Event "Web page access blockage message to administrator" didn't received

[AHmed Abdulla]

Good Afternoon Colleagues

I hope you are doing well . We have applied web control at one of our customers to block some categories of web pages . When webpage blocked , The user click "Request access" so he can send message to LAN administrator to approve access if applicable.

When the user send "Message to LAN administrator" , We didn't receive it at Events => User Requests.

 

I have created a new selection adding only the event "Web page access blockage message to administrator/Compliant about a blocked web page" as attached.

 

Also no events received for new selection.

 

So kindly advice what is the issue and how to solve it.

 

Best Regards

[KarDip]

Good afternoon!  @AHmed Abdulla

It sounds like the user requests for access approval aren't being registered properly within the system. Let's go over some steps to troubleshoot and address this issue:

1. Check Web Control and Policy Settings:

• Ensure that Web Control is properly configured, and the "Request Access" option is enabled in the relevant policy.
• Confirm that the administrator email or notification method is correctly set in the policy.

2. Review Event Configuration:

• Make sure that the correct event types are selected under Events > User Requests.
• Check if the "Web page access blockage message to administrator" event is logged under other filters like Blocked Pages or Policy Events, to ensure it isn't miscategorized.

3. Permissions and Roles:

• Verify if the user role or permissions you are using allows access to receive these specific events. There may be restrictions or missing rights.

4. Network or Communication Issues:

• Ensure that the message delivery system (email server or event logging system) is properly configured and working without disruptions.
• Test if other event notifications (e.g., security alerts) are being received correctly by the LAN administrator.

5. Synchronization and Updates:

• Confirm that the endpoint agent on the user’s machine is synchronized with the central system. Sometimes, a sync delay can cause events to not appear immediately.
• Make sure that both the client agent and the central system are running the latest updates to avoid bugs.

6. Check System Logs:

• Inspect the system logs (both on the endpoint and the central management server) for any errors related to Web Control or User Requests. This could provide more clues about communication breakdowns.

7. Test Scenarios:

• Try creating a test policy with a simpler web control rule and see if the user request is logged correctly under that setup.
• Have a test user submit a request from a different machine or network segment to rule out local issues.

8. Kaspersky Support or Forums:

• If all the settings appear correct but the issue persists, it could be a bug. It’s worth contacting Kaspersky support with detailed logs and screenshots to escalate the issue.

Let me know if these steps help or if you encounter anything specific during troubleshooting!

Thank you

[AHmed Abdulla]

Good Morning @KarDip

Thx for your detailed replay. May i know how to check weather on not option "Request Access" is enabled for web control?

 

Best Regards

[KarDip]

You're welcome! To check if the "Request Access" option is enabled in your Kaspersky Web Control policy, follow the steps below depending on your management console (either Kaspersky Endpoint Security Cloud or Kaspersky Security Center).

For Kaspersky Endpoint Security Cloud:

1. Login to the Kaspersky Security Cloud Portal.

   • Open your browser and go to the Kaspersky Endpoint Security Cloud console.
   • Log in using your administrator credentials.

2. Navigate to Security Policies:

   • On the left panel, go to Devices → Policies.

3. Select the Policy Applied to the Target Device:

   • Find and click the policy applied to the relevant group of devices/users.

4. Locate the Web Control Module:

   • In the policy settings, look for Web Control (usually under "Security Profiles" or directly listed under the policy modules).

5. Check the Block Action for Specific Web Categories:

   • In the Web Control settings, find the list of blocked categories.
   • Click on the relevant blocked category (or categories) to open the action settings.

6. Verify the "Request Access" Option:

   • In the action settings for each blocked category, ensure the "Allow users to request access" checkbox is enabled.
   • If this option is unchecked, the request feature won’t appear for the user.

7. Save the Changes and Apply Policy:

   • If you enable or change anything, click Save and make sure the policy is applied to the devices/users in question.

---

For Kaspersky Security Center:

1. Open the Kaspersky Security Center Console.

   • Log into the Kaspersky Security Center as an administrator.

