Appendices

This section provides reference information and additional facts regarding the use of Kaspersky Security Center.

Advanced features

This section describes a range of additional options of Kaspersky Security Center designed for expanding the functionality of centralized management of applications on devices.

Kaspersky Security Center operation automation. klakaut utility

You can automate the Kaspersky Security Center operation using the klakaut utility. The klakaut utility and a Help system for it are located in the Kaspersky Security Center installation folder.

Custom tools

Kaspersky Security Center allows you to create a list of custom tools (hereinafter also referred to simply as tools), that is, applications activated for a client device in Administration Console, through the Custom tools group of the context menu. Each tool in the list will be associated with a separate menu command, which Administration Console uses to start the application corresponding to that tool.

The applications starts on the administrator's workstation. The application can accept the attributes of a remote client device as command-line arguments (NetBIOS name, DNS name, or IP address). Connection to the remote device can be established through tunneling.

By default, the list of custom tools contains the following service programs for each client device:

• Remote diagnostics is a utility for remote diagnostics of Kaspersky Security Center.
• Remote Desktop is a standard Microsoft Windows component named Remote Desktop Connection.
• Computer Management is a standard Microsoft Windows component.

To add or remove custom tools, or to edit their settings,

In the context menu of the client device, select Custom tools → Configure custom tools.

The Custom tools window opens. In this window, you can add custom tools or edit their settings by using the Add and Modify buttons. To remove a custom tool, click the remove button with the red cross icon ().

Network Agent disk cloning mode

Cloning the hard drive of a reference device is a popular method of software installation on new devices. If Network Agent is running in standard mode on the hard drive of the reference device, the following problem arises:

After the reference disk image with Network Agent is deployed on new devices, they are displayed in Administration Console under a single icon. This problem arises because the cloning procedure causes new devices to keep identical internal data, which allows the Administration Server to associate a device with an icon in Administration Console.

The special Network Agent disk cloning mode allows you to avoid problems with an incorrect display of new devices in Administration Console after cloning. Use this mode when you deploy software (with Network Agent) on new devices by cloning the disk.

In disk cloning mode, Network Agent keeps running but does not connect to the Administration Server. When exiting the cloning mode, Network Agent deletes the internal data, which causes Administration Server to associate multiple devices with a single icon in Administration Console. Upon completing the cloning of the reference device image, new devices are displayed in Administration Console properly (under individual icons).

Network Agent disk cloning mode use scenario

1. The administrator installs Network Agent on the reference device.
2. The administrator checks the Network Agent connection to the Administration Server using the klnagchk utility.
3. The administrator enables the Network Agent disk cloning mode.
4. The administrator installs software and patches on the device, and restarts it as many times as needed.
5. The administrator clones the hard drive of the reference device on any number of devices.
6. Each cloned copy must meet the following conditions:
   1. The device name must be changed.
   2. The device must be restarted.
   3. The disk cloning mode must be disabled.

Enabling and disabling the disk cloning mode using the klmover utility

To enable or disable the Network Agent disk cloning mode:

1. Run the klmover utility on the device with Network Agent installed that you have to clone.

   The klmover utility is located in the Network Agent installation folder.

2. To enable the disk cloning mode, enter the following command at the Windows command prompt: klmover -cloningmode 1.

   Network Agent switches to disk cloning mode.

3. To request the current status of the disk cloning mode, enter the following command at the command prompt: klmover -cloningmode.

   The utility window shows whether the disk cloning mode is enabled or disabled.

4. To disable the disk cloning mode, enter the following command in the utility command line: klmover -cloningmode 0.

Preparing a reference device with Network Agent installed for creating an image of operating system

You may want to create an operating system image of a reference device with Network Agent installed and then to deploy the image on the networked devices. In this case, you create an operating system image of a reference device on which the Network Agent has not yet been started. If you start the Network Agent on a reference device before creating an operating system image, Administration Server's identification of devices deployed from an operating system image of the reference device will be problematic.

To prepare the reference device for creating an image of the operating system:

1. Make sure that the Windows operating system is installed on the reference device and install the other software that you need on that device.
2. On the reference device, in the Windows Network Connections settings, disconnect the reference device from the network where Kaspersky Security Center is installed.
3. On the reference device, start the local installation of Network Agent by using the setup.exe file.

   The Kaspersky Security Center Network Agent Setup Wizard starts. Follow the instructions of the Wizard.

4. On the Administration Server page of the Wizard, specify the Administration Server IP address.

   If you do not know the exact address of the Administration Server, enter localhost. You can change the IP address later by using the klmover utility with the -address key.

5. On the Start application page of the Wizard, disable the Start application during installation option.
6. When the Network Agent installation is complete, do not restart the device before creating an operating system image.

   If you restart the device, you will have to repeat the whole process of preparing a reference device for creation of an operating system image.

7. On the reference device, in the command line, start the sysprep utility and execute the following command: sysprep.exe /generalize /oobe /shutdown.

The reference device is ready for creating an operating system image.

Configuring receipt of messages from File Integrity Monitor

Managed applications such as Kaspersky Security for Windows Server or Kaspersky Security for Virtualization Light Agent send messages from File Integrity Monitor to Kaspersky Security Center. Kaspersky Security Center also allows you to monitor any changes to critically important components of systems (such as web servers and ATMs) and promptly respond to breaches of the integrity of such systems. For these purposes, you can receive messages from the File Integrity Monitor component. The File Integrity Monitor component lets you monitor not only the file system of a device, but also its registry hives, firewall status, and the status of connected hardware.

You must configure Kaspersky Security Center to receive messages from the File Integrity Monitor component without using Kaspersky Security for Windows Server or Kaspersky Security for Virtualization Light Agent.

To configure receipt of messages from File Integrity Monitor:

1. Open the system registry of the device on which Administration Server is installed (for example, locally, using the regedit command in the Start → Run menu).
2. Go to the following hive:
   • For 32-bit systems:

     HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\1093\1.0.0.0\ServerFlags

   • For 64-bit systems:

     HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\1093\1.0.0.0\ServerFlags

3. Create keys:
   • Create the key KLSRV_EVP_FIM_PERIOD_SEC to specify the time period for counting the number of processed events. Specify the following settings:
     1. Specify KLSRV_EVP_FIM_PERIOD_SEC as the key name.
     2. Specify DWORD as the key type.
     3. Specify a range of values for the time interval from 43 200 to 172 800 seconds. By default, the time interval is 86 400 seconds.
   • Create the key KLSRV_EVP_FIM_LIMIT to limit the number of received events for the specified time interval. Specify the following settings:
     1. Specify KLSRV_EVP_FIM_LIMIT as the key name.
     2. Specify DWORD as the key type.
     3. Specify a range of values for received events from 2 000 to 50 000. The default number of events is 20 000.
   • Create the key KLSRV_EVP_FIM_PERIOD_ACCURACY_SEC to count events with accuracy up to a specific time interval. Specify the following settings:
     1. Specify KLSRV_EVP_FIM_PERIOD_ACCURACY_SEC as the key name.
     2. Specify DWORD as the key type.
     3. Specify a range of values from 120 to 600 seconds. The default time interval is 300 seconds.
   • Create the key KLSRV_EVP_FIM_OVERFLOW_LATENCY_SEC so that, after the specified amount of time, the application can check whether the number of events processed over the time interval is turning out to be less than the specified limit. This check is performed upon reaching the limit for receiving events. If this condition is met, the application resumes saving events to the database. Specify the following settings:
     1. Specify KLSRV_EVP_FIM_OVERFLOW_LATENCY_SEC as the key name.
     2. Specify DWORD as the key type.
     3. Specify a range of values from 600 to 3 600 seconds. The default time interval is 1 800 seconds.

   If the keys are not created, the default values are used.

4. Restart the Administration Server service.

The limits on receiving events from the File Integrity Monitor component will be configured. You can view the results of the File Integrity Monitor component in the reports named Top 10 rules of File Integrity Monitor / System Integrity Monitoring that were triggered on devices most frequently and Top 10 devices with File Integrity Monitor / System Integrity Monitoring rules most frequently triggered.

