Configuring Kaspersky Thin Client

This section describes how to configure Kaspersky Thin Client.

Scenario: quick start for administrators

This section describes the sequence of steps that must be performed by the administrator to configure Kaspersky Thin Client and Kaspersky Security Center, and to establish a connection between them.

Instructions on installing Kaspersky Thin Client to a thin client are provided in a separate article.

Before installation of Kaspersky Thin Client or prior to the first startup of a thin client on which a Kaspersky Thin Client system is pre-installed, you are advised to update the BIOS on the thin client to the latest version, set a password for BIOS configuration changes, and configure the option to boot only from a local SSD device. These recommended measures will help prevent potential security risks, such as operating system substitution, replacement or deletion of remote server connection certificates, and unauthorized access to operating system settings.

The scenario for initial configuration of Kaspersky Thin Client and Kaspersky Security Center, and for establishing a connection between them consists of the following steps:

1. Installing Kaspersky Security Center

   Download the Kaspersky Security Center distribution package and install the full version of Kaspersky Security Center on the server. The distribution package for the full version of Kaspersky Security Center includes the Kaspersky Security Center Web Console. We recommend selecting the standard installation. For details on installing Kaspersky Security Center, please refer to the Installation of Kaspersky Security Center section of the Kaspersky Security Center Online Help Guide.

2. Configuring firewall rules

   If you plan to use the default port to connect the thin client to Kaspersky Security Center, set the rules allowing TCP connections through port 13292 for the operating system firewall of the server on which Kaspersky Security Center is installed. If you plan to use a port other than 13292, set the permissions accordingly. For detailed information on configuring firewall rules, please refer to the relevant documentation on the operating system you are using.

3. Installing the Kaspersky Security Management Suite web plug-in

   In the Kaspersky Security Center Web Console, install the Kaspersky Security Management Suite web plug-in.

4. Preparing ports

   Kaspersky Thin Client uses a mobile protocol to connect to Kaspersky Security Center. On the Kaspersky Security Center Administration Server, enable use of the TCP port that you set up access to in step 2. For details on TCP port enabling on the Kaspersky Security Center Administration Server, see the Modifying the Mobile Device Management settings section of the Kaspersky Security Center Online Help Guide.

5. Turning on Kaspersky Thin Client

   Turn on Kaspersky Thin Client and wait for the system to load. Please read the terms and conditions of the End User License Agreement and accept the agreement.

6. Configuring Kaspersky Thin Client settings

   After turning on Kaspersky Thin Client and accepting the End User License Agreement, configure general settings and network connection settings.

7. Configuring a connection between Kaspersky Thin Client and Kaspersky Security Center

   In the Kaspersky Thin Client interface, configure the connection to Kaspersky Security Center.

8. Adding Kaspersky Thin Client to the list of managed devices

   Connect to the Kaspersky Security Center Web Console and add Kaspersky Thin Client to the list of managed devices in Kaspersky Security Center. Policies in the Kaspersky Security Center Web Console are applied only for managed devices.

9. Creating an active Kaspersky Security Center policy for Kaspersky Thin Client

   If you need to manage a group of devices, create an active policy for Kaspersky Thin Client.

10. Assigning certificates for a group of devices

    Assign certificates to connect a group of devices to a remote environment and to a log server. We also recommend adding a certificate for connecting Kaspersky Thin Client to Kaspersky Security Center.

When these actions are completed, the Kaspersky Thin Client system will be ready for operation. You will be able to control Kaspersky Thin Client through the Kaspersky Thin Client interface or through the Kaspersky Security Center Web Console, and monitor events of Kaspersky Thin Client.

Scenario: certificate assignment for a group of thin clients

If certificates are assigned for an

Kaspersky Security Center must be installed and configured in advance.

The scenario for assigning certificates to a group of thin clients includes the following steps:

1. Configuring a connection to Kaspersky Security Center

   In the Kaspersky Thin Client interface, configure the connection to Kaspersky Security Center.

2. Adding thin clients to managed devices

   In the Web Console interface, add a thin client to the managed devices group if the thin client is still in the unassigned devices group.

