Kaspersky Administration Kit 8.0 Critical Fix 2 (8.0.2134) _____________________________________________________________________________ GENERAL DESCRIPTION Kaspersky Administration Kit 8.0 Critical Fix 2 is a cumulative update for Kaspersky Administration Kit. You can use this version of the application both for initial installation of Kaspersky Administration Kit, and for upgrade of earlier application versions. The following procedure is recommended to upgrade the application: 1) Read this document carefully and determine whether you need this update. 2) Back up Administration Server data using klbackup.exe utility or the Administration Server backup tasks. Please note that complete restoration of the Administration Server data requires saving the Server certificate. 3) Start the installation of Kaspersky Administration Kit 8.0 Critical Fix 2 on the host with installed Administration Server, then upgrade the version of the Administration Server. The new version of the Administration Server is backward compatible. All data related to the previous version of the Administration Server will be saved. 4) Create a group or a global deployment task for Network Agent version 8.0.2134. Run the task manually or according to a schedule. After the task is completed, Network Agent will be updated on client computers. -------------------------------------------------------------------------- Changes introduced in the 8.0.2134 build (Kaspersky Administration Kit 8.0 Critical Fix 2) as compared with 8.0.2090 (Kaspersky Administration Kit 8.0 Critical Fix 1): Added: support for management of the following applications: - Kaspersky Endpoint Security 8 for Smartphone; - Kaspersky Endpoint Security 8 for Mac; - Kaspersky Endpoint Security 8 for Linux. Fixed issues: - Failures in Kaspersky Lab Network Agent service. - Failure when creating a report by Update Agents when you use MySQL as Administration Server database. - Error when adding a computer relocation rule (move computers by operating system if the operating system is Windows Server 2008 R2). - Time lag when switching from a mobile policy to an active policy. - Use of NetBIOS name instead FQDN when you connect to mail server. - Computers that used VPN to connect to Administration Server have the "Disconnected from Administration Server" status. - Frequents starts of remote installation task if the "Run missed tasks" option is selected. - Error when deleting files from Quarantine and Backup. - Error when downloading updates using multicast distribution. - Administration Console failures when deleting an administration group; - Error when discovering Active Directory. - In the Administration Console, a turned off computer can be assigned the "Visible" status when you attempt to run a task on it. - False alarms ("Disconnected from Administration Server") on computers that have multiload configuration. - Localization issues. - The "No access" error when polling Active Directory domains if there is no trusted connection to the current domain. - Error when refreshing informational panels in the Administration Console. - Error when tasks inherited from master Administration Server are not deleted from slave Server. - Fault-tolerance of the Administration Server update mechanism has been enhanced. - Automatic license installation has been sped up. -------------------------------------------------------------------------- Changes introduced in the 8.0.2090 (Kaspersky Administration Kit 8.0 Critical Fix 1) as compared with 6.0.2048 (Kaspersky Administration Kit 8.0): - Fixed: An error in the installation package synchronization between master and slave Administration Servers. - Fixed: resource leakage while running Network Agent with Kaspersky Anti-Virus 6.0 for Windows Workstations MP3 and Kaspersky Anti-Virus 6.0 for Windows Servers MP3. - Fixed: an error which emerged when installing the task on all computers under the Update Agent with the multicast IP-based delivery enabled. - Connection to Update Agent is established by DNS name. - Fixed: an error resulting in the installation package removal from an Update Agent before the installation task has been removed from the Administration Server. - Fixed: an error resulting in the fact that Administration Console does not respond to administrator's commands. - Fixed: an error related to the wrong registration of Administration Server operation errors in the Microsoft Windows Event Log. - Fixed: incorrect Wake On LAN signal sending algorithm. - Fixed: the Administration Server incorrect running after BUILDIN\Administrators account removal from the list of Administration Server access rights privileges. - Fixed: entering incorrect access rights after restoring a backup copy on Administration Server in another domain. - Fixed: an error which caused Administration Server failure due to an error in the current version of OpenSSL library. - Fixed: Administration Server failure when processing SNMP response while polling the network. - Fixed: incorrect recognition of DNS suffix by the Network Agent. - The Network Agent now addresses the Administration Server correctly by its mirror address. - If Network Agent remote deployment is not available, a correct diagnostic message is displayed on the terminal server. - The Administration Server service does not fail at setup after upgrading from the previous version if files of some group tasks are missed in the file repository and links to them are stored in the database. - Fixed: while upgrading from the previous version, the properties of the task of downloading updates to the Administration Server were converted incorrectly if the option of downloading all possible updates was enabled before getting updates. - Fixed: integration with Microsoft NAP on Microsoft Windows XP. - Applications registry functionality under Microsoft Windows Vista does not cause CPU overload if there is an Administration Server installed. - Fixed: an error related to the false notification on protection inoperability at computer startup. - Fixed: possible cuts of large reports when saving as .pdf document. - Fixed: the error which caused excessive addressing to the Active Directory tree along with Network Agent running. - Fixed: The problem related to excessive "Domain controller is unavailable" records in the Kaspersky Administration Kit event log. - Fixed: The problem which did not allow to open the 13000 port when restarting the Administration Server. -------------------------------------------------------------------------- Changes introduced in the 8.0.2048 (Kaspersky Administration Kit 8.0) as compared with 6.0.1710 (Administration Kit 6 Maintenance Pack 2): - Introduced: simplified application installation mode. - Installation packages for remote deployment of Kaspersky Anti-Virus 6.0 for Windows Workstations