Installing Kaspersky Endpoint Agent in quiet mode requires acceptance of the terms and conditions of the End User License Agreement and Privacy Policy. Use the EULA=1 and PRIVACYPOLICY=1 parameters only if you have fully read, understood, and accept the terms of the End User License Agreement and Privacy Policy.

Example:

msiexec /i endpointagent.msi EULA=1 PRIVACYPOLICY=1 USE_AZURE_SUPPORT=1 /qn

Command parameters for installing Kaspersky Endpoint Agent

Parameter	Description
`EULA`	Required parameter. This parameter indicates whether the user consents to or declines the terms of the End User License Agreement. Values: 0 – decline; 1 – consent. If the value 0 is passed, the application is not installed.
`PRIVACYPOLICY`	Required parameter. This parameter indicates whether the user consents or declines the terms of the Privacy Policy. Values: 0 – decline; 1 – consent. If the value 0 is passed, the application is not installed.
`USE_AZURE_SUPPORT`	This parameter sets the flag for using the hardware identifier in the form of the value of the `EnableAzureSupport` HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Environment parameter for operating systems on an x86 platform or the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SOYUZ\4.0\Environment parameter for operating systems on an x64 platform. Values: 0 – When sending events to the telemetry collection server, Kaspersky Endpoint Agent passes the host's OS identifier from the registry as the sensor_id value in requests to the server. Default value 1 – When sending events to the telemetry collection server, Kaspersky Endpoint Agent passes the host's BIOS identifier as the sensor_id value in requests to the server.

Parameter

Description

EULA

Required parameter. This parameter indicates whether the user consents to or declines the terms of the End User License Agreement.

Values:

0 – decline;
1 – consent.
If the value 0 is passed, the application is not installed.

PRIVACYPOLICY

Required parameter. This parameter indicates whether the user consents or declines the terms of the Privacy Policy.

Values:

0 – decline;
1 – consent.
If the value 0 is passed, the application is not installed.

USE_AZURE_SUPPORT

This parameter sets the flag for using the hardware identifier in the form of the value of the EnableAzureSupport HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Environment parameter for operating systems on an x86 platform or the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SOYUZ\4.0\Environment parameter for operating systems on an x64 platform.

Values:

0 – When sending events to the telemetry collection server, Kaspersky Endpoint Agent passes the host's OS identifier from the registry as the sensor_id value in requests to the server. Default value
1 – When sending events to the telemetry collection server, Kaspersky Endpoint Agent passes the host's BIOS identifier as the sensor_id value in requests to the server.

Repairing Kaspersky Endpoint Agent

An example of restoring the application in quiet mode is shown below. After starting application restoration in quiet mode, your participation in the restoration process is not required.

Example:

msiexec /i endpointagent.msi REINSTALL=ALL /qn

Uninstalling Kaspersky Endpoint Agent

An example of uninstalling the application in quiet mode is shown below. After starting application uninstallation in quiet mode, your participation in the uninstallation process is not required.

Example:

msiexec /i {BB66A7B5-A5C0-45E6-92B9-D0B848B6F394} REMOVE=ALL /qn

If the application is password protected:

msiexec /i {BB66A7B5-A5C0-45E6-92B9-D0B848B6F394} REMOVE=ALL UNLOCK_PASSWORD=<password> /qn

All data that is stored locally on the device, except for trace and dump files, is deleted from the device when the application is uninstalled.

Installing Kaspersky Endpoint Agent using Kaspersky Security Center

Kaspersky Endpoint Agent can be installed using a remote installation task in Kaspersky Security Center. Installation consists of the following steps:

Creating an installation package.
Creating a remote installation task.

Kaspersky Security Center also supports other methods of installing applications on groups of managed devices. For more information about installation using a remote installation task and other installation methods, refer to the Kaspersky Security Center Help.

When creating an installation package using Kaspersky Security Center 12 and later in order to install Kaspersky Endpoint Agent on devices running Windows XP, use the installation startup file (setup.exe) from the installation package created using Kaspersky Security Center 10.5.

