Kaspersky applications: licensing and activation

This section describes the features of Kaspersky Security Center related to working with the license keys of managed Kaspersky applications.

Kaspersky Security Center allows you to perform centralized distribution of license keys for Kaspersky applications on client devices, monitor their use, and renew licenses.

When adding a license key using Kaspersky Security Center, the settings of the license key are saved on the Administration Server. Based on this information, the application generates a license key usage report and notifies the administrator of license expirations and violation of license restrictions that are set in the properties of license keys. You can configure notifications of the use of license keys within the Administration Server settings.

Licensing of managed applications

The Kaspersky applications installed on managed devices must be licensed by applying a key file or activation code to each of the applications. A key file or activation code can be deployed in the following ways:

• Automatic deployment
• The installation package of a managed application
• The Add license key task for a managed application
• Manual activation of a managed application

You can add a new active or reserve license key by any of the methods listed above. A Kaspersky application uses an active key at the current moment and stores a reserve key to apply after the active key expires. The application for which you add a license key defines whether the key is active or reserve. The key definition does not depend on the method that you use to add a new license key.

Automatic deployment

If you use different managed applications and you have to deploy a specific key file or activation code to devices, opt for other ways of deploying that activation code or key file.

Kaspersky Security Center allows you to automatically deploy available license keys to devices. For example, three license keys are stored in the Administration Server repository. You have selected the Automatically distribute license key to managed devices check box for all three license keys. A Kaspersky security application—for example, Kaspersky Endpoint Security for Windows—is installed on the organization's devices. A new device is discovered to which a license key must be deployed. The application determines, for instance, that two of the license keys from the repository can be deployed to the device: license key named Key_1 and license key named Key_2. One of these license keys is deployed to the device. In this case, it cannot be predicted which of the two license keys will be deployed to the device because automatic deployment of license keys does not provide for any administrator activity.

When a license key is deployed, the devices are recounted for that license key. You must make sure that the number of devices to which the license key was deployed does not exceed the license limit. If the number of devices exceeds the license limit, all devices that were not covered by the license will be assigned Critical status.

Before deployment, the key file or activation code must be added to the Administration Server repository.

How-to instructions:

• Administration Console:
  • Adding a license key to the Administration Server repository
  • Automatic distribution of a license key

  or

• Kaspersky Security Center Web Console:
  • Adding a license key to the Administration Server repository
  • Automatic distribution of a license key

Note that an automatically distributed license key may not be displayed in the virtual Administration Server repository in the following cases:

• The license key is not valid for the application.
• The virtual Administration Server does not have managed devices.
• The license key has already been used for devices managed by another virtual Administration Server and the limit on the number of devices has been reached.

Adding a key file or activation code to the installation package of a managed application

For security reasons, this option is not recommended. A key file or activation code added to an installation package may be compromised.

If you install a managed application using an installation package, you can specify an activation code or key file in this installation package or in the policy of the application. The license key will be deployed to managed devices at the next synchronization of the device with the Administration Server.

How-to instructions:

• Administration Console:
  • Creating an installation package
  • Installing applications on client devices

  or

• Kaspersky Security Center Web Console: Adding a license key to an installation package

Deployment through the Add license key task for a managed application

If you opt for using the Add license key task for a managed application, you can select the license key that must be deployed to devices and select the devices in any convenient way—for example, by selecting an administration group or a device selection.

Before deployment, the key file or activation code must be added to the Administration Server repository.

How-to instructions:

• Administration Console:
  • Adding a license key to the Administration Server repository
  • Deploying a license key to client devices

  or

• Kaspersky Security Center Web Console:
  • Adding a license key to the Administration Server repository
  • Deploying a license key to client devices

Adding an activation code or a key file manually to the devices

You can activate the installed Kaspersky application locally, by using the tools provided in the application interface. Please refer to the documentation of the installed application.

Viewing information about license keys in use

To view information about license keys in use,

In the console tree, select the Kaspersky Licenses folder.

The workspace of the folder displays a list of license keys used on client devices.

Next to each of the license keys an icon is displayed, corresponding to the type of use:

• —Information about the currently used license key is received from a client device connected to the Administration Server. The file of this license key is stored outside of the Administration Server.
• —The license key is stored in the Administration Server repository. Automatic distribution is disabled for this license key.
• —The license key is stored in the Administration Server repository. Automatic distribution is enabled for this license key.

You can view information about which license keys are used for activation of the application on a client device by opening the Applications section of the client device properties window.

To define the up-to-date settings of virtual Administration Server license keys, the Administration Server sends a request to Kaspersky activation servers at least once per day. If access to the servers using system DNS is not possible, the application uses public DNS servers.

If a license key is received from a client device, you cannot export it as a file.

