Managing user accounts

This section provides information about user accounts and roles supported by the application. This section contains instructions on how to create accounts and roles for users of Kaspersky Security Center.

Kaspersky Security Center allows you to manage user accounts and groups of accounts. The application supports two types of accounts:

• Accounts of organization employees. Administration Server retrieves data of the accounts of those users when polling the organization's network.
• Accounts of internal users. These accounts are applied when virtual Administration Servers are used. Accounts of internal users are created and used only within Kaspersky Security Center.

Working with user accounts

Kaspersky Security Center allows you to manage user accounts and groups of accounts. The application supports two types of accounts:

• Accounts of organization employees. Administration Server retrieves data of the accounts of those users when polling the organization's network.
• Accounts of internal users. These accounts are applied when virtual Administration Servers are used. Accounts of internal users are created and used only within Kaspersky Security Center.

All user accounts can be viewed in the User accounts folder in the console tree. The User accounts folder is a subfolder of the Advanced folder by default.

You can perform the following actions on user accounts and groups of accounts:

• Configure users' rights of access to the application features using roles.
• Send messages to users by email and SMS.
• View the list of the user's mobile devices.
• Issue and install certificates on the user's mobile devices.
• View the list of certificates issued to the user.
• Disable two-step verification for a user account.

Adding an account of an internal user

To add a new internal user account to Kaspersky Security Center:

1. In the console tree, open the User accounts folder.

   The User accounts folder is a subfolder of the Advanced folder by default.

2. In the workspace, click the Add user button.
3. In the New user window that opens, specify the settings of the new user account:
   • A user name ()

     Please be careful when entering the user name. You will not be able to change it after saving the changes.

   • Description
   • Full name
   • Main email
   • Main phone
   • Password for the user connection to Kaspersky Security Center

     The password must comply with the following rules:

     • The password must be 8 to 16 characters long.
     • The password must contain characters from at least three of the groups listed below:
       • Uppercase letters (A-Z)
       • Lowercase letters (a-z)
       • Numbers (0-9)
       • Special characters (@ # $ % ^ & * - _ ! + = [ ] { } | : ' , . ? / \ ` ~ " ( ) ;)
     • The password must not contain any whitespaces, Unicode characters, or the combination of "." and "@", when "." is placed before "@".

     To see the entered password, click and hold the Show button.

     The number of attempts for entering the password is limited. By default, the maximum number of allowed password entry attempts is 10. You can change the allowed number of attempts to enter a password, as described in "Changing the number of allowed password entry attempts".

     If the user enters an invalid password the specified number of times, the user account is blocked for one hour. In the list of user accounts, the user icon () of a blocked account is dimmed (unavailable). You can unblock the user account only by changing the password.

   • If necessary, select the Disable account check box to prohibit the user from connecting to the application. You can disable an account, for example, if you want to create it beforehand but activate it later.
   • Select the Request the password when account settings are modified check box if you want to enable an additional option to protect a user account from unauthorized modification. If this option is enabled, modifying user account settings requires authorization of the user with the Modify object ACLs right of the General features: User permissions functional area.
4. Click OK.

The newly created user account is displayed in the workspace of the User accounts folder.

Editing an account of an internal user

To edit an internal user account in Kaspersky Security Center:

1. In the console tree, open the User accounts folder.

   The User accounts folder is a subfolder of the Advanced folder by default.

2. In the workspace, double-click the internal user account that you want to edit.
3. In the Properties: <user name> window that opens, change the settings of the user account:
   • Description
   • Full name
   • Main email
   • Main phone
   • Password for the user connection to Kaspersky Security Center

     The password must comply with the following rules:

     • The password must be 8 to 16 characters long.
     • The password must contain characters from at least three of the groups listed below:
       • Uppercase letters (A-Z)
       • Lowercase letters (a-z)
       • Numbers (0-9)
       • Special characters (@ # $ % ^ & * - _ ! + = [ ] { } | : ' , . ? / \ ` ~ " ( ) ;)
     • The password must not contain any whitespaces, Unicode characters, or the combination of "." and "@", when "." is placed before "@".

     To see the entered password, click and hold the Show button.

