KESS installation fails on DisableWindowsDefender [Kaspersky Embedded Systems Security]

[Egor Erastov]

Installation of affected products fails if it can't disable Windows Defender. To do this, during the installation the installer tries to edit edit local policy settings via Windows APIs, which load cached machine local policy from %windir%\System32\GroupPolicy folder, make changes and save back to the file system.

 

If mentioned operations with local policy fail, MSI log contains following errors:

DisableWindowsDefender: Error: (_com_error): OpenLocalMachineGPO(GPO_OPEN_LOAD_REGISTRY) failed code=<some error code>

OR

 

DisableWindowsDefender: Error: (_com_error): pGroupPolicy->Save failed code=<some error code>

 

KESS 3.1+ and KICS 3.0+ have a setup parameter SKIP_DISABLE_DEFENDER=1, which forces installation to skip the disabling Windows Defender operation:

 

msiexec /i <product msi file> SKIP_DISABLE_DEFENDER=1 /L*V C:\installation.log

 

With SKIP_DISABLE_DEFENDER=1 installation will not touch local group policy files, therefore you have to disable Windows Defender yourself.