3. Creating an active Kaspersky Security Center policy for Kaspersky Thin Client

   In the Web Console interface, create an active policy for the relevant group of devices.

4. Adding certificates for connection to a remote environment and a log server

   In the Kaspersky Security Center Web Console interface, add required certificates and move the toggle button in the right part of the page to the Enforced position. Wait for Kaspersky Thin Client to fully synchronize with Kaspersky Security Center. You can define the synchronization period when configuring Kaspersky Thin Client through the Kaspersky Security Center Web Console. After synchronization, devices will receive the Kaspersky Security Center Administration Server certificates.

If you remove all certificates that were assigned to a group of devices, the users of thin clients from this group will be able to connect to any server, including servers that have not been assigned any certificates.

Scenario: thin client migration to a new Kaspersky Security Center Server

This section describes the steps to be performed by the administrator when configuring devices running Kaspersky Thin Client for management via a new Kaspersky Security Center Administration Server (hereinafter also referred to as "the Server") if these devices were previously managed via a different Kaspersky Security Center Server.

The scenario for configuring Kaspersky Thin Client management when migrating thin clients to a new Kaspersky Security Center Server consists of the following steps:

1. Installing a new Kaspersky Security Center Administration Server

   Download the Kaspersky Security Center distribution package and install the full version of Kaspersky Security Center on the server. The distribution package for the full version of Kaspersky Security Center includes the Kaspersky Security Center Web Console. We recommend selecting the standard installation. For details on installing Kaspersky Security Center, please refer to the Installation of Kaspersky Security Center section of the Kaspersky Security Center Online Help Guide.

2. Configuring firewall rules

   If you plan to use the default port to connect the thin client to Kaspersky Security Center, set the rules allowing TCP connections through port 13292 for the operating system firewall of the server on which Kaspersky Security Center is installed. If you plan to use a port other than 13292, set the permissions accordingly. For detailed information on configuring firewall rules, please refer to the relevant documentation on the operating system you are using.

3. Installing the Kaspersky Security Management Suite web plug-in

   In the Web Console, install the Kaspersky Security Management Suite web plug-in for the new Kaspersky Security Center Administration Server.

4. Preparing ports

   Kaspersky Thin Client uses a mobile protocol to connect to Kaspersky Security Center. On the Kaspersky Security Center Administration Server, enable use of the TCP port that you set up access to in step 2. For details on TCP port enabling on the Kaspersky Security Center Administration Server, see the Modifying the Mobile Device Management settings section of the Kaspersky Security Center Online Help Guide.

5. Turning on Kaspersky Thin Client

   Turn on Kaspersky Thin Client and wait for the system to load.

6. Creating an active Kaspersky Security Center policy for Kaspersky Thin Client

   In the previously used Web Console, create an active policy for the group of devices that will be managed through the new Kaspersky Security Center Server.

7. Updating the security certificate for connecting to Kaspersky Security Center

   Issue a certificate, save it on the current Kaspersky Security Center Administration Server as a reserve one, and then use it on the new Server as the primary certificate.

8. Configuring a connection between Kaspersky Thin Client and the new Kaspersky Security Center Server

   If a DHCP server is deployed in your enterprise infrastructure and the settings for connecting Kaspersky Thin Client to Kaspersky Security Center are received automatically, use option 224 to define the IP address or domain name of the new Kaspersky Security Center Administration Server and wait for all devices running Kaspersky Thin Client to finish synchronizing with Kaspersky Security Center.

   If a DHCP server is not deployed in your enterprise infrastructure, manually configure the connection to the new Kaspersky Security Center in the Kaspersky Thin Client interface.

Thin client administration groups are connected to the new Kaspersky Security Center Server, and you can manage them using the Web Console interface.

Configuring general settings

In the Kaspersky Thin Client interface, you can configure the general settings of the thin client. For example, you can specify the thin client name that will be displayed in the Kaspersky Thin Client taskbar and in the Kaspersky Security Center Web Console, and select the language of the Kaspersky Thin Client interface.