2. Go to Managed Devices → Policies.

   • Find the policy that applies to the group or individual endpoints you are managing.

3. Edit the Relevant Policy:

   • Right-click the policy and choose Properties or Edit.

4. Locate Web Control Settings:

   • Expand General Settings and look for Web Control in the list.

5. Check Block Actions and Request Settings:

   • Inside the Web Control module, click on the category rules where the blockage occurs.
   • For each blocked category, ensure that the "Allow users to request access" option is enabled.

6. Save Changes and Force Synchronization:

   • If you made any changes, click OK or Apply.
   • Force a policy synchronization with the devices to ensure the updated settings are applied.

---

By following these steps, you can ensure the "Request Access" feature is correctly enabled. If the option was already enabled, you might need to troubleshoot further by testing communication or checking logs. Let me know if you need additional help!

Thank you

Edited October 28 by KarDip
content edit

[AHmed Abdulla]

Good Morning @KarDip

Thanks for your replay and your fast response . We are using Kaspersky Security Center 14.2 . 

 

I browse to Policy => Security Controls =>Web Control =>I open one of the rules as per the attached image but i still can't find the option  "Allow users to request access"

 

Can you clarify where i can find it ?

 

Best Regards

[KarDip]

Hello @AHmed Abdulla

Okay it  sounds like you're close to finding the right setting but not seeing the "Allow users to request access" option. Let’s walk through a couple of additional scenarios that might explain why it’s not visible and guide you to find the correct setting.

1. Ensure Full Administrator Permissions

• Verify that your account has full administrative rights to modify the Web Control policy. Some features might not appear if your role or permissions are limited.

---

2. Double-Check Policy Version Compatibility

• Legacy policies or certain versions of Kaspersky Endpoint Security may not display this feature the same way. Make sure the version of the product you’re using supports the request access feature.

• Ensure that Kaspersky Endpoint Security for Business or Kaspersky Cloud Endpoint Security is updated. Some features, like user access requests, are only available in the latest versions.

---

3. Switch Between "Block" and "Warn" Modes

• In Web Control, if the action for a category is set to "Block," try switching it temporarily to "Warn" and see if an option for user access requests appears. In some configurations, the "Request Access" feature might only show up if "Warn" or "Interactive" modes are active.

---

4. Alternative Location for Access Requests Feature

• If it’s not under Web Control Rules, try the following:
  1. Policy → User Notifications/Reports:
     • Sometimes, the "Request Access" feature is configured under notifications or alerts rather than Web Control directly.
  2. Look for Notifications Settings or User Requests Configuration.

---

5. Update the Kaspersky Web Control Module

• If the feature is missing entirely:
  • Make sure the Web Control module is fully installed and up-to-date on all endpoint devices.
  • Go to Policies → Modules to confirm that Web Control is activated as part of the active policy.

---

6. Testing with Another Rule Set or Template Policy

• If the feature doesn’t appear in your current rule, try:
  1. Creating a new Web Control rule from scratch.
  2. Use a default template policy to see if the "Request Access" option becomes visible in the new configuration.

---

7. Check the Documentation

• Review the Kaspersky documentation for your product version to confirm the exact steps and location for enabling user access requests. There might be product-specific variations or requirements.

---

If none of the above resolves the issue, could you upload a screenshot or describe the options you see within the Web Control rule? That way, I can assist more precisely.

Thank you

[AHmed Abdulla]

Good Afternoon @KarDip

I have go through all points but still can't find the option "Allow users to request access"

I have attached snapshots from WebControl in addition from Notifications related to WebControl.

 

So kindly advice.

 

Best Regards

 

[KarDip]

Hello @AHmed Abdullah 

It seems you’re trying to enable or find the "Allow users to request access" feature, typically related to Web Control in Kaspersky Endpoint Security Cloud. 

In the screenshot i encircled in red "allow users" test that first before you attempt below help.

