Stop KES locally when UI is hidden and endpoint is offline

[Fatemeh]

Hello,

We have the local UI user interface hidden for users. In some cases, endpoints are offline from the Admin Server, so KES cannot be disabled remotely. We need a temporary local way to stop or disable KES for troubleshooting.

I tried:

klpsm.exe stop_avp_service
But it returns:
The call of the ControlService return code 1052: The requested control is not valid for this service.

I also tried "Disabling Protection of application services against external management”, but this allows any user with Administration Privilage to disable KES without authentication.

Is there any supported CLI or local method to stop/disable KES?

[JL - KL DACH]

Hello Fatemeh,

please refer to the following documentation:
AVP commands

Use a CMD Windows started as Admininstrator to run the commands.

Thank you in advance
Best Regards

[Fatemeh]

Hello,

Thank you for the reference.

For anyone facing the same issue: AVP commands work only if the policy allows overwriting local settings. In that case, running AVP commands from an elevated CMD allows stopping specific modules or profiles locally for troubleshooting. If local override is not allowed, this is not possible even with administrator privileges.

Thanks for pointing me to the AVP commands documentation.

Best regards,
Fatemeh