If you encounter an 'Incorrect format' error while saving an Application Control rule in the KES Cloud console, follow these steps to resolve it:

1. Temporarily replace all '+' symbols in the rule with a different character.
2. Save the rule.
3. Export the rules list to a JSON file.
4. Open the JSON file and manually change the placeholder symbols back to the correct path (using '+').
5. Import the modified JSON file back into the console.

This issue is scheduled to be fixed in the next KES Cloud release.

Scenario

1. Enable Network Threat Protection
2. Connect another Mac via a thunderbolt cable
3. Try to send any data from one computer to another
4. Connection times out

Workaround & Solution

Connect computers by other means or disable NTP when using Thunderbolt bridge.

RCA

This issue is caused by a bug in macOS' built-in packet filter and was reported to apple.

This article is about Kaspersky Endpoint Security for Windows (KES for Windows)

Outlook add-in failure may be related to a KES upgrade.

Step-by-step guide

As the first step to quickly fix majority of the issues with Outlook add-in, unregister it and register again. Here is how to do it properly:

1. Close Outlook if opened. 

2. Execute

   regsvr32 /u <product_folder>/mcou.dll regsvr32 /u <product_folder>/x64/mcou.dll

3. Delete all keys like HKLM\SOFTWARE\(Wow6432Node)\Microsoft\Office\Outlook\Addins\OutlookKLAvPlg.Addin*

4. Execute 

   regsvr32 <product_folder>/mcou.dll regsvr32 <product_folder>/x64/mcou.dll

5. Open MS Outlook, go to 

   File\ Options\ Add-ins\ field "Manage:", value "COM Add-ins", press button "Go..."\ window "COM Add-ins"

   Make sure the Kaspersky Outlook Anti-Virus Addin checkbox is selected.

Problem

KSWS10 and KSWS11 may have two issues because of the Application Control component:

1. Can't uninstall KSWS with the error "There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run"
   
2. Can't run GSI with this error "Unable to unpack the critical file. GsiSharp.bin"
   

Solution

Disable Application Control and retry uninstallation.

Сollect GSI, if necessary. 

Local installation from a standalone package fails

Diagnostics

Check installation logs of the product. We are looking for the following string:

09.02.2022 17:06:19.453 00000374.000028B4 L1  KLSTD: #1, Error was caught in KLERR_throwError, c:\a\b\a_6vlf7p9h\s\csadminkit\development2\klri\pkginst\klpkinst.cpp@1061. Error params: (1187/0x0 ("Bad parameter "VerifyCertDate""), "KLSTD", c:\a\b\a_6vlf7p9h\s\csadminkit\development2\klri\pkginst\klpkinst.cpp@1061) Error loc: ''. 

This string means that a certificate in the package is out of date

Workaround & Solution

In order to fix the problem you should:

1. Log in to your KESCloud console
2. Change a language \ proxy settings of the existing installation package
3. Save changes
4. Return needed language \ proxy settings
5. Save changes
6. Download a new standalone package and install products

When USB connection bus is blocked on hosts with KES 12.4 and further, devices (adapters) USB-COM (or USB-Serial) are denied, too. In Windows Device Manager, the following message is displayed: "This device cannot start. (Code 10) {Access Denied}"

Such devices are not supported on KSC and cannot be added to Trusted.

Starting from KES 12.4, these devices are treated as USB devices, not Serial. Since USB bus is blocked, they are blocked as well.

As a workaround, instead of blocking all USB devices, use granular access control for specific devices instead.

In some cases, KESMac versions 11.2.1.145 and 11.3.0.320 may indicate the status "Some protection components are not running" on the macOS 15 Sequoia:

This can be a reason of disabled system extension the Kaspersky Endpoint Security Daemon. You need to re-enable it once again.