_____________________________________________________________________________________

It seems you’re trying to enable or find the "Allow users to request access" feature, typically related to Web Control in Kaspersky Endpoint Security Cloud. Let’s walk through what might be going wrong, and where this setting is usually found.

Troubleshooting Steps:

1. Verify Web Control Policy Settings

Ensure you are checking the correct policy associated with the device or user group.

1. Navigate to Security Management → Policies.

2. Open the active policy applied to the affected device or group.

3. Look for the Web Control section.

4. In Web Control Settings, ensure the following:

   • Enable Web Control is checked.
   • Review all categories or specific websites to see if blocking rules are set.

5. Some versions provide a Request Access feature directly under the Blocking configuration or category rules. Look for an option labeled "Allow users to request access when a website is blocked."

2. Location of “Allow Users to Request Access” Option

In Kaspersky, this setting may sometimes not be directly labeled as "Allow users to request access." Instead, try the following:

• Open the Notifications or Advanced settings tab under Web Control.
• Look for a checkbox or drop-down allowing users to request website access for blocked categories.
• If missing: This option might only be available in specific Kaspersky editions or configurations. Confirm whether your current plan supports this feature (e.g., some cloud versions might lack it).

3. Check Policy Sync and Permissions

• Ensure the policy has been successfully applied and synced to the endpoint.
• Go to Devices → Select Device → Check Policy Sync to ensure the latest policy is active.
• Also, verify if your administrative role gives full control over the Web Control settings. If not, check with another admin or adjust your role permissions.

4. Notifications Section Configuration

Ensure that Web Control notifications are properly configured:

• Go to Settings → Notifications in the console.
• Make sure notifications related to user requests or website access requests are enabled and routed to the appropriate channels (e.g., cloud console, email alerts).

5. Try Different User Interfaces

Sometimes, certain features are accessed via the local client agent UI on the endpoint. Open Kaspersky Endpoint Security on the user’s computer and:

• Go to Web Control and attempt accessing a blocked site to see if an access request prompt appears.
• Some access request options may only become visible at the endpoint level.

6. Kaspersky Endpoint Security Cloud Plan Limitations

It’s possible that this feature is not included in your current Kaspersky Cloud plan. If this option is missing altogether, confirm with Kaspersky support whether your edition supports access request functionality.

---

If you’re still stuck, feel free to provide more details from your snapshots, or directly contact Kaspersky Technical Support with the logs for deeper troubleshooting.lease try mthat first before y

Troubleshooting Steps:

1. Verify Web Control Policy Settings

Ensure you are checking the correct policy associated with the device or user group.

1. Navigate to Security Management → Policies.

2. Open the active policy applied to the affected device or group.

3. Look for the Web Control section.

4. In Web Control Settings, ensure the following:

   • Enable Web Control is checked.
   • Review all categories or specific websites to see if blocking rules are set.

5. Some versions provide a Request Access feature directly under the Blocking configuration or category rules. Look for an option labeled "Allow users to request access when a website is blocked."

2. Location of “Allow Users to Request Access” Option

In Kaspersky, this setting may sometimes not be directly labeled as "Allow users to request access." Instead, try the following:

• Open the Notifications or Advanced settings tab under Web Control.
• Look for a checkbox or drop-down allowing users to request website access for blocked categories.
• If missing: This option might only be available in specific Kaspersky editions or configurations. Confirm whether your current plan supports this feature (e.g., some cloud versions might lack it).

3. Check Policy Sync and Permissions

• Ensure the policy has been successfully applied and synced to the endpoint.
• Go to Devices → Select Device → Check Policy Sync to ensure the latest policy is active.
• Also, verify if your administrative role gives full control over the Web Control settings. If not, check with another admin or adjust your role permissions.

4. Notifications Section Configuration

Ensure that Web Control notifications are properly configured:

• Go to Settings → Notifications in the console.
• Make sure notifications related to user requests or website access requests are enabled and routed to the appropriate channels (e.g., cloud console, email alerts).

