Need to know in which system sophos safeguard is not installed

Question

Dear Team, 
 Our company is having Active Directoty and Workgroup user environments. 
 
 We have deployed the Sophos Safeguard 8.1 in one server & sync all AD user & Computer in the Safegurad. 
 
 We need your help in following outputs: 
 
 1. Suppose if AD is having 100 user and computers active, and out of 80 system is having Sophos Safeguard Software in their systems. 
 ANd we need to know which systems (20 System Data from the SQL Query )is don't have installed sophos Safeguard software . 
 So that we can installed the software on this systems.

2. Does Sophos Safeguard support NAT(Public IP/Alternate Host) for outside clients. 
 -If yes then share us the procedure for the same and it will helpful if the romaming client is outside public network to sync the Safeguar policy at the client level. 
 Thanks.

MichaelMcLannahan · Answer

Hi Paresh - This forum is a community and not the best place perhaps for urgent assistance. We'll all do our best of course, but work, family, life allowing! 
 I would suggest raising a ticket, or better still - calling Sophos if you need more urgent help than the community can sometimes offer. 
 
 That said - It's not the Sophos product that supports NAT, you'll need to adjust routing on your network/firewalls to allow access. 
 I personally (and did) setup a secondary server and placed this within the DMZ network, and then adjusted routing so traffic could flow. 
 My config and certs therefore have TWO servers defined. One for internal use and then the DMZ server for outside/off network use. 
 This setup works well and is the Sophos recommended config. 
 
 There's a few ways you can find out what clients are installed/not installed.

This SQL query will list all machines, names, features and version installed.

/* SGN Client Native device Encrypion and its version number */ use yourdbnamehere SELECT SAFE_GUARD_DIR.SGD_name as 'Machine name', IVT_INST_FEATURES.IIF_FEATURE as 'Feature Installed', IVT_INST_FEATURES.IIF_FEATURE_VERSION 'Version Installed' FROM IVT_INST_FEATURES INNER JOIN SAFE_GUARD_DIR ON IVT_INST_FEATURES.IIF_MACHINE_ID = SAFE_GUARD_DIR.SGD_ID where IVT_INST_FEATURES.IIF_FEATURE like 'Bit%' order by SAFE_GUARD_DIR.SGD_name 
 
 You can paste this query into SQL Management Studio once you've connected/authenticated against your DB. 
 I would then compare this against what you have in AD/OU's and you'll quickly be able to patch a report together. 
 
 Or - write a few more queries.... 
 
 There's lots of different queries you could do - a good few examples here (you'll need to check the DB name each time) 
 
 https://community.sophos.com/kb/en-us/109925

MichaelMcLannahan · Answer

When you install the management side on the extra server, you then create a configuration on the primary server to then install on the additional servers. 
 I've just allowed 443/SSL to get through, you could skip this if you wanted unsecure traffic too, but I've forced SSL on all my clients. 
 If you log in to the console as a MAINMSO - Launch the Configuration Package Tool - Add a server. You will need the cert that you either created on the server, or a CA minted for you. 
 
 Give it a friendly name 
 
 Once this is added you can assign it a role if needed. I didn't assign any roles to my DMZ server. 
 
 You can then create the Server configuration package. You create one for each server.

2 - Your clients will appear in Sophos SafeGuard console IF they have the Sophos SafeGuard client installed. If you go into an OU that contains PC's but they are NOT listed within the console - the agent is NOT installed. 
 
 The easiest mode for this is the Inventory tab that appears on each OU. If when you select the OU and then the Inventory displays "No entry!" - it is just that. No clients in that OU have the agent installed. If the "Including subcontainers" is ticked it will display the clients within the sub-OU's of that one.

Hope this helps?

paresh palav · Answer

How you define the SGN server as NAT Alternate Server