BTADPro | ODM AD | Device ReAcl Result code: 0 Unable to process Service 'klupd_KES-21-7_arkmon' System.ComponentModel.Win32Exception (0x80004005): QueryServiceConfig: The system cannot find the file specified Unable to process Service (4373713)

BTADPro | ODM AD | Device ReAcl Result code: 0 Unable to process Service 'klupd_KES-21-7_arkmon' System.ComponentModel.Win32Exception (0x80004005): QueryServiceConfig: The system cannot find the file specified Unable to process Service

1) What is needed to add exclusion for Kaspersky Endpoint Security for ReAcl, 

2) after adding exclusion for ReAcl, getting the error similar to below process in not found
klupd_KES-21-14_arkmon_RandomID
klupd_KES-21-14_klark_RandomID
klupd_KES-21-14_mark_RandomID

Sample error as below

2023/10/20 10:28:01 ERROR: Unable to process Service 'klupd_KES-21-14_arkmon_3EAA902C' System.ComponentModel.Win32Exception (0x80004005): QueryServiceConfig: The system cannot find the file specified
   at BinaryTree.ReACL.Lib.ServiceMgr.GetServiceAccount(String serviceName)
   at BinaryTree.ReACL.Engine.ServiceUpdater.#4h(Mode #Je, String #tf, UpdateStats #ph)
   at BinaryTree.ReACL.Engine.ServiceUpdater.UpdateServices(Mode mode, UpdateStats stats)
2023/10/20 10:28:01 ERROR: Unable to process Service 'klupd_KES-21-14_arkmon_F150F1F4' System.ComponentModel.Win32Exception (0x80004005): QueryServiceConfig: The system cannot find the file specified
   at BinaryTree.ReACL.Lib.ServiceMgr.GetServiceAccount(String serviceName)
   at BinaryTree.ReACL.Engine.ServiceUpdater.#4h(Mode #Je, String #tf, UpdateStats #ph)
   at BinaryTree.ReACL.Engine.ServiceUpdater.UpdateServices(Mode mode, UpdateStats stats)
2023/10/20 10:28:01 ERROR: Unable to process Service 'klupd_KES-21-14_klark_C526585C' System.ComponentModel.Win32Exception (0x80004005): QueryServiceConfig: The system cannot find the file specified
   at BinaryTree.ReACL.Lib.ServiceMgr.GetServiceAccount(String serviceName)
   at BinaryTree.ReACL.Engine.ServiceUpdater.#4h(Mode #Je, String #tf, UpdateStats #ph)
   at BinaryTree.ReACL.Engine.ServiceUpdater.UpdateServices(Mode mode, UpdateStats stats)
2023/10/20 10:28:01 ERROR: Unable to process Service 'klupd_KES-21-14_mark_F2E96205' System.ComponentModel.Win32Exception (0x80004005): QueryServiceConfig: The system cannot find the file specified
   at BinaryTree.ReACL.Lib.ServiceMgr.GetServiceAccount(String serviceName)
   at BinaryTree.ReACL.Engine.ServiceUpdater.#4h(Mode #Je, String #tf, UpdateStats #ph)
   at BinaryTree.ReACL.Engine.ServiceUpdater.UpdateServices(Mode mode, UpdateStats stats)

 

It is a third-party software configuration and behavior after the Kaspersky database update, it is not able to clean up without a device reboot. Sample screenshot of the update from KES.

**This is not issue with Quest Product. Kindly proceed to clarify further with Kaspersky Support for the process cleanup, or try with the workaround in the resolution.

 

Possible Workaround 1
1) Add  the below to the exclusion list to exclude from Process the below file by ReACL

C:\Windows\System32\drivers\klupd_KES-21-14_arkmon.sys
C:\Windows\System32\drivers\klupd_KES-21-14_klark.sys 
C:\Windows\System32\drivers\kklupd_KES-21-14_klbg.sys 
C:\Windows\System32\drivers\klupd_KES-21-14_arkmon.sys
C:\Windows\System32\drivers\klupd_KES-21-14_mark.sys 
C:\Windows\System32\drivers\Klwfp.sys 
C:\Program Files (x86)\Kaspersky Lab

2) Perform ReACL/cutover depends on your requirement
3) if issue persist , Proceed with Workaround 2

Possible Workaround 2
1) Temporary Disable auto update to Kaspersky (KES)
2) Make sure it follows the latest policy without auto-update enabled is applied to the device
3) Perform Device restart
4) Perform ReACL/cutover depends on your requirement
5) Once ReACL is complete, Resume/restore any temporary changes in Step 1 
*** If the Same error reoccurs, retry from step 1 or Kindly contact the ThirdParty vendor to verify why the process is created and reported to the Operating system.

Possible Workaround 3
1) Uninstall Kaspersky Product
2) Reboot the device
3) Perform ReACL/cutover depends on your requirement
4) Install Kaspersky Product.

For more information Kindly contact Kaspersky Support.
 

Windows Defender is not using the same mechanism, where it's creating temporary services with random names when new definitions are being uploaded. Services are having a template name: MpKsl