     The number of attempts for entering the password is limited. By default, the maximum number of allowed password entry attempts is 10. You can change the allowed number of attempts to enter a password, as described in "Changing the number of allowed password entry attempts".

     If the user enters an invalid password the specified number of times, the user account is blocked for one hour. In the list of user accounts, the user icon () of a blocked account is dimmed (unavailable). You can unblock the user account only by changing the password.

   • If necessary, select the Disable account check box to prohibit the user from connecting to the application. You can disable an account, for example, after an employee leaves the company.
   • Select the Request the password when account settings are modified option if you want to enable an additional option to protect a user account from unauthorized modification. If this option is enabled, modifying user account settings requires authorization of the user with the Modify object ACLs right of the General features: User permissions functional area.
4. Click OK.

The edited user account is displayed in the workspace of the User accounts folder.

Changing the number of allowed password entry attempts

The Kaspersky Security Center user can enter an invalid password a limited number of times. After the limit is reached, the user account is blocked for one hour.

By default, the maximum number of allowed attempts to enter a password is 10. You can change the number of allowed password entry attempts, as described in this section.

To change the number of allowed password entry attempts:

1. Open the system registry of the device on which Administration Server is installed (for example, locally, using the regedit command in the Start → Run menu).
2. Go to the following key:
   • For 32-bit systems:

     HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\1093\1.0.0.0\ServerFlags

   • For 64-bit systems:

     HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\1093\1.0.0.0\ServerFlags

3. If the SrvSplPpcLogonAttempts value is not present, create it. The value type is DWORD.

   By default, after Kaspersky Security Center is installed this value is not created.

4. Specify the required number of attempts in the SrvSplPpcLogonAttempts value.
5. Click OK to save the changes.
6. Restart the Administration Server service.

The maximum number of allowed password entry attempts is changed.

Configuring the check of the name of an internal user for uniqueness

You can configure the check of the name of an internal user of Kaspersky Security Center for uniqueness when this name is added to the application. The check of the name of an internal user for uniqueness can only be performed on a virtual Administration Server or on the primary Administration Server for which the user account is to be created, or on all virtual Administration Servers and on the primary Administration Server. By default, the name of an internal user is checked for uniqueness on all virtual Administration Servers and on the primary Administration Server.

To enable the check of the name of an internal user for uniqueness on a virtual Administration Server or on the primary Administration Server:

1. Open the system registry of the device on which Administration Server is installed (for example, locally, using the regedit command in the Start → Run menu).
2. Go to the following hive:
   • For 32-bit systems:

     HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\.core\.independent\KLLIM

   • For 64-bit systems:

     HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\.core\.independent\KLLIM

3. For the LP_InterUserUniqVsScope (DWORD) key, set the 00000001 value.

   The default value specified for this key is 0.

4. Restart the Administration Server service.

The name will only be checked for uniqueness on the virtual Administration Server on which the internal user was created, or on the primary Administration Server if the internal user was created on the primary Administration Server.

To enable the check of the name of an internal user on all virtual Administration Servers and on the primary Administration Server:

1. Open the system registry of the device on which Administration Server is installed (for example, locally, using the regedit command in the Start → Run menu).
2. Go to the following hive:
   • For a 64-bit system:

     HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\.core\.independent\KLLIM

   • For a 32-bit system:

     HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\.core\.independent\KLLIM

3. For the LP_InterUserUniqVsScope (DWORD) key, set the 00000000 value.

   The default value specified for this key is 0.

4. Restart the Administration Server service.

The check of the name for uniqueness will be performed on all virtual Administration Servers and on the primary Administration Server.

Adding a security group

You can add security groups (groups of users), perform flexible configuration of groups and security group access to various application features. Security groups can be assigned names that correspond to their respective purposes. For example, the name can correspond to where users are located in the office or to the name of the company's organizational unit to which the users belong.

One user can belong to several security groups. A user account managed by a virtual Administration Server can belong only to security groups of this virtual Server and have access rights only within this virtual Server.

To add a security group:

1. In the console tree select the User accounts folder.

   The User accounts folder is a subfolder of the Advanced folder by default.

2. Click the Add security group button.

   The Add security group window opens.