Administration Server maintenance

The Administration Server maintenance allows you to reduce the database volume, and improve the performance and operation reliability of the application. We recommend that you maintain the Administration Server at least every week.

The Administration Server maintenance is performed using the dedicated task. The application performs the following actions when maintaining the Administration Server:

• Checks the database for errors.
• Re-organizes database indexes.
• Updates the database statistics.
• Shrinks the database (if necessary).

The Administration Server maintenance task supports MariaDB versions 10.3 and later. If you use MariaDB versions 10.2 or earlier, administrators have to maintain this DBMS on their own.

To create the Administration Server maintenance task:

1. In the console tree, select the node of the Administration Server for which you want to create the Administration Server maintenance task.
2. Select the Tasks folder.
3. By clicking the New task button in the workspace of the Tasks folder.

   The Add Task Wizard starts.

4. In the Select the task type window of the Wizard, select Administration Server maintenance as the task type and click Next.
5. If you have to shrink the Administration Server database during maintenance, in the Settings window of the Wizard, select the Shrink database check box.
6. Follow the rest of the Wizard instructions.

The newly created task is displayed in the list of tasks in the workspace of the Tasks folder. Only one Administration Server maintenance task can be running for a single Administration Server. If an Administration Server maintenance task has already been created for an Administration Server, no new Administration Server maintenance task can be created.

User notification method window

In the User notification method window, you can configure the user notification about certificate installation on the mobile device:

• Show link in Wizard. If you select this option, a link to the installation package will be shown at the final step of the New Device Connection Wizard.
• Send link to user. If you select this option, you can specify the settings for notifying the user about connection of a device.

In the By email group of settings, you can configure user notification about installation of a new certificate on his or her mobile device using email messages. This notification method is only available if the SMTP Server is enabled.

In the By SMS group of settings, you can configure the user notification about installation of a certificate on his or her mobile device by using SMS. This notification method is only available if SMS notification is enabled.

Click the Edit message link in the By email and By SMS groups of settings to view and edit the notification message, if necessary.

General section

Expand all | Collapse all

In this section, you can adjust the general profile settings for Exchange ActiveSync mobile devices:

• Name

  Profile name.

• Allow non-provisionable devices

  If this option is enabled, devices that cannot access all the Exchange ActiveSync policy settings are allowed to connect to Mobile Device Server. By using the connection, you can manage Exchange ActiveSync mobile devices. For example, you can set passwords, configure sending emails, or view information about the devices, such as the device ID or the policy status.

  If this option is disabled, you cannot connect to the Mobile Device Server and manage Exchange ActiveSync mobile devices.

  By default, this option is enabled. You can disable this option if you are not going to manage Exchange ActiveSync mobile devices and receive information about them.

• Updating frequency (hours)

  If this option is enabled, the application refreshes information about the Exchange ActiveSync policy with the frequency specified in the entry field.

  If the option is disabled, information about the Exchange ActiveSync policy is not refreshed.

  By default, this option is enabled, and the refreshing interval is one hour.

Device selection window

Choose a selection from the Device selection list. The list contains the default selections and the selections created by the user.

You can view the details of device selections in the workspace of the Device selections section.

Define the name of the new object window

In the window, specify the name of the newly created object. A name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).

Application categories section

Expand all | Collapse all

In this section, you can configure the distribution of information about application categories on client devices.

Full data transmission (for Network Agents Service Pack 2 and earlier)

Transmission of modified data only (for Network Agents Service Pack 2 and later)

Features of using the management interface

This section describes actions that you can perform in the main window of Kaspersky Security Center.

Console tree

The console tree (see the figure below) is designed to display the hierarchy of Administration Servers on the corporate network, the structure of their administration groups, and other objects of the application, such as the Repositories or Application management folders. The name space of Kaspersky Security Center can contain several nodes including the names of servers corresponding to the installed Administration Servers included in the hierarchy.

Console tree

Administration Server node

The Administration Server – <Device name> node is a container that shows the structural organization of the selected Administration Server.

The workspace of the Administration Server node contains summary information about the current status of the application and devices managed through the Administration Server. Information in the workspace is distributed between various tabs:

• Monitoring. Displays information about the application operation and the current status of client devices in real-time mode. Important messages for the administrator (such as messages on vulnerabilities, errors, or viruses detected) are highlighted in a specific color. You can use links on the Monitoring tab to perform the standard administrator tasks (for example, install and configure the security application on client devices), as well as to go to other folders in the console tree.
• Statistics. Contains a set of charts grouped by topics (protection status, Anti-Virus statistics, updates, etc.). These charts visualize current information about the application operation and the status of client devices.
• Reports. Contains templates for reports generated by the application. On this tab, you can create reports using preset templates, as well as create custom report templates.
• Events window. Contains records on events that have been registered during the application operation. Those records are distributed between topics for ease of reading and filtering. On this tab, you can view selections of events that have been generated automatically, as well as create custom selections.

Folders in the Administration Server node

The Administration Server – <Device name> node includes the following folders:

• Managed devices. This folder is intended for storage, display, configuration, and modification of the structure of administration groups, group policies, and group tasks.
• Mobile Device Management. This folder is intended for managing mobile devices. The Mobile Device Management folder contains the following subfolders:
  • Mobile Device Servers. Intended for managing iOS MDM Servers and Microsoft Exchange Mobile Devices Servers.
  • Mobile Devices. It is intended for managing mobile devices, KES, Exchange ActiveSync, and iOS MDM.
  • Certificates. It is intended for managing certificates of mobile devices.
• Device selections. This folder is intended for quick selection of devices that meet specified criteria (a device selection) among all managed devices. For example, you can quickly select devices on which no security application is installed, and proceed to these devices (view the list). You can perform specific actions on these selected devices, for example, assign them some tasks. You can use preset selections or create your own custom selections.
• Unassigned devices. This folder contains a list of devices that have not been included in any of the administration groups. You can perform some actions on unassigned devices, for example, move them into administration groups or install applications on them.
• Policies. This folder is intended for viewing and creating policies.
• Tasks. This folder is intended for viewing and creating tasks.
• Kaspersky Licenses. Contains a list of license keys available for Kaspersky applications. In the workspace of this folder, you can add new license keys to the license key repository, deploy license keys to managed devices, and view the license key usage report.
• Advanced. This folder contains a set of subfolders that correspond to various groups of application features.

Advanced folder. Moving folders in the console tree

The Advanced folder includes the following subfolders:

• User accounts. Contains a list of network user accounts.
• Application management. Intended for managing applications installed on devices on the network. The Application management folder contains the following subfolders:
  • Application categories. Intended for managing custom application categories.
  • Applications registry. Contains a list of applications on devices with Network Agent installed.
  • Executable files. Contains the list of executable files stored on client devices with Network Agent installed.
  • Software vulnerabilities. Contains a list of vulnerabilities in applications on devices with Network Agent installed.
  • Software updates. Contains a list of application updates received by Administration Server that can be distributed on devices.
  • Third-party licenses usage. Contains a list of licensed applications groups. You can use licensed applications groups to monitor the usage of licenses for third-party software (non-Kaspersky applications) and possible violations of licensing restrictions.
• Remote installation. This folder is intended for managing remote installation of operating systems and applications. The Remote installation folder contains the following subfolders:
  • Deploy device images. Intended for deploying images of operating systems on devices.
  • Installation packages. Contains a list of installation packages that can be used for remote installation of applications on devices.
• Data encryption and protection. This folder is intended for managing the process of data encryption on hard drives and removable drives.
• Network poll. This folder displays the network in which Administration Server is installed. Administration Server receives information about the structure of the network and its devices, through regular polls of the Windows network, IP subnets, and Active Directory on the corporate network. Poll results are displayed in the workspaces of the corresponding folders: Domains, IP ranges, and Active Directory.
• Repositories. This folder is intended for operations with objects used to monitor the status of devices and perform maintenance. The Repositories folder contains the following subfolders:
  • Adaptive anomaly detection. Contains a list of detects performed by the Kaspersky Endpoint Security rules working in the SMART Training mode on client devices.
  • Kaspersky software updates and patches. Contains a list of updates received by Administration Server that can be distributed to devices.
  • Hardware. Contains a list of hardware connected to the organization's network.
  • Quarantine. Contains a list of objects moved to Quarantine by anti-virus applications on devices.
  • Backup. Contains a list of backup copies of files that were deleted or modified during disinfection on devices.
  • Unprocessed files. Contains a list of files assigned for later scanning by anti-virus applications.

