• For correct operation of the hard drive encryption feature, system reboot is required after the installation of the product.
• The authentication agent does not support hieroglyphics and the special symbols "|" and "\".
• Kaspersky Endpoint Security 10 shows the notification that you need to close the processes that use the encrypted devices before the the application grants access to such devices. If all such processes cannot be terminated, the encrypted drives have to be reconnected.
• Unique IDs of hard drives are displayed in the device encryption statistics in inverted format.
• We do not recommend to format the devices during the process of their encryption.
• When more than one removable drives are connected to the device, the encryption policy is applied only to one of the drives. Upon the next attempt of connecting the drives that were not encrypted, the policy works correctly.
• Encryption may fail to start on a heavily fragmented hard drive. In this case, hard drive defragmentation should be performed.
• Hybernation is blocked during hard drives encryption at the following periods:
  • From the start of the encryption task until the first restart of the Microsoft Windows 7 / 8 / 8.1 / 10 computer.
  • From the installation of the hard drive encryption until the first restart of the Microsoft Windows 7 / 8 / 8.1 / 10 computer.
  During hard drive decryption, hibernation is blocked from the time when the boot hard drive is fully decrypted until the first reboot of the operating system. When the Quick Start option is enabled in Microsoft Windows 8 / 8.1 / 10, blocking of hibernation makes it impossible to shut down the operating system.
• We do not recommend that you use the xbootmgr.exe tool with additional providers enabled (such as Dispatcher, Network, Drivers).
• Formatting of an encrypted removable drive is not supported on a computer with Kaspersky Endpoint Security for Windows installed.
• Formatting of an encrypted removable drive with the FAT32 file system is not supported (the device is displayed as encrypted). To be able to format the drive, reformat it to the NTFS file system.
• Issues of restoring the operating system from a backup copy to an encrypted GPT device are described in this article. 
• Coexistence of several download agents on one encrypted computer is not supported.
• Unable to access the removable drive which was earlier encrypted on another computer under one of the following conditions:
  • No connection with the Kaspersky Security Center 10 server.
  • The user has signed in with a new token or a new password.
  In such cases, restart the computer. Access to the encrypted drive will be restored.
• Discovery of USB devices by the authentication agent is not supported when xHCI mode for USB is enabled in BIOS settings.
• Full-disk encryption (FDE) of the SSD part of the drive, which is used for caching the most frequently used data, is not supported for SSHD devices.
• Full-disk encryption of 32-bit Microsoft Windows 8 / 8.1 / 10 operating systems running in UEFI mode is not supported.
• Before the next encryption of the decrypted hard drive, computer restart is required.
• Hard drive encryption is incompatible with Kaspersky Anti-Virus for UEFI. We do not recommend that you use full disk encryption on computers with Kaspersky Anti-Virus for UEFI installed.
• Creating authentication agent user accounts based on Microsoft accounts is supported with the following limitations:
  • Single sign-on is not supported.
  • Automatic creation of user accounts for the authentication agent is not supported if the option of creating accounts for users who have logged in to the system within N days is enabled.
• If the authentication agent account name is "domain"/"Windows account name", then after changing the computer name you must also update the domain part of the account names created for local users on this computer.
  For example, the computer name is USER and your local user account name is Username, and the FDE account has been created under the name USER/Username. If the computer name (USER) has been changed (for example, to USER-PC) , then you must change the FDE account name from USER/Username to USER-PC/Username. To change the authentication agent account name, use the local accounts management task. Until the account name is changed, only the old name can be used for preboot authentication (in the example: USER/Username).
• If the user restarts the computer when the message «Your password has been changed. Click OK» is displayed, the new password is not saved. The old password must be used for the next preboot authentication.
• If the user restores the access on an encrypted computer which is accessed with the token only, make that after the access is restored the user can access the computer using the password in the authentication agent.  The password set by the user during access restore procedure may not be saved. In this case, the user will have to restore access to the encrypted host once again at the next computer restart.
• The single sign-on feature of the application is incompatible with similar third-party solutions.
• FDE is not supported on Hyper-V and Citrix virtual platforms.
• On some devices, hard drives encryption is supported with limitations. For the list of such devices, see this article.

