Hi, I am Simon Fu from Sophos Support and today I will be explaining how to configure
Control Updates for Sophos Central managed endpoints.
By default, computers with Central Endpoint installed get the latest Sophos product updates
automatically. This is critical for staying up to date with the latest threat protection
software. There are, however, situations where you may need to control when computers update
for compatibility or performance in your environment. For example, if you need to stop updates on
computers during a busy period when they need as much network bandwidth as possible, or
to test updates on selected computers to ensure software compatibility of internal applications.
Before configuring Controlled Updates there are a few things you will need to know:
Controlling software updates does not stop protection updates. Computers still get automatic
security updates or threat identity files to protect them against the latest threats.
Controlled updates only apply to the version of the Sophos Endpoint software on your devices
Controlled updates only apply to Windows and Linux Server and Endpoint devices, not Mac
devices. Server and Endpoint software updates are controlled
independently of one another, so you need to change settings for Endpoints and Servers
respectively if you wish to control both.
Now let’s start with the configuration.
Once logged into Sophos Central, from the Overview Dashboard go to Global Settings.
Scroll down to Endpoint or Server protection then select “Controlled Updates”
There are 3 options to choose from. If you select Pause Updates Now
you will immediately pause product updates for all computers. You can only pause updates
for up to 90 days, so it will display the date when computers begin regular automatic
updates. To revert, simply click resume automatic updating,
or if that’s what you want, click back to list, or just navigate to any other page.
If you select “Pause Updates on a Set Date” you can choose a date to pause product updates,
and the date to resume automatic updates. Again, this can still only be a a maximum
of 90 days. Once completed, click onto “Apply” to save the changes. During the period where
updates are paused, you can resume updating by coming back to this menu and clicking resume
automatic updating. If you select “Control Updates Manually”
pause all updates to your devices, but you will now have the option to create a test
group to test updates before rolling out to all devices.
To do so, you will need to select a “Test” computer first and then add it to the “Test”
Computer list. Click “Manage Computers”
From the "Select Test Computers" screen, select a computer from the "Available Computers"
list Click the right arrow button to add to the
"Assigned Computers" list Once added, click "SAVE".
You can now see the selected computer is added to the Test computers table.
When Sophos releases a new product version, you will receive an email alert like this
one All the Computers that were on the Newest
(recommended) version will now show as being on the Oldest, including the “Test” computer
You can then select to update Test computers by clicking "Update test computer to the newest
version". Once updated, the test endpoint will now show
as “Newest" version, and the Non-test computers will stay on the “Oldest” version
When you are ready to update all other computers in your environment, you can then click
"Update to match test computers" to update all the Non-test computers.
I hope you found this video useful! Let us know by giving us a thumbs up,
and let us know if we resolved your issue.
Check out the documentation for this video in the video description and go to techvids.sophos.com
for more great videos like this one!
View and post questions on community.sophos.com.
Thank you for watching. Take care.