backup, kl-share |
SMB Permissions NTFS ACL - - Full Control for KLAdmins
Created MS SQL Database - KLFOC | Grand Access
NOTE: KSC CC is a cloud solution and its IP can be changed.
Run klnagchk utility on connected to target workspace host.
Find KSC CC server address in klnagchk output. It should looks like eXXX.ksc.kaspersky.com.
Use nslookup utility to find the IP address of this server.
Description and cautions
The article shares working example of using KSC API calls for one of the available scenarios - retrieving events, HW and/or SW inventory data.
For the Windows version of cURL, you need to specify that the arguments need to be escaped with "\", otherwise there will be an error. For example: 'Authorization: KSCBasic user=\"YXBpLXVzZXI=\", pass=\"cGFzc3dvcmQ=\", internal=\"1\"'
Details
Prerequisites
internal user: api-user
Exa
Description and cautions
The article shares working examples of using KSC API calls for one of the available scenarios - publishing KSC virtual server Administration Agent package.
For the Windows version of cURL, you need to specify that the arguments need to be escaped with "\", otherwise there will be an error. For example: 'Authorization: KSCBasic user=\"YXBpLXVzZXI=\", pass=\"cGFzc3dvcmQ=\", internal=\"1\"'
Details
Prerequisites
Make sure
Description and cautions
The article shares working examples of using KSC API calls for one of the available scenarios - retrieving tasks results and statistics data for Dashboards and Reports.
For the Windows version of cURL, you need to specify that the arguments need to be escaped with "\", otherwise there will be an error. For example: 'Authorization: KSCBasic user=\"YXBpLXVzZXI=\", pass=\"cGFzc3dvcmQ=\", internal=\"1\"'
Details
Prerequisites
internal
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
The article is giving a working configuration instructions for domain authentication by using NTLM and Kerberos protocols.
NOTE: Domain authentication in OpenAPI over Kerberos protocol has the following restrictions:
Administration Server address must be specified exactly as the address for which the Service Principal Name (SPN) is registered for domain account name.
In the domain, yo
Description and cautions
That article is describing KSC rel. 13.2 to rel. 14.x SW upgrade procedure.
Prerequisites
KSC 13.2 on MS Windows
S/N
Action
Online-Help
1
Download the KSC 14 Version
2
Take the backup of KSC Administration
The best practice is to back up your current Administration Server and then install the new version of Kaspersky Security Center.
To do so, follow these steps:
Back up the data of Kaspersky Security Center using one of the methods described below:
Backup and Restore Wizard
Backup task
Check if you can install Kaspersky Security Center on your current server. For system requirements, see Online Help.
Then export the list of currently inst
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Consider the following scenario:
You have a large local area network 10.36.0.0/16. There is a managed device with the following IP config: IPv4 address: 10.36.35.10 and Subnet Mask: 255.255.255.0. You create a new subnet condition for klnagent connection profile: 10.36.0.0/16.
Actual result:
The connection profile is not applied to the managed device.
The reason of this behavior is equali
Description and cautions
You may experience low time to live value set in ICMP network packets sent by klnagents.
The following can be seen in wire shark traffic dump:
Explanation:
There are two modes of distribution point search:
0 - search of the nearest DP using a tool similar to traceroute. It generates a number of ICMP packets to find out the neatest route to DP - this is the default mode.
1 - selection of random DP without sending such amount of ICMP p
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Product: KSC 11+
Applies also to the update utility version 4.1 and more recent.
Consider the following problematic scenarios:
You have installed KSWS on the KSC server and enabled Traffic Security component and Traffic Security uses MITM mechanism to analyze traffic.
You use a 3rd party sof
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Product: KSC 11 and more recent versions
Consider the following problematic scenario:
You use a caching proxy server to download updates for the KSC Server, for example, Squid. KSC is configured to download updates via https (default config).
$up2date-1103-eka.log analysis
KL uses the HTT
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Product: Any KSC version
Problem Description, Symptoms & Impact
Network Agent local installation errors: "Setup Wizard cannot process the command line", "Setup wizard cannot process the internal error."
Diagnostics
Error can be found on the screenshots or in the installation log.
Workaro
Problem Description, Symptoms & Impact
The installation of the Network Agent isn't possible on a device because of the error System error 0x1F (A device attached to the system is not functioning.)
Diagnostics
In the MSI Log and Application Eventlog can be found the following line:
(1192/0x0 ("System container 'LOC-PUB-6EEB50F8D2EB46029DB4CCB77E0DA651' is corrupt")
Workaround & Solution
The issue comes from a corrupt cryptostorage in the OS. It's not a KL rel