If the thin client is included in an administration group, the values of settings specified in this article may be enforced through the Web Console. If this is the case, you will not be able to configure these settings in the Kaspersky Thin Client interface.

The settings specified in this article may be hidden on the thin client.

To configure general settings of Kaspersky Thin Client:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the General section (see the figure below).

   

   Settings. General section

3. In the Thin client name field, enter the name that will be displayed for Kaspersky Thin Client in the Web Console. The name can contain uppercase and lowercase letters of the Latin and Cyrillic alphabets, numerals, and a hyphen. The length of the thin client name must not exceed 30 characters.
4. In the Interface language list, select a user interface language. Kaspersky Thin Client supports the Russian, English, Spanish, and Brazilian Portuguese user interface languages.
5. In the Preferred input languages drop-down list, select one or more languages. Kaspersky Thin Client supports the Russian, English, Spanish, and Brazilian Portuguese input languages. The selected languages are displayed in the Kaspersky Thin Client control panel in the order that you selected, and available when switching the keyboard input language.

Changes will be applied after the thin client restart.

Configuring network settings

In the Settings → Network section, you can configure the settings for connecting Kaspersky Thin Client to the network.

To configure the network settings:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the Network section (see the figure below).

   

   Settings. Network section

3. Configure the settings for connecting Kaspersky Thin Client to the network:
   • If you need to receive the network settings automatically via DHCP, select Automatic (DHCP) for the Network settings parameter. In this mode, the IP address, Subnet mask, Default gateway, and DNS servers fields are not accessible.
   • If you need to manually specify the network settings, select Manual for the Network settings parameter and do the following:
     • In the IP address field, enter the IP address of Kaspersky Thin Client in IPv4 format.
     • In the Subnet mask field, enter the subnet mask.
     • In the Default gateway field, enter the address of the network gateway.
     • In the DNS servers field, enter the addresses of the DNS servers. You can enter no more than two addresses. This field is optional.
4. Click Save in the lower part of the window to save the changes.

Configuring settings for connecting Kaspersky Thin Client to Kaspersky Security Center

To manage a thin client through the Web Console, you must configure settings for connecting Kaspersky Thin Client to the Kaspersky Security Center Administration Server.

Kaspersky Thin Client must be connected to the Kaspersky Security Center Server in a secure network segment. We advise to configure this connection with the help of one of your company's qualified experts who will be able to verify the authenticity of the accepted certificate.

We recommend using a separate Kaspersky Security Center Administration Server to manage thin clients in order to receive important security updates from the Kaspersky update servers. The reason for this is that one Kaspersky Security Center Administration Server can have only one active update task with one priority update source.

To configure settings for connecting Kaspersky Thin Client to the Kaspersky Security Center Administration Server:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the Centralized control section (see the figure below).

   

   Settings. Centralized control section

3. In the Centralized control window that opens, configure the following settings for connecting Kaspersky Thin Client to Kaspersky Security Center:
   • If you want to use the DHCP protocol to automatically receive the settings for connecting Kaspersky Thin Client to Kaspersky Security Center, select Automatic (DHCP) in the Method for determining the server IP address block. In this mode, the IP address/server name field cannot be edited.

     To use this connection option, a DHCP server must be deployed in the enterprise infrastructure and option 224 must be used to define the IP address or domain name of the Kaspersky Security Center Administration Server to which you plan to connect Kaspersky Thin Client. Kaspersky Thin Client receives string values in IP address:Port format or Server name:Port format in option 224. For example, 192.168.2.4 or ksc.example.com:12345. The port must be specified only if a port other than port 13292 is used for the connection.

     By default, use of DHCP is enabled to automatically receive the settings for connecting Kaspersky Thin Client to Kaspersky Security Center.

   • If you want to manually define the settings for connecting Kaspersky Thin Client to Kaspersky Security Center, select Manual in the Method for determining the server IP address block and in the IP address/server name field enter the IP address or name of the Kaspersky Security Center Administration Server. If you are using a port other than port 13292, indicate it in IP address:Port format or Server name:Port format.
4. Activate the Connection to Kaspersky Security Center toggle button.
5. If you are connecting to Kaspersky Security Center for the first time, check the settings of the certificate used for connecting Kaspersky Thin Client to Kaspersky Security Center in the Add certificate window and click the Add certificate button. The added certificate will be used for subsequent connections between Kaspersky Thin Client and Kaspersky Security Center.

