KES 11.0.1.90 - Policy is not supported: Web Control

[Simon Reach]

Short Story Just installed KSC11 on a brand new Server 2016 server and deployed Network Agent 11.0.0.1131 and KES 11.0.1.90 on about 10 machines, 3 of them are fine but the rest are coming back with an error stating "Policy Is Not Supported: Web Control". Does anyone have any ideas? Long Story We've got a current Server 2012 machine running KSC10 managing 200+ devices all running atleast KES 11 and the Network agent version of 10.5, this is running absolutely fine. I've built up a brand new Server 2016 machine and installed KSC11 on it, all of the clients are going to be managed by this new server. The new policy seems to be fine and KES11.1 and Network Agent 11 was deployed out via a task to 10+ clients to make sure they go through ok and everything is working. 3 of the machines are coming up as being fine whilst the rest are reporting issues with "Policy Is Not Supported: Web Control". Has anyone seen this before and know a resolution?

[Dmitry Parshutin]

Short Story Just installed KSC11 on a brand new Server 2016 server and deployed Network Agent 11.0.0.1131 and KES 11.0.1.90 on about 10 machines, 3 of them are fine but the rest are coming back with an error stating "Policy Is Not Supported: Web Control". Does anyone have any ideas? Long Story We've got a current Server 2012 machine running KSC10 managing 200+ devices all running atleast KES 11 and the Network agent version of 10.5, this is running absolutely fine. I've built up a brand new Server 2016 machine and installed KSC11 on it, all of the clients are going to be managed by this new server. The new policy seems to be fine and KES11.1 and Network Agent 11 was deployed out via a task to 10+ clients to make sure they go through ok and everything is working. 3 of the machines are coming up as being fine whilst the rest are reporting issues with "Policy Is Not Supported: Web Control". Has anyone seen this before and know a resolution?

Hello! Can you please provide a screenshot of this error and policy export? Thank you!

[Simon Reach]

Please find the image below, policy linked below as well. The policy was created from the default template and not imported from the old KSC10 server. https://www.filehosting.org/file/details/799412/KSC11%20Client.klp

[Simon Reach]

Just an update, i fully removed both KES11 and the network agent from a machine and then reinstalled it and it is now working fine. Will try to do a task for all of the other machines to remove Kaspersky and then do a reinstall of it.

[Simon Reach]

Just to update my previous message. The issue seemed to go away when i did a full uninstall of the old KES11 and Agent 10.5, after these had been uninstalled and the workstation restarted, everything worked fine with the new install.

[Ali]

We are facing same issue in almost 100 devices, Its not easy to uninstall KES 11 and netagent on all 100 devices or install again. Its not Proper solution. do you have any other solution. Thanks

[Simon Reach]

We are facing same issue in almost 100 devices, Its not easy to uninstall KES 11 and netagent on all 100 devices or install again. Its not Proper solution. do you have any other solution. Thanks

Fraid not, it's the only thing we've found but we've stopped all of our rollout as we've found that the newest Kaspersky is blocking all of our VPN connections and anything that connects to a untrusted certificate, so things like our phone system and backup system.

[Ali]

How to solve the issue "Policy Is Not Supported: Web Control".

[Dmitry Parshutin]

How to solve the issue "Policy Is Not Supported: Web Control".

Hello! Please describe the version of KES and KES plugin installed. Thank you!

[Ali]

How to solve the issue "Policy Is Not Supported: Web Control".

Hello! Please describe the version of KES and KES plugin installed. Thank you!

Kaspersky Endpoint Security for Windows - 11.0.0.6499 Kaspersky Security Center 11 Network Agent 11.0.0.1131

[Kavuser10]

We are facing same issue in almost 100 devices, Its not easy to uninstall KES 11 and netagent on all 100 devices or install again. Its not Proper solution. do you have any other solution. Thanks

Fraid not, it's the only thing we've found but we've stopped all of our rollout as we've found that the newest Kaspersky is blocking all of our VPN connections and anything that connects to a untrusted certificate, so things like our phone system and backup system.

As a temporary workaround you can fix this by disabling Encrypted Connections Scan in policy. You might even fix it by just disabling the Block SSL 2.0 option in Encrypted Connections Scan subsettings. The latter caused a lots of issues for us as well at first. But after disabling it most of the problems went away and I kept the Encrypted Connections Scan. VPN issue is more trickier. Try disabling the ARP Spoofing detection if it's on. Also you have to add your VPN network to Trusted Networks in Firewall.

[Simon Reach]

We are facing same issue in almost 100 devices, Its not easy to uninstall KES 11 and netagent on all 100 devices or install again. Its not Proper solution. do you have any other solution. Thanks

Fraid not, it's the only thing we've found but we've stopped all of our rollout as we've found that the newest Kaspersky is blocking all of our VPN connections and anything that connects to a untrusted certificate, so things like our phone system and backup system.

As a temporary workaround you can fix this by disabling Encrypted Connections Scan in policy. You might even fix it by just disabling the Block SSL 2.0 option in Encrypted Connections Scan subsettings. The latter caused a lots of issues for us as well at first. But after disabling it most of the problems went away and I kept the Encrypted Connections Scan. VPN issue is more trickier. Try disabling the ARP Spoofing detection if it's on. Also you have to add your VPN network to Trusted Networks in Firewall.

Just turned off the block ssl 2.0 option so will see if that works with the web portals. The ARP/MAC spoofing detection was never enabled so it's not that i'm afraid.

[Simon Reach]

The issue has been resolved by downgrading to KES11.0.1 which has resolved every one of our issues.