As most will know its a big no no to clear this location but we are having no choice as for some unknown reason Kaspersky is constantly pushing these database update files to machines, these are filling the hard drive and can consist of 170GB of space in some instances, please can someone advise why this is happening so I can resolve the route cause issue.

We are facing an issue on several Windows Server 2022 member servers and would like to know if it is a known problem.

Environment

• Windows Server 2022 Datacenter, build 20348.169

• Kaspersky Security 11.0.1 for Windows Server, 11.0.1.897

• Network Agent 14.2.0.26967, deployed via a remote installation task

Symptom
Right after Network Agent was deployed, the servers were rebooted. Since then, the Windows Event Log service no longer starts.

It goes to START_PENDING, then stops with WIN32_EXIT_CODE 31 (ERROR_GEN_FAILURE). All dependent services fail as well (for example DHCP Server, error 1068).

Three servers are affected, all of them rebooted after receiving the agent.

Two domain controllers received the agent plus Kaspersky Security 11.0.1 for Windows Server (11.0.1.897) the day before, but have not been rebooted yet, so we don't know if they are affected.

What we checked

• Disk space, permissions on winevt\Logs, log file paths: OK

• Moving all .evtx files out of the Logs folder: no change

• Privileges required by the service (SeAuditPrivilege, SeImpersonatePrivilege, SeChangeNotifyPrivilege) for LocalService: OK

• Autologger configuration: only default Microsoft sessions

• On one server, we uninstalled Network Agent and rebooted: the issue persists. No kl* services or filter drivers remain.

Is this a known issue with Network Agent 14.2 on Windows Server 2022, especially on an unpatched build?

Could the agent installation leave changes that are not reverted by uninstallation? Would kavremover help in this case?

Is it safe to reboot domain controllers running Kaspersky Security 11.0.1 for Windows Server on Windows Server 2022, or should we remove it first?

The steps to repair the Event Log service on the affected servers, without reinstalling Windows

Thanks in advance for any help

Environment:

• OS: Windows 11 24H2

• Product: Kaspersky Endpoint Security for Business (KES) 14.1.0.423

• Note: This exact same bug also infects your entire Home/Personal product line.

Steps to Reproduce (Takes 0 effort if you use a real PC):

1. Install KES on a REAL physical machine (NOT a VMware/Hyper-V instance).

2. Put the workstation to sleep overnight.

3. Wake up the PC the next day and click the KES tray icon (e.g., Pause/Resume protection).

Result: The entire Kaspersky UI instantly deadlocks. The system tray context menu hangs permanently. The ONLY way to recover the workstation is a hard reset.

To the Kaspersky UI Development Team: We already know exactly what the problem is. The broader cybersecurity community (and major security forums) has already reverse-engineered and identified that your .NET UI framework is fatally flawed when handling Windows Power State transitions (S3/S4 resumes).

Because you share this flawed .NET UI codebase across both your Home and Enterprise products, everyone is suffering.

Please DO NOT insult my intelligence by asking for "Trace Logs" just to stall this ticket. This is not a local misconfiguration. This is a fundamental architectural failure in your .NET wrapper.

As IT admins, having our enterprise users perform hard reboots every morning is completely unacceptable. If your UI needs a complete rewrite to fix this .NET resume bug, do it. Stop carrying this years-old garbage code into enterprise environments. Escalate this to the lead UI developers immediately.

Environment:

• OS: Windows 11 24H2

• Product: Kaspersky Endpoint Security for Business (KES) 14.1.0.423

The Exact Technical Cause (We already debugged this for you): The root cause is that the Kaspersky UI is inextricably hooked to the Windows Desktop Window Manager (DWM.exe) without any recovery mechanism.

On real physical hardware (NOT your Hyper-V/VMware test environments), waking up from Sleep/Hibernation often causes a brief GPU driver reset, which triggers DWM.exe to crash and automatically restart. While Windows and every other application recover gracefully from this DWM restart, the Kaspersky UI does not. It completely loses its hook, permanently deadlocks in whatever state it was in, and freezes the entire system tray context menu.

Steps to Reproduce (On physical hardware):

1. Install KES on a REAL PC with a dedicated/integrated GPU.

2. Force a GPU driver reset or forcefully restart DWM.exe via Task Manager (or simply put the PC to sleep overnight).

3. Watch the KES UI completely freeze. The only recovery is a hard system reset.

To the Lead UI Developers: It is absolutely unacceptable that an Enterprise endpoint security solution crashes because it cannot handle a standard Windows DWM restart. Your QA team is missing this because they only test power states on VMs, which do not drop GPU drivers like physical machines do.

Stop ignoring this UI deadlocking issue. We cannot manage enterprise environments if our security software forces a hard reboot every time a laptop wakes from sleep. Fix the DWM recovery logic in your GUI immediately.

