Installing applications using a remote installation task

Kaspersky Security Center allows you to install applications on devices remotely, using remote installation tasks. Those tasks are created and assigned to devices through a dedicated Wizard. To assign a task to devices more quickly and easily, you can specify devices in the Wizard window in one of the following ways:

• Select networked devices detected by Administration Server. In this case, the task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
• Specify device addresses manually or import addresses from a list. You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
• Assign task to a device selection. In this case, the task is assigned to devices included in a selection created earlier. You can specify the default selection or a custom one that you created.
• Assign task to an administration group. In this case, the task is assigned to devices included in an administration group created earlier.

For correct remote installation on a device with no Network Agent installed, the following ports must be opened: a) TCP 139 and 445; b) UDP 137 and 138. By default, these ports are opened on all devices included in the domain. They are opened automatically by the remote installation preparation utility.

Installing an application on selected devices

To install an application on selected devices:

1. In the console tree, select the Tasks folder.
2. Run the task creation by clicking the Create a task button.

   The Add Task Wizard starts. Follow the instructions of the Wizard.

   In the Select the task type window of the Add Task Wizard, in the Kaspersky Security Center 14 Administration Server node select Install application remotely as the task type.

   The Add Task Wizard creates a task of remote installation of the selected application for specific devices. The newly created task is displayed in the workspace of the Tasks folder.

3. Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

On completion of the remote installation task, the selected application will be installed on the selected devices.

Installing an application on client devices in an administration group

To install an application on client devices in an administration group:

1. Establish a connection with the Administration Server that controls the relevant administration group.
2. Select an administration group in the console tree.
3. In the group workspace, select the Tasks tab.
4. Run the task creation by clicking the Create a task button.

   The Add Task Wizard starts. Follow the instructions of the Wizard.

   In the Select the task type window of the Add Task Wizard, in the Kaspersky Security Center 14 Administration Server node select Install application remotely as the task type.

   The Add Task Wizard creates a group task of remote installation of the selected application. The new task appears in the workspace of the administration group on the Tasks tab.

5. Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

On completion of the remote installation task, the selected application will be installed on client devices in the administration group.

Installing an application through Active Directory group policies

Kaspersky Security Center allows you to install Kaspersky applications on managed devices by using Active Directory group policies.

You can install applications by using Active Directory group policies only from installation packages that include Network Agent.

To install an application using Active Directory group policies:

1. Start configuring the application installation by using Remote Installation Wizard.
2. In the Defining remote installation task settings window of the Remote Installation Wizard, select the Assign package installation in Active Directory group policies option.
3. In the Select accounts to access devices window of the Remote Installation Wizard, select the Account required (Network Agent is not used) option.
4. Add the account with administrator privileges on the device where Kaspersky Security Center is installed or the account included in the Group Policy Creator Owners domain group.
5. Grant the permissions to the selected account:
   1. Go to Control Panel → Administrative Tools and open Group Policy Management.
   2. Click the node with the required domain.
   3. Click the Delegation section.
   4. In the Permission drop-down list, select Link GPOs.
   5. Click Add.
   6. In the Select User, Computer, or Group window that opens, select the necessary account.
   7. Click OK to close the Select User, Computer, or Group window.
   8. In the Groups and users list, select the account that you have just added, and then click Advanced → Advanced.
   9. In the Permission entries list, double-click the account that you have just added.
   10. Grant the following permissions:
       • Create Group objects
       • Delete Group objects
       • Create group Policy Container objects
       • Delete group Policy Container objects
   11. Click OK to save the changes.
6. Define other settings by following the instructions of the Wizard.
7. Run the created remote installation task manually or wait for its scheduled start.

The following remote installation sequence starts:

1. When the task is running, the following objects are created in each domain that includes any client devices from the specified set:
   • Group policy object (GPO) under the name Kaspersky_AK{GUID}.
   • A security group that corresponds to the GPO. This security group includes client devices covered by the task. The content of the security group defines the scope of the GPO.
2. Kaspersky Security Center installs the selected Kaspersky applications on client devices directly from Share, that is, the shared network folder of the application. In the Kaspersky Security Center installation folder, an auxiliary subfolder will be created that contains the .msi file for the application to be installed.
3. When new devices are added to the task scope, they are added to the security group after the next start of the task. If the Run missed tasks option is selected in the task schedule, devices are added to the security group immediately.
4. When devices are deleted from the task scope, they are deleted from the security group after the next start of the task.
5. When a task is deleted from Active Directory, the GPO, the link to the GPO, and the corresponding security group are deleted, too.

If you want to apply another installation schema using Active Directory, you can configure the required settings manually. For example, this may be required in the following cases:

• When the anti-virus protection administrator does not have rights to make changes to the Active Directory of certain domains
• When the original installation package has to be stored on a separate network resource
• When it is necessary to link a GPO to specific Active Directory units

The following options for using an alternative installation scheme through Active Directory are available:

• If installation is to be performed directly from the Kaspersky Security Center shared folder, in the GPO properties you must specify the .msi file located in the exec subfolder of the installation package folder for the required application.
• If the installation package has to be located on another network resource, you must copy the whole exec folder content to it, because in addition to the file with .msi extension the folder contains configuration files generated when the package was created. To install the license key with the application, copy the key file to this folder as well.

Installing applications on secondary Administration Servers

To install an application on secondary Administration Servers:

1. Establish a connection with the Administration Server that controls the relevant secondary Administration Servers.
2. Make sure that the installation package corresponding to the application being installed is available on each of the selected secondary Administration Servers. If the installation package cannot be found on any of the secondary Servers, distribute it by using the installation package distribution task.
3. Create the task of application installation on secondary Administration Servers in one of the following ways:
   • If you want to create a task for secondary Administration Servers in the selected administration group, create a group task of remote installation for this group.
   • If you want to create a task for specific secondary Administration Serves, create a task of remote installation for specific devices.

   The Deployment Task Creation Wizard starts to guide you through creation of the remote installation task. Follow the instructions of the Wizard.

   In the Select the task type window of the Add Task Wizard, in the Kaspersky Security Center 14 Administration Server section open the Advanced folder and select Install application on secondary Administration Servers remotely as the task type.

   The Add Task Wizard will create the task of remote installation of the selected application on specific secondary Administration Servers.

4. Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

On completion of the remote installation task, the selected application will be installed on secondary Administration Servers.