You can change the set of subfolders included in the Advanced folder. Frequently used subfolders can be moved up one level from the Advanced folder. Subfolders that are used rarely can be moved to the Advanced folder.

To move a subfolder out of the Advanced folder:

1. In the console tree, select the subfolder that you want to move out of the Advanced folder.
2. In the context menu of the subfolder, select View → Move from Advanced folder.

You can also move a subfolder out of the Advanced folder in the workspace of the Advanced folder by clicking the Move from Advanced folder link in the section with the name of that subfolder.

To move a subfolder to the Advanced folder:

1. In the console tree, select the subfolder that you need to move to the Advanced folder.
2. In the context menu of the subfolder, select View → Move to Advanced folder.

How to update data in the workspace

In Kaspersky Security Center, the workspace data (such as device statuses, statistics, and reports) are never updated automatically.

To update data in the workspace:

• Press the F5 key.
• In the context menu of the object in the console tree, select Refresh.
• Click the refresh icon () in the workspace.

How to navigate the console tree

To navigate the console tree, you can use the following toolbar buttons:

• —One step back.
• —One step forward.
• —One level up.

You can also use a navigation chain located in the upper-right corner of the workspace. The navigation chain contains the full path to the folder of the console tree in which you are currently located. All elements of the chain, except for the last one, are links to the objects in the console tree.

How to open the object properties window in the workspace

You can change the properties of the most Administration Console objects in the object properties window.

To open the properties window of an object located in the workspace:

• From the context menu of the object, select Properties.
• Select an object and press ALT+ENTER.

How to select a group of objects in the workspace

You can select a group of objects in the workspace. You can select a group of objects, for example, to create a set of devices for which you may create tasks later.

To select an objects range:

1. Select the first object in the range and press Shift.
2. Hold down the Shift key and select the last object in the range.

The range will be selected.

To group separate objects:

1. Select the first object in the group and press Ctrl.
2. Hold down the Ctrl key and select other objects that you want to include in the group.

The objects will be grouped.

How to change the set of columns in the workspace

Administration Console allows you to change a set of columns displayed in the workspace.

To change a set of columns displayed in the workspace:

1. In the console tree, click the object for which you wish to change the set of columns.
2. In the workspace of the folder, open the window intended for configuration of the set of columns by clicking the Add/Remove columns link.
3. In the Add/Remove columns window, specify the set of columns to be displayed.

Reference information

Tables of this section provide summary information about the context menu of Administration Console objects, as well as about the statuses of console tree objects and workspace objects.

Context menu commands

This section lists Administration Console objects and corresponding context menu items (see table below).

Items of the context menu of Administration Console objects

Page top

List of managed devices. Description of columns

The following table displays the names and respective descriptions of columns in the list of managed devices.

Descriptions of columns in the list of managed devices

Page top

Statuses of devices, tasks, and policies

The table below contains a list of icons displayed in the console tree and in the Administration Console workspace, next to the names of devices, tasks, and policies. Those icons define the statuses of objects.

Statuses of devices, tasks, and policies

Page top

File status icons in Administration Console

For ease of file management in Kaspersky Security Center Administration Console, icons are displayed next to the names of files (see table below). Icons indicate statuses assigned to files by managed Kaspersky applications on client devices. Icons are shown in the workspaces of the Quarantine, Backup, and Active threats folders.

Statuses are assigned to objects by Kaspersky Endpoint Security installed on the client device on which the object is located.

Correspondence between icons and file statuses

Page top

Searching and exporting data

This section contains information about data search methods and about exporting data.

Finding devices

Kaspersky Security Center allows you to find devices on the basis of specified criteria. Search results can be saved to a text file.

The search feature allows you to find the following devices:

• Client devices in administration groups of an Administration Server and its secondary Servers.
• Unassigned devices managed by an Administration Server and its secondary Servers.

To find client devices included in an administration group:

1. In the console tree, select an administration group folder.
2. Select Search from the context menu of the administration group folder.
3. On the tabs of the Search window, specify the criteria for the search of devices, and click the Find now button.

Devices that meet the specified search criteria are now displayed in a table in the lower part of the Search window.

To find unassigned devices:

1. In the console tree, select the Unassigned devices folder.
2. Select Search from the context menu of the Unassigned devices folder.
3. On the tabs of the Search window, specify the criteria for the search of devices, and click the Find now button.

Devices that meet the specified search criteria are now displayed in a table in the lower part of the Search window.

To find devices regardless of whether they are included in an administration group:

1. In the console tree, select the Administration Server node.
2. In the context menu of the node, select Search.
3. On the tabs of the Search window, specify the criteria for the search of devices, and click the Find now button.

Devices that meet the specified search criteria are now displayed in a table in the lower part of the Search window.

In the Search window you can also search for administration groups and secondary Administration Servers using a drop-down list in the top right corner of the window. Search functionality for administration groups and secondary Administration Servers is not available if you opened the Search window from the Unassigned devices folder.

To find devices, you can use regular expressions in the fields of the Search window.

Full text search in the Search window is available:

• On the Network tab, in the Description field
• On the Hardware tab, in the Device, Vendor, and Description fields

Device search settings

Expand all | Collapse all

Below are descriptions of the settings used for searching managed devices. Search results are displayed in the lower part of the window.

Network

On the Network tab, you can specify the criteria that will be used to search for devices according to their network data:

• Device name or IP address

  Windows network name (NetBIOS name) of the device or IPv4 address.

• Windows domain

  Displays all devices included in the specified Windows domain.

• Administration group

  Displays devices included in the specified administration group.

• Description

  Text in the device properties window: In the Description field of the General section.

  To describe text in the Description field, you can use the following characters:

  • Within a word:
    • *. Replaces any string with any number of characters.

    Example:

    To describe words such as Server or Server's, you can enter Server*.

    • ?. Replaces any single character.

    Example:

    To describe words such as Window or Windows, you can enter Windo?.

    Asterisk (*) or question mark (?) cannot be used as the first character in the query.

  • To find several words:
    • Space. Displays all the devices whose descriptions contain any of the listed words.

    Example:

    To find a phrase that contains Secondary or Virtual words, you can include Secondary Virtual line in your query.

    • +. When a plus sign precedes a word, all search results will contain this word.

    Example:

    To find a phrase that contains both Secondary and Virtual, enter the +Secondary+Virtual query.

    • -. When a minus sign precedes a word, no search results will contain this word.

    Example:

    To find a phrase that contains Secondary and does not contain Virtual, enter the +Secondary-Virtual query.

    • "<some text>". Text enclosed in quotation marks must be present in the text.

    Example:

    To find a phrase that contains Secondary Server word combination, you can enter "Secondary Server" in the query.

• IP range

  If this option is enabled, you can enter the initial and final IP addresses of the IP range in which the relevant devices must be included.

  By default, this option is disabled.

• Managed by a different Administration Server

  Select one of the following values:

  • Yes. Only the client devices managed by other Administration Servers are considered.
  • No. Only the client devices managed by the same Administration Server are considered.
  • No value is selected. The criterion will not be applied.

Tags

On the Tags tab, you can configure a device search based on key words (tags) that were previously added to the descriptions of managed devices:

• Apply if at least one specified tag matches

  If this option is enabled, the search results will show devices with descriptions that contain at least one of the selected tags.

  If this option is disabled, the search results will only show devices with descriptions that contain all the selected tags.

  By default, this option is disabled.

• Tag must be included

  If this option is selected, the search results will display the devices whose descriptions contain the selected tag. To find devices, you can use the asterisk, which stands for any string with any number of characters.

  By default, this option is selected.