In this Help section

Creating Kaspersky Endpoint Agent installation package

Creating Kaspersky Endpoint Agent remote installation task

Page top

Creating Kaspersky Endpoint Agent installation package

Expand all | Collapse all

An installation package is a set of files generated for the remote installation of a Kaspersky application using Kaspersky Security Center. The installation package contains the required settings to install the application and ensure its operation immediately after installation. The installation package is created on the basis of the file with the KUD extension included in the application distribution package.

Creating an installation package in the Administration Console.

To create an installation package:

In the Administration Console, select Administration Server → Advanced → Remote installation → Installation packages.
Click the Additional actions button and select View current versions of Kaspersky applications from the drop-down list.
The list of current versions of Kaspersky applications will be displayed.
Select Kaspersky Endpoint Agent installation package.
Click the Download application and create an installation package button.
The installation package will be displayed in the list of installation packages.
To change the installation package properties, in the context menu of the installation package, select Properties.
The properties window of Kaspersky Endpoint Agent installation package opens. You can specify:
- Application installation folder
- Value of the repair mode flag
- Value of the flag indicating compatibility with Azure WVD
- The settings of the key file for activating the application

The new installation package is available in the list of installation packages. You can use this installation package for a remote installation task.

Creating an installation package in the Web Console and in the Cloud Console.

To create an installation package:

In the main Web Console window, select Discovery and Deployment → Deployment and Assignment → Installation packages.
The list of installation packages downloaded to Kaspersky Security Center will open.
Click the Add button.
The New Package Wizard will start.
On the first screen of the wizard, select Create installation package for Kaspersky application.
A list of installation packages available on Kaspersky web servers will be displayed. The list only contains installation packages for applications that are compatible with the current version of Kaspersky Security Center.
Select Kaspersky Endpoint Agent installation package.
This opens a window containing information about the installation package.
Read the information and click Download and create installation package.
If the distribution package cannot be converted to an installation package, the Download distribution package button will be displayed instead of the Download and create installation package button. In that case, do the following:
1. Click the Download distribution package button to download the distribution package to your computer.
  Wait for the download to finish.
2. Close the installation package creation wizard window and restart the wizard.
3. On the first page of the wizard, select Create installation package from file.
4. On the second page of the wizard, specify the path to the distribution package file on your computer.
5. Follow the wizard's instructions.
When you create the installation package, accept the terms and conditions of the License Agreement and the Privacy Policy.
After download is complete, click Close.
The selected installation package has been downloaded to the Administration Server shared folder, into the Packages subfolder. The downloaded installation package will be displayed in the list of installation packages.
To change the installation package's properties, click on the installation package name.
The properties window of Kaspersky Endpoint Agent installation package opens. You can specify:
- Application installation folder
- Value of the repair mode flag
- Value of the flag indicating compatibility with Azure WVD
- The settings of the key file for activating the application

The new installation package is available in the list of installation packages. You can use this installation package for a remote installation task.

When creating an installation package using Kaspersky Security Center 12 and later in order to install Kaspersky Endpoint Agent on devices running Windows XP, use the installation startup file (setup.exe) from the installation package created using Kaspersky Security Center 10.5.

Page top

Creating Kaspersky Endpoint Agent remote installation task

Expand all | Collapse all

The Remote application installation task is intended for the remote installation of Kaspersky Endpoint Agent using Kaspersky Security Center. To install the application, the task uses the application installation package.

Creating a remote installation task in the Administration Console.

To create a remote installation task:

In the Administration Console, open the Administration Server → Tasks folder.
A list of tasks appears.
Click Create a task.
The task creation wizard will start. Follow its steps.

Step 1. Selecting the task type

Select Kaspersky Security Center Administration Server → Remote application installation.

Step 2. Selecting the installation package

In the list of installation packages, select Kaspersky Endpoint Agent installation package.

You can change the properties of the Kaspersky Security Center installation package.

Step 3. Optional

The Network Agent can be installed together with Kaspersky Endpoint Agent. The Network Agent provides interaction between the Administration Server and the client computer. If the Network Agent is already installed on the computer, it is not re-installed.