• Once you have installed the application, you must restart the operating system for the file and folder encryption functionality to work properly.
• If encryption is unavailable on the computer, then in case it tries to access an encrypted file on the computer with encryption enabled, direct access to the file may be provided. The encrypted file located in a shared folder on the computer computer where the encryption functionality of Kaspersky Endpoint Security is available, is copied unencrypted to the computer with encryption functionality unavailable.
• You are advised to decrypt files that were encrypted with Encrypting File System, before encrypting files with Kaspersky Endpoint Security.
• After a file is encrypted, its size increases by 4 KB.
• After a file is encrypted, the "Archive" attribute is set in the file properties.
• When extracting the files from an encrypted archive, the extracted files are replaced with existing files that are included into the encrypted archive in case their names are the same. The user is not notified about this operation.
• Portable File Manager errors are not displayed in the Portable File Manager interface.
• Kaspersky Endpoint Security does not launch Portable File Manager on a computer with file encryption functionality installed.
• When file encryption functionality is used, the application is incompatible with the Sylpheed email client.
• The parameters of the swap file cannot be changed. Instead of the specified settings, the operating system uses the default values.
• Using FLE for full disk encryption is not recommended. For encryption of the system drive, use FDE.
• Safe removal should be used when working with encrypted removable drives. If the removable drive is not ejected safely, data may be lost.
• After the files are encrypted, their non-encrypted original copies undergo safe removal.
• Synchronization of offline files using Client-Side Caching service (CSC) is not supported. We recommend that you block the autonomous use of shared resources at the policy level. Files in the autonomous mode can be edited. Changes made to the autonomous file can be lost during synching. For more information about Client-Side Caching (CSC) support, see this article.
• Creation of an encrypted archive in the root of the system hard drive is not supported.
• Problems can be experienced when attempting to access encrypted files over the network. We recommend that you move files to a different source or make sure that the computer used as a file server is managed by the same Kaspersky Security Center Administration Server.
• Changing the keyboard layout causes the password entry window for an encrypted self-extracting archive to stop responding. To solve this problem, close the password entry window, switch the keyboard layout in your operating system, and re-enter the password for the encrypted archive. 
• When using file encryption on systems with several disk partitions, it is recommended that you use the automatic pagefile.sys file size identification option.
• After applying file encryption rules, including the files located in the Documents folder, make sure all users for which the encryption was enabled have access to the files. Each of users must log in with Administration Server connected. If the user tries to access the encrypted files when there is no connection to Administration server, the system may stop responding.
• Encryption of files used by the system at the startup is not recommended. Otherwise, when the system tries to access these files without connection to Kaspersky Security Center, the system may stop responding or may show multiple requests on access to the files.
• Password expiration term cannot be disabled for encryption of removable drives that suppoer the portable mode.
• Encryption of files and folders is not supported on Citrix virtual platforms.

• The task of adding keys through Kaspersky Security Center might not work correctly. See this article for more information about adding the key file.
• If the "Error receiving data" system message is displayed, check if the computer on which you are performing activation has network access, or configure activation via Kaspersky Security Center Activation Proxy.
• Installation of the subscription license through Kaspersky Security Center 10 automatic distribution is not performed if the license on the computer is expired or if trial license is used. To replace the trial license or a renewal license which is due to expire soon, use the license distribution task to apply the renewal license.

• After being installed to an infected computer, the application does not inform the user of required scan of the computer. Problems with the application activation may be occur. To solve this problem, run the critical areas scan after the application installation.
• If setup.ini contains non-ASCII characters (e.g. Cyrillic letters), we recommend editing the file using notepad.exe. Save the file in Encoding Unicode or UTF-16LE. Other encodings are not supported.
• If changing of application settings is password-protected, use the following commands to remove the encryption module:
  • For AES encryption module (256 bit):
• msiexec /x {090EAE5F-F428-49D5-9CAF-BEED98A702CA} KLLOGIN=<login> KLPASSWD=<password>/qn
  • For AES encryption module (56 bit):
  msiexec /x {51DAFEE1-44D0-4E1E-8F6B-80F57FEC5AE0} KLLOGIN=<login> KLPASSWD=<password>/qn
• During the product settings import from the cfg file, the value for participation in Kaspersky Security Network is not applied. After the settings are imported, you must review the Kaspersky Security Network Statement and select whether you agree to participate in Kaspersky Security Network. You can find the text of the Kaspersky Security Network Statement in the product interface or in the file ksn_*.txt in the product installation folder.
• When the encryption module (FLE or FDE) or the Device Control component is removed then installed again, computer restart is required before enabled.
• During installation of product patches, the option Start Kaspersky Endpoint Security 10 for Windows on computer startup is enabled by default.
• The attempts to install any version of the AES encryption module on a computer with Kaspersky Endpoint Security 10 for Windows SP2, SP2MR1, SP2MR2, SP2MR3 installed fail with the error informing that the newer version of the application is installed on the computer, even if no encryption components are installed. Starting with Kaspersky Endpoint Security 10 Service Pack 2, the encryption module does not have a separate installation file. Encryption libraries are included into the application installation package. Thus, Kaspersky Endpoint Security 10 Service Pack 2 Maintenance Release 3 for Windows is incompatible with AES encryption modules released for previous versions of Kaspersky Endpoint Security. All libraries required for encryption are installed automatically when the full disk encryption (FDE) or file level encryption (FLE) component is selected.
• Installing Kaspersky Endpoint Security 10 for Windows SP2 MR4 as a full distribution package is not supported.