• Tag must be excluded

  If this option is selected, the search results will display the devices whose descriptions do not contain the selected tag. To find devices, you can use the asterisk, which stands for any string with any number of characters.

Active Directory

On the Active Directory tab, you can specify that devices should be searched for in the Active Directory organizational unit (OU) or group. You can also include devices from all child OUs of the specified Active Directory OU in the selection. To select devices, define the following settings:

• Device is in an Active Directory organizational unit

  If this option is enabled, the selection includes devices from the Active Directory unit specified in the entry field.

  By default, this option is disabled.

• Include child organizational units

  If this option is enabled, the selection includes devices from all child organizational units of the specified Active Directory organizational unit.

  By default, this option is disabled.

• This device is a member of an Active Directory group

  If this option is enabled, the selection includes devices from the Active Directory group specified in the entry field.

  By default, this option is disabled.

Network activity

On the Network activity tab, you can specify the criteria that will be used to search for devices according to their network activity:

• This device is a distribution point

  In the drop-down list, you can set up the criterion for including devices in the selection when performing search:

  • Yes. The selection includes devices that act as distribution points.
  • No. Devices that act as distribution points are not included in the selection.
  • No value is selected. The criterion will not be applied.
• Do not disconnect from the Administration Server

  In the drop-down list, you can set up the criterion for including devices in the selection when performing search:

  • Enabled. The selection will include devices on which the Do not disconnect from the Administration Server check box is selected.
  • Disabled. The selection will include devices on which the Do not disconnect from the Administration Server check box is cleared.
  • No value is selected. The criterion will not be applied.
• Connection profile switched

  In the drop-down list, you can set up the criterion for including devices in the selection when performing search:

  • Yes. The selection will include devices that connected to the Administration Server after the connection profile was switched.
  • No. The selection will not include devices that connected to the Administration Server after the connection profile was switched.
  • No value is selected. The criterion will not be applied.
• Last connected to Administration Server

  You can use this check box to set a search criterion for devices according to the time they last connected to the Administration Server.

  If this check box is selected, in the entry fields you can specify the time interval (date and time) during which the last connection was established between Network Agent installed on the client device and the Administration Server. The selection will include devices that fall within the specified interval.

  If this check box is cleared, the criterion will not be applied.

  By default, this check box is cleared.

• New devices detected by network poll

  Searches for new devices that have been detected by network polling over the last few days.

  If this option is enabled, the selection only includes new devices that have been detected by device discovery over the number of days specified in the Detection period (days) field.

  If this option is disabled, the selection includes all devices that have been detected by device discovery.

  By default, this option is disabled.

• Device is visible

  In the drop-down list, you can set up the criterion for including devices in the selection when performing search:

  • Yes. The application includes in the selection devices that are currently visible in the network.
  • No. The application includes in the selection devices that are currently invisible in the network.
  • No value is selected. The criterion will not be applied.

Application

On the Application tab, you can specify the criteria that will be used to search for devices according to the selected managed application:

• Application name

  In the drop-down list, you can set a criterion for including devices in a selection when search is performed by the name of a Kaspersky application.

  The list provides only the names of applications with management plug-ins installed on the administrator's workstation.

  If no application is selected, the criterion will not be applied.

• Application version

  In the entry field, you can set a criterion for including devices in a selection when search is performed by the version number of a Kaspersky application.

  If no version number is specified, the criterion will not be applied.

• Critical update name

  In the entry field, you can set a criterion for including devices in a selection when search is performed by application name or by update package number.

  If the field is left blank, the criterion will not be applied.

• Modules last updated

  You can use this option to set a criterion for searching devices by time of the last update of modules of applications installed on those devices.

  If this check box is selected, in the entry fields you can specify the time interval (date and time) during which the last update of modules of applications installed on those devices was performed.

  If this check box is cleared, the criterion will not be applied.

  By default, this check box is cleared.

• Device is managed through Kaspersky Security Center 13.1

  In the drop-down list, you can include in the selection the devices managed through Kaspersky Security Center:

  • Yes. The application includes in the selection devices managed through Kaspersky Security Center.
  • No. The application includes devices in the selection if they are not managed through Kaspersky Security Center.
  • No value is selected. The criterion will not be applied.
• Security application is installed

  In the drop-down list, you can include in the selection all devices with the security application installed:

  • Yes. The application includes in the selection all devices with the security application installed.
  • No. The application includes in the selection all devices with no security application installed.
  • No value is selected. The criterion will not be applied.

Operating system

On the Operating system tab, you can set up the following criteria to find devices by their operating system (OS) type:

• Operating system version

  If the check box is selected, you can select an operating system from the list. Devices with the specified operating systems installed are included in the search results.

• Operating system bit size

  In the drop-down list, you can select the architecture for the operating system, which will determine how the moving rule is applied to the device (Unknown, x86, AMD64, or IA64). By default, no option is selected in the list so that the operating system's architecture is not defined.

• Operating system service pack version

  In this field, you can specify the package version of the operating system (in the X.Y format), which will determine how the moving rule is applied to the device. By default, no version value is specified.

• Operating system build

  This setting is applicable to Windows operating systems only.

  The build number of the operating system. You can specify whether the selected operating system must have an equal, earlier, or later build number. You can also configure searching for all build numbers except the specified one.

• Operating system release ID

  This setting is applicable to Windows operating systems only.

  The release identifier (ID) of the operating system. You can specify whether the selected operating system must have an equal, earlier, or later release ID. You can also configure searching for all release ID numbers except the specified one.

Device status

On the Device status tab, you can specify criteria for searching devices based on the device status from the managed application:

• Device status

  Drop-down list in which you can select one of the device statuses: OK, Critical, or Warning.

• Real-time protection status

  Drop-down list, in which you can select the real-time protection status. Devices with the specified real-time protection status are included in the selection.

• Device status description

  In this field, you can select the check boxes next to conditions that, if met, assign one of the following statuses to the device: OK, Critical, or Warning.

• Device status defined by application

  Drop-down list, in which you can select the real-time protection status. Devices with the specified real-time protection status are included in the selection.

Protection components

On the Protection components tab, you can set up the criteria to search for client devices by their protection status.

• Databases released

  If this option is selected, you can search for client devices by anti-virus database release date. In the entry fields you can set the time interval, on the basis of which the search is performed.

  By default, this option is disabled.

• Last scanned

  If this check option is enabled, you can search for client devices by time of the last virus scan. In the entry fields you can specify the time period within which the last virus scan was performed.

  By default, this option is disabled.

• Total number of threats detected

  If this option is enabled, you can search for client devices by number of viruses detected. In the entry fields you can set the lower and upper threshold values for the number of viruses found.

  By default, this option is disabled.

Applications registry

On the Applications registry tab, you can configure the search for devices according to applications installed on them:

• Application name

  Drop-down list in which you can select an application. Devices on which the specified application is installed, are included in the selection.

• Application version

  Entry field in which you can specify the version of selected application.

• Vendor

  Drop-down list in which you can select the manufacturer of an application installed on the device.

• Application status

  A drop-down list in which you can select the status of an application (Installed, Not installed). Devices on which the specified application is installed or not installed, depending on the selected status, will be included in the selection.

• Find by update

  If this option is enabled, search will be performed using the details of updates for applications installed on the relevant devices. After you select the check box, the Application name, Application version, and Application status fields change to Update name, Update version, and Status respectively.

  By default, this option is disabled.

• Incompatible security application name

  Drop-down list in which you can select third-party security applications. During the search, devices on which the specified application is installed, are included in the selection.

• Application tag

  In the drop-down list, you can select the application tag. All devices that have installed applications with the selected tag in the description are included in the device selection.

Hierarchy of Administration Servers

On the Hierarchy of Administration Servers tab, check the Include data from secondary Administration Servers (down to level) box if you want the information stored on secondary Administration Servers to be considered while searching for devices, and in the entry field, you can specify the nesting level of secondary Administration Server from which information is considered while searching for devices. By default, this check box is cleared.