If you want to install the Network Agent together with Kaspersky Endpoint Agent, select the Network Agent installation package.

Step 4. Settings

Configure the following additional application settings:

Force installation package download. Select the application installation method:
- Using Network Agent. If the Network Agent is not installed on the computer, first the Network Agent is installed using the operating system tools. Than Kaspersky Endpoint Agent is installed using the Network Agent tools.
- Using operating system resources through distribution points. The installation package will be disseminated to client computers through distribution points using operating system resources . You can select this option if there is at least one distribution point in your network. For details on distribution point operation, refer to Kaspersky Security Center Help.
- Using operating system resources through Administration Server. The Administration Server disseminates files to client computers by means of the operating system. This option can be selected if the Network Agent is not installed on the client computer, but the client computer is in the same network as the Administration Server.
Behavior of devices managed by other Servers. Select how to install Kaspersky Endpoint Agent. If more than one Administration Server is installed in the network, these Administration Servers can detect the same client computers. It can result in remote installation of the same application on one client computer from several Administration Servers and in other conflicts.
Do not install application if it is already installed. Clear this check box if you want, for example, to install an earlier version of the application.

Step 5. Selecting how to restart the operating system

Select the action to be performed if the computer must be restarted.

Step 6. Selecting devices to receive the task assignment

Select the devices on which Kaspersky Endpoint Agent will be installed.

Step 7. Selecting an account to run the task

Select an account to install the Network Agent using the operating system. In this case, administrator permissions are required to access the computer. You can add multiple accounts. If an account does not have the required permissions, the installation wizard uses the next account in the list. You do not need to select an account to install Kaspersky Endpoint Agent using the Network Agent.

Step 8. Configuring task schedule settings

Configure the task start schedule. For example, manually or when the computer is idle.

Step 9. Defining the task name

Enter the task name, for example, Installing Kaspersky Endpoint Agent.

Step 10. Finishing task creation

Complete the wizard operation. If required, select the Run task after wizard finishes check box. You can monitor the task's progress in the task properties. The application will be installed in quiet mode.

Creating a remote installation task in the Web Console and in the Cloud Console.

To create a remote installation task:

In the main Web Console window, select Devices → Tasks.
A list of tasks appears.
Click the Add button.
The task creation wizard will start. Follow its steps.

Step 1. Configuring the general task settings

In order to configure the general task settings:

In the Application drop-down list, select Kaspersky Security Center.
In the Task type drop-down list, select Remote application installation.
In the Task name field, enter a short description, for example, Installing Kaspersky Endpoint Agent.
In the Devices to which the task will be assigned section, select the task scope.

Step 2. Selecting computers for installation

At this step, select the computers on which Kaspersky Endpoint Agent will be installed in accordance with the selected task scope.

Step 3. Configuring the installation package settings

At this step, configure the installation package settings:

Select Kaspersky Endpoint Agent installation package.
Select the Network Agent installation package.
The selected version of the Network Agent will be installed together with Kaspersky Endpoint Agent. The Network Agent provides interaction between the Administration Server and the client computer. If the Network Agent is already installed on the computer, it is not re-installed.
In the Force installation package download section, select the application installation method:
- Using Network Agent. If the Network Agent is not installed on the computer, first the Network Agent is installed using the operating system tools. Than Kaspersky Endpoint Agent is installed using the Network Agent tools.
- Using operating system resources through distribution points. The installation package will be disseminated to managed devices through distribution points using operating system resources. You can select this option if there is at least one distribution point in your network. For details on distribution point operation, refer to Kaspersky Security Center Help.
- Using operating system resources through Administration Server. The Administration Server will deliver files to managed devices by means of the operating system. This option can be selected if the Network Agent is not installed on the managed device, but the managed device is in the same network as the Administration Server.
In the Maximum number of concurrent downloads field, specify the limit on the number of installation package download requests to the Administration Server. A limit on the number of requests helps prevent network overload.
In the Number of installation attempts field, specify the limit on the number of application installation attempts. After successfully installing Kaspersky Endpoint Agent , the task will automatically start the next installation.
If required, clear the Do not install application if it is already installed check box. This will allow, for example, installing an earlier version of the application.
If required, clear the Verify operating system type before downloading check box. This will prevent the superfluous download of the application distribution package in the event that the computer's operating system does not meet the software requirements. If you are sure that the computer's operating system meets the software requirements, you can skip this check.
If required, select the Assign package installation in Active Directory group policies check box. Kaspersky Endpoint Agent can be installed manually using the Network Agent or Active Directory. To install using the Network Agent, the remote installation task must be started with the domain administrator permissions.
If required, select the Prompt the user to close running applications check box. Installing Kaspersky Endpoint Agent requires computer resources. For the user's convenience, the application installation wizard prompts the user to close running applications before starting the installation. This will prevent slowdowns in the operation of other applications, as well as possible computer malfunctions.
In the Behavior of devices managed by other Servers section, select the installation method for Kaspersky Endpoint Agent. If more than one Administration Server is installed in the network, these Administration Servers can detect the same client computers. It can result in remote installation of the same application on one client computer from several Administration Servers and in other conflicts.

