Jump to content
Kaspersky Support Forum

Stephen B

Members
 View Profile  See their activity

  • Posts

    23

  • Joined

  • Last visited

    Never

 Content Type 

Posts posted by Stephen B

    Network Attack Detected

    in Kaspersky Endpoint Security for Business

    Posted

    I am using 11.4.0.233 on some of our servers with agent 12.0.0.7734 and I am getting these reports from a single device.  The item being identified is a UPS that is monitored.  We added the IP Address to the “Exclusions” but the reports still come through.  We could change it to “Do not track MAC spoofing attacks” but I don’t think that is the safest thing to do.  The preference would be for the Exclusion to work.  

     

    Any ideas? 

     

    Event "Network attack detected" occurred on device MILESTONEE1 in Windows domain ##### on Tuesday, 14 July 2020 11:30:56 AM (GMT+10:00)
    Event type:     Network attack detected
    Application:     Kaspersky Endpoint Security for Windows
    Application\Path:     C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security for Windows\
    User:     NT AUTHORITY\SYSTEM (System user)
    Component:     Network Threat Protection
    Result\Description:     Allowed
    Object:     ARP from unexpected source
    Object\Type:     Network packet
    Object\Name:     ARP from unexpected source
    Object\Additional:     
    Suspicious: 14/07/2020 11:30:56 AM: 00-20-85-DF-19-CE -> 172.17.2.44

    Setup process error: 1603 Increase DiskSpace on Network Agent 11.0.0.1131

    in Kaspersky Endpoint Security for Business

    Posted

    The issue is as per described in the posts above. The instillation of the latest version of the network agent is failing and reporting that it is due to a lack of disk space. The item has been described in detail above. There is no shortage of disk space. The removal tool DOES NOT WORK WHEN THERE IS NOTHING INSTALLED. I am not having issues removing an old version. The issue is with installing a new version. If I go to an older version it will install and work fine. I can also uninstall the old version. The issue is only with the new version.

    Setup process error: 1603 Increase DiskSpace on Network Agent 11.0.0.1131

    in Kaspersky Endpoint Security for Business

    Posted

    Interestingly we started to work on another server and had the same error, but this time on the Kaspersky Endpoint for Windows (11.1.0) (11.1.0.15919) and not the network agent. What we have found so far is that all servers seeing this error have dynamicly expanding disks and run on a Hyper-V 2012 R2 host. We will be updating our hosts to 2019 in the next 3 months but I am not sure I can go three months without AV on these servers. GSI of this second server is attached.
    Hello! First of all you need to check if the Windows has some fragments of the previous KES installation. Please use KavremoverThe error that we seen in the logs is "Application: Kaspersky Endpoint Security for Windows -- The installed AES-56 encryption libraries do not correspond to the AES-256 encryption libraries in this package." Also check the type of encryption of installing package, Thank you!
    Thanks you for the information. I ran the Kavremover tool as requested on the main server (the one I have access to reboot during the day). I did not see any option in this tool to remove the Network Agent, which is the item failing on this server, It fails on the network agent and then does not proceed to the installation of the main application. I did select the Kasp Endpoint Security (in the Kavremover tool) and rebooted as requested by the software. This did not make any difference and the software still refuses to install at the Network Agent.

    Setup process error: 1603 Increase DiskSpace on Network Agent 11.0.0.1131

    in Kaspersky Endpoint Security for Business

    Posted

    Interestingly we started to work on another server and had the same error, but this time on the Kaspersky Endpoint for Windows (11.1.0) (11.1.0.15919) and not the network agent. What we have found so far is that all servers seeing this error have dynamicly expanding disks and run on a Hyper-V 2012 R2 host. We will be updating our hosts to 2019 in the next 3 months but I am not sure I can go three months without AV on these servers. GSI of this second server is attached.

    Protection is disabled. 10.1.2.996

    in Kaspersky Endpoint Security for Business

    Posted

    Since upgrading to 10.1.2.996 with network agent 11.0.0.1131 we are getting several servers reporting that "Protection is disabled" When I try to start the protect I can not seem to turn on the protection or work out why it is disabled. This server is a 2012 R2 as are the other servers where I am seeing the same issue. A GSI is attached. When I look at the Admin server it shows the following Internal task error occurred. Error code: 0x0007. Subsystem code: 0x6 (WP). For more details go to the Kaspersky Lab Technical Support site: https://click.kaspersky.com/?hl=en-US&link=error&pid=wsee&version=10.1.0.0&error=B6X7X13X20X The only reference I could find was that to the licence, so I deployed the licence file again which reported that it was successful, but this did not resolve the issue. It also reports that it has an active key

    Setup process error: 1603 Increase DiskSpace on Network Agent 11.0.0.1131

    in Kaspersky Endpoint Security for Business

    Posted

    From what we know this event is just a warning from Microsoft for computers that are not on a UPS. Cache is not recommended in some circumstances. This is a VM on a host that has UPS protection, so there is no real risk. The server was a fresh build a few years ago (Server 2016) and has similar settings to other servers. One thing we did note is that this has a dynamically expanding disk, so the hard drive expands as required. Could the installer be reading this incorrectly and not allowing for it to be a dynamically expanding disk? Also, the temp file you have asked for is not on that server.

    Google Drive buttons greyed out since upgrading to 11.1.0.15919

    in Kaspersky Endpoint Security for Business

    Posted

    I'm still looking, but this came up in the chrome logs The requested web page cannot be provided. Address: https://clients6.google.com/drive/v2b.... The web page has been blocked by the Block Bad Sites rule. Reason: the web resource belongs to the Torrents content category(-ies) and the Undetermined data type category(-ies). This web resource is prohibited at the company. If you consider the blocking to be mistaken or if you need to access this web resource, contact the administrator of the local corporate network (Request access). Message generated on: 25/06/2019 4:07:48 PM

    Google Drive buttons greyed out since upgrading to 11.1.0.15919

    in Kaspersky Endpoint Security for Business

    Posted

    We recently upgraded some computers from 11.0.1.90 and network agent 10.5.1781 to 11.1.0.15919 with network agent 11.0.0.1131 Since doing this we have found that Kasperky is blocking access to parts of Google Drive. We have not been able to work out how to stop this. We do not want to turn off scanning of Google Drive, but just allow the normal functionality. The top part of the image shows how Google Drive looks when Kaspersky is running. The second part shows how it looks when we disable Kaspersky. Note that the File upload and Folder upload are greyed out and the option of Docs, Sheets and Slides are missing when Kaspersky is enabled. Running Windows 10 1803 and we have tried this on a couple of computers.

    Setup process error: 1603 Increase DiskSpace on Network Agent 11.0.0.1131

    in Kaspersky Endpoint Security for Business

    Posted

    We are trying to install Network Agent 11.0.0.1131 and Kasp Endpoint 11.1.0.15919. Several servers are reporting errors with the Network Agent on some systems:- Setup process error: 1603 (General Windows Installer engine error. Increase DiskSpace requirements in Setup.ini and try again.) Installing on Windows Server 2019 version 1809 Server has 298Gig C Drive with with 279Gig free, so space is not an issue. I have tried logging in with my account and with the admin account and get the same result. It's not happening to all servers/computers. Only about 20% of them. Any ideas?
×
×
  • Create New...