Hi, I’m Glenn Archie Senas
from the Sophos Community,
and today
we'll be discussing
how to automate software
deployment for Sophos Central Endpoint
on Windows devices.
For a quick overview,
there are multiple ways to deploy
Sophos Central Endpoint,
including
Manually installing the Software on endpoi
Triggering the installation
through a start-up or login script
via Active Directory Group Policy
and using Intune or SCCM.
Today we’ll
be using the group policy method,
but the steps for Intune or SCCM
deployment are available
in the documentation links
in the video description.
We’ll be following along
with the steps outlined in the KB article
also linked in the video description.
There are some pre-requisites
to keep in mind.
We’ll be using a start-up script
as opposed to a log on script
for this deployment
because the installer file
“SophosSetup.exe” requires administrator
privilege to run on a device.
However,
if you are planning
to use a log on script,
keep in mind
the logged in user
will need to be
an administrator.
And before installation,
there are a few software packages
that must not be installed
on the endpoints,
or the installation will fail.
These includes Sophos Patch,
Sophos Client Firewall
and Sophos Antivirus , if Web Control,
Data Control
or Application Control are
enabled on the computer.
If a device
control policy
has been applied to a computer,
Sophos Anti-Virus'
uninstallation requires
a restart to unload the kernel driver
sdcfilter.sys
Possible note about
competitor AV’s preventing installation.
Recommending to remove the competitor
before deploying
Sophos. Sophos’ CRT
(as part of the
AV install)
will try and remove the competitor,
this is done
using the recorded “UninstallString”
from the registry
and can sometimes fail
if additional protections
similar to that of Tamper
Protection are turned on.
To manage Endpoint devices,
the first thing we need to do
is download the Central Endpoint
Installer from the Central Dashboard
that will manage your endpoints.
Go to Protect Devices >
under Endpoint Protection
> select Download Complete
Windows Installer.
Keep in mind,
though the link shows
Complete Windows Installer,
this is a thin installer that deploys
all the features available
depending on your license.
This means when you run the installer,
it’ll establish
a connection to Sophos Central,
to check your license,
and download the rest of
the software as needed.
Devices must have a connection
to the internet for the installation
to go through.
You’ll also need to ensure
to allow all traffic
to the domains and ports
required for communication
to and from Sophos Central.
The documentation listing
that information is available
in the video description.
If you have devices to protect that can’t
be connected to the internet directly,
check out our documentation
on “Update
Caches”, again
available in the video description.
One last thing to mention
about the installer,
don’t use a user-specific
“SophosSetup.exe” received
via Email Deployment.
If you do,
all devices will be associated
with the Sophos Central user
that was sent the email.
Let's proceed on creating a .bat script.
We are going to be creating a "bat”
or “batch” script
that will call this installer,
so place the installer
in a shared folder accessible
to all the devices that need it.
To create the batch script,
open a text editor of your choosing,
and paste in the script
from the video description, or the KB
article.
the line pushd \\servername\share
with the location
of the installer package on your network.
Save the file
as SophosCentralEndpointInstall.bat and
place it somewhere temporary that
you can find later, we’ll
just place it on the desktop for now.
Let's proceed
onto deploying the script via GPO.
To deploy the script via
Active Directory,
you can either create a new group policy
or edit an existing one.
In the next steps
I’ll be showing you
how to create a new one.
So to proceed. Let’s open the Group
Policy Management Console.
Open the Run window > type
gpmc.msc > and press Enter.
Now, Right-click
on the Organizational Unit
where you need to deploy
the Sophos Central Endpoint,
and select the option
Create a GPO in this domain,
and link it here.
Now enter a GPO name.
For example,
Sophos Central Windows
Endpoint deployment policy.
Right-click on the new GPO
that you created
and select Edit.
This opens the Group Policy Management
Editor window of the Sophos Central
Windows Endpoint
deployment policy GPO.
Go to Computer Configuration
> Policies > Windows
Settings >
Scripts (Startup/Shutdown).
On the right-panel,
double-click on Startup.
Click the Show Files button.
This will open the File
Explorer in the location
where the GPO will run the script from.
Copy the Sophos
Central Endpoint Iinstalled
.bat script from the location,
you save it to and paste it.
Now back in the Startup Properties
window,
click on
Add then Browse.
After clicking on 'Browse',
we will see the directory
which contains the file we pasted.
[SophosCentralEndpointInstall.bat]
Select the file and click 'Open'
Clico Click Apply
> OK
Now, in the Group Policy Management window
click Sophos Central Windows Endpoint
deployment policy GPO.
Go to the Scope tab.
Ensure that the Links have the correct OU
Check that the Security
Filtering contains
your target user group.
If it does not have the user group
where the Sophos Central Endpoint
is intended to be deployed,
click Add to add them.
Right-click on the OU,
then select
Group Policy
Update to enforce the deployment
of the new GPO.
To force an update of the GPO,
open a Command
Prompt on
one of the target
endpoints and run the command
gpupdate /force,
then reboot the computer.
Now when the computers
that this policy applies to reboot,
they’ll run the batch script
to install Central Endpoint.
I hope you found this video useful.
Let us know by giving us a thumbs up
on Techvids or like comment and subscribe
on YouTube for further assistance.
View and post questions
on community.sophos.com.
Thanks for watching. Take care!