MP4 and Kaspersky Anti-Virus 6.0 for Windows Servers MP4 are created during Kaspersky Administration Kit installation. - Application kit now includes the distribution package of Microsoft SQL Express 2005. Microsoft SQL Express 2005 is installed automatically if standard setup is selected. - Redesigned: application user interface. - Added: support for informational panels (dashboards) updated in real time. - Added: feature which collects information about the applications installed on client computers. - Redesigned and extended: system of access rights. - Added: support for SNMP monitoring of basic parameters of anti-virus protection in corporate LAN. - Added: support for Microsoft NAP. - Added: capability to switch mobile clients among Administration Servers. - Extended: criteria for switching clients between the mobile and regular policies. - Extented: options for automatic relocation of computers to administration groups have been extended. - Added: capability to create the administration groups based on Active Directory. - Added: automation interface for the Administration Server. - Added: documented database views enabling users to create custom reporting systems. - Added: possibility of creating a standalone installation package for Kaspersky Lab applications. - Added: possibility of exporting reports to .pdf and .xml (Excel) formats. - Several accounts can be specified in a deployment task. - Added: support for two sets of columns in the Administration Console. - Added: new criteria of computer status: "License expired", "There are unprocessed objects", and "Waiting for reboot". - Added: columns for the list of computers: "Restart", "Status description", "Network Agent version", "Protection version", "Database version", and "Turn-on time". - Extended: statistics of Update Agents. - Added: capability to create a selection of all computers acting as Update Agents. - Added: capability to select all computers with enabled option "Do not disconnect from the Administration Server". - Added: capability to maintain a list of administrator comments and generate a corresponding report. - Added: capability to view the current user sessions on a computer and user contact information (in case of its availability in Active Directory). - Added: graphical interface for the klbackup utility. - The task for removal of external applications can now remove several applications at once. - Files of policies and groups tasks are distributed using multicast IP delivery provided that the necessary settings are selected in the Update Agent properties. - Wake On LAN setting is available for clients in subnets other than the Administration Server subnet. - Wake On LAN setting is available in case of manual task launch. - Administrators do not see the objects for which they have no rights for reading in the Administration Console and when generating reports. - Restart settings for client computers can be specified in the properties of a remote deployment task. - Extended information displayed in reports (in particular, in the license usage report). - Added new reports (report on most active viruses, deployment report, report on applications registry, events report, report on the versions of updates for program modules of Kaspersky Lab's applications, and report on administrator notes). - Implemented: capability to keep record of applications connected to slave Administration Servers upon downloading of the necessary updates. - An account not included in the group of local administrators can be used as the Administration Server account. - Developed: utility for preparation of computers included in a workgroup for remote deployment. - Implemented: functionality for retrieval of updates necessary for an application immediately after the creation of its installation package. - Modified: mechanism used for restriction of the number of notifications sent within a specified time unit; now the restrictions are calculated independently for each event type. - Implemented: functionality for stable collection of data for reports from slave Administration Servers even upon disconnection between the Servers. - Implemented: data caching functionality for generation of summary reports including information from slave Administration Servers. - Added: capability to collect detailed data during creation of summary reports. - Implemented: classification of possible errors returned by the application deployment subsystem; added: guidelines for troubleshooting typical problems. - Implemented: functionality of subsystems statuses in the administration system. - Added: mechanism for automatic application of update modules of the administration system components. - Added: functionality for creating computer selections including information from slave Administration Servers. - Added: capability to search for groups and slave Administration Servers by Server hierarchy. - Added: capability to install applications using Active Directory tools. Known issues: - The installation of Administration Server under Microsoft Windows Vista x64 or Microsoft Windows Server 2008 x64 may cause the Windows Installer to fail. To resolve this issue, it is recommended to install the latest system updates and Windows Installer 4.5. - The installation of Microsoft Server Express 2005 with Service Pack 3 under Microsoft Windows XP with Service Pack 2 may cause the operating system to fail. This issue is described in Microsoft KB921337. To resolve this issue, upgrade your operating system to Windows XP with Service Pack 3. - Administration Server running Microsoft Windows Vista x64 / 2008 Server x64 under the domain account, which has no domain administrator's rights, may cause a failure in Administration Server installation using the remote computer shared folder admin$. To resolve this issue, switch the Administration Server account to the local account or use alternative installation methods. - In the Administration Console 8.0 the information on accounts for tasks created in 6.0. The tasks will continue running under the account, specified earlier by the administrator for version 6.0. To solve this problem, edit the account in which the task is started. - The install / uninstall of the Administration Server on the Microsoft Windows 7 operating system can fail if the UAC component is enabled. To solve this problem, disable UAC when the Administration Server is installed/uninstalled. - Administration Server running Microsoft Windows Vista x64 / 2008 Server x64 may cause functional errors in package installation using Active Directory. To resolve this issue, use alternative installation methods, or publish the package in Active Directory without using Kaspersky Administration Kit. - No interaction with Microsoft NAP Agent in the Microsoft Windows XP SP3 operating system.