SGN Client automatic upgrade or central deployment methodology that works?

Question

Hi there. 
 Long time user of SafeGuard Enterprise. Initially purchased for laptop FDE, now being used for Data Exchange and File Encryption. 
 We're in a race against time to complete the rollout of version 7.00.2 to all machines in the enterprise (1300+ at the last count). 
 This is a mixture of fresh deployments to desktops (where FDE was not needed) and an upgrade of some notebooks which are running various legacy versions of SGN, as far back as 5.6. 
 I know that there's no direct upgrade path to 7.00.2 from some of the older versions, that's not the reason (directly) for this post. 
 So, to the point: has anyone found a good way to automatically deploy SGN? 
 To date, we're stuck using scripts which are run manually on each machine call the 3 msi files in sequence. Typically, the client will eventually be installed using this method (usually 3+ attempts with reboots in between). Pre-reqs and config files typically install without issue. 
 I'm open to suggestions about how we can better accomplish this! 
 To say that this current practice is a ball-ache is something of an understatement, especially when we need to upgrade where we usually have the same process again - this is one reason why we've got such a legacy of installed versions. 
 When I was at Sophos HQ last week, I was shown the persistent file encryption option and (as it fits with a project that I'm currently working on) asked for some more details. At which point I was told that it needed SGN 8. 
 I rolled my eyes at this and mentioned the fact that upgrade process for us can take several months because of its manual nature. I also pointed out that I was likely to get lynched upon my return if I suggested another SGN upgrade before mid-2017. 
 The senior tech that was running through the demo exclaimed that 'it was easy' and then proceeded to click the 'Synchronise' button in SGN which he assured me meant that the machine would download the latest client version from the server and that it would be updated automatically. 
 Has anyone seen this witchcraft working? Is what I was shown is true then it looks like future upgrades could be very straightforward, however I can't see anything in the (v7) SGN Console that hints as to how this might be achieved. 
 Any info is gratefully received! 
 Kind regards, 
 Mark

FormerMember · Accepted Answer

Hello Mark, 
 I'm afraid that is Witchcraft indeed, during sync hronization the states of the clients are reported to the SafeGuard Enterprise backend, policies are updated and the user-machine assignment is checked, only the following things are changed on the client: 
 
 Policies that were changed in the Management Center 
 On a Mac, users that have been deleted or blocked in the Management Center are also removed from the list of FileVault 2 users 
 
 In regards to an upgrade of the endpoints this is still an easy process, the pre-install, Client and Configs are all just MSIs (.Zips on a Mac) so can be pushed out via GPO, SCCM, LANDESK or other similar systems. 
 We do have basic documentation for Central Installations ( https://docs.sophos.com/esg/sgn/8-0/admin/win/en-us/webhelp/index.htm#concepts/ClientInstallCentralCommand.htm) but if you're looking for some help putting a script together it would be well worth having a chat to our Pro Services team which can be booked in via your account manager. 
 I hope that helps Mark but do let me know if you have any questions on that.

MarkWheeler · Answer

To more-or-less close this out, we opted for deployment via GPO, initially for our desktop machines with no existing SGN footprint, then as a step-by-step upgrade from 5.6 (with ConfigProtection) through 6.1 to 7.00.2 
 Initial testing looks good and we're starting a larger-scale roll-out as I type this. 
 The process has not been helped by the need to create our own MST files for the installations. Ultimately, this is not a complex task but it is pretty fiddly and time consuming if you don't have someone in the team with the necessary knowledge and experience. This is definitely one areas where Sophos could help, e.g. by providing a transform creator. 
 Also, because we have not kept up-to-date with the client versions (our fault), the upgrade process from 5.6 (with CP) to 7.00.2 is a little cumbersome, even when automated (4 reboots and around 20 minutes end-to-end). 
 Still, we've got a working platform and I've learned a lot about WMI, GPOs and MST files in the last few days. 
 Happy to provide some guidance if anyone is interested. