Kaspersky Security Center 14 Windows

Remote removal of applications

Kaspersky Security Center allows you to uninstall applications from devices remotely through remote uninstallation tasks. Those tasks are created and assigned to devices through a dedicated Wizard. To assign a task to devices more quickly and easily, you can specify devices in the Wizard window in one of the following ways:

  • Select networked devices detected by Administration Server. In this case, the task is assigned to specific devices. The specific devices can include devices in administration groups as well as unassigned devices.
  • Specify device addresses manually or import addresses from a list. You can specify NetBIOS names, DNS names, IP addresses, and IP subnets of devices to which you want to assign the task.
  • Assign task to a device selection. In this case, the task is assigned to devices included in a selection created earlier. You can specify the default selection or a custom one that you created.
  • Assign task to an administration group. In this case, the task is assigned to devices included in an administration group created earlier.

Remote removal issues

When performing remote removal of third-party applications, administrators may encounter a warning stating, "Remote uninstallation has finished on this device with warnings: Application for removal is not installed." This issue typically arises when the application to be removed is installed only for the individual user who is currently logged in. If the user is not logged in, such an application becomes invisible and cannot be targeted for remote removal.

This behavior differs with applications intended for use by multiple users on the same device, where applications are globally visible and accessible by all users of the device.

Within Kaspersky Security Center, the application registry algorithm handles applications for individual users and applications for multiple users differently:

  • Applications for multiple users are maintained in a real-time, up-to-date list of installed applications.
  • Applications for individual users are monitored using a caching mechanism.

    If a user was logged in at the time of application detection, Kaspersky Security Center caches information about that user's applications. Even if the user subsequently logs out, Kaspersky Security Center continues to display these applications as installed based on the cached data, although they are no longer visible or accessible on the device.

This discrepancy can result in situations where Kaspersky Security Center identifies an application as installed based on cached data, but the application removal task fails because the application is not accessible when the user is logged out.

By default, the lifetime of cached application data is set to 30 days. Administrators can modify this setting to reduce the cache duration, thereby minimizing discrepancies between the displayed data and actual application visibility on devices.

To adjust the cache lifetime to 1 hour (3600 seconds), run the following command on the Administration Server:

klscflag -fset -pv klserver -n KLNAG_INV_PERUSER_APPS_CACHE_NONACTIVE_SIDS_LIFETIME_SEC -t d -v 3600

After running this command, restart the Administration Server for the changes to take effect.

Source of information about installed applications

The Network Agent retrieves information about software installed on Windows devices from the following registry keys:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

    Contains information about applications installed for all users.

  • HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

    Contains information about applications installed for all users.

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall

    Contains information about applications installed for the current user.

  • HKEY_USER<...>\Software\Microsoft\Windows\CurrentVersion\Uninstall

    Contains information about applications installed for specific users.

In this section

Remote removal of an application from client devices of the administration group

Remote removal of an application from selected devices

Page top
[Topic 6389]

Remote removal of an application from client devices of the administration group

To remove an application remotely from client devices of the administration group:

  1. Establish a connection with the Administration Server that controls the relevant administration group.
  2. Select an administration group in the console tree.
  3. In the group workspace, select the Tasks tab.
  4. Run the task creation by clicking the Create a task button.

    The Add Task Wizard starts. Follow the instructions of the Wizard.

    In the Select the task type window of the Add Task Wizard, in the Kaspersky Security Center 14 Administration Server node, in the Advanced folder select Uninstall application remotely as the task type.

    The Add Task Wizard creates a group task of remote removal of the selected application. The new task appears in the workspace of the administration group on the Tasks tab.

  5. Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

On completion of the remote removal task, the selected application will be removed from client devices in the administration group.

Page top
[Topic 54998]

Remote removal of an application from selected devices

To remove an application remotely from selected devices:

  1. In the console tree, select the Tasks folder.
  2. Run task creation by clicking New task.

    The Add Task Wizard starts. Follow the instructions of the Wizard.

    In the Select the task type window of the Add Task Wizard, in the Kaspersky Security Center 14 Administration Server node, in the Advanced folder select Uninstall application remotely as the task type.

    The Add Task Wizard creates a task of remote removal of the selected application from specific devices. The newly created task is displayed in the workspace of the Tasks folder.

  3. Run the task manually or wait for it to launch according to the schedule specified by you in the task settings.

Upon completion of the remote removal task, the selected application will be removed from the selected devices.

Page top
[Topic 54999]