KAPERSKY ADMINISTRATION KIT 6.0 Use and care manual

KASPERSKY LAB
Kaspersky®Administration Kit
version 6.0
Administrator’s manual

KASPERSKY®ADMINISTRATION KIT
VERSION 6.0
Administrator’s manual
©Kaspersky Lab
Visit our website: http://www.kaspersky.com/
Revision date: February, 2007

Contents
CHAPTER 1. KASPERSKY ADMINISTRATION KIT....................................................6
1.1. About Kaspersky Administration Kit......................................................................6
1.2. Hardware and software requirements..................................................................8
1.3. Distribution kit ........................................................................................................9
1.4. Help desk for registered users............................................................................10
1.5. The purpose of the document.............................................................................10
1.6. Conventions.........................................................................................................10
CHAPTER 2. UNDERSTANDING KASPERSKY ADMINISTRATION KIT................12
2.1. Logical network....................................................................................................12
2.1.1. Logical network. Administration Server........................................................12
2.1.2. Hierarchy of the Administration servers.......................................................13
2.1.3. Client computer. Group................................................................................14
2.1.4. Administrator's workstations.........................................................................15
2.1.5. Application administration plug-in.................................................................15
2.1.6. Policies, settings, and tasks .........................................................................16
2.1.7. Relationship between the policies and the local application settings .........18
2.2. Connecting clients to the Administration server.................................................19
2.3. Secure connection to the Administration Server................................................20
2.3.1. Administration Server certificate...................................................................21
2.3.2. Administration Server authentication (when the Administration Console
connects to the server) .................................................................................21
2.3.3. Administration Server authentication when establishing connection with
a client...........................................................................................................22
2.4. Identification of computers on the logical network..............................................22
2.5. Logical network access rights.............................................................................22
2.6. Deployment of anti-virus protection over logical network computers................25
2.7. Building a centralized anti-virus protection administration system ....................25
2.8. Maintaining a logical network..............................................................................27
2.9. Coordinating joint operation of administrators....................................................27
2.10. User interface ....................................................................................................28
2.10.1. Launching the application...........................................................................28

4 Kaspersky Administration Kit
2.10.2. Main window...............................................................................................28
2.10.3. Console tree................................................................................................29
2.10.4. Shortcut menu ............................................................................................31
CHAPTER 3. USING THE APPLICATION...................................................................36
3.1. Connecting to the administration server.............................................................36
3.2. Granting rights.....................................................................................................37
3.3. Viewing Network Information. Domains, IP Subnets, Active Directory
Groups................................................................................................................38
3.4. Quick Start Wizard...............................................................................................41
3.5. Viewing, creating, and configuring a logical network .........................................42
3.5.1. Groups ..........................................................................................................45
3.5.2. Client computers...........................................................................................46
3.5.3. Slave Administration servers........................................................................49
CHAPTER 4. REMOTE POLICY MANAGEMENT......................................................52
4.1. Configuring the application settings....................................................................52
4.1.1. Managing policies.........................................................................................52
4.1.2. Local application settings .............................................................................57
4.2. Managing the application....................................................................................58
CHAPTER 5. UPDATING THE ANTI-VIRUS DATABASE AND PROGRAM
MODULES..................................................................................................................65
5.1. Receiving updates by the Administration server................................................65
5.2. Distribution of updates to the client computers...................................................68
5.3. Updating of the slave Servers and their client computers..................................69
5.4. Updates distribution using the updating agents .................................................70
CHAPTER 6. MAINTENANCE......................................................................................72
6.1. Renewing your license........................................................................................72
6.2. Quarantine and backup storage .........................................................................74
6.3. Event logs. Event filters.......................................................................................76
6.4. Reports ................................................................................................................79
6.5. Finding computers...............................................................................................81
6.6. Computers filters..................................................................................................84
6.7. Virus outbreaks monitoring .................................................................................86
6.8. Backup copying and restoration of the Administration server data...................89
APPENDIX A. GLOSSARY...........................................................................................91

Table of Contents 5
APPENDIX B. KASPERSKY LAB.................................................................................98
B.1. Other Kaspersky Lab Products ..........................................................................99
B.2. Contact Us.........................................................................................................109
APPENDIX C. LICENSE AGREEMENT ....................................................................110