   If the certificate used for connecting Kaspersky Thin Client to Kaspersky Security Center has been changed in Kaspersky Security Center, you must confirm the certificate change to continue configuring the connection.

Kaspersky Thin Client will attempt to connect to Kaspersky Security Center. Following successful connection to Kaspersky Security Center, the Connected to Kaspersky Security Center status will be displayed.

Changing settings for connecting Kaspersky Thin Client to Kaspersky Security Center

If the thin client is included in an administration group, the values of settings specified in this article may be enforced through the Web Console. If this is the case, you will not be able to configure these settings in the Kaspersky Thin Client interface.

The settings specified in this article may be hidden on the thin client.

To change the settings for connecting Kaspersky Thin Client to Kaspersky Security Center:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the Centralized control section.
3. Deactivate the Connection to Kaspersky Security Center toggle button.
4. In the Confirm disconnection window that opens, view and memorize the confirmation code for disconnecting Kaspersky Thin Client from Kaspersky Security Center, then provide it to the Kaspersky Security Center administrator. The administrator contact details are provided in the Confirm disconnection window. The administrator should send you a confirmation code in response.
5. Click Next.
6. In the Confirmation code window that opens, enter the code provided by the Kaspersky Security Center administrator and click the Confirm button.

   Kaspersky Thin Client will be disconnected from management through Kaspersky Security Center.

7. In the Centralized control window, manually configure settings for connecting to Kaspersky Security Center.
8. Activate the Connection to Kaspersky Security Center toggle button.

The thin client will attempt to connect to Kaspersky Security Center. Following successful connection to Kaspersky Security Center, the Connected to Kaspersky Security Center status will be displayed.

Configuring settings for connecting to a remote environment via RDP

Kaspersky Thin Client lets you configure settings for connecting to a virtual application or remote desktop via RDP.

Information about devices that are redirected to a remote environment is provided in a separate article.

To correctly redirect USB devices to a remote desktop in the Windows 10 operating system, you must enable Microsoft Remote Desktop Services and allow redirection of Plug and Play devices in the settings of Remote Desktop Services. For Microsoft Windows Server 2016 and Microsoft Windows Server 2019 operating systems, you must also allow a remote connection using Remote Desktop Services and allow remote control rules to be set for connection sessions in Microsoft Remote Desktop Services.

To configure settings for connecting to a remote desktop or virtual application via RDP:

1. In the main window of Kaspersky Thin Client, click the RDP button.
2. In the left part of the connection window that opens, click Settings.

   This opens a window in which you can configure settings for connecting to a remote desktop (see the figure below).

   

   Window for configuring settings for connecting to a remote desktop via RDP

3. In the Device redirection settings block, next to the required devices, select the following check boxes:
   • Smart cards if you want to enable redirection of smart cards and tokens.
   • USB drives if you want to enable redirection of USB drives.
   • Printers if you want to enable redirection of printers.

     The remote computer must have the installed driver for the printer that is connected to the thin client.

   • Microphone if you want to enable redirection of audio recording devices.

     Audio volume and other settings are managed from the remote computer.

   • Audio playback devices if you want to enable redirection of headphones or speakers.

     Kaspersky Thin Client supports both mono and stereo playback. Audio volume and other settings are managed from the remote environment.

4. In the Image quality block, select the check boxes next to the remote desktop graphics settings that you need to use:
   • Smooth fonts
   • Menu animation
   • Desktop background
   • Show window contents while dragging
   • Enhanced theme

   Enabling remote desktop display settings may affect the speed of Kaspersky Thin Client operations.

5. If two monitors are installed at your workstation and you want a remote desktop image to be displayed on both monitors, select the Use two monitors check box in the Monitor management block. If necessary, you can configure the layout of monitors.
6. If you need to improve the display and ensure a smoother appearance of graphical elements when connected to a remote environment, select the Improve graphics performance check box in the Performance block.

