Contents
Device discovery
This section describes the types of device discovery available in Kaspersky Security Center and provides information using each type.
The Administration Server receives information about the structure of the network and devices on this network through regular polling. The information is recorded to the Administration Server database. Administration Server can use the following types of polling:
- Windows network polling. The Administration Server can perform two kinds of Windows network poll: quick and full. During a quick poll, the Administration Server only retrieves information from the list of the NetBIOS names of devices in all network domains and workgroups. During a full poll, more information is requested from each client device, such as operating system name, IP address, DNS name, and NetBIOS name. By default, both quick poll and full poll are enabled. Windows network polling may fail to discover devices, for example, if the ports UDP 137, UDP 138, TCP 139 are closed on the router or by the firewall.
- Active Directory polling. The Administration Server retrieves information about the Active Directory unit structure and about DNS names of the devices from Active Directory groups. By default, this type of polling is enabled. We recommend that you use Active Directory polling if you use Active Directory; otherwise, the Administration Server does not discover any devices. If you use Active Directory but some of the networked devices are not listed as members, these devices cannot be discovered by Active Directory polling.
- IP range polling. The Administration Server polls the specified IP ranges using ICMP packets or the NBNS protocol and compiles a complete set of data on devices within those IP ranges. By default, this type of polling is disabled. It is not recommended to use this type of polling if you use Windows network polling and/or Active Directory polling.
- Zeroconf polling. A distribution point that polls the IPv6 network by using zero-configuration networking (also referred to as Zeroconf). By default, this type of polling is disabled. You can use Zeroconf polling if the distribution point runs Linux.
If you set up and enabled device moving rules, the newly discovered devices are automatically included in the Managed devices group. If no moving rules have been enabled, the newly discovered devices are automatically included in the Unassigned devices group.
You can modify device discovery settings for each type. For example, you may want to modify the polling schedule or to set whether to poll the entire Active Directory forest or only a specific domain.
Before you start network polling, make sure that the SMB protocol is enabled. Otherwise, Kaspersky Security Center cannot discover devices in the polled network. To enable the SMB protocol, follow the instructions for your operating system.
Windows network polling
About Windows network polling
During a quick poll, the Administration Server only retrieves information from the list of the NetBIOS names of devices in all network domains and workgroups. During a full poll, the following information is requested from each client device:
- Operating system name
- IP address
- DNS name
- NetBIOS name
Both quick polls and full polls require the following:
- Ports UDP 137/138, TCP 139, UDP 445, TCP 445 must be available in the network.
- The SMB protocol is enabled.
- The Microsoft Computer Browser service must be used, and the primary browser computer must be enabled on the Administration Server.
- The Microsoft Computer Browser service must be used, and the primary browser computer must be enabled on the client devices:
- On at least one device, if the number of networked devices does not exceed 32.
- On at least one device for each 32 networked devices.
The full poll can run only if the quick poll has run at least once.
Viewing and modifying the settings for Windows network polling
To modify the settings for the Windows network polling:
- In the console tree, in the Device discovery folder, select the Domains subfolder.
You can proceed from the Unassigned devices folder to the Device discovery folder by clicking the Poll now button.
In the workspace of the Domains subfolder, the list of the devices is displayed.
- Click Poll now.
The domain properties window opens. If you want, modify the settings of Windows network polling:
If you want to perform the poll immediately, click Poll now. Both types of polls will start.
On the virtual Administration Server you can view and edit the polling settings of the Windows network in the properties window of the distribution point, in the Device discovery section.
Active Directory polling
Use Active Directory polling if you use Active Directory; otherwise, it is recommended to use other poll types. If you use Active Directory but some of the networked devices are not listed as members, these devices cannot be discovered by Active Directory polling.
Before you start network polling, make sure that the SMB protocol is enabled. Otherwise, Kaspersky Security Center cannot discover devices in the polled network. To enable the SMB protocol, follow the instructions for your operating system.
Viewing and modifying the settings for Active Directory polling
To view and modify the settings for polling Active Directory groups:
- In the console tree, in the Device discovery folder, select the Active Directory subfolder.
Alternatively, you can proceed from the Unassigned devices folder to the Device discovery folder by clicking the Poll now button.
- Click Configure polling.
The Active Directory properties window opens. If you want, modify the settings of Active Directory group polling:
If you want to perform the poll immediately, click the Poll now button.
On the virtual Administration Server, you can view and edit the polling settings of Active Directory groups in the properties window of the distribution point, in the Device discovery section.
IP range polling
The Administration Server polls the specified IP ranges using ICMP packets or the NBNS protocol and compiles a complete set of data on devices within those IP ranges. By default, this type of polling is disabled. It is not recommended to use this type of polling if you use Windows network polling and/or Active Directory polling.
Before you start network polling, make sure that the SMB protocol is enabled. Otherwise, Kaspersky Security Center cannot discover devices in the polled network. To enable the SMB protocol, follow the instructions for your operating system.
Viewing and modifying the settings for IP range polling
To view and modify the settings for polling IP range groups:
- In the console tree, in the Device discovery folder, select the IP ranges subfolder.
You can proceed from the Unassigned devices folder to the Device discovery folder by clicking Poll now.
- If you want, in the IP ranges subfolder click Add subnet to add an IP range for polling, and then click OK.
- Click Configure polling.
The IP ranges properties window opens. If you want, you can modify the settings of IP range polling:
If you want to perform the poll immediately, click Poll now. This button is only available if you selected Enable IP range polling.
On the virtual Administration Server, you can view and edit the settings for IP range polling in the distribution point properties window, in the Device discovery section. Client devices discovered during the poll of IP ranges are displayed in the Domains folder of the virtual Administration Server.
Zeroconf polling
This polling type is supported only for Linux-based distribution points.
A distribution point can poll networks that have devices with IPv6 addresses. In this case, IP ranges are not specified and the distribution point polls the whole network by using zero-configuration networking (referred to as Zeroconf). To start using Zeroconf, you must install the avahi-browse utility on the distribution point.
To enable Zeroconf polling:
- In the console tree, in the Device discovery folder, select the IP ranges subfolder.
You can proceed from the Unassigned devices folder to the Device discovery folder by clicking Poll now.
- Click Configure polling.
- In the IP ranges properties window that opens, select Enable polling with Zeroconf technology.
After that, the distribution point starts to poll your network. In this case, the specified IP ranges are ignored.
Page top