CHAPTER 1. KASPERSKY
ADMINISTRATION KIT
1.1. About Kaspersky Administration
Kit
Kaspersky® Administration Kit is designed for centralized performance of key
administrative tasks. It gives you complete control over your enterprise antivirus
policy, built on the Kaspersky Business Optimal and Kaspersky Corporate Suite
applications. Kaspersky Administration Kit supports all network configurations
that use TCP/IP protocol.
Kaspersky Administration Kit is a tool for corporate network administrators and
anti-virus security officers.
The application enables administrators to:
• Deploy and remotely remove Kaspersky Lab applications on and from the
network computers. You can create a custom set of Kaspersky Lab appli-
cations on a dedicated computer and then install these multiple applica-
tions at once on networked computers on any number of networked com-
puters.
• Efficiently manage license keys. With Kaspersky Administration Kit, you
can centrally install license keys for all Kaspersky Lab applications, moni-
tor the correspondence between the numbers of licenses and Kaspersky
Lab applications installed across your network, and track license expira-
tion dates.
• Remotely manage Kaspersky Lab applications from a single location.
With Kaspersky Administration Kit, you can build a multitiered anti-virus
protection system managed from one single administrator’s workstation.
This is particularly important for enterprises with a multiplayer local
spread over remote offices. This feature enables the administrators to:
• Create administration groups of computers with similar func-
tions and applications;
• Configure application settings simultaneously by applying group
policies;
• Tailor installations to fit the requirements for individual com-
puters by using application settings;

Kaspersky Administration Kit 7
• Manage multiple applications by assigning group and global
tasks;
• Schedule tasks for applications installed on computers from dif-
ferent administration groups.
• Automatically update the anti-virus database. You can centrally update
the anti-virus database for all applications without having each computer
directly connect to Kaspersky Lab update servers. You can schedule up-
dating to run automatically at a specified time to constantly keep your pro-
tection current and monitor the update process on client computers.
• Gather reports from all installations. Using the enhanced reporting capa-
bilities of Kaspersky Administration Kit, you can collect statistics about the
operation of all installations and create reports based on the most recent
statistics. The program allows you to create a cumulative network report
for a single Kaspersky Lab application (application-specific reports) or a
report about all Kaspersky Lab applications installed on an individual
computer (computer-specific report).
• Using mechanism of notifications about specific events in application's
operation and notifications sending mechanism. You can specify a set of
events which require notification. Such events that may occur during ap-
plication performance could be, for example, detection of a virus, failure to
update, or a new computer appearing on the network.
• Cooperate with Cisco Network Admission Control (NAC). This functional-
ity provides a mapping between host antivirus protection conditions and
Cisco NAC statuses.
Kaspersky Administration Kit has three main components:
• Administration Server is a centralized storage of information about
Kaspersky Lab applications installed on the local company network and a
tool for efficiently managing them.
• Network Agent coordinates the Administration Server and the Kaspersky
Lab applications installed on a particular network node (a workstation or a
server). This component supports all Windows applications included in
Kaspersky Business Optimal and Kaspersky Corporate Suite. Separate
versions of Administration Agent exist for Kaspersky Lab Novell and UNIX
applications.
• Administration Console, a user interface for Server and Agent Admini-
stration services, plugs into the Microsoft Management Console (MMC).

8 Kaspersky Administration Kit
1.2. Hardware and software
requirements
Administration Server
• Software requirements:
• Microsoft Data Access Components (MDAC) version 2.8 and
above
• MSDE 2000 SP 3 or MS SQL Server 2000 SP 31 or higher or
MySQL version 5.0.32 or MS SQL 2--5 or higher or MS SQL
2005 Express and higher;
• Microsoft Windows 2000 SP 1 or higher; Microsoft Windows XP
Professional SP 1 or higher; Microsoft Windows XP Profes-
sional x64 and higher, Microsoft Windows Server 2003 or
higher; Microsoft Windows Server 2003x64 or higher Microsoft
Windows NT4 SP 6a or higher, Microsoft Windows Vista, Mi-
crosoft Windows Vista x64.
• Hardware requirements:
• Intel Pentium III processor, 800 MHz or faster
• 128 MB RAM
• 400 MB available space on hard drive
Administration Console
• Software requirements:
• Microsoft Windows 2000 SP 1 or higher; Microsoft Windows
NT4 SP 6a; Microsoft Windows XP Professional SP 1 or higher;
Microsoft Windows XP Home Edition SP1 or higher; Microsoft
Windows XP Professional x64 or higher. Microsoft Windows
Server 2003 or higher; Microsoft Windows Server 2003 x64 and
above, Microsoft Windows NT 4 SP 6a or higher, Microsoft
Windows Vista, Microsoft Windows Vista x64;
• Microsoft Management Console version 1.2 or higher
• To work with Microsoft Windows NT4 you need Microsoft Inter-
net Explorer 6.0 installed
1You can install MSDE from the distribution package included in the Kaspersky Ad-
ministration Kit distribution kit.