• OGV and WEBM formats are not supported.
• RTMP protocol is not supported.

Filtering packets / connections by local addresses, physical interface, and TTL is supported in the following cases:

• by local address for outgoing packets / connections in applications rules (for TCP and UDP) and packet rules;
• by local address for incoming packets / connections (except for UDP) in blocking rules of apps and packet rules;
• by packet TTL in blocking packet rules for incoming / outgoing packets;
• by network interface for incoming and outgoing packets / connections in packet rules.

• Full disk encryption (FDE) on Hyper-V virtual machines is not supported.
• Full disk encryption (FDE) and encryption of files and folders (FLE) are not supported on Citrix virtual platforms.
• To enable Kaspersky Endpoint Security compatibility with Citrix PVS, perform installation with the Ensure compatibility with Citrix PVS option enabled. This option can be enabled in the Setup Wizard or using the command line parameter /pCITRIXCOMPATIBILITY=1. In case of remote installation, you must add the /pCITRIXCOMPATIBILITY=1 key into the KUD file.
• In Citrix Xen Desktop, before cloning virtual machines which use vDisk, Self-Defense mast be disabled.
• When preparing the template machine for the master image of Citrix XenDesktop with pre-installed Kaspersky Endpoint Security 10 and the KSC Network Agent, add the exclusion of the following type to the configuration file:

For more information, see the Citrix XenDesktop guide.

• Under server operating systems, no warning of required advanced disinfection is displayed.
• If an infected file was detected during the autorun objects scan and the user decided against disinfection, the file will be deleted upon restart of the computer if it was restored from Quarantine before restart.
• Incorrect processing of trusted websites is possible.
• Application events are displayed incorrectly in Kaspersky Security Center reports.
• Recovery of objects moved to Quarantine by Mail Anti-Virus is not supported.
• When System Watcher is enabled, full information about processes is not displayed.
• At the first run of Kaspersky Endpoint Security 10 for Windows, an application with a digital signature may be assigned to an incorrect group. The group will be automatically changed to the correct one.
• Vulnerability scan takes a long time if many updates for Microsoft Windows are not installed on the host.
• When checking mail with the MS Outlook plug-in, we recommend that you use the Cached Exchange Mode (option Use Cached Exchange Mode). For more information about the Cached Exchange Mode and Microsoft recommendations on its use, please follow this link.
• When using on-premises relay in the network with different localizations of Kaspersky Endpoint Security installed on the computers, use Update Utility of the compatible version to download application module updates.
• When switching from global KSN to local KSN through Kaspersky Security Center 10 or vice versa, the option of participation in KSN is disabled in the application policy. After switching, you must review the Kaspersky Security Network Statement and select whether you agree to participate in Kaspersky Security Network. You can view the Kaspersky Security Network Statement in the application interface or while editing the application policy.
• If you want to use PIN for disk encryption using the Microsoft BitLocker technology on the computers with Microsoft Windows 10 RS2 installed, set the minimum PIN length to 6 characters. If the PIN is shorter than 6 characters, the encryption process ends with the error Failed to prepare the system volume for encryption.
• When re-scanning a malicious object that has been blocked by the application, the user is not informed that the threat has been rediscovered. The rediscovery of the threat is displayed as an event in the product report and the Kaspersky Security Center report.