• We have added:
  • Support of Windows 10 version 2004.
  • Display of the status Not supported by license for the application components in the local user interface.
  • Kaspersky Disk Encryption drivers to the Windows Recovery Environment (WinRE) when encryption of the computer’s hard drives starts.
  • New events to the reports about the Exploit Prevention component.
• Kaspersky Endpoint Agent, which is included in the Kaspersky Endpoint Security for Windows distribution kit, has been updated. Kaspersky Endpoint Agent 3.9 supports integration with the following Kaspersky solutions:
  • Kaspersky Sandbox
  • Kaspersky Endpoint Detection and Response
  • Kaspersky Managed Detection and Response

Endpoint Sensor has been removed from Kaspersky Endpoint Security for Windows. However, you can still manage the Endpoint Sensor component integrated into Kaspersky Endpoint Security versions 11.0.0 to 11.3.0 using Kaspersky Endpoint Security 11.4.0 for Windows management plug-ins.

Installation from the distribution package

To install the application locally, run the setup_kes.exe file from the full distribution package and follow the Setup Wizard instructions. For more information about installation, see Online Help.

During installation, Kaspersky Endpoint Security for Windows detects applications that may affect the performance of the user's computer or cause other problems (even to the point of complete inoperability). The full list of incompatible software is available in this article.

Upgrade

You can upgrade the following applications to Kaspersky Endpoint Security 11.4.0 for Windows during installation from the full distribution package:

• Kaspersky Endpoint Security 10 Service Pack 1 Maintenance Release 4 for Windows (version 10.2.6.3733). For details on installing the upgrade on a computer that has AES Encryption Module installed, see the section below.
• Kaspersky Endpoint Security 10 Service Pack 2 for Windows (10.3.0.6294)
• Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 1 for Windows (version 10.3.0.6294)
• Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 2 for Windows (version 10.3.0.6294)
• Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 3 for Windows (version 10.3.3.275)
• Kaspersky Endpoint Security 11.0.0 for Windows (version 11.0.0.6499)
• Kaspersky Endpoint Security 11.0.1 for Windows (version 11.0.1.90)
• Kaspersky Endpoint Security 11.1.0 for Windows (version 11.1.0.15919)
• Kaspersky Endpoint Security 11.1.1 for Windows (version 11.1.1.126)
• Kaspersky Endpoint Security 11.2.0 for Windows (version 11.2.0.2254)
• Kaspersky Endpoint Security 11.2.0 Critical Fix 1 for Windows (version 11.2.0.2254)
• Kaspersky Endpoint Security 11.3.0 for Windows (version 11.3.0.773)

If the Full Disk Encryption (FDE) or the File Level Encryption (FLE) components are installed on the computer, upgrading the application installed from a distribution kit with one key length using a distribution kit with a different key length is not supported. To install the update, use the distribution package that has the same effective key length as the version that is being updated. For example:

• keswin_11.4.0.233_<localization>_aes256 if you are upgrading an application that was installed from the AES256 distribution package
• keswin_11.4.0.233_<localization>_aes56 if you are upgrading an application that was installed from the AES56 distribution package

If no encryption component is installed on the computer, you can use a distribution kit with any key length to upgrade the application to version 11.4.0.

Upgrading via the Kaspersky update service

Kaspersky Endpoint Security 11.4.0 for Windows can be installed via the Kaspersky update service over the following versions:

• Kaspersky Endpoint Security 11.0.1 for Windows (version 11.0.1.90)
• Kaspersky Endpoint Security 11.0.1 Security Fix 1 for Windows (version 11.0.1.90)
• Kaspersky Endpoint Security 11.1.0 for Windows (version 11.1.0.15919)
• Kaspersky Endpoint Security 11.1.1 for Windows (version 11.1.1.126)
• Kaspersky Endpoint Security 11.2.0 for Windows (version 11.2.0.2254)
• Kaspersky Endpoint Security 11.2.0 Critical Fix 1 for Windows (version 11.2.0.2254)
• Kaspersky Endpoint Security 11.3.0 for Windows (version 11.3.0.773)

If the version of Kaspersky Endpoint Security 11.3.0 is deployed in the infrastructure along with the older versions of the application, then Kaspersky Endpoint Security will be able to install 2 updates of Kaspersky Endpoint Security to version 11.4.0: one for updating Kaspersky Endpoint Security versions 11.0.1 — 11.2.0 Critical Fix 1, the second is for updating version 11.3.0.