Kaspersky Administration Kit 9
• Hardware requirements:
• Intel Pentium II processor, 400 MHz or faster
• At least 64 MB RAM
• 10 MB of available hard drive space
Network Agent
• Software requirements:
• For Windows systems:
• Microsoft Windows 98; Microsoft Windows ME; Microsoft Win-
dows 2000 SP 1 or higher; Microsoft Windows NT4 SP 6a or
higher; Microsoft Windows XP Professional x64 or higher,
Microsoft Windows XP Professional SP 1 or higher, and Win-
dows Server 2003 or higher; Microsoft Windows Server
2003 x64 or higher, Microsoft Windows Vista, Microsoft Win-
dows Vista x64.
• For Novell systems
• Novell NetWare 6 with SP3 or higher; Novell Netware 6.5 with
SP3 or higher.
• Hardware requirements:
• For Windows Systems:
• Intel Pentium processor, 233 MHz or faster
• 32 MB RAM
• 10 MB available space on hard drive
• For Novell systems:
o Intel Pentium 233 MHz or better;
o 12 MB RAM;
o 32 MB free (available) disk space.
1.3. Distribution kit
This software product is supplied free-of-charge with any Kaspersky Lab's
application included into the package of Kaspersky Business Optimal and
Kaspersky Corporate Suite (retail box version) and also available for download
from Kaspersky Lab's corporate website at www.kaspersky.com.

10 Kaspersky Administration Kit
1.4. Help desk for registered users
Kaspersky Lab offers a large service package, enabling its legal users to enjoy
all available features of Kaspersky Lab's products.
Once you purchase a license for any Kaspersky Lab's product included into
Kaspersky Business Optimal or Kaspersky Corporate Suite, you become a
registered user of Kaspersky Administration Kit. After this you will receive the
following services during the term of your license:
• New versions of the anti-virus software application provided free of
charge;
• Phone or e-mail consultations on matters related to the installation, con-
figuration, and operation of the anti-virus application by phone or based
on requests sent using a web form;
When sending a request to the Technical support service, make sure
you specify information about the license for Kaspersky Lab's
application used in conjunction with Kaspersky Administration Kit.
• Information about new Kaspersky Lab applications and about new com-
puter viruses (for those who subscribe to the Kaspersky Lab newsletter).
Kaspersky Lab does not provide information related to operation and use of your
operating system or various other technologies.
1.5. The purpose of the document
This Guide describes the purpose, general concepts, functions and general
operation schemes of Kaspersky Administration Kit application. Step-by-step
description of actions is provided in the Kaspersky Administration Kit Reference
Book. Functions described in the Reference Manual are underlined.
In order to review questions that our users often ask Kaspersky Lab's support
specialists visit our website and follow the Services ÆKnowledge base link.
This section contains information about installation, configuration and functioning
of Kaspersky Lab's applications and about removal of most commonly spread
viruses and disinfection of infected files.
1.6. Conventions
Various formatting features and icons are used throughout this document
depending on the purpose and the meaning of the text. The table below lists the
conventions used in the text.

