KlNagSvc Profile folder

[ak01]

We noticed that our clients now have KlNagSvc and ksnproxy Profile Folders (in C:\Users).

Is that normal (I guess that this is caused by KSC agent and/or distribution point)? If yes, could you please explain the background (what is the reason for that)?

I only found this concerning distribution point: https://help.kaspersky.com/KSC/11/en-us/188662.htm

I have KSC12 and KES11.3.

[ak01]

Can anyone answer my question?

[Guest #37]

Hi,

Network Agent in KSC 11 has a new service account created during installation, this account is used when network agent acts as a KSN Proxy.

 

Account parameters:

 

KlNagSVC obtains rights "Log on as a service" and "Deny log on locally"

(SE_NETWORK_LOGON_NAME)

(SE_DENY_INTERACTIVE_LOGON_NAME)

 

Pseudo random number generator from "windows cryptographic service provider" is used to generate password. The password is generated in accordance with policy and stored in encrypted form. The encryption key is stored in Windows Protected Storage.

 

Please be informed that newer version of KLNagent, available in KSC 12,  has implemented new feature allowed to use a virtual service account with the name "NT SERVICE\ksnproxy", in cases when klnagent is acting as the KSNProxy;

 

The ksnproxy service must have access to Kaspersky Security Center Network Agent data -

 1) on host that is not domain controller:

   the account "NT SERVICE\ksnproxy" (virtual service account) is a member of the KLAdmins group

2) on host that is a domain controller:

   the account "NT SERVICE\ksnproxy" (virtual service account) has assigned proper ACL rights to folders and sections of the Registry:

    ◾HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34

   installation folder

  ◾%ALLUSERSPROFILE%\KasperskyLab\adminkit\

 

Upgrade to new version of klnagent replaces KlNagSvc with "NT SERVICE\ksnproxy" virtual account.

 

Regards