Virtual machines

On the Virtual machines tab, you can configure the search for devices according to whether these are virtual machines or part of virtual desktop infrastructure (VDI):

• This is a virtual machine

  In the drop-down list, you can select the following options:

  • Not important.
  • No. Find devices that are not virtual machines.
  • Yes. Find devices that are virtual machines.
• Virtual machine type

  In the drop-down list, you can select the virtual machine manufacturer.

  This drop-down list is available if the Yes or Not important value is selected in the This is a virtual machine drop-down list.

• Part of Virtual Desktop Infrastructure

  In the drop-down list, you can select the following options:

  • Not important.
  • No. Find devices that are not part of Virtual Desktop Infrastructure.
  • Yes. Find devices that are part of the Virtual Desktop Infrastructure (VDI).

Hardware

On the Hardware tab, you can configure search for client devices according to their hardware:

• Device

  In the drop-down list, you can select a unit type. All devices with this unit are included in the search results.

  The field supports the full-text search.

• Vendor

  In the drop-down list, you can select the name of a unit manufacturer. All devices with this unit are included in the search results.

  The field supports the full-text search.

• Description

  Description of the device or hardware unit. Devices with the description specified in this field are included in the selection.

  A device's description in any format can be entered in the properties window of that device. The field supports the full-text search.

• Inventory number

  Equipment with the inventory number specified in this field will be included in the selection.

• CPU frequency, in MHz

  The frequency range of a CPU. Devices with CPUs that match the frequency range in these fields (inclusive) will be included in the selection.

• Virtual CPU cores

  Range of the number of virtual cores in a CPU. Devices with CPUs that match the range in these fields (inclusive) will be included in the selection.

• Hard drive volume, in GB

  Range of values for the size of the hard drive on the device. Devices with hard drives that match the range in these entry fields (inclusive) will be included in the selection.

• RAM size, in MB

  Range of values for the size of the device RAM. Devices with RAMs that match the range in these entry fields (inclusive) will be included in the selection.

Vulnerabilities and updates

On the Vulnerabilities and updates tab, you can set up the criterion to search for devices according to their Windows Update source:

• WUA is switched to Administration Server

  You can select one of the following search options from the drop-down list:

  • Yes. If this option is selected, the search results will include devices that receive updates through Windows Update from the Administration Server.
  • No. If this option is selected, the results will include devices that receive updates through Windows Update from another sources.

Users

On the Users tab, you can set up the criteria to search for devices according to the accounts of users who have logged in to the operating system.

• Last user who logged in to the system

  If this option is enabled, click the Browse button to specify a user account. The search results include devices on which the specified user performed the last login to the system.

• User who logged in to the system at least once

  If this option is enabled, click the Browse button to specify a user account. The search results include devices on which the specified user logged in to the system at least once.

Status-affecting problems in managed applications

On the Status-affecting problems in managed applications tab, you can set up search for devices according to descriptions of their statuses provided by the managed application:

• Device status description

  You can select check boxes for descriptions of statuses from the managed application; upon receipt of these statuses, the devices will be included in the selection. When you select a status listed for several applications, you have the option to select this status in all of the lists automatically.

Statuses of components in managed applications

On the Statuses of components in managed applications tab, you can set up the criteria to search for devices according to the statuses of components in managed applications:

• Data Leakage Prevention status

  Search for devices by the status of Data Leakage Prevention (No data from device, Stopped, Starting, Paused, Running, Failed).

• Collaboration servers protection status

  Search for devices by the status of server collaboration protection (No data from device, Stopped, Starting, Paused, Running, Failed).

• Anti-virus protection status of mail servers

  Search for devices by the status of Mail Server protection (No data from device, Stopped, Starting, Paused, Running, Failed).

• Endpoint Sensor status

  Search for devices by the status of the Endpoint Sensor component (No data from device, Stopped, Starting, Paused, Running, Failed).

Encryption

• Encryption

  Advanced Encryption Standard (AES) symmetrical block cipher algorithm. In the drop-down list, you can select the encryption key size (56-bit, 128-bit, 192-bit, or 256-bit).

  Available values: AES56, AES128, AES192, and AES256.

Cloud segments

On the Cloud segments tab, you can configure a search based on whether a device belongs to specific cloud segments:

• Device is in a cloud segment

  If this option is enabled, you can click the Browse button to specify the segment to search.

  If the Include child objects option is also enabled, the search is run on all child objects of the specified segment.

  Search results include only devices from the selected segment.

• Device discovered by using the API

  In the drop-down list, you can select whether a device is detected by API tools:

  • AWS. The device is discovered by using the AWS API, that is, the device is definitely in the AWS cloud environment.
  • Azure. The device is discovered by using the Azure API, that is, the device is definitely in the Azure cloud environment.
  • Google Cloud. The device is discovered by using the Google API, that is, the device is definitely in the Google Cloud environment.
  • No. The device cannot be detected by using the AWS, Azure, or Google API, that is, it is either outside the cloud environment or it is in the cloud environment but it cannot be detected by using an API.
  • No value. This condition does not apply.

Application components

This section contains the list of components of those applications that have corresponding management plug-ins installed in Administration Console.

In the Application components section, you can specify criteria for including devices in a selection according to the statuses and version numbers of the components that refer to the application that you select:

• Status

  Search for devices according to the component status sent by an application to the Administration Server. You can select one of the following statuses: No data from device, Stopped, Starting, Paused, Running, Malfunction, or Not installed. If the selected component of the application installed on a managed device has the specified status, the device is included in the device selection.

  Statuses sent by applications:

  • Starting—The component is currently in the process of initialization.
  • Running—The component is enabled and working properly.
  • Paused—The component is suspended, for example, after the user has paused protection in the managed application.
  • Malfunction—An error has occurred during the component operation.
  • Stopped—The component is disabled and not working at the moment.
  • Not installed—The user did not select the component for installation when configuring custom installation of the application.

  Unlike other statuses, the No data from device status is not sent by applications. This option shows that the applications have no information about the selected component status. For example, this can happen when the selected component does not belong to any of the applications installed on the device, or when the device is turned off.

• Version

  Search for devices according to the version number of the component that you select in the list. You can type a version number, for example 3.4.1.0, and then specify whether the selected component must have an equal, earlier, or later version. You can also configure searching for all versions except the specified one.

Using masks in string variables

Using masks for string variables is allowed. When creating masks, you can use the following regular expressions:

• Wildcard character (*)—Any string of 0 or more characters.
• Question mark (?)—Any single character.
• [<range>]—Any single character from a specified range or set.

  For example: [0–9]—Any digit. [abcdef]—Any of the characters a, b, c, d, e, or f.

Using regular expressions in the search field

You can use the following regular expressions in the search field to search for specific words and characters:

• *. Replaces any sequence of characters. To search for such words as Server, Servers, or Server room, enter the Server* expression in the search field.
• ?. Replaces any single character. To search for such words as Word or Ward, enter the W?rd expression in the search field.

  Text in the search field cannot begin with a question mark (?).

• [<range>]. Replaces any single character from a specified range or set. To search for any numeral, enter the [0-9] expression in the search field. To search for one of the characters—a, b, c, d, e, or f—enter the [abcdef] expression in the search field.

Use the following regular expressions in the search field to run a full-text search:

• Space. The result is all devices whose descriptions contain any of the listed words. For example, to search for a phrase that contains the word "Secondary" or "Virtual" (or both these words), enter the Secondary Virtual expression in the search field.
• Plus sign (+), AND, or &&. When a plus sign precedes a word, all search results will contain this word. For example, to search for a phrase that contains both the word "Secondary" and the word "Virtual", you can enter any of the following expressions in the search field: +Secondary+Virtual, Secondary AND Virtual, Secondary && Virtual.
• OR or ||. When placed between two words, it indicates that one word or the other can be found in the text. To search for a phrase that contains either the word "Secondary" or the word "Virtual", you can enter any of the following expressions in the search field: Secondary OR Virtual, Secondary || Virtual.
• Minus sign (-). When a minus sign precedes a word, no search results will contain this word. To search for a phrase that must contain such word as Secondary and must not contain such word as Virtual, you must enter the +Secondary-Virtual expression in the search field.
• "<some text>". Text enclosed in quotation marks must be present in the text. To search for a phrase that contains such word combination as Secondary Server, you must enter the "Secondary Server" expression in the search field.