Kaspersky Administration Kit 11
Convention Meaning
Bold font Menu titles, commands, window titles,
dialog elements, etc.
Note
Additional information, notes.
Attention
Critical information.
To perform an action:
1. Step 1.
2. …
Description of the successive user's
steps and possible actions
[key] – modifier name Command line modifier
Information messages and
command line text Text of configuration files, information
messages and command line

CHAPTER 2. UNDERSTANDING
KASPERSKY
ADMINISTRATION KIT
2.1. Logical network
2.1.1. Logical network. Administration
Server.
Logical network is a hierarchical structure of administration groups consisting of
client computers. Kaspersky Lab applications installed on client computers are
managed through Kaspersky Administration Kit.
Administration Server is a computer on which the Administration Server
component is installed.
The Administration server is installed as a service on a computer with the
following attributes:
• having name Kaspersky Administration Server;
• with the automatic startup at the operating system startup;
• with profile Local system or user's profile depending on the selection
made during the component's installation.
The functions of the Administration Server (or, more precisely, of the
administration server application installed on this computer) are as follows:
• Store information about the logical network structure (network configura-
tion);
• Store backup copies of the configuration information of the computers in
the logical network;
• Store distribution files for Kaspersky Lab applications;
• Remotely install and uninstall applications on the computers;
• Update anti-virus database and program modules;
• Manage policies and tasks on the computers in the logical network;

Understanding Kaspersky Administration Kit 13
• Store information about events occurred on the computers in the logical
network;
• Generate reports on application performance across the logical network;
• Distribute license keys across the computers in the logical network, store
information about license keys;
• Send alerts from tasks running on the computers in the logical network.
You can be notified, for example, about detection of a virus on a client
computer.
2.1.2. Hierarchy of the Administration
servers
The Administration servers may form hierarchy of type "main server - slave
server". Each Administration server may have several slave servers either on
one level of hierarchy or using nested hierarchal levels. There is no limit on the
degree of nesting. In this case the structure of the logical network of the main
server will include the logical networks of all slave servers. This way, individual
independent from each other sections of the computer network can be managed
by different Administration servers that, in turn, will be controlled by the main
server (details see section 3.5.1 on page 45).
The ability to create a hierarchy of servers may be used:
• to restrict the load on the Administration server (compared with one
server installed in the network);
• to decrease the traffic within the network and simplify the interaction with
remote offices. There is no necessity to establish connection between the
main server and all computers of the network that may be located, for ex-
ample, in other regions. It is sufficient to install a slave Administration
server in each segment of the network, distribute the computers in the
logical networks of the slave servers and ensure connection between the
slave servers and the main server using fast communication channels;
• to ensure a more distinct division of responsibility between the anti-virus
security administrators. All features of centralized control and monitoring
of the corporate network anti-virus security status will be preserved.
Each computer included into the logical network structure can be connected
only to one Administration server.
The administrator must control the correctness of the computers' connection to
the Administration servers using the find computer by network attributes
function to search for computers in the logical networks of various servers.

14 Kaspersky Administration Kit
2.1.3. Client computer. Group
Interaction between the Administration server and the computers:
• delivery of information about the current status of the applications;
• sending and receiving of control commands;
• synchronization of the configuration information;
• sending information about events in the applications' operation to the
Server;
• functioning of the updating agent;
is ensured by the Network agent. This component must be installed on all
computers where the control of the Kaspersky Lab's applications is performed
using Kaspersky Administration Kit.
The Network agent is installed on the computer as a service with a set of
attributes as follows:
• with name Kaspersky Network Agent;
• with automatic start at the operating system startup;
• with the Local system profile.
A plug-in for Cisco NAC is installed on a host computer together with the
Administration Agent. This plug-in is invoked if the Cisco Trust Agent application
is installed. Parameters for cooperation with Cisco NAC are configured through
Administration Server properties.
A computer, server or workstation on which the Network agent and the monitored
Kaspersky Lab's applications are installed will be called the Server
administration client (or simply the client computer).
Depending on the organizational or territorial structure of the company, functions
performed and the set of Kaspersky Lab's applications installed, client computers
may be organized in administration groups. This arrangement may be
implemented in order to ensure convenience of managing the computers in the
group as a single entity and when arranging computers in the group any
combination of the specified principles and other attributed at the administrator's
discretion may be used. For example, the top level can be comprised of groups
corresponding to the departments. On the next level, within each department,
computers will be grouped depending on the function they perform: one group of
computers may include all workstations, another all file servers, etc.