In order to fix this error:

1. Open System Settings and navigate to General → Login Items & Extensions;

2. Then find the Kaspersky Endpoint Security Daemon and Enable it:

In case this would not help, try restarting the application or the system;

If you see a new state "Allow encrypted traffic to be inspected":

Ensure you allowed its interception and all the other requirements:

Symptoms

OS hang, sometimes with open file errors in journals

Customer application degrades with errors "unable to open file", "too many open files"

Hangs and third-party (compatibility) issues often require advanced data collection and are sophisticated to investigate. However, a quick check is possible:

On a system where KESL has worked for some time (not immediately after reboot/restart), validate the output of the following command, ran as root, for numerous records of /usr/bin or /usr/sbin folders

lsof | grep -E 'kesl.+DIR.+\/usr\/s?bin'

Root Cause

Under heavy load, KESL may display linear increase in file descriptors usage (sysctl - fs.file-nr) up to system-wide limit (sysctl - fs.file-max) and eventually degradation.

Workaround

Schedule restart of KESL service every week/day, depending on intensity of descriptors growth.

NB: KESL restart will also reset progress of certain tasks like "malware scan" and "database update". Schedule KESL restart outside of tasks timeframes.

Solution

This issue was fixed in KESL 12.1.0.1274, so an update to that or newer version should fix it.

Description and cautions

The original scenario located on the page https://support.kaspersky.com/kes11mac/diagnostics/15299, requires a lot of efforts and manual manipulations.

I am offering a bit easier and time-saving approach doing the same.

Details

All the commands from the original document are saved here, but placed together and being run one after another consequently; the old product logs are also wiped up in order to avoid mess:

1. Login under root:

   sudo -i

2. Enable KESMac KLnagent tracing:

   rm -rf /Library/Logs/Kaspersky\ Lab/* /Library/Logs/klnagent_trace.log && launchctl unload /Library/LaunchDaemons/com.kaspersky.klnagent.plist && cat /Library/LaunchDaemons/com.kaspersky.klnagent.plist > /Library/LaunchDaemons/com.kaspersky.klnagent.plist.backup && chmod ugo+w /Library/LaunchDaemons/com.kaspersky.klnagent.plist && curl -o klnagent_enabled_traces.zip -J -L https://media.kaspersky.com/utilities/CorporateUtilities/klnagent_enabled_traces.zip && unzip klnagent_enabled_traces.zip && cat klnagent_enabled_traces.plist > /Library/LaunchDaemons/com.kaspersky.klnagent.plist && chmod ugo-w /Library/LaunchDaemons/com.kaspersky.klnagent.plist && launchctl load /Library/LaunchDaemons/com.kaspersky.klnagent.plist

   
   Now you can check the log is being written:

   ls -lh /Library/Logs/klnagent_trace.log

3. In case you need to enable KESMac tracing, refer to the specially dedicated article https://support.kaspersky.com/kes11mac/diagnostics/15041;
4. It is time to reproduce the issue;
5. When it is done, disable KESMac KLnagent tracing the same manner (ensure, you are still under root: sudo -i):

   launchctl unload /Library/LaunchDaemons/com.kaspersky.klnagent.plist && chmod ugo+w /Library/LaunchDaemons/com.kaspersky.klnagent.plist && cat /Library/LaunchDaemons/com.kaspersky.klnagent.plist.backup > /Library/LaunchDaemons/com.kaspersky.klnagent.plist && chmod ugo-w /Library/LaunchDaemons/com.kaspersky.klnagent.plist && launchctl load /Library/LaunchDaemons/com.kaspersky.klnagent.plist

6. Upon finish, gather the collect package (https://support.kaspersky.com/collect)

   curl -o collect.tar.gz -L "https://box.kaspersky.com/f/00a1a6d8beb24554a72d/?dl=1" && tar -zxvf collect.tar.gz && chmod +x collect.sh && sudo ./collect.sh

Please, follow the instructions below in order to create remote installation package for KES 12.5 patch (and probably newer versions):

1. Download the patch provided by our technical support.

2. Unpack the patch into a separate folder.

3. Make sure that the folder contains the patch file (.msp) and digital signature file (.kcat).

2. In KSC navigate to Advanced > Remote installation > Installation packages.

3. Click Create installation package.

4. Select option Create an installation package for the specified executable file.

5. Give name to the installation package, it's recommended to include name of the application and name the .msp file, for example: KES12.5_pf17006.