5. Try Different User Interfaces

Sometimes, certain features are accessed via the local client agent UI on the endpoint. Open Kaspersky Endpoint Security on the user’s computer and:

• Go to Web Control and attempt accessing a blocked site to see if an access request prompt appears.
• Some access request options may only become visible at the endpoint level.

6. Kaspersky Endpoint Security Cloud Plan Limitations

It’s possible that this feature is not included in your current Kaspersky Cloud plan. If this option is missing altogether, confirm with Kaspersky Technical support whether your edition supports access request functionality.

---

If you’re still stuck, feel free to provide more details from your snapshots.

Thank you

Edited October 30 by KarDip

[KarDip]

On 10/21/2024 at 7:24 PM, AHmed Abdulla said:

Good Afternoon Colleagues

I hope you are doing well . We have applied web control at one of our customers to block some categories of web pages . When webpage blocked , The user click "Request access" so he can send message to LAN administrator to approve access if applicable.

When the user send "Message to LAN administrator" , We didn't receive it at Events => User Requests.

 

I have created a new selection adding only the event "Web page access blockage message to administrator/Compliant about a blocked web page" as attached.

 

Also no events received for new selection.

 

So kindly advice what is the issue and how to solve it.

 

Best Regards

Hello @AHmed Abdulla

This post relates to your first post please review.

If the user’s message isn’t showing under Events → User Requests in Kaspersky Endpoint Security Cloud, there may be a few possible causes. Let's walk through some troubleshooting steps to identify and resolve the issue:

1. Check Policy Configuration

• Go to Policies for the affected group or device.
• Look for Notification settings or User requests settings under the policy.
• Ensure that Send message to LAN administrator is enabled and configured to send messages appropriately (to cloud console).

2. Verify Agent-to-Cloud Communication

• Ensure the affected endpoint is successfully communicating with the Kaspersky Endpoint Security Cloud.
• Check the Device Management section for the last communication time and ensure the agent is connected and up-to-date.

3. Review Endpoint Logs

On the client machine:

• Open Kaspersky Endpoint Security.
• Go to Reports or Detailed logs.
• Check if the Message to LAN administrator event was successfully generated and transmitted.

4. Permissions and Role Configuration

• Ensure that the role assigned to you within Kaspersky Endpoint Security Cloud allows access to Events → User Requests.
• Go to Settings → Administrators and verify the roles assigned to your account.

5. Check for Errors in Event Logs

• If there are any sync issues or errors, they might show up in Events → System or Administration → Issues and alerts.
• Look for any alerts about message delivery or endpoint connectivity.

6. Test with Another Device or User

• Ask another user or endpoint to try sending a Message to LAN administrator and see if it shows up.
• This can help determine if the issue is device-specific or a broader configuration problem.

7. Agent Version and Updates

• Make sure the endpoint device has the latest version of Kaspersky Endpoint Security installed.
• Outdated agents might fail to send certain events properly to the cloud console.

8. Network Issues or VPN Interference

• Check if any network restrictions or VPN settings (like Kaspersky VPN) are blocking the communication between the endpoint and the Kaspersky Cloud Console.

If none of these solutions work, it may be worth contacting Kaspersky Technical Support for further investigation and providing them with logs from both the endpoint and the cloud console.

Thank you

 

Edited October 30 by KarDip
element source

[AHmed Abdulla]

Good Morning @KarDip

I am really much appreciated your great support in this case . let me clarify the below points:

• The customer is using Kaspersky Security Center not Kaspersky Endpoint Security Cloud.
• In our lab , When we send "Message to LAN administrator" , We received it at Events => User Requests successfully in spite of the fact that "Allowed Access" option is not selected.
• At customer site , I need to confirm also that When there is webpage block ,  the user successfully redirect to page "The requested web page cannot be provided" where the "Request access" is appear as per the attached snapshot.
• Once user click the "Request access" , He redirect to "Message to LAN administrator" page as per the attached snapshot.
• When the user send "Message to LAN administrator" , We didn't receive it at Events => User Requests and this is the issue

 

Hopefully i could clarify the situation so far.

