Advice and solutions for Kaspersky Security Center

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem While running Fix vulnerabilities task, the following error can occur: 'Transaction became the database conflict victim: '1205, 'Lock wait timeout exceeded; try restarting transaction' , LastStatement='CALL vapm_arrange_task_updates(119, 0xC89EAD3312227039C9FAC933840D7936)' Solution Most possible, the reason of the problem is that you have Fix vulnerabilities task or tasks with a big number of vulnerabilities that should be fixed inside one task. For example, you scroll list of KLAs and add each KLA to be fixed in the existing task. You have to check all fix v…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem Sometimes it is necessary to replace the KSN proxy address in products like KSWS, KESS or KES after restoring KSC from backup or when Server moved to new Hardware. Unfortunately, there are no settings in the policy for this. Solution The corresponding option can be found in the properties of Installation packages node in KSC. See the effects of changing this value: Note that after changing these settings, you must also rebuild the Network Agent installation packages, even if the change is propagated to connected clien…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. 0 - Update completed successfully 1 - All files are up-to-date (No available updates) Result codes depending on OS type: Windows Linux(FreeBSD) -1 255 Command line parsing exception -2 254 Update Utility error (exception or another malfu…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem Sometimes the problem with events receiving/transferring on KSC (including export to SIEM) may occur. The first thing that you have to check is Kaspersky Event Log. The following warnings may occur: Warning Total number of events stored in database (4010532) has exceeded the actual limit of 4000000 event(s). Starting to delete excessive events from the database... Warning 600 event(s) have been deleted from the database because the limit of 4000000 event(s) was exceeded. Warning Server is busy: event has …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. NAgent upgrade failure because the old agent was installed from a different .msi package than the new NAgent's .msi package. The below logs describe the root cause. KLNAG_INS_MSI: CheckInstalledMsiName: installed name 'KasperskyNetworkAgent', installed ext '.msi' MSI_UTILS: CAGetProperty(OriginalDatabase) called... KLNAG_INS_MSI: CheckInstalledMsiName: installing name 'Kaspersky Network Agent', installing ext '.msi' KLNAG_INS_MSI: CheckInstalledMsiName: names are NOT equal Solution 1. Copy the installation package of the new NA version from the shared fold…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem: You have a new CPU in your managed device and Windows operating system released prior to Windows 10\Windows Server 2016. Start "Find vulnerabilities and required updates" for a managed devices. Task results and Kaspersky Event log on a workstation may indicate a following error: Windows Update Agent error 80240037 ("The functionality for the operation is not supported.") #1181 (-2145124297) COM error 0x80240037 (wcode: 0) '' Additionally, if you try to update workstation directly from Microsoft Update servers, you may see an error messag…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem You install latest Windows Assessment and Deployment Kit (Windows ADK) on the server where KSC is installed, but KSC console still shows message "to deploy OS images, you must install the Windows Assessment and Deployment Kit (Windows ADK) on the device that has KSC installed". Solution KSC doesn't see all the needed WADK components being installed. Because Microsoft is always changing components within their installation packages, we recommend to install all utilities from the Microsoft's official article. Go to https://docs.microsoft.com/en-us/wind…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. To minimize network load, stop receiving error messages related to SNMP scan or to comply with security standards, you can disable SNMP scan completely. Step-by-step guide On KSC server: Execute: klscflag.exe -pv klserver -fset -n KLSRV_NETSVAN_MAY_USE_SNMP -v 0 -t d Restart network agent service net stop klnagent net start klnagent In case if you need to disable SNMP scan made by UA/DP, then the command will be slightly different: klscflag.exe -pv klnagent -fset -n KLSRV_NETSVAN_MAY_USE_SNMP -v 0 -t d

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Sometimes you want to use Connection Gateway for roaming hosts, but you don't want to use the default connection port (13000). To achieve that you can use the following solution. Step-by-step guide Open NAgent policy. Network → Connection section. Open connection profile properties. Set necessary port after CG address (see screenshot).