Adding a license key to the Administration Server repository

To add a license key to the Administration Server repository:

1. In the console tree, select the Kaspersky Licenses folder.
2. Start the license key adding task in one of the following ways:
   • Select Add activation code or key file in the context menu of the list of license keys.
   • Click the Add activation code or key file link in the workspace of the list of license keys.
   • Click the Add activation code or key file button.

   The Add License Key Wizard starts.

3. Select how you want to activate Administration Server: by using an activation code or by using a key file.
4. Specify your activation code or a key file.
5. Select the Automatically distribute license key to managed devices option if you want to distribute a relevant license key on your network immediately. If you do not select this option, you can manually distribute a license key later.

As a result, the key file is downloaded and the Add License Key Wizard is finished. You can now see the added license key in the list of Kaspersky licenses.

Removing an Administration Server license key

To remove an Administration Server license key:

1. In the context menu of the Administration Server, select Properties.
2. In the Administration Server properties window that opens, select the License keys section.
3. Remove the license key by clicking the Remove button.

This removes the license key.

If a reserve license key has been added, the reserve license key automatically becomes the active license key after the former active license key is removed.

After the active license key of Administration Server is removed, Vulnerability and Patch Management and Mobile Device Management become unavailable. You can add a removed license key again or add a new license key.

Deploying a license key to client devices

Expand all | Collapse all

Kaspersky Security Center allows you to distribute a license key to client devices through the license key distribution task.

Before deployment, add the license key to the Administration Server repository.

To distribute a license key to client devices:

1. In the console tree, select the Kaspersky Licenses folder.
2. In the workspace of the list of license keys, click the Automatically distribute license key to managed devices button.

   The Application Activation Task Creation Wizard starts. Proceed through the wizard by using the Next button.

3. In the list of applications, select the application for which you want to create a task.
4. At the Add key step of the wizard, add the license key by using one of the following options:
   • Select the Activation code option to add an activation code from the Kaspersky Security Center repository.

     Click Select. In the window that opens, select the activation code, and then click OK.

   • Select the Key file or key option, and then do the following:
     1. Click Select.
     2. In the context menu, select one of the options:
        • Key file from folder.

          In the window that opens, select the key file from your computer, and then click Open.

        • Key from the Kaspersky Security Center repository.

          In the window that opens, select the key from the Kaspersky Security Center repository, and then click OK.

5. If you want to replace the active license key, clear the default Use as a reserve key check box.

   For example, this is needed when the organization changes, and another organization's key is required on the device; or if the key was reissued, and a new license expires earlier than the current license. To avoid errors, you have to clear the Use as a reserve key check box.

   If you want to find out more information about the issues that may occur when adding a license key to Kaspersky Security Center Windows and the ways to resolve them, refer to the Kaspersky Security Center Knowledge Base.

6. Check the license key information, and then click Next.
7. At this step of the wizard, select the devices to which you want to assign the add key task. You can specify devices in one of the following ways:
   • Select networked devices detected by Administration Server. In this case, the task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
   • Specify device addresses manually or import addresses from a list. You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
   • Assign task to a device selection. In this case, the task is assigned to devices included in a selection created earlier. You can specify the default selection or a custom one that you created.
   • Assign task to an administration group. In this case, the task is assigned to devices included in the administration group created earlier.
8. At the Configure task schedule step of the wizard, create a schedule for task start:
   • Scheduled start:
     • Once

       The task runs once, on the specified date and time (by default, on the day when the task was created).

     • Manually

       The task does not run automatically. You can only start it manually.

       By default, this option is selected.

     • When new updates are downloaded to the repository

       The task runs after updates are downloaded to the repository. For example, you may want to use this schedule for the find vulnerabilities and required updates task.

     • On virus outbreak

       The task runs after a Virus outbreak event occurs. Select application types that will monitor virus outbreaks. The following application types are available:

       • Anti-virus for workstations and file servers
       • Anti-virus for perimeter defense
       • Anti-virus for mail systems

       By default, all application types are selected.

       You may want to run different tasks depending on the security application type that reports a virus outbreak. In this case, remove the selection of the application types that you do not need.

     • On completing another task

       The current task starts after another task completes. You can select how the previous task must complete (successfully or with error) to trigger the start of the current task. For example, you may want to run the Manage devices task with the Turn on the device option and, after it completes, run the Virus scan task. This parameter only works if both tasks are assigned to the same devices.

   • Run missed tasks

     This option determines the behavior of a task if a client device is not visible on the network when the task is about to start.

     If this option is enabled, the system attempts to start the task the next time the Kaspersky application is run on the client device. If the task schedule is Manually, Once or Immediately, the task is started immediately after the device becomes visible on the network or immediately after the device is included in the task scope.

