Kaspersky Endpoint Security 11.6.0.394 and access to the server or to other servers

[Dmitry_blagovest]

Good afternoon.

       There is a server platform with installed windows server 2008r2 - 2012r2 x64 bit. All servers are located in the same domain, universal security policy settings are applied everywhere, without group support and pairing with kaspersky security center 11. All servers have the built-in windows firewall and KES firewall disabled.

The problem itself: Internet access is lost - not a single browser page is opened, smb access to shared folders does not work (ports both new and old - smb v2-v3), consultant +, 1c enterprise does not function properly (you cannot see contractors online or regional exchange does not work).

An attempt to solve the problem was, initially, adding ip-addresses to exceptions as well as folders with software. - did not help.
It helped either to completely turn off the Kaspersky antivirus on the server, or to reboot the server, it was enough for 2-3 days, maximum.
We tried to disable it in the “protection against network threats” tab - consider port scanning and intensive network requests as attacks, it did not help
We tried to disable it in the “Network Threat Protection” tab - add the attacking computer to the block list for 60 minutes (default -) - did not help
It helped as a temporary solution - a complete shutdown of the component - protection against network threats, but there is no benefit, then there is no benefit from this component.
p.s .: This problem was not observed on either KES 10.3 or KES 11.2-11.4. We did not try version 11.5, but immediately jumped with a patch from 11.4 to 11.6.

 

//ModNote: moved.

[R.pine]

Hi @Dmitry_blagovest 

The problem with Kaspersky Endpoint Security 11.6.0.394 will likely require further investigation. please feel free to contact  Kaspersky Technical Support via your Kaspersky Company Account

As a suggestion, I recommend you try to install Kaspersky Security For Windows Server, instead of a complete shutdown, If you are looking for a faster solution. Kaspersky Security for Windows Server usually suitable for critical servers for more details : https://usa.kaspersky.com/small-to-medium-business-security/windows-server-security
How to install Kaspersky Security for Windows Server: https://support.kaspersky.com/13692

 

[Dmitry_blagovest]

Hi @Dmitry_blagovest 

The problem with Kaspersky Endpoint Security 11.6.0.394 will likely require further investigation. please feel free to contact  Kaspersky Technical Support via your Kaspersky Company Account

As a suggestion, I recommend you try to install Kaspersky Security For Windows Server, instead of a complete shutdown, If you are looking for a faster solution. Kaspersky Security for Windows Server usually suitable for critical servers for more details : https://usa.kaspersky.com/small-to-medium-business-security/windows-server-security
How to install Kaspersky Security for Windows Server: https://support.kaspersky.com/13692

 

You wrote to me about another Kaspersky product. I meant the Kaspersky endpoint security-https: //support.kaspersky.com/kes11. And you mean the security version. - https://support.kaspersky.com/13692?_ga=2.138837360.219031543.1628836465-273038231.1628836465

[R.pine]

Hi @Dmitry_blagovest 

I am just giving you another alternative instead of the Kaspersky Endpoint Security 11 version, so that version should not interfere with the SMB ports. 

[Dmitry_blagovest]

Hi @Dmitry_blagovest 

I am just giving you another alternative instead of the Kaspersky Endpoint Security 11 version, so that version should not interfere with the SMB ports. 

Hi. I understood. I installed a different version - the one that was recommended. So far, everything works without problems. I am amazed and amazed that in the system requirements for the first version there is a Windows server 2008r2 - 2019 in the list. Just like that, they would not write such information on the official website. 

https://www.kaspersky.com/small-to-medium-business-security/endpoint-windows

 

[R.pine]

Hi @Dmitry_blagovest 

 

Great! Good to know the version is working without problems. You can obtain the complete manual through  this link : https://support.kaspersky.com/KSWS/11.0.1/en-US/147896.htm

[Dmitry_blagovest]

I tweaked the version without manuals, adding port 135 to the exception, and installed it remotely.

[Dmitry_blagovest]

Hi @Dmitry_blagovest 

 

Great! Good to know the version is working without problems. You can obtain the complete manual through  this link : https://support.kaspersky.com/KSWS/11.0.1/en-US/147896.htm

For the link to the guide - thanks!