K7 Endpoint Security Setup Guide India — Deploying K7 for Your Business

K7 Endpoint Security is straightforward to deploy compared to most enterprise endpoint security products — but getting the policy configuration right from the start is what separates a clean deployment from one that generates constant false positives and support calls. This guide walks through a complete K7 Enterprise Security deployment for an Indian business environment.

Pre-Deployment Checklist

Before installing any K7 components:

• Download K7 EPS from the K7 portal (access provided with your licence keys)
• Identify one Windows Server or Windows PC to host the K7 EPS Console (the management server)
• Confirm minimum server requirements: Windows Server 2012 R2 or later, 4GB RAM, 20GB free disk
• Confirm all target endpoints are running Windows 7 SP1 or later (Windows 10/11 recommended)
• Uninstall any existing antivirus software on ALL endpoints before deploying K7
• Note any existing group policy (GPO) settings that may conflict with endpoint security
• Gather a list of all custom or locally-developed applications that may trigger false positives

Phase 1: Install the K7 EPS Console

Step 1: Install the Management Server

1. Run the K7 EPS installer on your designated server machine
2. Choose Console + Agent installation (installs both the management server and protects the server itself)
3. Set the K7 EPS Server Port — default is 80/443. If your server already runs IIS or another web server, change the port (e.g. 8080)
4. Set the admin password — choose a strong password and store it in your password manager
5. Note the Console URL: http://[server-ip]:[port]/EPS

Step 2: Apply Your Licence Key

1. Open the K7 EPS Console in a browser from the server
2. Go to Settings > Licence
3. Enter your K7 licence key (provided by Cloudfy at purchase)
4. Confirm the licence shows the correct user count and expiry date

Step 3: Configure Console Time Zone

1. Go to Settings > General Settings
2. Set time zone to Asia/Kolkata (IST)
3. All logs, reports and alerts will use this time zone

Phase 2: Policy Configuration

Do this before deploying agents. The default K7 policy is permissive. Harden it first.

Step 4: Create Your Base Policy

1. Go to Policies > New Policy
2. Name it: "Cloudfy Standard Policy — [Company] — [Date]"
3. Start with the default K7 policy and modify these settings

Step 5: Antimalware Settings

Real-Time Protection:

• Scan all files: Enable
• Scan archives: Enable
• Scan emails: Enable (Outlook and POP3/IMAP)
• Action on detection: Quarantine (safer than Delete for false positive recovery)

Scheduled Scan:

• Enable weekly scan
• Schedule: Sunday 2:00 AM (avoids business hours)
• Scan network shares: Enable

Step 6: Enable Anti-Ransomware (Critical)

In the policy, go to Anti-Ransomware Settings:

• Enable Anti-Ransomware: Yes
• Action on ransomware detection: Block and Alert

For Indian businesses, ransomware delivered via phishing is the most common endpoint threat vector. Anti-ransomware must be explicitly enabled — verify this is on in every policy.

Step 7: Web Protection

1. Enable Web Protection
2. Enable Web Filtering (requires Enterprise Security licence or higher)
3. Block these categories:
   • Adult/Mature content
   • Gambling
   • P2P / Torrent downloads
   • Anonymiser/Proxy bypass
   • Malware and phishing URLs
4. Allow with log:
   • Social media (assess for your business)
   • Personal cloud storage

For BPO or call centre environments: Block social media completely during business hours. Review blocked site reports weekly to catch legitimate business tools being accidentally blocked.

Step 8: Device Control (USB Protection)

1. In the policy, go to Device Control
2. Enable Device Control
3. Set USB Storage Devices: Block (recommended) or Read-Only
4. Block Optical Drives (CD/DVD): Yes
5. Allow Printers: Yes

USB exceptions for authorised devices: For IT staff or specific users who need USB access, create a separate policy with USB permitted, or add specific device serial numbers to the exception list.

Step 9: Application Control

For tighter environments (BPO, call centres, regulated industries):

1. Enable Application Control
2. Mode: Report Only for the first 2 weeks (build up the baseline of installed applications before enforcing)
3. After the baseline period, review the report and add legitimate applications to the whitelist
4. Switch to Block mode

Phase 3: Network Groups

Step 10: Organise Your Endpoints into Groups

1. Go to Network > Groups
2. Create groups matching your business structure:
   • Finance Team
   • HR
   • IT (needs AV exclusions for management tools)
   • Production / Operations
   • Remote Employees
   • Servers

Groups allow you to apply different policies per department. IT staff may need USB access or AV exclusions; production floor PCs may need stricter application control.

