Kavuser10

Also as a side note, I'm pretty sure that the article You pointed out, has mistakes in it. Per article none of the masks includes any subfolders in directories which is not true, to my knowledge. C:\Dir\* should be a mask that includes all the files and subfolders under Dir.

Pretty sure HIPS is an exception here. As can be seen from default HIPS rules, %userprofile% variable is used to define protected resources. That's why I'm asking. I'd like to be sure whether KES will recognize OneDrive variable as Windows does or do I have to use %userprofile%\OneDrive path.

Are OneDrive variables (%OneDriveCommercial%, %OneDriveConsumer%) supported as paths in various KES rules? For example when creating a HIPS rule I would prefer to specify path as %OneDriveCommercial% instead of %USERPROFILE%\Onderive\* as a protected ressource because latter would only have effect if the OneDrive folder has not been moved to a different location. %OneDriveCommercial%\* would always be applicable to OneDrive folder even if it's moved to a different physical drive. Is there even a list of all the environment variables available that KES supports?

Depends. Theoretically there are some problems. With write filter the places where anything can write is very limited and nothing persist after reboot. But there is a possibility to use Thin Client as a jump point to other systems. The built-in Defender does offer some protection. HP supports a very limited set of AV products on Thin Clients. The question is whether you need USB on those devices. If not, you can use HP USB Port Manager to disable front ports and also disable connecting any mass storage devices on any ports.

HP does support limited set of AV products. Theoretically Kaspersky for Embedded Security is the product to look into. The real question is why do you need AV for Thin Clients in the first place? Your Thin Clients should be completely locked down with Write Filter. If they are running Windows 10 IoT then you also could get by with the built in Windows Defender.

Where's the product feature suggestion forum? Where's the beta testing announcements? Also this all languages in one page approach to forum has turned the forums into annoying mess. The old forum was much better organized.

Hello! Please create a question here https://kasperskyclub.com/support Not related to OP but I would just like to point out that this page is infested with pages and pages of spam.

Fraid not, it's the only thing we've found but we've stopped all of our rollout as we've found that the newest Kaspersky is blocking all of our VPN connections and anything that connects to a untrusted certificate, so things like our phone system and backup system. As a temporary workaround you can fix this by disabling Encrypted Connections Scan in policy. You might even fix it by just disabling the Block SSL 2.0 option in Encrypted Connections Scan subsettings. The latter caused a lots of issues for us as well at first. But after disabling it most of the problems went away and I kept the Encrypted Connections Scan. VPN issue is more trickier. Try disabling the ARP Spoofing detection if it's on. Also you have to add your VPN network to Trusted Networks in Firewall.

If it's not running, it's not protecting anything. I think the recommended setting would be to launch the task at program start. Then it will be started and keep running after KSFSW launches.

Actually I see from the event logs that KES is crashing on those machines. I guess I have to open another ticket in company account.

Hello, We are also deploying a bunch of HP Elite Desk 705 G4 machines with Windows 10 Pro, HP Sure Start / Secure Boot enabled and noticed similar issue. The machines randomly fail to boot up saying that boot device can not be found. After power cycling the machine it boots normally. Happens completely randomly. I have been too busy deploying the machines to dig in deeper yet but somehow I have a feeling that the latest KES 11.1 is to blame for it. I have tried cursory looking at logs but so far have not seen anything important yet. PS. Also this new forum sucks.:sob:

I have created a completely new policy for KES 11.1 and 11 clients. As I have understood from the documentation, there's no need for predefined exclusions anymore in KES 11.1 and when creating a new policy all the exclusions are empty (as seen on the image). If I push this policy out to clients that are running KES 11.0.1 the predefined exclusions are also removed. Will this have any negative effect on KES 11 clients that have not yet been upgraded to 11.1?