Jump to content
vashthestampede

Local system task versus group task

Recommended Posts

Hi all,

i'd like to understand the topic in subject in my environment KSC 10.3.407 and Kaspersky Security 10.0.0.486.

Reading the admin guide, pg. 364 in chapter "Configuring a scheduled launch of local system tasks" it is raccomanded to disable by policy the local system tasks schedules.

By the way, in my case i have a policy with both check box in "Launch of system tasks" cleared, but the local system task schedule still going on.

In particular the task "critical area scan" still run according to the local server task schedule.

I have also a group task configured for the server group.

This doesn't happen with the task "dabase Update".

Same behaviour with KAV8EE.

There is something i miss, bug or what else?


Thank you

Share this post


Link to post

Hello,

what patches did you install for KSWS 10 ?

Please attach screenshots of mentioned settings and unexpected behavior.

Thank you.

 

Share this post


Link to post

Hello,

no patches installed, just download the updated package from Security Center and install it on a server

Attched some screenshots.

Immagine1: Settings in the policy

Immagine2: Events list of the server, please note the difference between the first three events (local system task of the server) and the last three (group task configured in Security Center). Both are running ignoring the settings of the policy.

Immagine3: The schedule of the local system task "Scan of critical area". For testing i changed for three time the scheduled start time (the three different events in immagine2).

 

Immagine1.jpg

Immagine2.jpg

Immagine3.jpg

Share this post


Link to post
59 minutes ago, vashthestampede said:

Hello,

no patches installed, just download the updated package from Security Center and install it on a server

Attched some screenshots.

Immagine1: Settings in the policy

Immagine2: Events list of the server, please note the difference between the first three events (local system task of the server) and the last three (group task configured in Security Center). Both are running ignoring the settings of the policy.

Immagine3: The schedule of the local system task "Scan of critical area". For testing i changed for three time the scheduled start time (the three different events in immagine2).

Please install the latest available patch for KSWS: https://support.kaspersky.com/13463
Let us know if the issue persists.

Thank you!

Share this post


Link to post
1 hour ago, vashthestampede said:

Patch installed.

Same behaviour, the local system task "Critical Area Scan" still going on despite the policy settings.

Please clarify whether it is displayed as a local task in the host properties in KSC.

What group does the host belong to? Could this be an inherited task from a level up?

If you can confirm that the task is being perceived as local, please provide a policy export, and KSWS traces when the task starts.

Thank you.

Share this post


Link to post

Ki Kirill,

i can confirm that the task is a local task in the host.

As you can see in the screenshots of the events, the group task fill the last coloumn of the events with the name of the group task, in my case "on-demand scan".

Attached the policy; for the trace log, can you explain me how can i take the trace log since the KS10 doesn't have the user interface in the server.

 

Thanks

KS10.klp

Share this post


Link to post

Using the registry method, the only one i can use, does not produce any trace in c:\Temp.

I also try to create the temp folder, activate and deactivate trace several time.

Share this post


Link to post

Hi Nikolay,

since i'm using KS10 on a server i prefer to not install unusefull stuff. Why the reg edit method doesn't work?

What do you mean for "remote ocnsole"?

Share this post


Link to post

Well, you can install a console for KS10 at some remote host(your PC, for example) and control KS10 using remote console.

In that case you have to make necessary exclusions for kavfsgt.exe process at firewall settings.

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.