 

Waiting for your feedback.

 

Thx in advance.

 

Best Regards

[KarDip]

Hello @AHmed Abdulla

Okay thank you for the update there is a process in doing this we are on the last task after this if you still cannot figure out why this issue is still happening you need  to contact Kaspersky Technical support.

____________________________________________________________________________________________________________________________

For the scenario you’re troubleshooting, it sounds like there's a discrepancy between the lab environment and the customer site in handling "Message to LAN administrator" requests when users encounter a blocked webpage.

Suggested Troubleshooting Steps:

1. Policy Review on User Requests:

   • In the Security Center, check the Web Control and Application Control policies to ensure the "Request access" settings are configured identically in both environments (lab and customer site).
   • Confirm that the "Allowed Access" option is consistently configured under both policies. The request flow may vary if this option is implicitly activated or if there’s a discrepancy in handling across policies.

2. Event Notification Settings:

   • Go to Events & Notifications and verify that User Requests are configured to log and send notifications in both setups. This includes settings for Events => User Requests.
   • Ensure that notifications and logging for “Message to LAN administrator” requests are enabled under Endpoint Protection events.

3. Check User Permissions and Endpoint Settings:

   • Confirm the endpoint user permissions allow message routing to administrators.
   • Sometimes, discrepancies arise if user access permissions differ between the lab environment and customer site.

4. Update and Synchronize Policies:

   • If possible, export the lab environment policy settings for "User Requests" and import them to the customer site to ensure a consistent configuration.
   • If this issue persists, consider synchronizing all policies manually between both environments to rule out minor discrepancies that could impact behavior.

5. Review Web Control Block Page:

   • Check the configuration of the blocked webpage redirect for consistency. This can sometimes vary if there are custom redirects or additional options in the Web Control settings.

After these checks, test again to confirm if the customer site now correctly receives messages in Events => User Requests upon clicking "Request access." If the issue remains, logs from both the Security Center and endpoints at the customer site may provide further insights.

Thank you

[KarDip]

Hello @AHmed Abdulla

Just curious to know how you went in solving this above issue?

Thank you

[AHmed Abdulla]

Good Morning @KarDip

Thanks for your follow-up . The customer has internal issue so we are waiting for the issue to be solved before test the steps shared here.

 

Also i will confirm you regarding other thread "Email Notification - Office 365" once confirmed

 

Thanks in advance.

 

Best Regards

[KarDip]

5 hours ago, AHmed Abdulla said:

Good Morning @KarDip

Thanks for your follow-up . The customer has internal issue so we are waiting for the issue to be solved before test the steps shared here.

 

Also i will confirm you regarding other thread "Email Notification - Office 365" once confirmed

 

Thanks in advance.

 

Best Regards

Hello @AHmed Abdulla

Okay thanks for  the feedback.

[Renan Corassa]

@Ahmed Abdulla
Qual o DBMS utilizado ?

[Caos]

@Renan Corassa

Please remember: This is the English forum.

Regards

[JL - KL DACH]

Hello Ahmed Abdulla,

I am not sure if this will help in this case but please refer to the following description
Editing templates of Web Control messages

The Screenshot show how to configure it in Web Control Settings of the KES Policy

Best regards

[AHmed Abdulla]

Good Afternoon @JL - KL DACH

Thx for trying to help . I will test the steps shared by @KarDip once the customer ready and will revert back to both of you.

 

Thx in advance.

 

Best Regards

[mramasum264]

Hi, Thanks for share it
 

[AHmed Abdulla]

Good Afternoon @KarDip

I would like to share with you that issue has been solved . The issue that the customer needs to enable "Web page access blockage message to administrator " in policy.

 

Once enabled , issue has been solved.

 

Thanks for your great support in this case.

 

Best Regards

[KarDip]

@AHmed Abdulla

OK your welcome and thanks for the Solve update. 

[AHmed Abdulla]

@KarDipMost Welcome