KES and PF installation side effect: HIPS and Firewall rules restored to defaults [KES for Windows]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

This article is about Kaspersky Endpoint Security for Windows (KES for Windows)

 

This article covering the specific effect brought by any PF installation for the following versions:

• KES 11 and higher

Private fix installation on host with KES has a side effect: the HIPS (Host Intrusion Prevention System) configuration will be reset back to defaults and, since Firewall is the part of it, will also restore the network packet and application rules back to their original state. This is done intentionally to prevent storing in local KES cache outdated rules and synchronization issues, which is happening with product from time to time and causing strange and unexpected behavior of the product.  In most cases, this is not crucial, because as long as endpoint managed by Network Agent and KSC, it will reload all settings from the defined policy. But, if KES installed as standalone endpoint and managed via GUI, it is completely expected that no Firewall or HIPS settings will be saved after reboot, so for such configurations it is recommended to have a backup .cfg file.