Kaspersky’s on-premises business applications, such as Kaspersky Endpoint Security for Windows, Kaspersky Security Center, Kaspersky Security for Virtualization Light Agent and Kaspersky Next XDR Expert, are activated by adding a license key. A license key is a sequence of bits used to activate and then use the application under the End User License Agreement, and it can be added from a key file or by entering an activation code.[1] A licence is a time-limited right to use the application, and the features and term depend on the licence type.[2] Kaspersky Security Center acts as the key store. It distributes keys to managed devices, counts devices against each key’s limit and reports overage.[9] Virtual machines are licensed through Kaspersky Hybrid Cloud Security, which has its own key types for virtual machines, processor cores and processors.[14] For the vendor overview, see Kaspersky licensing.
Editions
The functions available in Kaspersky Endpoint Security for Windows depend on the licence type. Its help compares Kaspersky Endpoint Security for Business Select and Advanced, Kaspersky Total Security, Kaspersky Endpoint Detection and Response Optimum and Expert, Kaspersky Optimum Security, and Kaspersky Hybrid Cloud Security Standard and Enterprise. Kaspersky Sandbox and KUMA integration are purchased separately.[22] Catalog SKUs: Select, Advanced, Total Security for Business, Hybrid Cloud Security Standard and Enterprise.
Kaspersky Security Center features are unlocked by the licence on the Administration Server. Its help maps patch management, role-based access control, operating system deployment, mobile device management, cloud-environment configuration and SIEM export to licences such as Kaspersky Vulnerability and Patch Management, Endpoint Security for Business Select and Advanced, Total Security for Business, Hybrid Cloud Security and EDR Optimum. A licence key must be added manually to each Administration Server.[21]
Add-on keys. MDR and EDR Optimum can be covered by the Kaspersky Endpoint Security licence itself, or bought as separate add-ons (EDR Optimum Add-on, MDR Add-on). With an add-on, the device carries two keys, and the Kaspersky Endpoint Security key must be added first.[4] Only one active key for MDR and EDR Optimum is allowed. The combined [EDR Optimum+MDR] Add-on is no longer available, so customers wanting both activate MDR with a BLOB file and EDR Optimum with a licence key.[4] Catalog: MDR and EDR Optimum add-on keys follow the Endpoint Security key.
Metrics
Endpoint keys carry a limit on the number of devices in the Computer unit defined by the EULA (see Kaspersky EULA and cloud agreement). Kaspersky Security Center enforces that limit when it distributes keys.[10] Hybrid Cloud Security uses the Virtual machine, Physical processor core and Physical processor metrics described below.[14] Kaspersky Next XDR Expert is bought for a number of users.[23]
Activation artefacts
| Artefact | What Kaspersky says |
|---|---|
| Activation code | A unique sequence of 20 alphanumeric characters, emailed after purchase. It needs internet access to Kaspersky activation servers, and the application may keep checking the key’s status there.[6] |
| Key file | A file with the .key extension. It activates without contacting activation servers, and can be restored from the seller, from the Kaspersky website with the activation code, or by export from another Administration Server.[7] |
| License key | Shown in the interface as a unique alphanumeric sequence once added. Kaspersky may block it if the EULA is breached.[5] |
Managed applications activated through Kaspersky Security Center accept only activation codes, not key files.[6]
Active and reserve keys. An application can have only one active key. A reserve key is a key that entitles the user to use the application but is not in use yet. It becomes active automatically when the active key expires, and can be added only if an active key exists.[1] A trial key can only be the active key. It cannot be a reserve key and cannot replace a commercial active key.[1] Kaspersky Security Center and Kaspersky Next XDR Expert use the same active and reserve model.[5][17] Loading the renewal key as a reserve key is the documented way to avoid a gap at expiry. Catalog: One active key plus an optional reserve key.
Subscription keys. A subscription from a service provider is activated only with an activation code. A key file cannot be used, no reserve key can be added, and no License Certificate is issued for a subscription key.[3][1] A limited subscription may get a grace period whose length the provider decides. Subscription codes cannot activate earlier application versions.[3] Kaspersky Security Center lets a different activation code be applied only after the subscription expires or is cancelled.[20] Catalog: Subscriptions are activated only with activation codes.
Counting / floors
Distribution respects the limit. Kaspersky Security Center can distribute keys automatically to managed devices from the Administration Server repository. Automatic distribution takes the licensing limit into account and stops when the limit is reached.[10] When several keys qualify for a new device, which one is deployed cannot be predicted.[9] After deployment the devices are recounted. Any devices beyond the licence limit get Critical status.[9] Catalog: Devices beyond the licence limit get Critical status.
