Hey all, it's Jay from Sophos Support here. We'll be going over how to install Sophos Central
Endpoint on a gold image so that every instance of a virtual machine created from that gold image
gets its own unique identity. First, we'll go over the prerequisites before prepping the gold image
device. The gold image device must be a Windows OS. You'll need to have Sophos Central Endpoint or
Server fully installed on the gold image device, and also make sure there are no update failures or
communication issues on the device and that the device has a green status. The steps we cover
apply to Sophos Central Endpoint, Sophos Central Server, and Sophos Intercept X. For VMware Horizon
and Citrix, the Sophos MCS Client service must manually be set to Automatic (delayed start)
for a unique id to be obtained by the new computer. We'll cover this later in the video.
If using non-persistent VDI's, we suggest that you use the base policy as the policy to be applied to
the gold image device. This is because every time you create a new instance using this gold image,
the new instance will only have the base policies applied to it. The device will not retain group
membership since its name and identity will be new. The last thing I'll mention is that Server
Lockdown and/or an Update Cache on a gold image device is currently unsupported. There are two
ways to set up your gold image device. You can manually delete the files on the device that
associates the device's identity with central.Or, modify our existing script which will do the same.
When a new instance is created based on that gold image device those files will be regenerated to
create a unique identity. The link to the script is available in our KB article linked in the video
description. We'll be going over the scripted method today as it's generally the fastest,
but the steps to delete the files manually are available in the KBA link in the video
description. The first thing that you'll have to do is download the script onto the gold image
device. Once you've downloaded the script; which just to note is going to be a text file,
we'll need to go ahead and modify it. Let's take a look at our script. To make this work we'll be
replacing the GOLD_IMAGE_HOSTNAME, TP_PASSWORD, and the REGISTRATION_TOKEN entries with the actual
information from the gold image device. First, we'll grab the hostname of the gold image device.
We'll do this by opening a command prompt and issuing the command, hostname | clip on the
gold image device. This will copy the output of the hostname command to our clipboard.
Great tip by the way, using '| clip' at the end of any command will copy its output. Next,
let's open up our script and we'll replace the GOLD_IMAGE_HOSTNAME with the hostname we copied.
Next is the tamper protection password. We'll grab this from Sophos Central by going to the
devices section and going to either computers for an endpoint, or servers for a server. Once we
have the tamper protection password we'll want to copy it and replace the TP_PASSWORD in the script,
with the password we copied. Lastly, we're going to copy the registration token which ties the
device to your central dashboard. To get this, we'll open the file 'config.xml' located in the
folder 'C:\ProgramData\Sophos\Management Communications System\Endpoint\Config\'.
Remember, ProgramData is a hidden directory so if you're navigating manually you'll need to show
hidden items or just type in the full path. In the config.xml, we'll see the registration token
in between the strings . So let's go ahead and highlight and copy that.
Now going back to our script we simply replace the REGISTRATION_TOKEN string in the script with the
token we copied. Now the script is modified. And remember, if you're using VMware Horizon
or Citrix, you'll need to perform the following. Disable tamper protection. Run services as an
administrator, and change the startup type for the Sophos MCS Client service to Automatic (delayed
start). Once you're done make sure to re-enable tamper protection. To run this script we'll need
to modify it from a text file to a batch file. Hit save as and append the extension '.bat' to
the file name and change the save as type to all files. Remember, when the script is run it must be
run from an administrative Command Prompt window. Once you have a Command Prompt window open, change
directory to where you have the script located. In this instance, we have it on the desktop.
Then, run the script. The device is now ready to be prepped for imaging. Remember, this device
has no identity so the next time it's rebooted it will register as a new device in Sophos Central.
So don't reboot the device before you prep it or else you'll essentially undo everything you just
did with the script. And, it's that simple. Hope this video cleared things up for you.
Like this video if it did and drop a comment on what videos you would like to see in the
future. Check out the in-depth documentation for this video in the video description and check
out 'techvids.sophos.com' for more great videos like this one. Bookmark Techvids,
subscribe on YouTube, follow our socials and view and post questions on community.sophos.com,
we do it all! This is Jay, signing off!