We are attaching screenshot of the error by Whocrashed , Please let me know how to solve it. 

 

Two years ago, I upgraded my Linux KSC from version 14.2 to 15.1, but at that time the Windows MMC console was not yet available.

https://forum.kaspersky.com/topic/still-no-mmc-consolle-v-151-50386/#comment-185839

After a few months, the Windows MMC console was finally released.

Now I believe I’m facing the same situation again: I have upgraded KSC to version 16.2, but I cannot find the corresponding v16 MMC Windows console.

Am I missing something? Is there a direct download link available?
If not, could you clarify why the Windows MMC console is not released at the same time as the KSC server?

Thanks

Any guide, how to install third party antivirus on Win Server 2019 ?? 

Hello everyone, how are you? I need it and a help, we are doing disk encryption on the machines that use windows in the company where I work, are running Kaspersky Endpoint Security 11. Some machines (so far 4) are having a problem that when restarting, is only on the black screen with a dot in the upper left corner. As if loading S.O. but does not boot. If I take the ssd and put it in another notebook it works, but when I return the ssd to the person's notebook the same problem happens. I would like to know if something like this has happened to you and if you have found a solution.

I am currently using Kaspersky Endpoint Security (KES) to manage our server environment. Recently, I observed some unexpected behavior while executing a local PowerShell script (test.ps1) on one of our managed hosts. I would like to clarify how KES handles local scripts and verify some network activity.

1. Automated Script Execution in Remote/Sandbox Environments When a local PowerShell script is executed, does Kaspersky Endpoint Security (via KSN or Advanced Threat Prevention) upload the script or its metadata to Kaspersky’s cloud infrastructure for analysis? Specifically, if the script contains network-outbound logic (e.g., API calls via Invoke-RestMethod), is it possible that the script is being executed or "detonated" within a Kaspersky sandbox environment, causing the API calls to originate from a non-local IP address?

2. IP Address Verification During our security audit, we detected outbound connections to the following IP address:

• IP Address: 79.104.209.194

• Port: 443 / 13111

Could you please confirm if this IP belongs to the Kaspersky Security Network (KSN) or any official Kaspersky update/analysis servers? We need to verify if this is legitimate traffic or an unauthorized lateral movement attempt.

3. Context of the Issue We received automated alerts from our internal API (triggered by the script) that originated from an unrecognized environment. We suspect that KES might be performing a "Cloud Sandbox" analysis which triggered the script's logic externally.

I look forward to your technical clarification on these points to help us refine our security policies.

I am experiencing issues with a user profile in Kaspersky Endpoint Security designated as an IT profile. When this profile is assigned, it causes a specific problem with Hyper-V.

• Trying to start a virtual machine returns the error 0xC0000022 (Access Denied).

• Trying to create a new virtual machine  returns the error 0x80070005 (Access Denied).

I have researched these errors through Microsoft documentation and forums, focusing mainly on potential permission issues, but none of the solutions were successful.

To rule out Hyper-V or OS problems, I tested on another computer with Kaspersky Endpoint Security installed but using the Default Profile: I was able to create and start virtual machines without issues.

Assigning the IT profile to this machine caused the same errors. Reverting to the default profile restored Hyper-V functionality.

From the Kaspersky web console, I reviewed the profile settings. I do not see significant differences between the default profile and the IT profile, except:

• The IT profile has certain sites enabled in cloud discovery.

• Some storage devices are enabled.

Everything else appears identical at first glance.

Has anyone experienced similar behavior? What IT profile settings could be blocking Hyper-V? 

I would appreciate your help in resolving this problem 🙂 

Version of OS: Windows 11 Pro 25H2 compilation 26200.7922

Kaspersky Application: Kaspersky Endpoint Security 12.80.505 

After this problem with no solution, we decided to recreate a new KSC v 14.2.10359 from scratch on linux and rebuild everything fresh and updated.

We're trying to manage everything from web console (which we never used in the past). Seems everything is working fine at the moment but i have 2 questions:

1- The old MMC console has the very useful button to send a wake on lan packet to startup PC remotely, we use that a lot but i can't find the same button in the web console. Is this button missing?

2- Please look at the attached image. We created some groups and moving inside some Computers but when I try to open this window I see only the name of the groups, no computer inside. When I try to expand a group i see something loading for a millisecond but still no computers loaded. I have to find them on the complete "managed devices" list but computers are not ordered or divided by group, very complicated to manage this way. Is this correct?

If "Yes", this part of the page (red arrow) is completely useless, why not add the computers inside the groups?

If "No", any idea why i can't see the computers and how to solve?

Thanks

i'm having an issue with Kaspersky logs. For some of my company's laptops, when they go into sleep mode, they send/their network adapter send requests that trigger alerts in Kaspersky as "Mac Spoofing Attack: unexpected ARP response".
It seems to happen more with recent laptops, not old ones.
Whenever these laptops are woken up from sleep mode, the alerts in Kaspersky stop.