3. In the Add security group window, in the General section specify the name of the group.

   A group name cannot be more than 255 characters long and contain special symbols such as *, <, >, ?, \, :, |. The group name must be unique.

   You can enter the group description in the Description entry field. Filling in the Description field is optional.

4. Click OK.

The security group that you have added appears in the User accounts folder in the console tree. You can add users to the newly created group.

Adding a user to a group

To add a user to a group:

1. In the console tree, select the User accounts folder.

   The User accounts folder is a subfolder of the Advanced folder by default.

2. In the list of user accounts and groups, select the group to which you want to add the user.
3. In the group properties window, select the Group users section and click the Add button.

   A window with a list of users opens.

4. In the list, select a user that you want to include in the group.
5. Click OK.

The user is added to the group and displayed in the list of group users.

Configuring access rights to application features. Role-based access control

Kaspersky Security Center provides facilities for role-based access to the features of Kaspersky Security Center and managed Kaspersky applications.

You can configure access rights to application features for Kaspersky Security Center users in one of the following ways:

• By configuring the rights for each user or group of users individually.
• By creating standard user roles with a predefined set of rights and assigning those roles to users depending on their scope of duties.

User role (also referred to as a role) is a predefined set of access rights to the features of Kaspersky Security Center or managed Kaspersky applications. A role can be assigned to a user or a group of users.

Application of user roles is intended to simplify and shorten routine procedures of configuring users' access rights to application features. Access rights within a role are configured in accordance with the standard tasks and the users' scope of duties.

User roles can be assigned names that correspond to their respective purposes. You can create an unlimited number of roles in the application.

You can use the predefined user roles with already configured set of rights, or create new roles and configure the required rights yourself.

Access rights to application features

The table below shows the Kaspersky Security Center features with the access rights to manage the associated tasks, reports, settings, and perform the associated user actions.

To perform the user actions listed in the table, a user has to have the right specified next to the action.

Read, Modify, and Execute rights are applicable to any task, report, or setting. In addition to these rights, a user has to have the Perform operations on device selections right to manage tasks, reports, or settings on device selections.

All tasks, reports, settings, and installation packages that are missing in the table belong to the General features: Basic functionality functional area.

Access rights to application features

Page top

Predefined user roles

User roles assigned to Kaspersky Security Center users provide them with sets of access rights to application features.

You can use the predefined user roles with already configured set of rights, or create new roles and configure the required rights yourself. Some of the predefined user roles available in Kaspersky Security Center can be associated with specific job positions, for example, Auditor, Security Officer, Supervisor (these roles are present in Kaspersky Security Center starting from the version 11). Access rights of these roles are pre-configured in accordance with the standard tasks and scope of duties of the associated positions. The table below shows how roles can be associated with specific job positions.

Examples of roles for specific job positions

The table below shows the access rights assigned to each predefined user role.

Access rights of predefined user roles

Page top

Adding a user role

To add a user role:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the context menu of the Administration Server, select Properties.
3. In the Administration Server properties window, in the Sections pane select User roles and click the Add button.

   The User roles section is available if the Display security settings sections option is enabled.

4. In the New role properties window, configure the role:
   • In the Sections, select General and specify the name of the role.

     The name of a role cannot be more than 100 characters long.

   • Select the Rights section, and configure the set of rights by selecting the Allow and Deny check boxes next to the application features.

   If you are operating on the primary Administration Server, you can enable the Relay list of roles to secondary Administration Servers option.

5. Click OK.

The role is added.

User roles that have been created for Administration Server are displayed in the Administration Server properties window, in the User roles section. You can modify and delete user roles, as well as assign roles to user groups or selected users.

Page top

Assigning a role to a user or a user group

To assign a role to a user or a group of users:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the context menu of the Administration Server, select Properties.
3. In the Administration Server properties window, select the Security section.

   The Security section is available if the Display security settings sections check box is selected in the interface settings window.

4. In the Names of groups or users field, select a user or a group of users to which you want to assign a role.

   If the user or the group is not contained in the field, you can add it by clicking the Add button.