Step 4. Selecting how to restart the operating system

Select the action to be performed if the computer must be restarted.

Step 5. Selecting an account to run the task

Select an account to install the Network Agent using the operating system. In this case, administrator permissions are required to access the computer. You can add multiple accounts. If an account does not have the required permissions, the installation wizard uses the next account in the list. You do not need to select an account to install Kaspersky Endpoint Agent using the Network Agent.

Step 6. Finishing task creation

Complete the wizard's operation by clicking the Finish button. The new task will appear in the task list. To run the task, select the check box next to the task and click Run. The application will be installed in quiet mode.

Page top

Installing Kaspersky Endpoint Agent administration tools

This section contains information on how to install Kaspersky Endpoint Agent Management plug-in for managing Kaspersky Endpoint Agent using Kaspersky Security Center Administration Console or Kaspersky Endpoint Agent Management web plug-in for managing Kaspersky Endpoint Agent using Kaspersky Security Center Web Console.

In this Help section

Installing and updating Kaspersky Endpoint Agent Management plug-in

Installing and updating Kaspersky Endpoint Agent Management web plug-in

Page top

Installing and updating Kaspersky Endpoint Agent Management plug-in

The Kaspersky Endpoint Agent Management plug-in must be installed in order to manage Kaspersky Endpoint Agent using the Kaspersky Security Center Administration Console.

To install the Kaspersky Endpoint Agent Management plug-in,

copy the klcfginst.msi file from the distribution kit to the device on which Kaspersky Security Center Administration Console is installed and run the file.

The application Installation Wizard starts.

Updating a previously installed version of the Kaspersky Endpoint Agent Management plug-in

This update is only available for the Kaspersky Endpoint Agent Management plug-in versions 3.7 and later.

When installing a plug-in on a device with a previous plug-in version:

All the setting values, including policies, group and local tasks, are migrated to the new plug-in version, and the previously installed plug-in version is automatically removed.
The Kaspersky Endpoint Agent settings that were not available in the previous plug-in version are set to default values and can be configured.
To apply previously unavailable settings, after updating the plug-in, change the desired policy or task and save your changes.
Policy templates created in the previous plug-in version are available in the new plug-in version.

You can use the new plug-in to manage previous Kaspersky Endpoint Agent versions. However, previous versions of Kaspersky Endpoint Agent do not support and do not apply the settings that have appeared in the new plug-in version.

Page top

Installing and updating Kaspersky Endpoint Agent Management web plug-in

Kaspersky Endpoint Agent Management web plug-in must be installed to manage Kaspersky Endpoint Agent using Kaspersky Security Center Web Console.

