Victor C.

Hi @Yasutoshi Takayama , It is advised to create and run a “Activation of application” task for Kaspersky Endpoint Agent in order to activate KEA. Setting the key to automatically deployed functionality for KEA is not supported as of now. Task “Change application components” would fail if Password protection is enabled in the policy of KES. To disable password protection, open the KES 11 policy in the General settings / Interface/ Password protection/ Settings section and uncheck password protection checkbox. Password protection can be enabled for most of the user actions that affect Kaspersky Endpoint Security: editing its settings, exiting, and uninstalling.

Hi @Yasutoshi Takayama , In order to turn off isolation, please follow the step here: Open host with KSC ->’Devices/TAGS’ Open the device list at the ISOLATED FORM NETWORK tag. Click “View devices” Click on the device name. To To remove the isolation, turn off the tag. Open ‘Tags’ tab Check ‘Isolated from network’ Tag and click ‘Unassign tag’ Open device property ->’Devices/Managed Devices-> Click <Device name>’ Open ‘Application’ tab Click ‘Kaspersky Endpoint Agent’ Open ‘Application Settings->Network isolation’ tab. Click ‘General’. uncheck the "Isolate current device from the network" click ‘OK’ Click ‘Save’ After these steps, the isolation is turned off Best, Victor

Hi @Yasutoshi Takayama, After installation of Endpoint Agent, please follow these steps: Activate EA with EDRO license trough a “Activation of application” task and confirm there are no activation errors.Ensure you have EA policy created and set to “Synchronize with Administration server settings” options enabled and enforced. Configure Kill Chain by configuring Threat Report. Connect to the web console of the KSC. In the Home page, select the ‘Reports’ tab.Click on ‘Report on threats In ‘report properties, open the ‘Fields’ tab and customizing the report for a user-friendly experience. the main thing: Check the box for ‘Open Incident’ and use the ‘Move up’ button to bring this to the top Click ‘Save’ If issue persists, please create and run the “Change application components” task on the host, enabling Endpoint Agent (Endpoint Sensor) in KES. Hope this helps.

If you first install KES without EA component, and then a standalone KEA package, KES EDRO integration will be disabled and killchain will not work. In order to fix this, please create and run the “Change application components” task on the host, enabling Endpoint Agent in KES. This fixed the current issue, and the incident was generated. The same rule applies: KEA component needs to be installed in KSWS. KSWS does not have a "Change application components" task in KSC, so this has to be taken into account during KSWS deployment.

In regards to the reason for task failures, results could be investigated under installation task results, Kaspersky Event Log, and installation logs. How to get installation or removal logs of Kaspersky Endpoint Security 11 for Windows https://support.kaspersky.com/15524

Installation of a package could be set to run “On completing another task” in the Schedule section of the installation task. So for example, installation of KES could be completed after installation of Network Agent. See below:

KSC's main purpose, in this case, is to deliver the package to the remote device, and once the package is copied over to remove the machine, it would be executed by the parameters set in the command line string provided by 3rd party vendor. The package copied needs to execute silently. If it requires user interaction, the package would not install. You could try to install the package from klshare where the package was created for remote deployment and verify the results. This would confirm if the installer requires user interaction.

In order to enable KES notifications by email, please set the address for email notifications by going to Administration Server properties -> Notification delivery settings -> Notification and input email into Recipients filed. More information here: Configuring email notifications https://support.kaspersky.com/KSC/11/en-US/175966.htm If the issue persists, please contact technical support by opening a support case at companyaccount.kaspersky.com or call 781.503.1880 option 3. Working hours: Mon–Fri, 10:00 am – 5:00 pm (ET) Excluding company holidays https://support.kaspersky.com/us/b2b/US To protect you as our customer, Kaspersky Lab requires any person contacting support to be registered in CompanyAccount. When registering, each person is required to enter a valid company name and contact information. To register for CompanyAccount click on the link below: https://companyaccount.kaspersky.com/account/create *Please note that you will need to log out prior to registering Once at this site: • Click on "Create now." • Enter First name, Last name, Company Name, E-mail address. • Upload a key file (.key) or enter your 20 digit activation code. • Enter the CAPTCHA code • Accept the “terms of Privacy Statement” • Click "Create now" Once completed, you will receive an email with instructions on how to access Kaspersky Lab support. For more details, click on the link below: http://support.kaspersky.com/faq/companyaccount_help

This problem has been observed in KES 11.5, but may apply to other versions as well. ProblemSometimes KES tray icon gives you some unexpected behavior like showing up twice or not appearing at all ( icons next to Windows clock). SolutionReset the tray icons: Open regedit; Go to HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify; In the right pane, backup & delete the IconStreams Registry value; Now back up & delete the PastIconsStream Registry value; Close Registry Editor; Open Task Manger Use File -> Run new task menu item in Task Manager; Type Explorer in the "Create New Task" dialog and press Enter to restore Desktop.This should fix your tray icons issues. The Registry values above represent the notification area icon cache which stores the tray icons for all apps. If this cache is corrupted, it may also prevent system icons from appearing in the tray.