Jump to content
Kaspersky Support Forum

xpreme

Members
 View Profile  See their activity

  • Posts

    64

  • Joined

  • Last visited

 Content Type 

Posts posted by xpreme

    Automating KES deployment

    in Kaspersky Security Center

    Posted

    Hi,

        I am going to install Network Agent MSI file on clients using GPO in Active Directory. Can I also automate deployment of KES on clients? For instance, every client on which Network Agent has been installed goes to a special group in KSC, then KES starts being installed on those clients automatically.

     

    Thanks in advance

    Export to Syslog Server

    in Kaspersky Security Center

    Posted

    Hi @Joerg Lechea

        Thanks for youe support. As a matter of fact, events are exported while setting on Syslog server but it does not work when choosing Splunk format. Then I checked Kaspersky event in Windows event viewer. I found some errors regarding export failure due to limited functionality mode. So, I guessed it is somthing related to license.

    Thanks

    Export to Syslog Server

    in Kaspersky Security Center

    Posted

    Dear friends,

        Good day. I have configured "Export to SIEM system" on my administration server (Automatically export... was checked as well). But nothing is exported to the syslog server. However, as I enable syslog export on KSWS policy (for servers) it sends data to syslog server (per server) successfully. But I need to send Kaspersky Security Center events to syslog server. Would it be possible? By the way, Kaspersky server has access to syslog server on port 514 UDP and TCP.

    Thanks  in advance

    Changing KLSHARE

    in Kaspersky Security Center

    Posted

    Hi,

        I have just installed KSC 14.2. Now, I want to change the KLSHARE destination. To do so, I have removed the default KLSHARE folder in windows shared folders on Computer Management console. Then I created a new KLSHARE folder pointing to another destination. But, now, when I create a stand-alone installer package it goes to the former destination in C:\ProgramData\... again. What should I do now? Thanks a lot for your tips.

     

    Audit logs

    in Kaspersky Security Center

    Posted

    Dears,

        I am checking Audit logs in event viewer on my KSC windows server. I have found some logon events (ID 4624) which are based ont NTLM. Does it happen normally from clients to the KSC server or it can be unauthorized access? Here is the event details:

    An account was successfully logged on.

    Subject:
        Security ID:        NULL SID
        Account Name:        -
        Account Domain:        -
        Logon ID:        0x0

    Logon Information:
        Logon Type:        3
        Restricted Admin Mode:    -
        Virtual Account:        No
        Elevated Token:        No

    Impersonation Level:        Impersonation

    New Logon:
        Security ID:        "a user in our domain" (I have sealed it)
        Account Name:        "the username"
        Account Domain:        "our domain"
        Logon ID:        0x19565D21
        Linked Logon ID:        0x0
        Network Account Name:    -
        Network Account Domain:    -
        Logon GUID:        {00000000-0000-0000-0000-000000000000}

    Process Information:
        Process ID:        0x0
        Process Name:        -

    Network Information:
        Workstation Name:    "client's computer name"
        Source Network Address:    "client's IP"
        Source Port:        63675

    Detailed Authentication Information:
        Logon Process:        NtLmSsp 
        Authentication Package:    NTLM
        Transited Services:    -
        Package Name (NTLM only):    NTLM V2
        Key Length:        128

     

    Thanks in advance

    Blocking internet access of an application

    in Kaspersky Security Center

    Posted

    Dears,

        I have a specific application on some devices which their access to the internet must be blocked. I tried configuring application rules on Firewall in Kaspersky Security Center (KES policy). However I cannot find it on application rule window. How can it be done actually? Can I define an application manually to block its access to the internet?

    Your help is highly appreciated

     

    Configuring rule based on "Last Visible"

    in Kaspersky Security Center

    Posted

    Thanks for your reply. 

        Infact, we have some users which leave the office for several days occasionally. I want to keep them out of my main managed devices in order not to have lots of devices in Critical status (because of not being connected). While creating periodic reports, active devices need to be taken into account in our company.

     

×
×
  • Create New...