6. On the next step Selecting the distribution package for installation do the following:

- Click Browse and select the .msp file of the patch.

- In the field Executable file command line (optional) enter.

EULA=1 PRIVACYPOLICY=1 /qn

- Check the box Copy entire folder to the installation package (important!).

The result should look like this:

7. Finish creation of the installation package

8. Right-click the created package, select Install application, and follow the steps of the wizard

In cases when you need to diagnose an intermittent network issue, or capture an event that occurs only once in a while, you may need to use ring-buffer mode in Wireshark. In this mode, the number and overall size of the capture files will be fixed and when the limit will be reached, the newest data will start continuously overwrite the oldest data in the capture buffer.

Below, you will find instructions for how to configure this capture mode:

1. Download and install Wireshark from the official website, if you have not done that already.
2. Launch Wireshark and click Capture options.
   
    
3. On the Input tab, uncheck option Enable promiscuous mode on all interfaces and select interfaces from which you want to capture traffic. If you are not sure which ones to select, look at the graphs in the Traffic column to determine which interfaces are active and select all of them. If you are completely lost, you can also select all interfaces.
   
    
4. On the Output tab you configure where the resulting files will be saved, the ring buffer capture is also configured here. It's a good idea to create a separate folder to store the capture files.
   
   The screenshot below shows optimal configuration for the capture settings.
   
   
   Note that the space occupied by the capture files will be equal to the size of a single capture file multiplied by the number of files in the ring buffer. In our example it's 500 MB * 8 = 4000 MB, which is the optimal size to upload to Company Account portal. You can modify these parameters to allocate more or less space for the capture files, though we don't recommend making it less than 2 GB.
   
   Use of compression is optional. With it, more data can be stored within the same file size, but it also can increase load on the CPU. Disable this option in case of performance problems.
    
5. When everything is configured, click Start to start the capture.
   
   Please, pay attention that when capturing traffic in the ring buffer mode, it's very important to monitor for the occurrence of the event that you need to record and disable capture as soon as possible after the event has occurred, otherwise the relevant part of the capture may be overwritten. The timing is especially important, when using smaller sizes of the buffer.
    
6. When the capture is finished, click Stop capturing packets, then Close this capture file.
   
    
7. Pack the resulting files into an archive and upload it to your Company Account.
   

• Download Apple configurator via App Store.

• Run Apple Configurator.

• Connect your iOS device.
• Unlock the device and tap Trust.
• Select your device and click on the Prepare button

• Select 'Manual Configuration'. Check 'Supervise devices' and 'Allow devices to pair with other computers' (if you want to allow it). Click on the Next button.

• Leave it on "Do not enroll in MDM" and click on the Next button

• Click on the Skip button

• Enter information about your organization (only 'Name' filed is mandatory'). Click on the Next button.

• Select 'Generate a new supervision identity'. Click on the Next button.

• In the next window you should choose which steps will be presented to the user in Setup Assistant. You can choose 'Show all steps', 'Do not show any of these steps' and 'Show only some' steps - in this options you must select the steps. Click on Prepare button.

• Enter password for your macOS account
• Click on Erase button. Your device will be reset to factory settings.

• Wait while your device will be prepared 

• When your device will be turned on, you should see that your device is supervised and managed by your organization in device settings

Now you can install iOS MDM profile to this device and apply iOS MDM policy with options for supervised devices.

Problem Description, Symptoms & Impact

KES File Threat Protection sometimes can't check Microsoft office documents from mounted Google Drive shares, therefore generating Processing error events. This issue is caused by an incompatibility between Google Drive VFS driver and KES. There are no plans on making KES compatible with Google Drive.

Workaround & Solution

As a workaround, add files with Office extensions stored on the share to exclusions, this shouldn't lower protection, because Office creates a temporary copy of a document when it is opened, which will not be in the exclusion scope and will still be checked. Example for .xlsx files: Path\to\google\drive\folder\*.xlsx, where Path\to\google\drive\folder is replaced with an actual path.

This article might be useful in the following cases:

• If you want to configure multi-vendor security on endpoints, keeping both Kaspersky and Microsoft technologies;
• If you don't know how to properly configure a Microsoft solution after installing KES;
• If you're having some issues with the product and the OS after configuring KES and Defender.

The differences between the Defender products

There are three different products:

• Windows Defender: an anti-malware solution for Windows 8, 8.1 and Server systems based on it. For details, see here.
• Microsoft Defender Antivirus: an anti-malware solution for Windows 10, 11 and Server systems based on it. For details, see here.
• Defender for Endpoint: an EDR solution for Windows 10, 11 that might be used together with Microsoft Defender Antivirus or a third-party solution (from the Microsoft point of view, of course). For details, see here.

KES installation specifics

During the installation of KES, the Defender solution status is verified and disabled automatically. After that, KES notifies the operating system about a new AV and FW feature (if the KES Firewall component is going to be installed).

Please note that even if Defender is replaced with the AV in the system, the Defender service might still run, and this is an expected behavior. There is no need to disable this service explicitly, and it also might be harmful in certain scenarios. For example, if Defender is disabled by GPO, it may result in the KES installation failure since the installer might not be able to get access to the desired setting.

Configuring systems to use both KES and Defender solutions

Here you can find the article with the details on how to configure a Microsoft solution to properly coexist with third-party AV vendors (and KES is a third-party from the Microsoft point of view). No special actions should be taken from the KES side, at least at this moment. The information will be updated in case of finding any issues.

Repairing KES registration in WSC

KES registration within Windows Security Center might be affected. For example, when WMI repository getting corrupted, Windows is just restoring it back to defaults. In such cases KES and Defender might be both actively scan files and cause performance issues. The workaround to restore KES registration is:

1. Disable KES Self-defense
2. Open registry key Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\protected\KES\Data
3. Find value "IsRegisteredInSecurityCenter" and set it to zero.
4. Restart KES service or the whole host.

Unfortunately, there is no possibility to restore KES registration by using some WMI scripts because they're breaking product integration and does not allow to update product statuses in a way the product does.

There are multiple settings in both KES and KSC that allow to set notifications about various events. This article is based on example of setting complaint notification (message send to administrator if the users considers the blocking of the page to be mistaken).

Let's review three main scenarios, when KES is connected to KSC (either constantly or intermittently) and when it is not connected.

KES is always connected to KSC

How to set

To set address for email notifications go to Administration Server properties -> Notification delivery settings -> Notification and input email into Recipients filed.

To enable email notifications do the following

1. Open KES policy
2. Navigate to KES policy -> Event notification -> Warning -> Web page access blockage message to administrator
3. Press Properties
4. Mark Notify by email checkbox

What to expect

Once the user will fill the form (way to change default complaint message will be covered later in this article) and press Send, Network agent will send event to KSC. Once KSC will receive it, email notification will be send to administrator. The default email will look like this:

%EVENT%, %COMPUTER%, %DOMAIN%, %RISE_TIME% are self explanatory, while %DESCR% may rise some questions. This part will be substituted the whole message that the user put in to the complaint form. 

KES in not connected to KSC

How to set

1. Open KES GUI
2. Navigate to Settings -> Endpoint control -> Web Control and press Templates
3. Switch to Message to administrator tab
4. Input address for notifications into To field
5. Change Subject of the email and notification text if required.
6. Open General Settings -> Interface -> Notifications Settings configure SMTP client connection settings in "Email notification settings" menu of Notifications.

What to expect

Once the user will fill the form (way to change default complaint message will be covered later in this article) and press Send, KES will send email to specified address. It will contain everything user put into the form.