Overage events. Kaspersky Security Center publishes an Info event when used units are 90 to 100% of a licence, a Warning at 100 to 110%, and a Critical event above 110%.[11] The license key usage report lists active and reserve keys, the devices that use them and the limits set in each key.[12] A licence manager can use this report as the device-level reconciliation against the License Certificate. Catalog: Licence limit events at 90%, 100% and 110%.
XDR Expert. Overage of up to 5% is tolerated; beyond it, assets are restricted.[23] Licences can be renewed once expired or within 30 days of expiry. The console warns 30, 7 and 3 days and 24 hours before expiry.[18] Catalog: XDR Expert licences can be renewed within 30 days of expiry.
Floors. No minimum quantities appear in the cited help pages.
Expiry and blocked keys
When a commercial Kaspersky Endpoint Security licence expires, key features are disabled. A customer that does not plan to renew must remove the application.[2] When a Kaspersky Security Center trial expires, all features are disabled. After a commercial licence expires, the help says the application cannot continue to be used and must be removed.[19] Kaspersky Security Center also has a no-licence mode with basic Administration Console functionality, which applies before activation or after a commercial licence expires.[8] Catalog: Kaspersky Security Center basic functionality needs no licence.
If Kaspersky adds a key to its list of prohibited keys, Kaspersky Endpoint Security keeps the licensed functionality for eight days. It then falls to its post-expiry level: protection runs on the databases installed before expiry, and Kaspersky Security Network is unavailable.[1] Catalog: A blocked key leaves eight days of full function.
Virtualization & partitioning
Kaspersky Hybrid Cloud Security licenses Kaspersky Security for Virtualization Light Agent in three editions: Standard, Enterprise, and an EDR Optimum Add-on.[14] Enterprise functionality is available on a Light Agent only if the Security Virtual Machine (SVM) it connects to uses an Enterprise licence.[14] Three licensing schemes are offered:[14]
| Scheme | Key types | What is counted |
|---|---|---|
| Number of virtual machines | Key for VMs regardless of OS; server key; desktop key[16] | Protected VMs; desktop-limited licences only for desktop OS or workstation-role VMs, including VDI[14] |
| Number of processor cores | Core-limited key[16] | Physical processor cores on the hypervisors where protected VMs can run[14] |
| Number of processors | Processor-limited key[16] | Processors on those hypervisors[14] |
Under the core and processor schemes, one key covers all Light Agent VMs that can run on the licensed hosts, whatever their operating system.[15] The words “can run” mean that the count follows the hypervisors VMs may move to, not only where they run today. Under the VM-count scheme with server and desktop keys, an SVM protecting both kinds of guest needs both keys.[15] Catalog: Hybrid Cloud Security is licensed per VM, per core or per processor.
The help sets limits on combining keys. An SVM cannot use keys from different licensing schemes at once. Adding a core-limited key removes previously added desktop and server keys.[15] Commercial and subscription keys cannot be combined on an SVM.[15] A key removed from one SVM can be added to another while its term is still running.[15] After a commercial licence expires, Light Agent stops updating databases and using Kaspersky Security Network but keeps scanning with the old databases.[14] Catalog: No mixing of licensing schemes or of commercial and subscription keys on an SVM. See virtualization and partitioning.
Cloud / BYOL
Running Kaspersky Security Center in a public cloud is outside its basic functionality and needs a dedicated licence. Two options exist.[13]
- Paid image. A paid AMI in AWS or a usage-based monthly SKU in Azure. It licenses Kaspersky Security Center plus Kaspersky Endpoint Security for Linux and Kaspersky Security for Windows Server, billed under the cloud provider’s rules, for no more than 200 client devices per Administration Server.[13] A device not seen by the Administration Server for more than a week moves to limited functionality.[13]
- BYOL image. A free image activated with the customer’s Kaspersky Security for Virtualization or Kaspersky Hybrid Cloud Security licence. It covers up to 100,000 client devices per Administration Server, including devices outside AWS, Azure and Google environments.[13]
In both cases vulnerability and patch management is activated automatically and mobile device management cannot be activated.[13] Catalog: Paid cloud images cap at 200 devices; BYOL at 100,000.
Programs
Subscriptions bought from service providers are covered above. MSP subscription billing plans are covered in Kaspersky MSP subscription licensing.
Out of scope
- Kaspersky Security for Windows Server, Linux, Mac and mobile key specifics beyond those cited.
- Kaspersky Unified Monitoring and Analysis Platform (KUMA) licence keys, which XDR Expert renews separately in each solution’s web interface.
- Kaspersky Security for Virtualization Agentless and the Hybrid Cloud Security cloud-workload offerings in public cloud marketplaces other than Kaspersky Security Center.
- Prices and part numbers.