Full-text search is available in the following filtering blocks:

• In the event list filtering block, by the Event and Description columns.
• In the user account filtering block, by the Name column.
• In the applications registry filtering block, by the Name column, if the Show in list section has no grouping selected as the filtering criterion.

Exporting lists from dialog boxes

In dialog boxes of the application you can export lists of objects to text files.

Export of a list of objects is possible for dialog box sections that contain the Export to file button.

Settings of tasks

This section lists all settings of tasks in Kaspersky Security Center.

General task settings

Expand all | Collapse all

This section contains the settings that you can view and configure for most of your tasks. The list of settings available depends on the task you are configuring.

Settings specified during task creation

You can specify the following settings when creating a task. Some of these settings can also be modified in the properties of the created task.

• Operating system restart settings:
  • Do not restart the device

    Client devices are not restarted automatically after the operation. To complete the operation, you must restart a device (for example, manually or through a device management task). Information about the required restart is saved in the task results and in the device status. This option is suitable for tasks on servers and other devices where continuous operation is critical.

  • Restart the device

    Client devices are always restarted automatically if a restart is required for completion of the operation. This option is useful for tasks on devices that provide for regular pauses in their operation (shutdown or restart).

  • Prompt user for action

    The restart reminder is displayed on the screen of the client device, prompting the user to restart it manually. Some advanced settings can be defined for this option: text of the message for the user, the message display frequency, and the time interval after which a restart will be forced (without the user's confirmation). This option is most suitable for workstations where users must be able to select the most convenient time for a restart.

    By default, this option is selected.

  • Repeat prompt every (min)

    If this option is enabled, the application prompts the user to restart the operating system with the specified frequency.

    By default, this option is enabled. The default interval is 5 minutes. Available values are between 1 and 1440 minutes.

    If this option is disabled, the prompt is displayed only once.

  • Restart after (min)

    After prompting the user, the application forces restart of the operating system upon expiration of the specified time interval.

    By default, this option is enabled. The default delay is 30 minutes. Available values are between 1 and 1440 minutes.

  • Force closure of applications in blocked sessions

    Running applications may prevent a restart of the client device. For example, if a document is being edited in a word processing application and is not saved, the application does not allow the device to restart.

    If this option is enabled, such applications on a locked device are forced to close before the device restart. As a result, users may lose their unsaved changes.

    If this option is disabled, a locked device is not restarted. The task status on this device states that a device restart is required. Users have to manually close all applications running on locked devices and restart these devices.

    By default, this option is disabled.

• Task scheduling settings:
  • Scheduled start setting:
    • Every N hours

      The task runs regularly, with the specified interval in hours, starting from the specified date and time.

      By default, the task runs every six hours, starting from the current system date and time.

    • Every N days

      The task runs regularly, with the specified interval in days. Additionally, you can specify a date and time of the first task run. These additional options become available, if they are supported by the application for which you create the task.

      By default, the task runs every day, starting from the current system date and time.

    • Every N weeks

      The task runs regularly, with the specified interval in weeks, on the specified day of week and at the specified time.

      By default, the task runs every Monday at the current system time.

    • Every N minutes

      The task runs regularly, with the specified interval in minutes, starting from the specified time on the day that the task is created.

      By default, the task runs every 30 minutes, starting from the current system time.

    • Daily (daylight saving time is not supported)

      The task runs regularly, with the specified interval in days. This schedule does not support observance of daylight saving time (DST). It means that when clocks jump one hour forward or backward at the beginning or ending of DST, the actual task start time does not change.

      We do not recommend that you use this schedule. It is needed for backward compatibility of Kaspersky Security Center.

      By default, the task starts every day at the current system time.

    • Weekly

      The task runs every week on the specified day and at the specified time.

    • By days of week

      The task runs regularly, on the specified days of week, at the specified time.

      By default, the task runs every Friday at 6:00:00 PM.

    • Monthly

      The task runs regularly, on the specified day of the month, at the specified time.

      In months that lack the specified day, the task runs on the last day.

      By default, the task runs on the first day of each month, at the current system time.

    • Manually

      The task does not run automatically. You can only start it manually.

      By default, this option is enabled.

    • Every month on specified days of selected weeks

      The task runs regularly, on the specified days of each month, at the specified time.

      By default, no days of month are selected; the default start time is 6:00:00 PM.

    • When new updates are downloaded to the repository

      The task runs after updates are downloaded to the repository. For example, you may want to use this schedule for the find vulnerabilities and required updates task.

    • On virus outbreak

      The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:

      • Anti-virus for workstations and file servers
      • Anti-virus for perimeter defense
      • Anti-virus for mail systems

      By default, all application types are selected.

      You may want to run different tasks depending on the anti-virus application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.

    • On completing another task

      The current task starts after another task completes. You can select how the previous task must complete (successfully or with error) to trigger the start of the current task. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task.

  • Run missed tasks

    This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.

    If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.

    If this option is disabled, only scheduled tasks run on client devices; for Manually, Once and Immediately, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.

    By default, this option is enabled.

  • Use automatically randomized delay for task starts

    If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

    The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.

    If this option is disabled, the task starts on client devices according to the schedule.

  • Use randomized delay for task starts within an interval of (min)

    If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

    If this option is disabled, the task starts on client devices according to the schedule.

    By default, this option is disabled. The default time interval is one minute.

• Devices to which the task will be assigned:
  • Select networked devices detected by Administration Server

    The task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.

    For example, you may want to use this option in a task of installing Network Agent on unassigned devices.

  • Specify device addresses manually or import addresses from a list

    You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.

    You may want to use this option to execute a task for a specific subnet. For example, you may want to install a certain application on devices of accountants or to scan devices in a subnet that is probably infected.

  • Assign task to a device selection

    The task is assigned to devices included in a device selection. You can specify one of the existing selections.

    For example, you may want to use this option to run a task on devices with a specific operating system version.

  • Assign task to an administration group

    The task is assigned to devices included in an administration group. You can specify one of the existing groups or create a new one.

    For example, you may want to use this option to run a task of sending a message to users if the message is specific for devices included in a specific administration group.

• Account settings:
  • Default account

    The task will be run under the same account as the application that performs this task.

    By default, this option is selected.

  • Specify account

    Fill in the Account and Password fields to specify the details of an account under which the task is run. The account must have sufficient rights for this task.

  • Account

    Account under which the task is run.

  • Password

    Password of the account under which the task will be run.

Settings specified after task creation

You can specify the following settings only after a task is created.

• Advanced scheduling settings:
  • Activate the device before the task is started through Wake-on-LAN (min)

    The operating system on the device starts at the specified time before the task is started. The default time period is five minutes.

    Enable this option if you want the task to run on all of the client devices from the task scope, including those devices that are turned off when the task is about to start.

    If you want the device to be automatically turned off after the task is complete, enable the Shut down device when task is complete option. This option can be found in the same window.

    By default, this option is disabled.

  • Shut down device when task is complete

    For example, you may want to enable this option for an install update task that installs updates to client devices each Friday after business hours, and then turns off these devices for the weekend.

    By default, this option is disabled.

  • Stop if the task is taking longer than (min)

    After the specified time period expires, the task is stopped automatically, whether it is completed or not.

    Enable this option if you want to interrupt (or stop) tasks that take too long to execute.

    By default, this option is disabled. The default task execution time is 120 minutes.

• Notification settings:
  • Store task history block:
    • On Administration Server for (days)

      Application events related to execution of the task on all client devices from the task scope are stored on the Administration Server during the specified number of days. When this period elapses, the information is deleted from the Administration Server.

      By default, this option is enabled.

    • Store in the OS event log on device

      Application events related to execution of the task are stored locally in Windows Event Log of each client device.

      By default, this option is disabled.

    • Store in the OS event log on Administration Server

      Application events related to execution of the task on all client devices from the task scope are stored centrally in Windows Event Log of the Administration Server operating system (OS).