KES is connected to KSC from time to time

How to set

1. Follow the steps described in KES is always connected to KSC section. This will set KES for the time it has connection to KSC
2. Do the same as described in KES is not connected to KSC with only difference – make changes to policy not KES local settings. This will set KES for the time when it is not connected to KSC:
   1. Open KES policy
   2. Navigate to Endpoint control -> Web Control and press Templates
   3. Set email address that will receive notifications when KES is not connected to KSC
   4. Change Subject of the email and notification text if required.

What to expect

When KES has connection to KSC you will receive message from KSC described in KES is always connected to KSC section. When KES has no connection to KSC you will receive email from KES described in KES is not connected to KSC section. The same goes for cases when out-of-policy is used.

How it works

As noted earlier, when you manage KES using Kaspersky Security Center you can specify two methods of email notification delivery, both of them could be configured in KES policy.

KSC settings

Open KES policy properties navigate to “Event configuration”, select event that you are interested in, mark “Notify by email”

In this case, network agent transport will be used to deliver notification to KSC, then KSC will send an email to specified recipients. 

If you tracing KES activity, specialized information will be recorded in KES.version.date.time.PID.connector.log and KES.version.date.time.PID.SRV.log for each event sent by Nagent transport.

KES settings

Open KES policy, General Settings -> Interface -> Notifications Settings, leave tick marks in column "Notify by email" next to events that you are interested.

Also you will have to configure SMTP client connection settings in "Email notification settings" menu of Notifications. 

In this case, KES will send emails using it’s own mail client, from computer where event was registered. 

KES actions will be recorded in KES.version.date.time.PID.SRV.log 

Problem

There are slight differences when connecting devices to the Wi-Fi network configured via Kaspersky Endpoint Security for Mobile in Android 10. 

The main difference is that the connection to the target Wi-Fi network is made automatically through the product installed on the device and can't be forced manually via device settings.

Step-by-step description

The following scenario demonstrates the correct way to connect the device to a Wi-Fi network, as well as what behavior is expected.

1. Setting up the target Wi-Fi network in the Kaspersky Endpoint Security for Android as usual – navigate to Wi-Fi section and add new network by specifying network SSID, network protection type and password:

   

2. Apply the configured policy to the target mobile device with KESM installed and Android 10 (sync the product with the Security Center);

3. When the policy applies, "Allow suggested Wi-Fi networks" notification from Android System appears (unless the mobile phone is located in the target Wi-Fi access zone):

   

4. The user should open this notification and tap on ‘Allow’ / 'Yes' link. It should be done only once, when a new one network is added through the product;
5. Depending on the conditions:
   1. If the target mobile device is not connected to any Wi-Fi networks, then the connection to the expected network is made immediately automatically (no further actions are required from the user);
   2. If the target mobile device is already connected to another Wi-Fi network (and it was made manually by the device owner via native mobile phone network settings), then the connection to the expected network will not be made until the user manually disconnects his device from the current Wi-Fi network ('forgets' this network). As soon as this happens, the device will automatically connect to the desired network configured through the product.

If everything works as expected, then you’ll find an inscription near the network: ‘Connected via Kaspersky Endpoint Security’:

There are 2 methods of installing iOS MDM on the user's device:

• Via AppStore (iTunes Store);
• Via Manifest URL (with manual placement of the package).

How to install via AppStore

Installation via AppStore involves a special key named App ID.

This process is fully automatic and requires no actions from the KSC administrator. In KSC, you need to specify the application name (this name will be used in KSC event log) and the application ID.

The application ID can be learned from its URL.

To install an app on a device after the application's description has been published on the server, perform the corresponding command (Install application to device).

How to install via Manifest URL

Manual installation requires more actions from the company (in particular, from the KSC administrator).