   When you add a user by clicking the Add button, you can select the type of user authentication (Microsoft Windows or Kaspersky Security Center). Kaspersky Security Center authentication is used for selecting the accounts of internal users that are used for working with virtual Administration Servers.

5. Select the Roles tab and click the Add button.

   The User roles window opens. This window displays user roles that have been created.

6. In the User roles window, select a role for the user group.
7. Click OK.

The role with a set of rights for working with Administration Server is assigned to the user or the user group. Roles that have been assigned are displayed on the Roles tab in the Security section of the Administration Server properties window.

Page top

Assigning permissions to users and groups

You can give users and groups permissions to use different features of Administration Server and of the Kaspersky programs for which you have management plug-ins, for example, Kaspersky Endpoint Security for Windows.

To assign permissions to a user or a group of users:

1. In the console tree, do one of the following:
   • Expand the Administration Server node and select the subfolder with the name of the required Administration Server.
   • Select the administration group.
2. In the context menu of the Administration Server or the administration group, select Properties.
3. In the Administration Server properties window (or the administration group properties window) that opens, in the left Sections pane select Security.

   The Security section is available if the Display security settings sections check box is selected in the interface settings window.

4. In the Security section, in the Names of groups or users list select a user or a group.
5. In the permissions list in the lower part of the workspace, on the Rights tab configure the set of rights for the user or group:
   1. Click the plus signs (+) to expand the nodes in the list and gain access to the permissions.
   2. Select the Allow and Deny check boxes next to the permissions that you want.

      Example 1: Expand the Access objects regardless of their ACLs node or Deleted objects node, and select Read.

      Example 2: Expand the Basic functionality node, and select Write.

6. When you have configured the set of rights, click Apply.

The set of rights for the user or group of users will be configured.

The permissions of the Administration Server (or the administration group) are divided into the following areas:

• General features:
  • Management of administration groups (only for Kaspersky Security Center 11 or later)
  • Access objects regardless of their ACLs (only for Kaspersky Security Center 11 or later)
  • Basic functionality
  • Deleted objects (only for Kaspersky Security Center 11 or later)
  • Event processing
  • Operations on Administration Server (only in the property window of Administration Server)
  • Deploy Kaspersky applications
  • License key management
  • Enforced report management (only for Kaspersky Security Center 11 or later)
  • Hierarchy of Servers
  • User rights
  • Virtual Administration Servers
• Mobile Device Management:
  • General
• System Management:
  • Connectivity
  • Hardware inventory
  • Network Access Control
  • Deploy operating system
  • Manage vulnerabilities and patches
  • Remote installation
  • Software inventory

If neither Allow nor Deny is selected for a permission, then the permission is considered undefined: it is denied until it is explicitly denied or allowed for the user.

The rights of a user are the sum of the following:

• User's own rights
• Rights of all the roles assigned to this user
• Rights of all the security group to which the user belongs
• Rights of all the roles assigned to the security groups to which the user belongs

If at least one of these sets of rights has Deny for a permission, then the user is denied this permission, even if other sets allow it or leave it undefined.

Page top

Propagating user roles to secondary Administration Servers

By default, the lists of user roles of the primary and secondary Administration Servers are independent. You can configure the application to automatically propagate the user roles created on the primary Administration Server to all of the secondary Administration Servers. The user roles can also be propagated from a secondary Administration Server to its own secondary Administration Servers.

To propagate user roles from the primary Administration Server to the secondary Administration Servers:

1. Open the main application window.
2. Do one of the following:
   • In the console tree, right-click the name of the Administration Server and select Properties in the context menu.
   • If you have an active Administration Server policy, in the workspace of the Policies folder, right-click this policy and select Properties in the context menu.
3. In the Administration Server properties window, or in the policy settings window, in the Sections pane select User roles.

   The User roles section is available if the Display security settings sections option is enabled.

4. Enable the Relay list of roles to secondary Administration Servers option.
5. Click OK.

The application copies the user roles of the primary Administration Server to the secondary Administration Servers.

When the Relay list of roles to secondary Administration Servers option is enabled and the user roles are propagated, they cannot be edited or deleted on the secondary Administration Servers. When you create a new role or edit an existing one on the primary Administration Server, the changes are automatically copied to the secondary Administration Servers. When you delete a user role on the primary Administration Server, this role remains on the secondary Administration Servers afterward, but it can be edited or deleted.