You can install the web plug-in in one of the following ways:

Using the Initial Setup Wizard of the Kaspersky Security Center Web Console.
From the list of available distribution packages in the Kaspersky Security Center Web Console.
For detailed information on installing management web plug-ins, refer to the Kaspersky Security Center Help.
By downloading the distribution package to the Kaspersky Security Center Web Console from a third-party source.
To install the web plug-in, add a ZIP archive with the distribution package of the Kaspersky Endpoint Agent web plug-in to the Web Console interface (Console settings → Web plug-ins). You can download the web plug-in distribution kit, for example, from Kaspersky's website.

Updating a previously installed version of the Kaspersky Endpoint Agent Management web plug-in

When installing a plug-in on a device with a previous plug-in version:

All the setting values, including policies, group and local tasks, are migrated to the new plug-in version, and the previously installed plug-in version is automatically removed.
The Kaspersky Endpoint Agent settings that were not available in the previous plug-in version are set to default values and can be configured.
To apply previously unavailable settings, after updating the plug-in, change the desired policy or task and save your changes.
Policy templates created in the previous plug-in version are available in the new plug-in version.

You can use the new plug-in to manage previous Kaspersky Endpoint Agent versions. However, previous versions of Kaspersky Endpoint Agent do not support and do not apply the settings that have appeared in the new plug-in version.

Page top

Updating Kaspersky Endpoint Agent from the previous version

Only Kaspersky Endpoint Agent version 3.8 and later can be updated. The update is possible for application versions installed both as part of the

Endpoint Protection Platform

application and independently. The update can be performed by installing the new version.

When you update Kaspersky Endpoint Agent, the current license is automatically applied to Kaspersky Endpoint Agent. The license term will remain unchanged. When updating the application with an expired license, the new application version works in limited functionality mode after installation.

If the license for the updated version has expired, you can add the license key during the update. The key file can be passed using one of the specified methods.

When Kaspersky Endpoint Agent is installed on a device with a previous version of Kaspersky Endpoint Agent, first all

data that can be migrated

is saved and used, then the previous version of the application is automatically uninstalled.

If Kaspersky Endpoint Agent is installed on a device with a previous version of Kaspersky Endpoint Agent, you will need to create an account to connect to Kaspersky Security Center and migrate data from the previous version. The account uses the default name: AutoIOC_Admin and a password specified by the user.

When updating a previous version of Kaspersky Endpoint Agent that is password protected, you must pass this password to the installer in one of the following ways:

When installing the application locally using the installation wizard interface or interactively using the command line, specify the password at the appropriate step.
When installing the application locally using the command line in quiet mode, specify the password as the value of the UNLOCK_PASSWORD key.
When installing the application remotely using Kaspersky Security Center, pass the current password in the installation package settings.

When updating Kaspersky Endpoint Agent as part of EPP, you can pass the password as the value of the UNLOCK_PASSWORD key in the install_props.json configuration file.

The application password passed through the install_props.json configuration file is stored in the file in non-encrypted form. To reduce the probability of unauthorized access to this data, it is recommended to restrict access to the install_props.json file and delete it from the device after installing or updating the application.

Starting from version 3.10,

Kaspersky Managed Protection

(also referred to as KMP) usage cannot be configured by means of Kaspersky Endpoint Agent. If usage of the KMP service was enabled in the previous Kaspersky Endpoint Agent version, the KMP service continues functioning after the application is updated to version 3.10 and later. After the application update, you can disable the KMP service only using Kaspersky Endpoint Agent Administration Plug-in or Kaspersky Endpoint Agent Web Plug-in of versions earlier then 3.10.

When installing a plug-in on a device with a previous plug-in version:

All the setting values, including policies, group and local tasks, are migrated to the new plug-in version, and the previously installed plug-in version is automatically removed.
The Kaspersky Endpoint Agent settings that were not available in the previous plug-in version are set to default values and can be configured.
To apply previously unavailable settings, after updating the plug-in, change the desired policy or task and save your changes.
Policy templates created in the previous plug-in version are available in the new plug-in version.

You can use the new plug-in to manage previous Kaspersky Endpoint Agent versions. However, previous versions of Kaspersky Endpoint Agent do not support and do not apply the settings that have appeared in the new plug-in version.