Understanding Kaspersky Administration Kit 15
A group is a set of client computers combined by some attribute in order to
control a group computers as a single entity. All client computers in a group
share:
• common parameters of the application's operation using group policies;
• common application's operation mode - by creating group tasks (applica-
tion functions) with a specified set of parameters (for example, creation
and installation of a single installation package, updating of the anti-virus
database and application modules, on-demand computer scan and real-
time protection).
A client computer may be included into one group only.
The administrator may create a hierarchy of servers and groups using any
number of nested levels if this simplifies his application administration tasks.
Slave Administration servers, groups and client computers may be located on the
same hierarchical level.
2.1.4. Administrator's workstations
Corporate network computers running the administration console are referred to
as administrator workstations. From these workstations, administrators can
remotely manage all Kaspersky Anti-Virus components installed across the
logical network.
After the installation of the Administration Console an icon for this application will
appear in menu Start/Programs/Kaspersky Administration Kit.
The administrator workstation is not a logical network object. However, they can
be added to the logical network as client computers. The number of administrator
workstations is potentially unlimited. Administrator workstations from different
Logical Networks can coincide – any logical network can be administered from
any administrator workstation available on your local network.
On a logical network, the same computer can act as a client computer, an
administration server, and an administrator workstation.
2.1.5. Application administration plug-in
Network Agent Console Plug-in, a special component providing the
management interface for specific applications via the Administration Console, is
included in all Kaspersky Lab applications managed through Kaspersky
Administration Kit. Each application has its own plug-ins installed on the
administrator workstation. The plug-ins provide:

16 Kaspersky Administration Kit
• Dialog boxes for creating and editing application policies
• Dialog boxes for creating and editing application settings
• Dialog boxes for configuring task settings
• Information about tasks performed by an application
• Information about events generated by an application
• Information about events and statistics for each client computer sent to
the administration console.
2.1.6. Policies, settings, and tasks
A task is an action performed by a Kaspersky Lab application. There are several
types of tasks, depending on task functions. Each task corresponds to specific
application settings.
There is a set of application operating parameters assigned to its task and
applied during its execution. The set of parameters of the application, common
for all types of tasks, forms the application settings. Application operation
parameters specific for each type of tasks form the task settings. The application
settings and task settings do not overlap.
For more information about task types, refer to the documentation for
Kaspersky Lab applications.
To have an application to perform an action, you should configure application
settings, create and configure a corresponding task and run it.
Application settings defined for each individual client computer via a local
interface or remotely via an Administration console will be called the local
application settings.
Centralized configuration of the application operation settings installed on the
client computers in the logical network is performed by defining policies.
A Policy – is a set of parameters of an application in a group. A policy includes
settings for complete configuration of all functions of the application excluding
settings specific for individual tasks. An example of such settings are schedule
settings.
Therefore a policy includes the following settings:
• common settings for all types of tasks - application settings;
• common settings for all individual tasks of each type – most task settings.

Understanding Kaspersky Administration Kit 17
This means that the policy for the anti-virus application (see Figure 1) that
includes the real-time protection and on-demand scan tasks, contains all
required settings of the application's configuration for execution of both types of
tasks, but does not contain, for example, the schedule for execution of these
tasks or settings that define the scan scope.
Figure 1. Policy
Each setting in a policy has an attribute, a "lock" that indicates whether changing
this setting is allowed in the nested policies in the hierarchal level (for nested
groups and slave Administration servers), in the task settings and local
application settings. If there is a "lock" attached to this setting, you will not be
able to redefine its value (see section 2.1.6 on page 16).
In a group each application will have its own policy defined for it. Several policies
with different settings value may be defined for one application. However each
application may only have one active policy.
There is a provision that allows the user to activate an inactive policy based on
an event, which allows, for instance, to establish stricter anti-virus protection
settings during the periods of virus outbreaks.
You can also create policies for mobile users. Such policy will be applied when
the computer is disconnected from the corporate logical network.
For different groups the application's operating settings may be different. In each
group a separate policy for an application may be created.
Nested groups and slave Administration servers inherit policies of groups of
higher level in the hierarchy.
Creation and configuration of tasks across a logical network is centralized. A task
assigned to an administration group is a group task; a task assigned to an
individual client computer is referred to as a local task; and that assigned to
multiple client computers from different groups on the logical network is a global
task.

