Jump to content
Kaspersky Support Forum

About this blog

Entries in this blog

Known Problem

Encrypted machine is unable to boot into Windows after FDE [KES for Windows]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Version: KES 11.* Scenario: You're unable to boot into encrypted machine after FDE applied due to some problems with preboot agent or operating system.  The the safest and one of the most trivial options to restore the data from encrypted hdd or decrypt it 'in place' is going through KES related ‘challenge-response’ procedure using another (i.e. proxy) machine with KES and FDE installed.
svc_kms

svc_kms in Known Problem

0
Known Problem

Error 27310. Failed to install the directory file for the digital signature [KES for Windows]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. This article is about Kaspersky Endpoint Security for Windows (KES for Windows) Version: any KES11.* on any OS Scenario: The following error appears during the installation: Error 27310. Failed to install the directory file for the digital signature  Solution: 1. Run kavremover utility as administrator. 2. Delete KES drivers (if they were not deleted by kavremover) located
svc_kms

svc_kms in Known Problem

0
How-to

How to trace when KES doesn't detect malware files in Outlook [KES for Windows]

Step-by-step guide Open Outlook. Go to File → Options → Add-ins. Check add-in options for the KES plugin. Make sure that scan on receive and scan on send are enabled. If problem persists, enable KES tracing. Restart Outlook. Send e-mail with infected .doc file. Send another e-mail with EICAR. Stop traces and send them to the Kaspersky support for further analysis.
svc_kms

svc_kms in How-to

0
Known Problem

Why doesn't KES work in Safe Mode? [KES for Windows]

This behavior is expected. We have no control over a system booting in Safe mode, because Safe mode is a special boot mode for OS diagnostics and repair. It is not possible to enable KES booting when Safe mode is running. However, booting in Safe mode can be disabled using GPOs or the local registry. It can be done by a local administrator. One of the ways to disable Safe Mode is described here.
svc_kms

svc_kms in Known Problem

0
Known Problem

BitLocker management [KES for Windows]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. What is the role of Kaspersky in BitLocker encryption process ? Basically, KES BitLocker management is a COM object that is registered in the system and changes the BitLocker component settings in accordance to the settings that are specified in the KES policy. Afterwards it stores the recovery data received from BitLocker component on the KSC side. Also, it provides error-reporting and verifies that th
svc_kms

svc_kms in Known Problem

0
Known Problem

Why are not all browser extensions blocked by Application Control? [KES for Windows]

The Application Control component has a category called Browser extensions. There is a known limitation for it in Chrome. If an extension runs in an already running Chrome process (many of them run as newly started Chrome processes, especially for extension reasons), it cannot be blocked because it is not a newly started process and the extension itself is not an executable. It requires an .exe file to load. An extension that is already running cannot be blocked by application control (it h
svc_kms

svc_kms in Known Problem

0
Known Problem

SSH certificate import error during the "Install application remotely" task in KSC [KES for Linux]

Problem The "Install application remotely" task wizard presents an option to specify an SSH certificate as account credentials, if Linux package is selected for installation.  The wizard does not accept certain certificates and fails to provide informative error messages why this happens. Examples: Failed to upload the certificate. Failed to import the private key of the certificate. Root cause KSC 13.2 only accepts PEM certificates, they start with
svc_kms

svc_kms in Known Problem

0
Known Problem

Error: Please go to the Control Panel to install and configure system components [Kaspersky Security for Windows Server]

Product version/Environment KSWS 10.1/11.X Windows Server Requirements for the server on which Kaspersky Security for Windows Server is deployed Description of Error Run installation of the application or the console with the setup file. Error "Please go to the Control Panel to install and configure system components" pops up and installation doesn't run. Solution Unpack the installation file and run the .msi file inside instead of the setup:
svc_kms

svc_kms in Known Problem

0
Known Problem

KES public and product line versions chart [KES for Windows]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Same info can be found here: https://support.kaspersky.com/16010 Starting from version 11.5, some file versions, registry and file system paths may differ from the release version and refer to the product line version. Release full build version Product line version GUID 1
svc_kms

svc_kms in Known Problem

0
Known Problem

Anti-Cryptor doesn't start on OS boot [KES for Linux]

Problem Sometimes Anti-Cryptor task in KESL won't be able to launch after the OS is started. This may happen because Anti-Cryptor needs all the protected network resources to be up before KESL service is started. In other words, Samba or NFS services should be started before KESL service.  Solution To resolve this problem you need to make sure that services start in the correct order. For Systemd systems: 1. Create a file /etc/systemd/system/kesl.service.d/override.conf
svc_kms

svc_kms in Known Problem

0
Known Problem

Linux programs remote execution using "Install application remotely" task in KSC [KES for Linux]

This only applies to KSC 14.2 and below Problem Remote installation tasks finishes with uninformative errors: Setup process error: Unknown error. (126) Setup process error: Unknown error. (2) Solution 1. Create 3rd party installation package (Create installation package -> Create an installation package for the specified executable file.) 2. Specify executable file, for example script.sh 3. Locate this package folder in KSC storage, by default %ProgramD
svc_kms

svc_kms in Known Problem

0
Known Problem

Info about KES in registry [KES for Windows]

How to check if KES is installed, its state (running or not) and bases version via registry: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\Components\34\1103\1.0.0.0\Statistics\AVState   More information about these registry keys is available in Online Help: https://support.kaspersky.com/ksc14/3644. Obtaining information from the registry is for familiarization purposes only. KESCLI commands method supported by developers: Managing the application from the command
svc_kms

svc_kms in Known Problem

0
Known Problem

Device Control errors [KES for Windows]