Repairing Kaspersky Endpoint Agent

If you launch Kaspersky Endpoint Agent installer in Repair mode, it will check and restore the integrity of all damaged application modules and system registry keys created during the application's installation.

You can run the installer in Repair mode in one of the following ways:

Locally using Kaspersky Endpoint Agent Installation Wizard.
Locally using the command line.
Remotely using Kaspersky Security Center by performing one of the following actions (for details, refer to Kaspersky Security Center Help):
- By selecting the Repair application if it is already installed check box when creating the installation package.
- By specifying the REINSTALL=ALL parameter when creating a custom installation package.

If Kaspersky Endpoint Agent installer is launched in Repair mode and the application does not need to be repaired, the installer will not perform any changes on the device.

If Kaspersky Endpoint Agent installer is launched in Repair mode and the application is not installed on the device, the application installation will start.

If Kaspersky Endpoint Agent installer is launched in Repair mode locally using the command line or remotely using Kaspersky Security Center, and the settings of the installed application differ from the settings specified in the installer, the installer will be launched in the mode for changing the settings of the installed application.

Page top

Changes in the system after Kaspersky Endpoint Agent installation

The Windows Installer service performs the following changes on the protected device during the installation of Kaspersky Endpoint Agent:

Creates Kaspersky Endpoint Agent folders.
Registers Kaspersky Endpoint Agent keys in the system registry.
Registers Kaspersky Endpoint Agent services and drivers.

Kaspersky Endpoint Agent folders on the protected device

When Kaspersky Endpoint Agent is installed, the following folders are created on the device:

The default Kaspersky Endpoint Agent installation folder that contains Kaspersky Endpoint Agent executable files:
- On a 32-bit version of Microsoft Windows: %ProgramFiles%\Kaspersky Lab\Endpoint Agent\
- On a 64-bit version of Microsoft Windows: %ProgramFiles (x86)%\Kaspersky Lab\Endpoint Agent\
Folder containing Kaspersky Endpoint Agent (x86) drivers:
- On a 32-bit version of Microsoft Windows: %ProgramFiles%\Kaspersky Lab\Endpoint Agent\drivers\<OS version>\<driver name>
- On a 64-bit version of Microsoft Windows: %ProgramFiles (x86)%\Kaspersky Lab\Endpoint Agent\drivers\x64\<OS version>\<driver name>
Folders containing IOC files:
- In 32-bit version of Microsoft Windows:
  - %ProgramFiles%\Kaspersky Lab\Endpoint Agent\openioc
  - %ProgramFiles%\Kaspersky Lab\Endpoint Agent\openioc\1.0
  - %ProgramFiles%\Kaspersky Lab\Endpoint Agent\openioc\1.1
- In 64-bit version of Microsoft Windows:
  - %ProgramFiles (x86)%\Kaspersky Lab\Endpoint Agent\openioc
  - %ProgramFiles (x86)%\Kaspersky Lab\Endpoint Agent\openioc\1.0
  - %ProgramFiles (x86)%\Kaspersky Lab\Endpoint Agent\openioc\1.1
Folders containing Kaspersky Endpoint Agent system files:
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data\Cache
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data\Cache\Images
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data\Cache\Queue
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data\Cache\Queue\Kata
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data\Cache\Queue\Kmp
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data\Cache\Queue\Syslog
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data\Hunts
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Data\killchain
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Settings
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Tasks
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\DSKM
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Temp
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Temp\Tasks
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Bases
Folder containing system files for Kaspersky Security Network's operation.
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Ksn
Folder containing quarantined files:
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Quarantine
Folder containing files restored from quarantine:
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Restored
Folder containing Kaspersky Security Center policy configuration files:
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Policy
Folders containing system files for Kaspersky Sandbox's operation:
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Sandbox
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Sandbox\Queue
Folder containing files of updatable components:
- %ALLUSERSPROFILE%\Kaspersky Lab\Endpoint Agent\4.0\Update
Folder containing shortcut files for the Start menu:
- %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Kaspersky Endpoint Agent

Kaspersky Endpoint Agent services and drivers

The following Kaspersky Endpoint Agent services are registered and started under the system account (SYSTEM):

SOYUZ.exe is the main Kaspersky Endpoint Agent service that manages its tasks and operation processes.
VOSTOK.dll (executed in proton.exe) is a service that facilitates the interaction between Kaspersky Endpoint Agent and the Central Node component.
ANGARA.dll (executed in proton.exe) is a service that facilitates the interaction between Kaspersky Endpoint Agent and EPP in scenarios of Kaspersky Sandbox integration.