My KES version is 14.1 that is managed by KSC. Some webpages can not be loaded when KES is active. Those pages load right away when disable KES. I already added those page's Web/IP Addresses in Web Threat Protection/Trusted web addresses and Network Threat Protection/Exclusions but it did not work. Could someone please help me?

Thanks in advance.

NB: The printers are either local or network printers; when attempting to print, there is no message from the printer, nor is there anything in its print queue.

## Environment

- **OS:** Fedora Linux 43 Workstation, kernel 7.0.12
- **Product:** Kaspersky Endpoint Security for Linux (KESL) 12.4.0.1225
- **VPNs tested:** Mullvad 2026.3 (native app, WireGuard) and ProtonVPN 4.16.5 (flatpak, WireGuard via NetworkManager)
- Other security software present: firewalld, OpenSnitch (default allow), Wazuh agent — all ruled out during diagnosis.

## Symptoms

1. VPN app reports **Connected**, but there is no working internet: HTTPS connections fail immediately with `Connection reset by peer (os error 104)` (visible in the Mullvad daemon log for every API request).
2. Intermittently worse: with the tunnel up and the VPN's kill-switch firewall active, **HTTPS traffic leaked outside the tunnel** — `https://am.i.mullvad.net/connected` returned my real ISP IP address while Mullvad showed "Connected".
3. KVM/libvirt guest VMs kept working while the host had no internet (guest traffic is NAT-forwarded, so it bypasses KESL's per-process interception — a useful diagnostic hint).

## Root cause found

KESL's Web Threat Protection / Network Threat Protection / Mail Monitoring tasks install a transparent interception proxy:

- iptables-nft chains (`kesl_output` in `table ip mangle`) mark outbound TCP to ports 21, 25, 80, 110, 143, 443, 465, 587, 993, 995, 1080, 3128, 8080, etc. with fwmark `0x100`/`0x200`
- policy routing rules `fwmark 0x100/0x500 lookup 101` and `fwmark 0x200/0x600 lookup 101`, where table 101 is `local default dev lo`, divert the marked packets to a local proxy listening on `127.0.0.1:9789` and `127.0.0.1:9879`
- the proxy then **re-originates** the connections itself, plus two nfqueue hooks (queues 4/5) for inspection

When a VPN with a kill-switch firewall (Mullvad, ProtonVPN) is connected, the proxy's re-originated connections conflict with the VPN's nftables policy and mark-based WireGuard routing. Result: either every intercepted connection is reset (no internet), or the re-originated connection escapes via the physical interface — i.e. a **privacy leak: real IP exposed while the VPN reports Connected**.

## Verification

- KESL running, Mullvad connected → HTTPS resets + real-IP leak, DNS answered via WiFi instead of the tunnel, ping latency showed traffic going direct instead of through the VPN exit.
- `systemctl stop kesl`, Mullvad connected → everything perfect (correct exit IP, DNS via tunnel, tunnel-consistent latency).
- KESL running again but with tasks 14 (Web_Threat_Protection), 17 (Network_Threat_Protection) and 35 (Mail_Monitoring) stopped → everything perfect. Note: stopping tasks 14/17 alone at runtime was **not enough** — the interception hooks only disappeared after also stopping Mail_Monitoring and restarting the kesl service.

## Current workaround

`kesl-control --stop-task 14 && kesl-control --stop-task 17 && kesl-control --stop-task 35`, then `systemctl restart kesl`. File Threat Protection, Behavior Detection and Device Control keep working; only network traffic interception is off. The stopped state persists across restarts.

## Questions for Kaspersky

1. Is there a supported way to make KESL's traffic interception coexist with WireGuard VPNs / kill-switch firewalls (e.g. exclude a tunnel interface such as `wg0-mullvad`, or make the proxy honor the VPN's routing)?
2. The silent traffic leak outside an active VPN tunnel seems like a security issue in itself — is this a known problem, and is a fix planned?
3. Why do the interception firewall rules remain active after stopping the Web/Network Threat Protection tasks, until Mail Monitoring is also stopped and the service restarted?

can someone tell me the URL to download the .OVA image of the light agent protection server version 6.4? I'm not very familiar with the KASPERSKY HYBRID CLOUD SECURITY portal (https://www.kaspersky.com/small-to-medium-business-security/downloads/virtualization-hybrid-cloud). The latest version I managed to find somewhere is the archive ksvla-svm_vmware-vsphere_6.3.2.493_mlg.zip

Kind regards, Lukas

Two years ago, I upgraded my Linux KSC from version 14.2 to 15.1, but at that time the Windows MMC console was not yet available.

https://forum.kaspersky.com/topic/still-no-mmc-consolle-v-151-50386/#comment-185839

After a few months, the Windows MMC console was finally released.

