KES Mac 11 - Update Task and Network Agent Problems

[intrusus]

Dear Community, dear KL-Team, following fact: the new KES 11 for macOS is not executed correctly in our environment. Update tasks can neither be started remotely nor via the GUI. An Incident is already opened (INC000010353734 and INC000010487018), there is actually no really progress here however. The corresponding trace files can be found here. Via Kaspersky Security Center I can see that the KES is running, but the agent is displayed as inactive. I believe that the error is due to an incorrect adoption of the policy. After running the klnagchk -sendhb locally I get the following error message: The error shown in the screenshot continues after re-installing the network agent. We use the following programs:

1. KES Mac 11.0.0.51
2. Network Agent Mac 11.0.0.23

Is there a workaround for this? If not, I hope for a solution from support and will publish it here for everyone. Best regards Leon

[Nikolay Arinchev]

Hi, INC000010487018 is at work at the moment. Please await for an answer within the incident shortly.

[intrusus]

I have received feedback from support. The product cannot be controlled via KSC while the agent is not running. Of course I am aware of this, but it's funny that the tasks can still not be started locally. Probably the KES lacks the policy. I have now told my user to uninstall the agent and delete the directory: /Library/Application Support/.../klnagent_conf/. The user then has to reinstall the agent locally. If I have any news, I will post it here.

[donkeykongjr]

Dear Community, dear KL-Team, following fact: the new KES 11 for macOS is not executed correctly in our environment. Update tasks can neither be started remotely nor via the GUI. An Incident is already opened (INC000010353734 and INC000010487018), there is actually no really progress here however. The corresponding trace files can be found here. Via Kaspersky Security Center I can see that the KES is running, but the agent is displayed as inactive. I believe that the error is due to an incorrect adoption of the policy. After running the klnagchk -sendhb locally I get the following error message:

Hey Intrusus, Were you able to get anywhere with this? We have exactly the same problem with the Network Agent on all of our Mac installations. We have not yet deployed KES, just the agent itself. These appear to install without issue but never check in to the KSC. Running klnagchk on the machines gives us exactly the same error as above - 1128 the product was not installed correctly.

[intrusus]

donkeykongjr Maybe I closed this topic a little hastily, sorry.:thinking: I haven't received any feedback from the user yet, I hope the problem is solved now. But if you also found this error, I suspect bad. I'll get back to you as soon as I have news! Cheers Leon Nikolay arinchev Please uncheck the "best solution" so that the topic remains open for the moment, as the complete troubleshooting has not yet been confirmed. Thx!

[donkeykongjr]

Hi guys, Thanks for replying. I have managed to work around this now and for the affected machines have run a shell script to uninstall the agent through our RMM system followed by another to install it and all seems to be fine now. For some reason installing from the dmg seemed to cause an issue on some machines, For these ones, extracting the contents of the dmg and installing using the shell script with a few changes seems to be fine.

[intrusus]

I can finally confirm it too: Actually the agent has to be uninstalled manually (or via script) and then has to be reinstalled. Apparently the installer is buggy and doesn't always install the Network Agent in a clean way. After this walkaround the KES could be managed locally and remotely again.:thumbsup_tone2: I also stumbled across another bug: when checking ./klnagchk -sendhb I received the error message that the module SendHeartbeat is no longer available - bit strange:thinking: Thanks donkeykongjr for confirming the bug and the corresponding walkaround, I have informed the technical support that other customers are also affected. Cheers Leon