Special considerations when upgrading an application via the Kaspersky update service:

• After installing the update, you cannot roll back to the previous version of the application.
• This update is available only for applications with an active license.
• Full disk encryption (FDE) management is blocked until the installation of the application update is completed.
• To complete the update installation, restart your computer.
• To complete the update on a computer with hard drives encrypted using full disk encryption (FDE), you will need to restart the computer twice.
• During installation, Kaspersky Endpoint Security for Windows detects applications that may affect the performance of the user's computer or cause other problems. The full list of incompatible software is available in this article.
• Installing and upgrading Kaspersky Endpoint Agent through the Kaspersky update service is not supported.

Starting with Kaspersky Endpoint Security 10 Service Pack 2, the encryption module is included in the distribution package, therefore, a separate installation of an encryption module is not needed.

All libraries required for encryption will be automatically installed in the following cases:

• When the application is installed for the first time, provided that the full disk encryption (FDE) or file level encryption (FLE) components are selected.
• When installing the upgrade on a computer on which:
  • Kaspersky Endpoint Security for Windows version 10 Service Pack 2 or later is installed.
  • Full disk encryption (FDE) or file level encryption (FLE) components are installed.
  • The update uses distribution kit 11.4.0 with the appropriate key length.
• When installing the upgrade on a computer on which:
  • Kaspersky Endpoint Security 10 Service Pack 2 or later as well as AES encryption module are installed.
  • The update uses distribution kit 11.4.0 with the appropriate key length and updating is supported for the existing configuration.

For the installed AES encryption module to update automatically, use the appropriate distribution package for Kaspersky Endpoint Security 11.4.0:

• keswin_11.4.0.233_<localization>_aes256 – to update an AES encryption module with a 256-bit effective key length
• keswin_11.4.0.233_<localization>_aes56 – to update an AES encryption module with a 56-bit effective key length

Supported configurations that allow automatic update of an AES encryption module:

• Kaspersky Endpoint Security 10 for Windows Service Pack 1 Maintenance Release 3 (build 10.2.5.3201) and encryption module version 1.1.0.73.
• Kaspersky Endpoint Security 10 for Windows Service Pack 1 Maintenance Release 4 (build 10.2.6.3733) and encryption module version 1.1.0.73.

Other configurations of Kaspersky Endpoint Security for Windows and AES encryption modules are not supported. Before starting an update of Kaspersky Endpoint Security, you must remove the installed encryption module or update it to version 1.1.0.73.

Before removing or upgrading the Encryption Module, you must decrypt all hard drives that have been encrypted using Kaspersky Disk Encryption technology. You will not be able to access the files that were encrypted using File Level Encryption after you remove the Encryption Module.

If you want to switch from your encryption method to encryption with a different key length, prior to upgrading the application to version 11.4.0 you must decrypt all encrypted objects and remove the AES Encryption Module that was used. After switching to encryption with a different key length, you will no longer be able to access objects that were encrypted prior to switching.

The application is compatible with Kaspersky Security Center 11 and 12. The Management Web Plug-in for Kaspersky Endpoint Security for Windows version 11.4.0 is compatible with Kaspersky Security Center Web Console version 12.

To manage the application remotely via Kaspersky Security Center:

1. Install Network Agent on the computer. For more information, see Online Help.
2. Install the Management Plug-in for Kaspersky Endpoint Security 11.4.0 for Windows in the Kaspersky Security Center Administration Console or in the Kaspersky Security Center Web Console.
   The installation file of the Management Plug-in is included in the application distribution package. You can also download the required plug-in version from the list of Kaspersky Security Center plug-ins.

The installation package for the Management Plug-in is included in the application distribution package.

The Kaspersky Endpoint Security for Windows Management Plug-in for version 11.4.0 is installed over the Kaspersky Endpoint Security for Windows Management Plug-in for versions 11.x.x. To continue using the previous version of Management Plug-in, you should first remove the Management Plug-in version 11.4.0.

The web plug-in installation package is available for download on the website and in the plug-in management window of Kaspersky Security Center Web Console. To install the web plug-in version 11.4.0, you should first remove the previous version of the web plug-in.

The application is compatible with Kaspersky Endpoint Agent 3.7, 3.8, and 3.9. Kaspersky Endpoint Agent 3.9 installation package is included in the Kaspersky Endpoint Security 11.4.0 for Windows distribution kit.

If the Endpoint Agent component is selected during Kaspersky Endpoint Security installation:

• Kaspersky Endpoint Agent will be automatically installed.
• Kaspersky Endpoint Agent will be automatically updated to version 3.9 if Kaspersky Endpoint Agent version 3.7 or 3.8 is installed on the computer.

See this article for more information.