To perform an installation, you need:

1. An application signed with a developer certificate. Depending on what certificate is used, you may need a provisioning profile with the corresponding UDID installed on the device.
2. Manifest for the application. Manifest is an XML file that contains information about the application, including its name, version, and the location of its installation package

Workflow:

1. The user fills out the manifest with the application details (icon, metadata, .ipa package location).
2. Next, the user needs to upload the manifest to the web server and create a new application in the iOS MDM server properties with a link to the created manifest. ATTENTION! The link must lead to the manifest, not the ipa file.
3. Selecting an application:
   
4. Selecting a device and installing the application on it:
   

Step-by-step guide

Download Apple configurator via App Store.

Run Apple Configurator.

Connect your iOS device.

Unlock the device and tap Trust.

Open the iOS device → Console.

Reproduce the issue.

Save the log in Apple configurator.

Send the collected log file to Kaspersky support for further analysis.

Problem

KSC and KS4Android are implemented but KSC is offline and could not access Internet. KUU can be used for updating KS for Android and distribute the update databases. But after running KUU (Kaspersky Update Utility), you cannot find actual KES for Android versions. 

Solution

AV bases for new KESM versions will appear in KUU UI after running KUU with empty application list. 

The KUU settings should look like the following (in order to update the list of supported applications, you need first to press 'Start' with a blank application list as follows):

The KESMac 12 and the KESMac 11.3 patch C allows adding particular processes into the trusted section named Trusted Applications.

The both filesystem and network activity of which can be ignored by the product increasing performance.

Please, however, note that this could be potentially risky. 

https://support.kaspersky.com/KESMac/11.3_adminguide/en-US/194142.htm

Problem

This article will describe a few ways to configure KES for Mac to exclude some of the software from the scope of the product.

Solution

Trusted applications

In order to have an ability to exсlude an application from scanning with KES, a function of Trusted Applications available in Kaspersky Endpoint Security for Mac can be used:

In some specific cases it might be required to put several binaries to Trusted Applications simultaneously in order to take effect. So, a final solution might include several path-based exclusions accompanied by a few BundleID-based ones.

Common exclusions for developers

It's suggested excluding the following paths: "/Library/Developer/CommandLineTools" and "/Library/Toolchains" for the standard developers' utilities, as well as the "/Applications/Xcode.app/*" for the XCode.

At the same time, in case you use alternative tools, contact Kaspersky Support to get the exact paths for further exclusions.

Excluding TCP 443 from port monitoring

Additionally, in case of HTTPS-connectivity issues, unchecking port 443 in Monitored ports may also help:

Problem

In some cases KESMac is not able to start protection components:

Or, the status "Allow encrypted traffic to be inspected" is not changing:

Solution

1) Please get acquainted with the article https://support.kaspersky.com/kis20mac/error/15031#block1;

2) If the article above did not help, try to remove the FireFox user's profiles directory via Terminal:

Then, reboot the host and check the issue reproduction.

Intro

This instruction describes how to create an installation package (.pkg) for the MacOS operating system from the standalone installation package of Kaspersky Endpoint Security for Mac.

You may need to create such a package to automate the installation of Kaspersky Endpoint Security software via third-party systems (e.g. AirWatch).

Details

Files

Munki tool (with predefined files)

Prerequisites

• Kaspersky Security Center
• MacOS machine
• Python must be installed

Usage

• Create a standalone installation package for Kaspersky Endpoint Security for Mac (https://support.kaspersky.com/KSC/14/en-US/182663.htm)
• On a MacOS machine:

Unzip the file munki-munki-pkg-e018bf1.zip to Desktop.

Open Terminal and navigate to the directory munki-munki-pkg-e018bf1

Copy the built standalone installation package (kesmac11.2.1.145.sh) to the postinstall file in the kesmac/scripts/ directory:

Modify the code of the standalone installation package with the vim editor

Replace the section in the file  to the modified section (note that the line "#!/bin/sh" must be the first line in the file, there must be no empty lines before it):

Add the execution bit:

You can also change the metadata (if needed) in the nagent/build-info.plist file

Perform the assembly:

The built package will be available in the kesmac/build directory with the name <name of package from build-info.plist>.pkg

Important