KES v13 - WHT is happening? Do not upgrade!

[Kavuser10]

I’m stunned. What the hell is going on with KSC v13 and KES v11.6?

 

After the disastrous upgrade we got everything back to normal and everything was working fine yesterday. Today I come in to work and need to troubleshoot an issue. For that I need to disable Application Control on one machine. I open the KSC Console and my jaw drops to table.

Literally every workstation has been wiped from KSC! Wth? Really?

The I open the Unassigned Devices and every device is created there double with some garbage random names. Every machines says created 14 hours ago. All of course outside of our security policies. And it seems that network agent is not installed on a bunch of computers anymore.

 

Now, instead of working on stuff I need to work on, I’m rebuilding our KSC because to get everything back to normal I need to delete absolutely everything from KSC and do another network discovery and then move everything back to proper management groups. So pretty much back to when we upgraded but this time we even did not do anything ourselves.

 

What is going on with KSC v13? Was there some kind of update pushed yesterday? What is happening here? Will anyone from Kaspersky bothers to post here anymore? We are so close to moving to Sophos.

[Kavuser10]

I see now that there’s two patches released yesterday for KSC server and Agent. They are in unapproved state in KSC. Does this mean that those patches got pushed out by Kaspersky automatically anyway? That would explain this horrible mess.

[Kavuser10]

I think I figured out what has happened here. Turns out that that KSC Agent v13 has an option to install any of the undefined updates automatically and it’s enabled by default. Nice!

So when the patch was released it went straight out to all the machines and as there’s obviously still an issue even in the latest version of KSC that was uploaded lately, it just did the same thing that happened during the upgrade.

[KESuser]

I think there was an openssl patch for the NetAgent, and for the groups that we have configured Automatic Installation it automatically reinstalled NetAgent with the patch.

For some reason, whenever NetAgent is updated (since version 13) KES SC is considering it a new device and marking the old one as unmanaged, then we have to again move from Unassigned devices to the correct group.

 

I hope Kaspersky solved this issue, we cannot afford to do this after each update.

[jrudd]

This was a problem for us as well and caused our 1300+ machines to become new machines and have to be placed in all of their groups and locations again as well but even worse is that because it counted them as a new machine the licensing went crazy and went over causing all of our users to get popups of needing to Renew or Uninstall Kaspersky Security and then once that was fixed by clearing out the original entries in the Admin center and then even at that, once users licensing cleared again it made them accept the terms for KSN…