The roles that are propagated to the secondary Administration Server from the primary Server are displayed with the lock icon (). You cannot edit these roles on the secondary Administration Server.

If you create a role on the primary Administration Server, and there is a role with the same name on its secondary Administration Server, the new role is copied to the secondary Administration Server with the index added to its name, for example, ~~1, ~~2 (the index can be random).

If you disable the Relay list of roles to secondary Administration Servers option, all the user roles remain on the secondary Administration Servers, but they become independent from those on the primary Administration Server. After becoming independent, the user roles on the secondary Administration Servers can be edited or deleted.

Assigning the user as a device owner

You can assign the user as a device owner to allocate a device to that user. If you have to perform some actions on the device (for example, upgrade hardware), the administrator can notify the device owner to authorize those actions.

To assign a user as the owner of a device:

1. In the console tree, select the Managed devices folder.
2. In the workspace of the folder, on the Devices tab, select the device for which you need to assign an owner.
3. In the context menu of the device, select Properties.
4. In the device properties window, select System Info → Sessions.
5. Click the Assign button next to the Device owner field.
6. In the User selection window, select the user to assign as the device owner and click OK.
7. Click OK.

The device owner is assigned. By default, the Device owner field is filled with a value from Active Directory and is updated during every Active Directory poll. You can view the list of device owners in the Report on device owners. You can create a report using the New Report Wizard.

Delivering messages to users

To send a message to a user by email:

1. In the console tree, in the User accounts folder, select a user.

   The User accounts folder is a subfolder of the Advanced folder by default.

2. In the user's context menu, select Notify by email.
3. Fill in the relevant fields in the Send message to user window and click the OK button.

The message will be sent to the email address that has been specified in the user's properties.

To send an SMS message to a user:

1. In the console tree, in the User accounts folder, select a user.
2. In the user's context menu, select Send an SMS.
3. Fill in the relevant fields in the SMS text window and click the OK button.

The message will be sent to the mobile device with the number that has been specified in the user's properties.

Viewing the list of user mobile devices

To view a list of a user's mobile devices:

1. In the console tree, in the User accounts folder, select a user.

   The User accounts folder is a subfolder of the Advanced folder by default.

2. In the context menu of the user account, select Properties.
3. In the properties window of the user account, select the Mobile devices section.

In the Mobile devices section, you can view the list of the user's mobile devices and information about each of them. You can click the Export to file button to save the list of mobile devices to a file.

Installing a certificate for a user

You can install three types of certificates for a user:

• Shared certificate, which is required to identify the user's mobile device.
• Mail certificate, which is required to set up the corporate mail on the user's mobile device.
• VPN certificate, which is required to set up the virtual private network on the user's mobile device.

To issue a certificate to a user and then install it:

1. In the console tree, open the User accounts folder and select a user account.

   The User accounts folder is a subfolder of the Advanced folder by default.

2. In the context menu of the user account, select Install certificate.

The Certificate Installation Wizard starts. Follow the instructions of the Wizard.

After the Certificate Installation Wizard has finished, the certificate will be created and installed for the user. You can view the list of installed user certificates and export it to a file.

Viewing the list of certificates issued to a user

To view a list of all certificates issued to a user:

1. In the console tree, in the User accounts folder, select a user.

   The User accounts folder is a subfolder of the Advanced folder by default.

2. In the context menu of the user account, select Properties.
3. In the properties window of the user account, select the Certificates section.

In the Certificates section, you can view the list of the user's certificates and information about each of them. You can click the Export to file button to save the list of certificates to a file.

About the administrator of a virtual Administration Server

An administrator of the enterprise network managed through a virtual Administration Server starts Kaspersky Security Center 13.1 Web Console under the user account specified in this window to view the details of anti-virus protection.

If necessary, several administrator accounts can be created on a virtual Server.

The administrator of a virtual Administration Server is an internal user of Kaspersky Security Center. No data on internal users is transferred to the operating system. Kaspersky Security Center authenticates internal users.