Computers auto shutdown after Administration kit update to 11

[TechnicalQ]

Yesterday I’ve ugpraded administration kit from version 10 to version 11 latest.

Today morning many users complained that their computer was shutdown automatically without prior notice.

 

I’ve checked tasks that was inherited from the old version I don’t see auto shutdown set on any task.

 

I have another question, what does “run missed tasks” mean? does it run other scheduled tasks like or does it do exactly?

 

Administration kit version: 11.0.0.1131

[intrusus]

I have another question, what does “run missed tasks” mean? does it run other scheduled tasks like or does it do exactly?

Hi @TechnicalQ 

the “run missed tasks” option determines the behavior of a task if a client device is not visible on the network when the task is about to start.

If this option is enabled, the system attempts to start the task the next time the Kaspersky Lab application is run on the client device:

• If the task schedule is Manually - it’s run Once,
• If the task schedule is Immediately: the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.

You may want to disable this option for a resource-consuming task that you want to run only outside of business hours.

 

Today morning many users complained that their computer was shutdown automatically without prior notice.

 

What are the event logs of the specific client devices are saying? Check out the events in the client or administration server reports, please.

Cheers,
Leon

[TechnicalQ]

Thank you I suspect the issue was because I had “advanced disinfection” activated on one scan task that cause forced restart.

[intrusus]

Hey @TechnicalQ 

sounds good, always glad if someone figures it out himself. 😎

In general please use the “adavanced desinfection” only if an active threat occurs. This feature is aimed at purging the Windows operating system of malicious programs that have already started their processes in RAM and that prevent KES from removing them by using other methods. The threat is neutralized when Advanced Disinfection technology is applied. While Advanced Disinfection is in progress, you are advised to refrain from starting new processes or editing the Windows operating system registry. After the Advanced Disinfection procedure is completed, the application restarts the protected machine. This caused your problem btw. 😉

After reboot, the program deletes malware files and starts a "lite" full scan of the protected computer.

For your future & as a tip, Kaspersky teaches you to use the feature like this:

1. Disconnect the infected device from the corporate network
2. Disable the KSC policy locally (via right-click menu on KES-Symbol in Traybar)
3. Open KES Settings locally
4. Goto General Settings > Application Settings > Select checkbox “Enable Advanced Disinfection technology”
5. Run a virus scan task locally
6. Restart the computer, connect it to the internet again (maybe outside the windows network, so put in some kind of protected VLAN)
7. Scan the whole computer again

Cheers Mate,
Leon