   If you need to connect to a Microsoft Windows 7 remote desktop, clear the Improve graphics performance check box. The feature is not supported for connections to Microsoft Windows 7 remote desktops.

7. If you need to use the Microsoft Remote Desktop Connection Broker to connect to a remote desktop, use the Remote Desktop Connection Broker collection ID field to specify the collection ID in the format tsv://MS Terminal Services Plugin.1.collection_id (collection_id refers to the specific identifier of the collection).

   Specify a Remote Desktop Connection Broker collection ID to connect to a virtual application.

8. If you need to start a virtual application, specify the application alias in the Application alias field.
9. If you want to automatically restore a remote desktop connection that is unexpectedly disconnected, select the Connect again if connection is lost check box.
10. Click the back arrow in the upper-right corner of the window to return to the connection session.

Configuring settings for connecting to a remote environment in the Basis.WorkPlace infrastructure

Kaspersky Thin Client lets you configure settings for connecting to a remote environment in the Basis.WorkPlace infrastructure.

Information about devices that are redirected to a remote environment is provided in a separate article.

To configure settings for connecting to a remote environment in the Basis.WorkPlace infrastructure:

1. In the main window of Kaspersky Thin Client, click the Basis.WorkPlace button.
2. In the remote desktop connection window that opens, click Settings in the left part of the window.

   This opens a window in which you can configure settings for connecting to a remote desktop (see the figure below).

   

   Window for configuring settings for connecting to a remote desktop managed by Basis.WorkPlace

3. If you need to enable or disable redirection of devices to a remote environment, select or clear the appropriate check boxes in the Redirection of USB devices block.

   Redirection of USB devices to a remote desktop managed by Basis.WorkPlace may be blocked by the Basis.WorkPlace administrator.

4. In the Number of reconnection attempts field, enter the number of times that Kaspersky Thin Client should attempt to reconnect to the Basis.WorkPlace broker if disconnected. You can indicate no more than five attempts at reconnection.
5. In the Connection profile drop-down list, select the type of connection between Kaspersky Thin Client and the Basis.WorkPlace broker. The type of connection depends on the connection speed. The following values are available:
   • Detect automatically
   • Modem
   • Low-speed broadband connection
   • Satellite
   • High-speed broadband connection
   • Wide area network
   • Local area network
6. If two monitors are installed at your workstation and you want a remote desktop image to be displayed on both monitors, select the Use two monitors check box in the Monitor management block. If necessary, you can configure the layout of monitors.
7. Click Save in the lower part of the window to save the changes.
8. Click the back arrow in the upper-right corner of the window to return to the remote desktop connection window.

Configuring power-saving settings

If the thin client is included in an administration group, the values of settings specified in this article may be enforced through the Web Console. If this is the case, you will not be able to configure these settings in the Kaspersky Thin Client interface.

The settings specified in this article may be hidden on the thin client.

You can configure an idle timeout period to turn off the monitor. The monitor will turn on automatically when you click your mouse, press a key on your keyboard, or move your mouse cursor. You can also configure a Kaspersky Thin Client inactivity period after which the thin client will be turned off. To resume operations of the thin client, you will have to turn it on.

To configure power-saving settings:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the Power-saving settings section (see the figure below).

   

   Settings. Power-saving settings section

3. In the Turn off monitor drop-down list, select the system inactivity period after which the monitor will be turned off.
4. In the Turn off thin client drop-down list, select the system inactivity period after which the thin client will be turned off.

You can also configure power-saving settings through the Kaspersky Security Center Web Console interface.

Configuring monitors layout

If two monitors are installed at your workstation, you can select which monitor will be used as the primary monitor and which one will be used as the secondary monitor when showing the remote desktop screen. When connected to the remote desktop, the connection panel is displayed in the upper part of the screen on the primary monitor.

To use two monitors, you must first enable dual monitors support in the settings for connecting to remote desktops either via RDP or managed by Basis.WorkPlace.