Issue Sometimes Device Control errors in KES may occur. For example, hard drives are wrongly blocked when USB device blocking is enabled, or flash drive blocking is not happening although the policies require to do so. In some cases, the reason for erroneous blocking is that the operating system (OS) is incorrectly identifying the device type. Solution As an example, if the policies prohibit access to flash drives, but this rule does not always work, you can check the followi
svc_kms

svc_kms in Known Problem

0
How-to

How to check Adaptive Anomaly Control (AAC) [KES for Windows]

To check Block action: Specify Block actions for all rules in the group Activity of script engines and frameworks.  Extract files from the archive and start the scripts.  All scripts should be blocked, popup about it should be shown. There will be new records about blockings in the local report, events and AAC report in KSC console.    To check Smart action: Host where KES is installed is under the policy applied. Specify Smart mode for all rules in the group Activi
svc_kms

svc_kms in How-to

0
How-to

How to store MS BitLocker recovery keys in Active Directory [KES for Windows]

If you want to store FDE encryption keys in Active Directory, this is possible if BitLocker encryption is used.  In order to transfer and store the recovery passwords (keys) in Active Directory, it is necessary to: 1. Enable the “Choose how BitLocker-protected operating system drives can be recovered” group policy https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#bkmk-rec1 for target computers and configure saving BitLoc
svc_kms

svc_kms in How-to

0
Known Problem

OS hangs caused by excessive use of file descriptors [KES for Linux]

Symptoms OS hang, sometimes with open file errors in journals Customer application degrades with errors "unable to open file", "too many open files" Hangs and third-party (compatibility) issues often require advanced data collection and are sophisticated to investigate. However, a quick check is possible: On a system where KESL has worked for some time (not immediately after reboot/restart), validate the output of the following command, ran as root, for numerous records of /u
Stan Shpatar

Stan Shpatar in Known Problem

0
Known Problem

File Threat Protection does not start due to driver interceptor error [KES for Linux]

Problem kesl-control --app-info outputs the following error: en File Threat Protection:                     Unavailable due to file interceptor driver error One of the most common root causes is Fanotify is disabled (or KESL could not access it) and kernel module compilation also failed. A special utility can  be used for this directly on the affected mac
svc_kms

svc_kms in Known Problem

0
How-to

How to add domain\site name in exclusions of KSWS Traffic Security component [Kaspersky Security for Windows Server]

Sometimes you may need to add a particular site\domain to an exclusions list of Traffic Security. Unfortunately, at current moment KSWS console allows us to make exclusions ONLY for Ports, IP-addresses, and Processes:     But we have ability to make site and domain exclusions for Traffic Security via registry workaround. To implement workaround, we need to create and fill following REG_MULTI_SZ key: [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\WSEE\11.0\Env
svc_kms

svc_kms in How-to

0
How-to

How to let KS4Android update from the KUU [Kaspersky Security for Mobile]

Problem KSC and KS4Android are implemented but KSC is offline and could not access Internet. KUU can be used for updating KS for Android and distribute the update databases. But after running KUU (Kaspersky Update Utility), you cannot find actual KES for Android versions.  Solution AV bases for new KESM versions will appear in KUU UI after running KUU with empty application list.  The KUU settings should look like the following (in order to update the list of supported applic
svc_kms

svc_kms in How-to

0
How-to

How to generate an installation package [KES for Mac]

Intro This instruction describes how to create an installation package (.pkg) for the MacOS operating system from the standalone installation package of Kaspersky Endpoint Security for Mac. You may need to create such a package to automate the installation of Kaspersky Endpoint Security software via third-party systems (e.g. AirWatch). Details Files Munki tool (with predefined files) Prerequisites Kaspersky Security Center MacOS machine Python 
svc_kms

svc_kms in How-to

0
Known Problem

Error 27211. Failed to enable Self-Defense [KES for Windows]

Problem Description While installing KES for Windows via KSC installation package the following error appears and interferes with installation. Possible causes: KES components installed already before installation. Required driver files were not found. Workaround & Solution Use kavremover and reinstall KES with the latest patch. In case kavremover will not help, please collect procmon and KES installation logs, actual GSI with e
svc_kms

svc_kms in Known Problem

0
Known Problem

VMWare guest BSODs with a driver related stop code after installing or updating KES [KES for Windows]

Description VMWare guest using Kaspersky products hanging or crashing due to driver conflicts between drivers used by VMWare NSX (vnetWFP.sys, previously vnetflt.sys) and Network Threat Protection component. This problem is known to happen with following versions of KES and VMware Tools: KES 11.6 with VMWare Tools 10.0.9 KES 11.6 and 11.7 with VMWare Tools 11.3.5 KES 12 with VMWare Tools 10.1.7 Troubleshooting steps Update VMWare Tools Somet
svc_kms

svc_kms in Known Problem

0
How-to

How to find where the encryption/decryption keys are stored for FLE [KES for Windows]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. This article is about Kaspersky Endpoint Security for Windows (KES for Windows)   The complete encryption procedure is as follows: 1. During authentication, a private key is generated based on the username and password 2. The private key is used to decrypt the user’s storage and extract the primary key 3. The primary key is checked against the identifier specified in the file hea
svc_kms

svc_kms in How-to

0


×
×
  • Create New...