Step 11: Common Groups for Indian Business Types

Manufacturing:

• Production Floor PCs (strict application control, no internet except business sites)
• Engineering Workstations (allow CAD software, specific exceptions)
• Office PCs (standard policy)
• ERP Server (server policy — no scan during business hours, scheduled off-hours only)

BFSI:

• Customer-Facing Terminals (maximum lockdown — no USB, no personal browsing)
• Back Office (standard + USB blocked)
• Servers (server-specific policy)

Phase 4: Agent Deployment

Step 12: Deploy Agents to Windows Endpoints

Method A: Remote Push (domain-joined machines)

1. In Network > Computers, browse your Active Directory
2. Select the computers or OU you want to protect
3. Right-click > Install K7 Agent
4. Agent installs silently in the background
5. Allow 15–30 minutes for agents to appear as managed in the console

Method B: Installation Package (non-domain machines)

1. Go to Reports > Create Installation Package
2. Select the policy to pre-assign to this package
3. Download the .exe installer
4. Distribute via email, USB (IT staff USB), or MDM
5. Users run the installer — no admin rights needed if the package is signed

Method C: Login Script / GPO For large domain deployments:

1. Place the K7 agent installer in a shared network location
2. Create a GPO startup script that runs the installer silently on any unmanaged machine
3. Deploy over several nights to avoid business disruption

Step 13: Verify Agent Health

After deployment:

1. Go to Network > Computers
2. All deployed machines should show Protected status
3. Check for Not Protected or Unmanaged devices — investigate per device
4. Verify signature update date — should be within 24 hours of current date

Phase 5: Common Issues in Indian Deployments

Issue: Remote push fails on some machines

Cause: Windows Firewall blocking the K7 server's access via WMI/Remote Registry. Fix: Ensure the K7 console server's IP is allowed inbound on the Windows Firewall of target machines (ports 135, 445, and dynamic RPC range). Or use Group Policy to open the required Windows Firewall rules.

Issue: False positives on locally-developed software (Tally, custom ERP)

Cause: K7 detects custom-built software or older software with unclear signatures. Fix: Add the software's executable path or SHA-256 hash to the Exceptions List in the policy. Do NOT exclude entire directories — exclude only the specific file. Also report the false positive to K7 Labs (they update the database for the next signature release).

Issue: High CPU during business hours

Cause: Scheduled full scan running during work hours. Fix: Reschedule full scans to Sunday 2am. For shared network drives, scan on-demand is fine during off-hours; avoid continuous on-access scanning of large network shares (add network share paths to on-access scan exclusions, rely on scheduled scans instead).

Issue: Agent not receiving updates

Cause: Endpoint cannot reach K7 update servers (update.k7computing.com) due to proxy or firewall. Fix: Add K7 update domains to your proxy whitelist, or configure the K7 console server as a local update relay for all agents. The relay downloads updates once and distributes internally.

Issue: USB block breaking a legacy scanner or card reader

Cause: Device control policy blocking the device class the hardware uses. Fix: Identify the device's USB class or serial number, and add an exception in the Device Control policy for that specific device or device class.

Phase 6: Reporting and Alerts

Step 14: Configure Email Alerts

1. Go to Settings > Email Configuration
2. Set your SMTP server details
3. Add recipient email (IT manager or team distribution list)
4. Configure alerts for:
   • Malware detected
   • Agent offline (machine not reporting to console for 24+ hours)
   • Licence expiry warning (30 days before)

Step 15: Schedule Compliance Reports

1. Go to Reports > Schedule Reports
2. Create a monthly Security Summary Report — delivered to IT head
3. Create a monthly Device Status Report — all managed endpoints with protection status

For ISO 27001 or RBI audit evidence, schedule monthly PDF reports and archive them. The archived reports demonstrate continuous monitoring capability to auditors.

Post-Deployment Checklist

• All endpoints showing Protected status in K7 EPS Console
• Anti-ransomware enabled on all endpoint policies
• USB device control active and tested
• Web filtering blocking test URL in blocked category
• Monthly security report scheduled and delivered to IT manager
• Alert notifications active: malware detections, offline agents, licence expiry
• AV definitions current (< 24 hours old) on all endpoints
• No devices in Unmanaged state (investigate any exceptions)

Cloudfy Systems is an authorised K7 Computing reseller in India. We provide K7 Endpoint Security licensing, deployment, policy configuration and ongoing managed support with INR pricing and GST invoice.

Contact us: +91 97600 50555 · connect@cloudfysystems.com

See also: K7 Endpoint Security pricing for India

Frequently Asked Questions

How long does a K7 deployment take for 50 endpoints?

With remote push deployment on domain-joined machines, a 50-endpoint K7 deployment typically completes in 2–4 hours. Non-domain machines requiring manual installation packages take longer. Cloudfy handles full K7 deployment as part of our standard package.

Does K7 require a dedicated server for the management console?

The K7 EPS Console can run on a Windows Server or even a Windows 10/11 PC for small deployments. For 50+ devices, a dedicated Windows Server with 4GB+ RAM is recommended for performance. For very small deployments (under 20 devices), the console can run on an existing office server.

Can K7 manage endpoints outside the office (remote/WFH)?

K7's management architecture is primarily on-premise. Remote endpoints need either a VPN connection back to the office to communicate with the console, or a Communication Server relay in the cloud. For businesses with significant remote workforces, consider whether Seqrite's cloud console offers better operational fit.

How do I exclude Tally from K7 scanning?

In the K7 EPS Console, go to the applicable policy > Exclusions > add the Tally executable path (typically C:\Tally.ERP9\tally.exe or similar). Use file path exclusions rather than folder exclusions where possible for tighter security.

What happens if the K7 console server goes offline?

Endpoints continue to protect themselves using locally cached policies and signature databases. They will not receive new signature updates or send new alerts until the console server comes back online. For businesses where the console server availability is critical, consider running the console on a VM with regular snapshots.