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem You may run into differences between Application Registry and Incompatible Applications Report when trying to find computers with incompatible applications. For example, you created Device selection based on an Applications registry criteria, where you specified incompatible application name in Application name field and got a device selection of 12 computers. After that, you open Incompatible Applications Report and only get 3 computers with that software. It is expected, and here is why. Solution Application Registry and Incompatible Applications Repo…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. If you are using the MMC console with different servers, you may want to keep a list of configured servers after upgrading to a new version. Fortunately, this is possible. Step-by-step guide Follow these steps before the upgrade. Save Kaspersky Security Center XX file from C:\Users\%username%\AppData\Roaming\Microsoft\MMC Upgrade. Start and close the MMC console. Remove newly create Kaspersky Security Center XX file from C:\Users\%username%\AppData\Roaming\Microsoft\MMC Place the file you saved on the first step in the KSC installation folder (r…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. In some cases klakaut traces should be collected for diagnostics. Step-by-step guide To do so: Import klakaut-on_x*.reg file. Restart klakaut service. net stop klakaut net start klakaut Enable another trace if required. Reproduce the issue. Import klakaut-off_x*.reg file. Trace file $klakaut-klakaut.log will be placed in C:\Wind…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Problem Kaspersky Shared Access To Desktop does not work or image from remote PC is corrupted. Solution Check if the issue will reproduce with standard Windows functionality: On remote host create an invitation for Windows Remote assistance (Windows default feature). Send the file with invitation to the PC with KSC console installed. Connect to the remote PC via Windows remote assistance using the invitation file. Click on Request control. Check the behavior. If the behavior will be the same, then it is …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. Description Sometimes KSC backup task may fail with the following error: #1181 (-2147023878) System error 0x800703FA (Illegal operation attempted on a registry key that has been marked for deletion.) At first, rebooting the OS may help, but the error may return. Cause The user identity associated with the COM+ application was logged on when the COM+ application was first initialized. If that user logs off, their profile will be unloaded and the COM+ application will no longer be able to read the registry keys in that user's profile. The User Profile Servic…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. To troubleshoot SNMP functionality in KSC specific traces should be collected. Step-by-step guide To collect traces: Download archive Use trace-5-snmpagt.reg to start trace Reproduce the issue Use trace-off-snmpagt.reg to stop trace Archive files and send to Kaspersky Support.

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. This article explains ROBOT attack, RSA Key Exchange, OpenSSL and KSC. Explanation If you are running security analyzer and it shows that connections on ports 13000 (server-nagent traffic) and 17000 (activation proxy) are suspicious for a ROBOT attack, don't panic. Automatic analysis is not accurate. Run specific diagnostics to make sure that KSC traffic is actually not vulnerable. Examples: https://testssl.sh/ https://github.com/robotattackorg/robot-detect Check https://mta.openssl.org/pipermail/openssl-dev/2017-December/009887.html…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. The ability to modify the ciphers used by the product to communicate with port 13292 published on the Internet is required. Step-by-step guide You cannot change the ciphers used on a particular port, but you can change the cipher modes used by the MDM server on all listening ports.To do so, you will need to create a global variable KLTR_ENV_SSL_CIPHER_SUITE and restart Kaspersky Security Center server. You can familiarize yourself with the format of the values at this link https://www.openssl.org/docs/man1.0.2/man1/openssl-ciphers.html For example, a variable mi…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. RDP connection invoked via KSC console uses hostname to connect to a host - mstsc.exe is invoked with /v hostname parameter. Edit command line used to invoke mstsc.exe with ip address parameter instead of the hostname: Open Custom tools → Configure custom tools Select Remote Desktop, click Modify Edit Command line text box, it should contain <host_ip> instead of <A>: /v:<host_ip>:<P> /f …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. If there are many outdated entries in Executable files list in computer's properties or on a server, there is a way to bring it up-to-date. Step-by-step guide There is a hidden Actualization task that runs at the end of the Inventory task. To use this functionality and quickly update the list of executables, do the following: Create an Inventory task Set Inventory scope to either empty or very small folder Run it Since the scope of work is small, the inventory task will be performed much faster and will go straight to the actualization …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. This article is about Kaspersky Security Center for Windows (KSC for Windows) In this article we will share the steps on how run a .bat file remotely through Kaspersky Security Center (KSC). How to execute a batch file on the remote hosts Create an installation package based on a file Create a remote installation task for that Installation package Assign the task to a target hosts and start it During task execution NAgent will run the file using a 32-bit cmd.exe process (C:\Windows\SysWOW64\cmd.exe) under LocalSystem account. Limitations …

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. This article is about Kaspersky Security Center for Windows (KSC for Windows) Problem You set up integration with SIEM but no events come up on SIEM side. In some cases there is no incoming traffic to SIEM from KSC server. Solution In vast majority of cases the root cause can be located in KSC server trace Trace example #1 25.01.2017 09:56:56.855 00001320.0000015C L1 KLSPLG: There is no key for SystemManagement. Trace example #2…

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials. This article is about Kaspersky Security Center for Windows (KSC for Windows) Problem: KSC certificate renewal or replacement is made incorrectly because the option to instantly replace the server certificate is used. There is an article in Online help dedicated to the klsetsrvcert utility (https://support.kaspersky.com/KSC/13.2/en-US/227838.htm). Sometime people follow the instructions according to the example indicated in the article – "klsetsrvcert -t C -i <inputfile> -p <password> -o NoCA" without thinking about the consequences. This …