The following Kaspersky Endpoint Agent drivers are registered on the device:

klsnsr.sys is Event Tracing for Windows (ETW) driver.
klncap.sys is ETW network packet analyzer.
When installed on a device running Microsoft Windows XP, the klncapxp.sys driver is registered instead of klncap.sys.

System registry keys

As a result of Kaspersky Endpoint Agent's installation, the following registry keys are created:

Registry keys are listed in the 32-bit application view.

[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\Connectors\SOYUZ\4.0.0.0\ProdDisplayName]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\Connectors\SOYUZ\4.0.0.0\ProdVersion]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\Connectors\SOYUZ\4.0.0.0\ConnectorVersion]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\Connectors\SOYUZ\4.0.0.0\ConnectorFlags]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\Connectors\SOYUZ\4.0.0.0\NagentMinVer]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\Connectors\SOYUZ\4.0.0.0\ConnectorPath]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\SOYUZ\4.0.0.0\Installer\UninstallString3]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\SOYUZ\4.0.0.0\Installer\UninstallString3KPD]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\SOYUZ\4.0.0.0\Installer\ProductCode]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\NoPPL]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\BFESDDL]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\CrashDump\Enable]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\CrashDump\Folder]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\CrashDump\Enable(Example)]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\CrashDump\Folder(Example)]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Environment\EnableKillChain]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Environment\SvmUpdateMode]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Environment\MsiPath]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Environment\AgentPath]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Environment\EventsExpirationTimeout]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Install\InstallID]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Install\InstallTime]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Install\InstallLCID]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Install\InstallLocalization]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Install\InstallPlatformType]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Install\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Trace\Configuration]
[HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SOYUZ\4.0\Trace\Configuration(Example)]
[HKEY_CURRENT_USER\Software\KasperskyLab\SOYUZ\StartMenu]
[HKEY_CURRENT_USER\Software\KasperskyLab\SOYUZ\UninstallShortcut2]
[HKEY_CURRENT_USER\Software\KasperskyLab\SOYUZ\RelNotes]
[HKEY_CURRENT_USER\Software\KasperskyLab\SOYUZ\License]
[HKEY_CURRENT_USER\Software\KasperskyLab\SOYUZ\Ksn]
[HKEY_CURRENT_USER\Software\KasperskyLab\SOYUZ\Kmp]
[HKEY_CURRENT_USER\Software\KasperskyLab\SOYUZ\ProductUrl]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\angara]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\klelaml]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\klncap]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\klncapxp]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\klsnsr]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vostok]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\soyuz]

Page top

Kaspersky Anti Targeted Attack Platform

Contents

Installing and uninstalling Kaspersky Endpoint Agent

Preparing for Kaspersky Endpoint Agent installation

Installing Kaspersky Endpoint Agent

Installing and uninstalling Kaspersky Endpoint Agent locally

Installing Kaspersky Endpoint Agent using the Installation Wizard

Removing Kaspersky Endpoint Agent using the Installation and Uninstallation Wizard

Installing, restoring and uninstalling the application using the command line

Installing Kaspersky Endpoint Agent using Kaspersky Security Center

Creating Kaspersky Endpoint Agent installation package

Creating Kaspersky Endpoint Agent remote installation task

Installing Kaspersky Endpoint Agent administration tools

Installing and updating Kaspersky Endpoint Agent Management plug-in

Installing and updating Kaspersky Endpoint Agent Management web plug-in

Updating Kaspersky Endpoint Agent from the previous version

Repairing Kaspersky Endpoint Agent

Changes in the system after Kaspersky Endpoint Agent installation