The problem is that it actually spams the logs, for example once it triggered 270 events in 20 minutes.

These laptops are connected in WiFi.
The alerts come from several, many different computers on the same network than the laptop causing them (and not always the same computers), and roughly look like that - replacing some information by [their meaning] :
 
 

Quote

User : [domain]\[user of a computer] (Active User)
Module : Protection against network threats
Result description : Forbidden
Name : Mac Spoofing Attack: unexpected ARP response
Object : ARP from an unexpected source
Object type : Network packet
Name of the object : ARP of an unexpected source
More :  
Suspiscious : 23/01/2024 [time] : [MAC address of the laptop] -> [IP address of the laptop]
Date of bases publication : 23/01/2024 10:54:00

If you have any lead, i can conduct some tests.
Disabling Kaspersky's MAC spoofing protection isn't an option.

Thank you for any help.

Regards,

   _ Piter

The Kaspersky process consistently consumes more than 90% CPU(No problem at all with MacOS15.),which significantly degrades system performance and the device nearly unusable, even for basic tasks.

Has anyone encountered a similar issue in this environment? If so, are there any known workarounds, configuration changes, or fixes to mitigate the high CPU usage?

We are seeing heavy traffic on our Kaspersky network; when we begin the Malware Scanning task in Kaspersky Security Center, we notice a jump in network traffic flow in Firewall as well as excessive bandwidth utilization on the workstation. How can we solve this?

We’re a Kaspersky Partner and currently using two licenses: Kaspersky Endpoint Detection and Response Optimum and Kaspersky Security for Mail Server. Previously, these were valid for one year covering 50 nodes, and we could renew them via the partner portal.

This year, we only see two licenses available for request on the portal (snapshot attached), and the licenses we need are not listed.

Could someone confirm if these licenses will be available on the partner portal before 14 February? Any guidance would be greatly appreciated.

Thanks in advance!

Following KES 12.11.0 deployment, our users are getting an ERR_TOO_MANY_REDIRECTS errors when trying to access specific web sites. I have confirmed that it is browser independent and definitely related to the Web Threat Protection component. Adding site exceptions and/or changing other various parameters in the Web Threat Protection settings don not make a difference - the only thing that works is disabling Web Threat Protection completely.

Has anyone else experienced this and do you have any insights / suggested fixes?

Thanks,
Doug

We have multiple linux servers . Kaspersky endpoint security hangs the servers. linux team told that network agent is creating mulitple instance to access same file, anyone can help to resolve this issue.

Restarting the client does not help. The only fix seems to be manually removing Kaspersky and reinstalling, which can be time consuming. Is there a quicker repair fix for this? 

We are facing issues in installing keswin 12.10 , screenshot of the error attached 

I´m trying to automate the installation of Kaspersky Endpoint Security version 12 with PowerShell, and I´m trying to use silent install.

When testing the silent install manually before starting to write PowerShell code, I´ve found that the installer does not do anything when manually launched.

I´m trying with installer.exe /s /pAGREETOEULA=1 /pAGREETOPRIVACYPOLICY=1 for example, but when I run that, the execution finishes instanty with no message returned at all. 

It doesn´t matter which options I pass to the installer. if run installer.exe /s or I add any other option to the command line, it performs the same.

If I run installer.exe then the normal interactive setup starts, and it completes succesfully. 

Of course, all this is being done as administrator. Windows 11 Pro 25H2.

Can someone provide some help on this?

Thanks.

We have the local UI user interface hidden for users. In some cases, endpoints are offline from the Admin Server, so KES cannot be disabled remotely. We need a temporary local way to stop or disable KES for troubleshooting.

I tried:

klpsm.exe stop_avp_service
But it returns:
The call of the ControlService return code 1052: The requested control is not valid for this service.

I also tried "Disabling Protection of application services against external management”, but this allows any user with Administration Privilage to disable KES without authentication.

Is there any supported CLI or local method to stop/disable KES?

We have a situation where we checked that there two keswin is installed in a workstation but none of them are working and we are getting status from KSC that is protection disabled

we have a standalone server installed but we want add failover functionality, Can anyone guide on below points;

- is there any way to add failover server to existing installed server? if yes, how?

- What is difference between windows failover cluster and kaspersky failover 

- Which failover option is stable.

how to guides are needed.

Regards

Mirza

After installing Kaspersky Web Console version 16.0.378 and ksc64_16.0.0-254 on Linux 24.04, I encounter the following error when trying to log in to the console.

What should I do to resolve this issue?

Authentication required

Administration Server uses an untrusted certificate. Please reconfigure the application by specifying a valid certificate, or contact the main administrator.

I would appreciate your help. Thank you.