      By default, this option is disabled.

    • Save all events

      If this option is selected, all events related to the task are saved to the event logs.

    • Save events related to task progress

      If this option is selected, only events related to the task execution are saved to the event logs.

    • Save only task execution results

      If this option is selected, only events related to the task results are saved to the event logs.

  • Notify administrator of task execution results

    You can select the methods by which administrators receive notifications about task execution results: by email, by SMS, and by running an executable file. To configure notification, click the Settings link.

    By default, all notification methods are disabled.

  • Notify of errors only

    If this option is enabled, administrators are only notified when a task execution completes with an error.

    If this option is disabled, administrators are notified after every task execution completion.

    By default, this option is enabled.

• Security settings
• Task scope settings

  Depending on how the task scope is determined, the following settings are present:

  • Devices

    If the scope of a task is determined by an administration group, you can view this group. No changes are available here. However, you can set Exclusions from task scope.

    If the scope of a task is determined by a list of devices, you can modify this list by adding and removing devices.

  • Device selection

    You can change the device selection to which the task is applied.

  • Exclusions from task scope

    You can specify groups of devices to which the task is not applied. Groups to be excluded can only be subgroups of the administration group to which the task is applied.

• Revision history

Download updates to the Administration Server repository task settings

Expand all | Collapse all

Settings specified during task creation

You can specify the following settings when creating a task. Some of these settings can also be modified in the properties of the created task.

• Sources of updates

  The following resources can be used as a source of updates for the Administration Server:

  • Kaspersky update servers

    HTTP(S) servers at Kaspersky from which Kaspersky applications download database and application module updates. By default, the Administration Server communicates with Kaspersky update servers and downloads updates by using the HTTPS protocol. You can configure the Administration Server to use the HTTP protocol instead of HTTPS.

    Selected by default.

  • Primary Administration Server

    This resource applies to tasks created for a secondary or virtual Administration Server.

  • Local or network folder

    A local or network folder that contains the latest updates. A network folder can be an FTP or HTTP server, or an SMB share. When selecting a local folder, you must specify a folder on the device that has Administration Server installed.

    An FTP or HTTP server or a network folder used by an update source must contain a folders structure (with updates) that matches the structure created when using Kaspersky update servers.

• Other settings:

  Force update of secondary Administration Servers

  If this option is enabled, the Administration Server starts the update tasks on the secondary Administration Servers as soon as new updates are downloaded. Otherwise, the update tasks on the secondary Administration Servers start according to their schedules.

  By default, this option is disabled.

  Copy downloaded updates to additional folders

  After the Administration Server receives updates, it copies them to the specified folders. Use this option if you want to manually manage the distribution of updates on your network.

  For example, you may want to use this option in the following situation: the network of your organization consists of several independent subnets, and devices from each of the subnets do not have access to other subnets. However devices in all of the subnets have access to a common network share. In this case, you set Administration Server in one of the subnets to download updates from Kaspersky update servers, enable this option, and then specify this network share. In downloaded updates to the repository tasks for other Administration Servers, specify the same network share as the update source.

  By default, this option is disabled.

  Do not force updating of devices and secondary Administration Servers unless copying is complete

  The tasks of downloading updates to client devices and secondary Administration Servers start only after those updates are copied from the main update folder to additional update folders.

  This option must be enabled if client devices and secondary Administration Servers download updates from additional network folders.

  By default, this option is disabled.

  Update Network Agent modules (for Network Agent versions earlier than 10 Service Pack 2)

  If this option is enabled, updates for software modules of Network Agent are installed automatically after the Administration Server completes the download updates to the repository task. Otherwise, updates received for Network Agent modules can be installed manually.

  This option is only applicable to Network Agent versions earlier than 10 Service Pack 2. Starting from version 10 Service Pack 2, Network Agents are updated automatically.

  By default, this option is enabled.

Settings specified after task creation

You can specify the following settings only after a task is created.

• Settings section, Content of updates block:

  Download diff files

  This option enables the downloading diff files feature.

  By default, this option is disabled.

• Update verification section:

  Verify updates before distributing

  Administration Server downloads updates from the source, saves them to a temporary repository, and runs the task defined in the Update verification task field. If the task completes successfully, the updates are copied from the temporary repository to a shared folder on the Administration Server and then distributed to all devices for which the Administration Server acts as the source of updates (tasks with the When new updates are downloaded to the repository schedule type are started). The task of downloading updates to the repository is finished only after completion of the Update verification task.

  By default, this option is disabled.

  Update verification task

  This task verifies downloaded updates before they are distributed to all devices for which the Administration Server acts as the source of updates.

  In this field, you can specify the Update verification task created earlier. Alternatively, you can create a new Update verification task.

Download updates to the repositories of distribution points task settings

Expand all | Collapse all

Settings specified during task creation

You can specify the following settings when creating a task. Some of these settings can also be modified in the properties of the created task.

• Sources of updates

  The following resources can be used as a source of updates for the distribution point:

  • Kaspersky update servers

    HTTP(S) servers at Kaspersky from which Kaspersky applications download database and application module updates.

    This option is selected by default.

  • Primary Administration Server

    This resource applies to tasks created for a secondary or virtual Administration Server.

  • Local or network folder

    A local or network folder that contains the latest updates. A network folder can be an FTP or HTTP server, or an SMB share. If a network folder requires authentication, only the SMB protocol is supported. When selecting a local folder, you must specify a folder on the device that has Administration Server installed.

    An FTP or HTTP server or a network folder used by an update source must contain a folders structure (with updates) that matches the structure created when using Kaspersky update servers.

  If you enable the Do not use proxy server option for the Kaspersky update servers or Local or network folder sources of update, a distribution point does not use a proxy server for downloading updates, even if you enabled the option Use proxy server of the Network Agent policy settings for the distribution point.

• Other settings → Folder for storing updates

  The path to the specified folder for storing saved updates. You can copy the specified folder path to a clipboard. You cannot change the path to a specified folder for a group task.

Settings specified after task creation

You can specify the following setting in the Settings section, in the Content of updates block only after a task is created.

Download diff files

Find vulnerabilities and required updates task settings

Expand all | Collapse all

Settings specified during task creation

You can specify the following settings when creating a task. Some of these settings can also be modified in the properties of the created task.

• Search for vulnerabilities and updates listed by Microsoft

  When searching for vulnerabilities and updates, Kaspersky Security Center uses the information about applicable Microsoft updates from the source of Microsoft updates, which are available at the present moment.

  For example, you may want to disable this option if you have different tasks with different settings for Microsoft updates and updates of third-party applications.

  By default, this option is enabled.

  • Connect to the update server to update data

    Windows Update Agent on a managed device connects to the source of Microsoft updates. The following servers can act as a source of Microsoft updates:

    • Kaspersky Security Center Administration Server (see the settings of Network Agent policy)
    • Windows Server with Microsoft Windows Server Update Services (WSUS) deployed in your organization's network
    • Microsoft Updates servers

    If this option is enabled, Windows Update Agent on a managed device connects to the source of Microsoft updates to refresh the information about applicable Microsoft Windows updates.

    If this option is disabled, Windows Update Agent on a managed device uses the information about applicable Microsoft Windows updates that was received from the source of Microsoft updates earlier and that is stored in the device's cache.

    Connecting to the source of Microsoft updates can be resource-consuming. You might want to disable this option if you set regular connection to this source of updates in another task or in the properties of Network Agent policy, in the section Software updates and vulnerabilities. If you do not want to disable this option, then, to reduce the Server overload, you can configure the task schedule to randomize delay for task starts within 360 minutes.

    By default, this option is enabled.