Now I believe I’m facing the same situation again: I have upgraded KSC to version 16.2, but I cannot find the corresponding v16 MMC Windows console.

Am I missing something? Is there a direct download link available?
If not, could you clarify why the Windows MMC console is not released at the same time as the KSC server?

Thanks

I'm having a lot of troubles when using Kaspersky Endpoint Security 12 with Google Meet: after some minutes of heavy use, the wifi goes down, and I cannot find any wifi SSIDs anymore, this is solved with a full restart, or disabling the device, and enabling again, on device manager.

This problem is completely gone after uninstalling Kaspersky. I have several other laptops of this same model and all of them have this problem with Kaspersky.

- Kaspersky Endpoint Security 12.12 (latest updates applied)
- ThinkPad E14 Gen3, with Ryzen 3 5300U
- Realtek RTL8852AE (Tried latest driver version, older versions, all have the same issue)
- Windows 11 25H2, latest update applied

If someone has a hint of how to solve this issue (other than completely disabling Kaspersky network security) I would appreciate. I tried everything.

We are attaching screenshot of the error by Whocrashed , Please let me know how to solve it. 

 

I invite you to try this automatic installation script for Administration Agent 16 and KESl Protection 12.4.

All information regarding how the script works and the installation procedure is included in the script in .txt format (Readme, Manifest and Procedure).

It has been designed for beginners in the Linux environment. You can either download the packages in advance and place them in the script’s ‘packages’ folder, or let the script download them itself. Logs are collected in the event of an error and stored in the Logs folder. 

We would appreciate your feedback on its performance across different operating systems and environments.

If you are interested, you can download the script from this link: https://box.kaspersky.com/f/e39913e4f0c2470f81ea/ 

Please let us know the number of workstations tested and their operating systems (Oracle, Ubuntu, etc.).

Thank you in advance for your contribution

Bonjour,

Je vous invite à essayer ce script d'installation automatique pour Administration Agent 16 et KESl Protection 12.4.

Toutes les informations concernant le fonctionnement du script et la procédure d'installation sont incluses dans le script au format .txt (Readme, Manifest et Procedure).

Il a été conçu pour les débutants dans l'environnement Linux. Vous pouvez soit télécharger les paquets à l'avance et les placer dans le dossier « packages » du script, soit laisser le script les télécharger lui-même. Les journaux sont collectés en cas d'erreur et stockés dans le dossier Logs. 

Nous apprécierions vos commentaires sur ses performances sur différents systèmes d'exploitation et environnements.

Si vous êtes intéressé, vous pouvez télécharger le script à partir de ce lien : https://box.kaspersky.com/f/e39913e4f0c2470f81ea/ 

Veuillez nous indiquer le nombre de postes de travail testés et leur système d'exploitation (Oracle, Ubuntu, etc.).

Merci d'avance pour votre contribution.

We have comb through the update logs and audit logs from KES. For user PCs that failed to run the update task, all update entries end with "No updates available," while for the versions that ran successfully the update entries have "Completed" status.
The Kaspersky Security Center (KSC) being used is 11.0.0.1131( is this too outdated ?) . KSC is installed on Windows Server 2012 R2. The license details installed on KSC are "Kaspersky Next EDR Foundations South-East Asia Edition. 100-149 Users, 1-Year Renewal Plus License"

We have already tried clearing the KSC update repository and redownload the repo but to no avail.

Thanks in advance  

Any guide, how to install third party antivirus on Win Server 2019 ?? 

Hello everyone, how are you? I need it and a help, we are doing disk encryption on the machines that use windows in the company where I work, are running Kaspersky Endpoint Security 11. Some machines (so far 4) are having a problem that when restarting, is only on the black screen with a dot in the upper left corner. As if loading S.O. but does not boot. If I take the ssd and put it in another notebook it works, but when I return the ssd to the person's notebook the same problem happens. I would like to know if something like this has happened to you and if you have found a solution.

I am currently using Kaspersky Endpoint Security (KES) to manage our server environment. Recently, I observed some unexpected behavior while executing a local PowerShell script (test.ps1) on one of our managed hosts. I would like to clarify how KES handles local scripts and verify some network activity.

1. Automated Script Execution in Remote/Sandbox Environments When a local PowerShell script is executed, does Kaspersky Endpoint Security (via KSN or Advanced Threat Prevention) upload the script or its metadata to Kaspersky’s cloud infrastructure for analysis? Specifically, if the script contains network-outbound logic (e.g., API calls via Invoke-RestMethod), is it possible that the script is being executed or "detonated" within a Kaspersky sandbox environment, causing the API calls to originate from a non-local IP address?