     If this option is disabled, only scheduled tasks run on client devices. For Manually, Once and Immediately schedule, tasks run only on those client devices that are visible on the network. For example, you may want to disable this option for a resource-consuming task that you want to run only outside of business hours.

     By default, this option is disabled.

   • Use automatically randomized delay for task starts

     If this option is enabled, the task is started on client devices randomly within a specified time interval, that is, distributed task start. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

     The distributed start time is calculated automatically when a task is created, depending on the number of client devices to which the task is assigned. Later, the task is always started on the calculated start time. However, when task settings are edited or the task is started manually, the calculated value of the task start time changes.

     If this option is disabled, the task starts on client devices according to the schedule.

   • Use randomized delay for task starts within an interval of (min)

     If this option is enabled, the task is started on client devices randomly within the specified time interval. A distributed task start helps to avoid a large number of simultaneous requests by client devices to the Administration Server when a scheduled task is running.

     If this option is disabled, the task starts on client devices according to the schedule.

     By default, this option is disabled. The default time interval is one minute.

9. At the Define the task name step of the wizard, specify the name for the task. A task name cannot be more than 100 characters long and cannot include any special characters ("*<>?\:|).
10. On the Finish task creation step of the wizard, click the Finish button to close the wizard.

    If you want the task to start as soon as the wizard finishes, select the Run the task after the Wizard finishes check box.

The Application Activation Task Creation Wizard starts. Follow the instructions of the Wizard.

Tasks created through the Application Activation Task Creation Wizard are tasks for specific devices stored in the Tasks folder of the console tree.

You can also create a group or local license key distribution task through the Task Creation Wizard for an administration group and for a client device.

Automatic distribution of a license key

Kaspersky Security Center allows automatic distribution of license keys to managed devices if they are located in the license keys repository on the Administration Server. Automatic distribution of license keys does not apply to devices in the Unassigned devices folder.

To distribute a license key to managed devices automatically:

1. In the console tree, select the Kaspersky Licenses folder.
2. In the workspace of the folder, select the license key that you want to distribute to devices automatically.
3. Open the properties window of the selected license key in one of the following ways:
   • By selecting Properties in the context menu of the license key.
   • By clicking the View license key properties link in the information box for the selected license key.
4. In the license key properties window that opens, select the Automatically distributed license key check box. Close the license key properties window.

The license key will be automatically distributed to all compatible devices.

License key distribution is performed by means of Network Agent. No license key distribution tasks are created for the application.

During automatic distribution of a license key, the licensing limit on the number of devices is taken into account. (The licensing limit is set in the properties of the license key.) If the licensing limit is reached, distribution of this license key on devices ceases automatically.

The virtual Administration Server automatically distributes license keys from its repository and from the repository of the Administration Server. We recommend that you:

• Use the Add license key task to select the license key that must be deployed to devices.
• Avoid disabling the Allow automatic deployment of license keys from this virtual Administration Server to its devices option in the virtual Administration Server settings. Otherwise, the virtual Administration Server will not distribute license keys to devices, including the license keys from the Administration Server repository.

If you select the Automatically distributed license key check box in the license key properties window, a license key is distributed on your network immediately. If you do not select this option, you can manually distribute a license key later.

Creating and viewing a license key usage report

To create a report on usage of license keys on client devices:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. Select the report template named License key usage report, or create a new report template of the same type.

The workspace of the license key usage report displays information about active and reserve license keys used on the client devices. The report also contains information about devices on which the license keys are used, and about restrictions specified in the properties of those license keys.

Viewing information about the application license keys

To learn what license keys are in use for a Kaspersky application:

1. In the Kaspersky Security Center console tree, select the Managed devices node and go to the Devices tab.
2. Right-click to open the context menu of the relevant device and select Properties.
3. In the device properties window that opens, select the Applications section.
4. In the list of applications that appears, select the application whose license keys you want to view, and then click the Properties button.
5. In the application properties window that opens, select the License keys section.

   The information is displayed in the workspace of this section.

Exporting a license key file

If your license key has been accidentally deleted and you want to restore it, you can export a license key file from other Administration Server.

To export a license key file, you must have the Export key file right in the General features: Key management functional area.

If a license key is received from a client device, you cannot export it.

To export a license key:

1. In the console tree, select the Kaspersky Licenses folder.
2. In the list, select the license key that you want to export as a file.
3. In the information box that opens, click the Export key file link.
4. In the window that opens, specify the path to the folder where you want to save a license key file, and then specify a file name. After that, click Save.

The license key file in .key format is exported to the selected folder.

If the license key whose file you exported was added to the Administration Server repository as an activation code, and you want to add the exported license key file to the repository of another Administration Server, you must add it as an activation code, not as a key file. Otherwise, an error occurs. You have to open the exported license key file in any convenient text editor, and then copy the activation code.