Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
Version: KES 11.*
Scenario:
You're unable to boot into encrypted machine after FDE applied due to some problems with preboot agent or operating system.
The the safest and one of the most trivial options to restore the data from encrypted hdd or decrypt it 'in place' is going through KES related ‘challenge-response’ procedure using another (i.e. proxy) machine with KES and FDE installed.
Issue
Sometimes Device Control errors in KES may occur. For example, hard drives are wrongly blocked when USB device blocking is enabled, or flash drive blocking is not happening although the policies require to do so.
In some cases, the reason for erroneous blocking is that the operating system (OS) is incorrectly identifying the device type.
Solution
As an example, if the policies prohibit access to flash drives, but this rule does not always work, you can check the followi
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
This article is about Kaspersky Endpoint Security for Windows (KES for Windows)
In cases when Bitlocker encryption of a certain volume is started using KES Bitlocker management, and the product returns the following error:
Event type: The policy can not be applied.
Action: Encryption
Reason: The system drive is not compatible with the Microsoft BitLocker encryption.
Type of encryption: dis
Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.
What is the role of Kaspersky in BitLocker encryption process ?
Basically, KES BitLocker management is a COM object that is registered in the system and changes the BitLocker component settings in accordance to the settings that are specified in the KES policy. Afterwards it stores the recovery data received from BitLocker component on the KSC side. Also, it provides error-reporting and verifies that th
Problem
Application category based on the "Metadata" conditions created, but does not work.
Solution
This is expected behavior, in case the file does not have a digital signature, that can be trusted by local KES on the host in question, or is not known in KSN. Use sigcheck tool to see if the file has a valid digital signature – https://technet.microsoft.com/ru-ru/sysinternals/bb897441.aspx
Use other criteria, to determine the category (for example file hash).
Problem
Sometimes Anti-Cryptor task in KESL won't be able to launch after the OS is started. This may happen because Anti-Cryptor needs all the protected network resources to be up before KESL service is started. In other words, Samba or NFS services should be started before KESL service.
Solution
To resolve this problem you need to make sure that services start in the correct order.
For Systemd systems:
1. Create a file /etc/systemd/system/kesl.service.d/override.conf
In KSWS/KESS/KICS there is an option in update task to Lower the load on the disk I/O.
It is important to understand that when this option is enabled the task does not use HDD resources at all. Updater will not only place current updates to RAM. Update temp and cache files will also be placed there.
Incorrect expectation: The task uses dedicated amount of RAM, in case if dedicated RAM is not enough for all update files including temp and cache task will continues through HDD.
Actu
In KSWS/KESS/KICS there is an option in update task to Lower the load on the disk I/O.
It is important to understand that when this option is enabled the task does not use HDD resources at all. Updater will not only place current updates to RAM. Update temp and cache files will also be placed there.
Incorrect expectation: The task uses dedicated amount of RAM, in case if dedicated RAM is not enough for all update files including temp and cache task will continues through HDD.
Actu
Problem
In some cases KESMac is not able to start protection components:
Or, the status "Allow encrypted traffic to be inspected" is not changing:
Solution
1) Please get acquainted with the article https://support.kaspersky.com/kis20mac/error/15031#block1;
2) If the article above did not help, try to remove the FireFox user's profiles directory via Terminal:
rm -rf ~/Library/Application