2. IP Address Verification During our security audit, we detected outbound connections to the following IP address:

• IP Address: 79.104.209.194

• Port: 443 / 13111

Could you please confirm if this IP belongs to the Kaspersky Security Network (KSN) or any official Kaspersky update/analysis servers? We need to verify if this is legitimate traffic or an unauthorized lateral movement attempt.

3. Context of the Issue We received automated alerts from our internal API (triggered by the script) that originated from an unrecognized environment. We suspect that KES might be performing a "Cloud Sandbox" analysis which triggered the script's logic externally.

I look forward to your technical clarification on these points to help us refine our security policies.

I am experiencing issues with a user profile in Kaspersky Endpoint Security designated as an IT profile. When this profile is assigned, it causes a specific problem with Hyper-V.

• Trying to start a virtual machine returns the error 0xC0000022 (Access Denied).

• Trying to create a new virtual machine  returns the error 0x80070005 (Access Denied).

I have researched these errors through Microsoft documentation and forums, focusing mainly on potential permission issues, but none of the solutions were successful.

To rule out Hyper-V or OS problems, I tested on another computer with Kaspersky Endpoint Security installed but using the Default Profile: I was able to create and start virtual machines without issues.

Assigning the IT profile to this machine caused the same errors. Reverting to the default profile restored Hyper-V functionality.

From the Kaspersky web console, I reviewed the profile settings. I do not see significant differences between the default profile and the IT profile, except:

• The IT profile has certain sites enabled in cloud discovery.

• Some storage devices are enabled.

Everything else appears identical at first glance.

Has anyone experienced similar behavior? What IT profile settings could be blocking Hyper-V? 

I would appreciate your help in resolving this problem 🙂 

Version of OS: Windows 11 Pro 25H2 compilation 26200.7922

Kaspersky Application: Kaspersky Endpoint Security 12.80.505 

After this problem with no solution, we decided to recreate a new KSC v 14.2.10359 from scratch on linux and rebuild everything fresh and updated.

We're trying to manage everything from web console (which we never used in the past). Seems everything is working fine at the moment but i have 2 questions:

1- The old MMC console has the very useful button to send a wake on lan packet to startup PC remotely, we use that a lot but i can't find the same button in the web console. Is this button missing?

2- Please look at the attached image. We created some groups and moving inside some Computers but when I try to open this window I see only the name of the groups, no computer inside. When I try to expand a group i see something loading for a millisecond but still no computers loaded. I have to find them on the complete "managed devices" list but computers are not ordered or divided by group, very complicated to manage this way. Is this correct?

If "Yes", this part of the page (red arrow) is completely useless, why not add the computers inside the groups?

If "No", any idea why i can't see the computers and how to solve?

Thanks

i'm having an issue with Kaspersky logs. For some of my company's laptops, when they go into sleep mode, they send/their network adapter send requests that trigger alerts in Kaspersky as "Mac Spoofing Attack: unexpected ARP response".
It seems to happen more with recent laptops, not old ones.
Whenever these laptops are woken up from sleep mode, the alerts in Kaspersky stop.

The problem is that it actually spams the logs, for example once it triggered 270 events in 20 minutes.

These laptops are connected in WiFi.
The alerts come from several, many different computers on the same network than the laptop causing them (and not always the same computers), and roughly look like that - replacing some information by [their meaning] :
 
 

Quote

User : [domain]\[user of a computer] (Active User)
Module : Protection against network threats
Result description : Forbidden
Name : Mac Spoofing Attack: unexpected ARP response
Object : ARP from an unexpected source
Object type : Network packet
Name of the object : ARP of an unexpected source
More :  
Suspiscious : 23/01/2024 [time] : [MAC address of the laptop] -> [IP address of the laptop]
Date of bases publication : 23/01/2024 10:54:00

If you have any lead, i can conduct some tests.
Disabling Kaspersky's MAC spoofing protection isn't an option.

Thank you for any help.

Regards,

   _ Piter

The Kaspersky process consistently consumes more than 90% CPU(No problem at all with MacOS15.),which significantly degrades system performance and the device nearly unusable, even for basic tasks.

Has anyone encountered a similar issue in this environment? If so, are there any known workarounds, configuration changes, or fixes to mitigate the high CPU usage?

We are seeing heavy traffic on our Kaspersky network; when we begin the Malware Scanning task in Kaspersky Security Center, we notice a jump in network traffic flow in Firewall as well as excessive bandwidth utilization on the workstation. How can we solve this?

We’re a Kaspersky Partner and currently using two licenses: Kaspersky Endpoint Detection and Response Optimum and Kaspersky Security for Mail Server. Previously, these were valid for one year covering 50 nodes, and we could renew them via the partner portal.

This year, we only see two licenses available for request on the portal (snapshot attached), and the licenses we need are not listed.

Could someone confirm if these licenses will be available on the partner portal before 14 February? Any guidance would be greatly appreciated.

Thanks in advance!