18 Kaspersky Administration Kit
A group task can be assigned to a group even if a Kaspersky Lab application is
only installed on some of the client computers in this group. In this case, the
group task will be executed only on the computers that have this application
installed.
Nested groups and slave Administration servers inherit tasks from their parent
groups. A task defined for a group will be shared by all client computers from this
group but also by client computers of all nested groups at the lower levels and by
slaves Servers on all subsequent levels of the hierarchy.
The tasks assigned locally to a particular client computer will only be executed
on this computer. Local tasks will be added to the list of current tasks for this
client computer during synchronization of this client with the administration
server.
Because all application settings are governed by the policy, you can only
redefine settings that have been defined as modifiable by this policy or settings
specific to a particular task. For example, for an on-demand scan of a drive, you
should specify the disk name, file masks, etc.
You can schedule tasks to start automatically or run them on demand. Task
performance results are saved both on the administration server and locally. The
administrator can be notified of task results or can view detailed reports.
Information about policies, application settings, global and group tasks is stored
on the server and distributed to the client computers during synchronization.
From clients, the administration server receives data about local changes not
restricted by the policy, applications running on client computers, their status,
and assigned tasks.
2.1.7. Relationship between the policies
and the local application settings
Using policies for all computers included into a group, you can set same values
for the application's operating settings.
Values of the settings set by a policy can be redefined for individual computers in
a group using local application's settings. However, you can set values only for
those settings changes to which are not prohibited by the policy: that is their
settings should not be "locked".
Which value will be used on the client computer (see Figure 2) is determined by
whether the setting is "locked" by the policy.
• if any changes to a setting are prohibited, all client computers will use the
same value specified in the policy;

Understanding Kaspersky Administration Kit 19
• if changes to a setting are allowed, then each client computer uses a local
value of the settings rather than the value specified in the policy. In this
case the value of the setting can be changed via the local application set-
tings.
Thus, when a task is being executed on a client computer, the application will
use values determined by:
• task settings and local application settings if the policy did not prohibit
changes to this setting;
• a group policy, if the policy did not prohibit changes to this setting.
Figure 2. Policy and local application settings
Changes to local application settings following the initial policy application are
defined under application policies in the Advanced dialog (cf. Figure 14).
2.2. Connecting clients to the
Administration server
To enable communication between the clients and the administration server, the
client computers must be connected to the server (see section 2.1 on page 12).
The Network Agent installed on clients provides this functionality.
The following operations require connection to the server:
• Refreshing the list of applications installed on client computers

20 Kaspersky Administration Kit
• Synchronization of policies, application settings, tasks, and task settings
• Updating the information on applications and tasks running on client com-
puters
• Delivery of events to be processed on the server
In most cases, client computers are connected to the server. This connection is
used to automatically exchange data between the clients and the server and to
send information about application events to the server.
Automatic synchronization is performed at regular time intervals defined by the
Network Agent settings (for example, once every fifteen minutes). The time
interval is set by the administrator.
Information about an event is sent to the server immediately after the event
occurs.
In the client settings, you can check/uncheck the Keep connection checkbox to
keep or terminate the client–server connection after the above operations are
over. Permanent connection is preferred if connecting to a client is impaired for
some reasons (the client is behind a firewall, client ports cannot be opened, the
client IP address is unknown, etc.) or you need to constantly monitor the
performance of Kaspersky Lab applications.
The administrator can force synchronization to start by clicking the Force
synchronization command on the shortcut menu of the client computer
(see section 2.10.4 on page 31). In this case, the connection is initiated by the
server. To enable connection, the UDP port is opened on the client computer.
The server sends a connection query to the client’s UDP port. In response, the
server rights to connect to the client are verified (based on a digital signature),
and, if the signature is valid, the connection is established.
A second type of connection is also used to retrieve data from client computers –
update the lists of applications and tasks running on the client and refresh
application statistics.
2.3. Secure connection to the
Administration Server
Data exchange between clients and the Administration Server and connections
of the console to the Administration Server are secured by SSL protocol (Secure
Socket Layer). SSL protocol is responsible for authentication of communicating
parities, encryption of the data being transferred and preventing modification of
data during the transfer. Data integrity ensures that the data has not been
corrupted or altered in transit. An SSL-enabled connection involves