    Combination of the following options of the settings of Network Agent policy defines the mode of getting updates:

    • Windows Update Agent on a managed device connects to the Update Server to get updates only if the Connect to the update server to update data option is enabled and the Active option, in the Windows Update search mode settings group, is selected.
    • Windows Update Agent on a managed device uses the information about applicable Microsoft Windows updates that was received from the source of Microsoft updates earlier and that is stored in the device's cache, if the Connect to the update server to update data option is enabled and the Passive option, in the Windows Update search mode settings group, is selected, or if the Connect to the update server to update data option is disabled and the Active option, in the Windows Update search mode settings group, is selected.
    • Irrespective of the Connect to the update server to update data option's status (enabled or disabled), if Disabled option, in the Windows Update search mode settings group is selected, Kaspersky Security Center does not request any information about updates.
• Search for third-party vulnerabilities and updates listed by Kaspersky

  If this option is enabled, Kaspersky Security Center searches for vulnerabilities and required updates for third-party applications (applications made by software vendors other than Kaspersky and Microsoft) in Windows Registry and in the folders specified under Specify paths for advanced search of applications in file system. The full list of supported third-party applications is managed by Kaspersky.

  If this option is disabled, Kaspersky Security Center does not search for vulnerabilities and required updates for third-party applications. For example, you may want to disable this option if you have different tasks with different settings for Microsoft Windows updates and updates of third-party applications.

  By default, this option is enabled.

  • Specify paths for advanced search of applications in file system

    The folders in which Kaspersky Security Center searches for third-party applications that require vulnerability fix and update installation. You can use system variables.

    Specify the folders to which applications are installed. By default, the list contains system folders to which most of the applications are installed.

• Enable advanced diagnostics

  If this feature is enabled, Network Agent writes traces even if tracing is disabled for Network Agent in Kaspersky Security Center Remote Diagnostics Utility. Traces are written to two files in turn; the total size of both files is determined by the Maximum size, in MB, of advanced diagnostics files value. When both files are full, Network Agent starts writing to them again. The files with traces are stored in the %WINDIR%\Temp folder. These files are accessible in the remote diagnostics utility, you can download or delete them there.

  If this feature is disabled, Network Agent writes traces according to the settings in Kaspersky Security Center Remote Diagnostics Utility. No additional traces are written.

  When creating a task, you do not have to enable advanced diagnostics. You may want to use this feature later if, for example, a task run fails on some of the devices and you want to get additional information during another task run.

  By default, this option is disabled.

  • Maximum size, in MB, of advanced diagnostics files

    The default value is 100 MB, and available values are between 1 MB and 2048 MB. You may be asked to change the default value by Kaspersky Technical Support specialists when information in the advanced diagnostics files sent by you is not enough to troubleshoot the problem.

Install required updates and fix vulnerabilities task settings

Expand all | Collapse all

Settings specified during task creation

You can specify the following settings when creating a task. Some of these settings can also be modified in the properties of the created task.

• Specify rules for installing updates

  These rules are applied to installation of updates on client devices. If rules are not specified, the task has nothing to perform. For information about operations with rules, refer to Rules for update installation.

• Start installation at device restart or shutdown

  If this option is enabled, updates are installed when the device is restarted or shut down. Otherwise, updates are installed according to a schedule.

  Use this option if installing the updates might affect the device performance.

  By default, this option is disabled.

• Install required general system components

  If this option is enabled, before installing an update the application automatically installs all general system components (prerequisites) that are required to install the update. For example, these prerequisites can be operating system updates

  If this option is disabled, you may have to install the prerequisites manually.

  By default, this option is disabled.

• Allow installation of new application versions during updates

  If this option is enabled, updates are allowed when they result in installation of a new version of a software application.

  If this option is disabled, the software is not upgraded. You can then install new versions of the software manually or through another task. For example, you may use this option if your company infrastructure is not supported by a new software version or if you want to check an upgrade in a test infrastructure.

  By default, this option is enabled.

  Upgrading an application may cause malfunction of dependent applications installed on client devices.

• Download updates to the device without installing them

  If this option is enabled, the application downloads updates to the device but does not install them automatically. You can then Install downloaded updates manually.

  Microsoft updates are downloaded to the system Windows storage. Updates of third-party applications (applications made by software vendors other than Kaspersky and Microsoft) are downloaded to the folder specified in the Folder for downloading updates field.

  If this option is disabled, the updates are installed to the device automatically.

  By default, this option is disabled.

  • Folder for downloading updates

    This folder is used to download updates of third-party applications (applications made by software vendors other than Kaspersky and Microsoft).

• Enable advanced diagnostics

  If this feature is enabled, Network Agent writes traces even if tracing is disabled for Network Agent in Kaspersky Security Center Remote Diagnostics Utility. Traces are written to two files in turn; the total size of both files is determined by the Maximum size, in MB, of advanced diagnostics files value. When both files are full, Network Agent starts writing to them again. The files with traces are stored in the %WINDIR%\Temp folder. These files are accessible in the remote diagnostics utility, you can download or delete them there.

  If this feature is disabled, Network Agent writes traces according to the settings in Kaspersky Security Center Remote Diagnostics Utility. No additional traces are written.

  When creating a task, you do not have to enable advanced diagnostics. You may want to use this feature later if, for example, a task run fails on some of the devices and you want to get additional information during another task run.

  By default, this option is disabled.

  • Maximum size, in MB, of advanced diagnostics files

    The default value is 100 MB, and available values are between 1 MB and 2048 MB. You may be asked to change the default value by Kaspersky Technical Support specialists when information in the advanced diagnostics files sent by you is not enough to troubleshoot the problem.

Settings specified after task creation

You can specify the following settings only after a task is created.

• Updates to install

  In the Updates to install section, you can view the list of updates that the task installs. Only updates that match the applied task settings are shown.

• Test installation of updates:
  • Do not scan. Select this option if you do not want to perform a test installation of updates.
  • Run scan on selected devices. Select this option if you want to test updates installation on selected devices. Click the Add button and select devices on which you need to perform test installation of updates.
  • Run scan on devices in the specified group. Select this option if you want to test updates installation on a group of devices. In the Specify a test group field, specify a group of devices on which you want to perform a test installation.
  • Run scan on specified percentage of devices. Select this option if you want to test updates installation on some portion of devices. In the Percentage of test devices out of all target devices field, specify the percentage of devices on which you want to perform a test installation of updates.

Global list of subnets

This section provides information about the global list of subnets that you can use in the rules.

To store the information about subnets of your network, you can set up a global list of subnets for each Administration Server you use. This list helps you match pairs {IP address, mask} and physical units such as branch offices. You can use subnets from this list in the networking rules and settings.

Adding subnets to the global list of subnets

Expand all | Collapse all

You can add subnets with their descriptions to the global list of subnets.

To add a subnet to the global list of subnets:

1. In the console tree, select the node of the Administration Server that you require.
2. In the context menu of the Administration Server, select Properties.
3. In the Properties window that opens, in the Sections pane select List of global subnets.
4. Click the Add button.

   The New subnet window opens.

5. Fill in the following fields:
   • General settings

     The subnet IP address for the subnet you are adding.

   • Subnet mask

     The subnet mask for the subnet you are adding.

   • Name

     The name of the subnet. It must be unique within the global list of subnets. If you enter the name that already exists in the list, an index will be added, for example: ~~1, ~~2.

   • Description

     Description may contain some additional information about the branch office which has this subnet. This text will appear in all lists where this subnet is present, for example, in the list of traffic limitation rules.

     This field is not obligatory and may be left empty.

6. Click OK.

The subnet appears in the list of subnets.

Viewing and modifying subnet properties in the global list of subnets

You can view and modify the properties of subnets in the global list of subnets.

To view or modify properties of a subnet in the global list of subnets:

1. In the console tree, select the node of the Administration Server that you require.
2. In the context menu of the Administration Server, select Properties.
3. In the Properties window that opens, in the left Sections pane, select List of global subnets.
4. In the list, select the subnet that you want.
5. Click the Properties button.

   The New subnet window opens.

6. If necessary, change the settings of the subnet.
7. Click OK.

If you have made changes, they will be stored.

Usage of Network Agent for Windows, for macOS and for Linux: comparison

The Network Agent usage varies depending on the operating system of the device. The Network Agent policy and installation package settings also differ depending on the operating system. The table below compares Network Agent features and usage scenarios available for Windows, macOS, and Linux operating systems.

Network Agent feature comparison