To change the layout of monitors for displaying the remote desktop:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the Monitor management section (see the figure below).

   The window that opens displays the layout of monitors schematically. The primary monitor is always positioned on the left and labeled.

   

   Settings. Monitor management section

3. Change the position of monitors by clicking the button located between the monitors on the layout.

The layout of monitors for displaying the remote desktop will be changed.

Managing access to Kaspersky Thin Client settings

You can configure the Kaspersky Thin Client interface to display or hide settings that are configured only once and are no longer used in the core operating scenarios of the thin client.

If the thin client is included in an administration group, the values of settings may be enforced through the Web Console. These enforced settings will be blocked from editing in the Kaspersky Thin Client interface, and you will not be able to enable or disable their display.

To enable or disable the display of Kaspersky Thin Client settings:

1. In the Kaspersky Thin Client control panel, click and select Tools in the menu that opens.
2. In the window that opens, select the Access to settings section (see the figure below) and do one of the following:
   • If you need to hide the settings, move the toggle button to the Access is blocked position.

     All of the following settings will be hidden in the thin client interface:

     • RDP connection settings
     • Basis.WorkPlace connection settings
     • General settings
     • Network settings
     • Kaspersky Security Center connection settings
     • Date and time
     • Power-saving settings
     • Layout of monitors
     • Reset of Kaspersky Thin Client settings
   • If you need to display the settings, move the toggle button to the Access is unblocked position.

     The settings will be displayed. You will be able to define new values for these settings.

   

   Tools. Access to settings section

Configuring the date and time

When a thin client is connected to Kaspersky Security Center, it receives the date and time from the Kaspersky Security Center Administration Server. You can manually change the date and time of Kaspersky Thin Client only if the system is not being managed via Kaspersky Security Center.

If the thin client is included in an administration group, the values of settings specified in this article may be enforced through the Web Console. If this is the case, you will not be able to configure these settings in the Kaspersky Thin Client interface.

The settings specified in this article may be hidden on the thin client.

To change the date and time of Kaspersky Thin Client:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the Date and time section (see the figure below).

   

   Settings. Date and time section

3. Configure the date and time settings:
   • Select the relevant time zone from the Time zone drop-down list.
   • In the Date field, enter the current date in DD-MM-YYYY format.
   • In the Time field, enter the current time in HH:MM:SS format.
4. Click Save in the lower part of the window to save the changes.

Resetting Kaspersky Thin Client settings

Reset will result in the loss of all defined settings and all data of Kaspersky Thin Client (except the audit log and system date), and will disconnect the device from Kaspersky Security Center. We recommend performing a reset only after approval with your company administrator.

If the thin client is included in an administration group, the values of settings specified in this article may be enforced through the Web Console. If this is the case, you will not be able to configure these settings in the Kaspersky Thin Client interface.

The settings specified in this article may be hidden on the thin client.

To perform a factory reset of a thin client that is not included in an administration group:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the Factory reset section (see the figure below).

   

   Settings. Factory reset section

As a result, all defined settings of Kaspersky Thin Client will be restored to their original values (default), all data on the device will be deleted (except the audit log and system date), and Kaspersky Thin Client will be disconnected from Kaspersky Security Center. After reset, the thin client turns off.

To perform a factory reset of a thin client that is included in an administration group:

1. In the Kaspersky Thin Client control panel, click and select Settings in the menu that opens.
2. In the window that opens, select the Factory reset section.
3. In the window that opens, click the Reset settings button.

   This opens the Confirm reset window showing a confirmation code.

4. Provide the confirmation code to the Kaspersky Security Center administrator. The administrator contact details are provided in the Confirm reset window. The Kaspersky Security Center administrator sends you a confirmation code in response.
5. Click Next.
6. In the Confirmation code window that opens, enter the code provided by the Kaspersky Security Center administrator and click the Confirm button.

As a result, all defined settings of Kaspersky Thin Client will be restored to their original values (default), all data on the device will be deleted (except the audit log and system date), and Kaspersky Thin Client will be disconnected from Kaspersky Security Center. After reset, the thin client turns off.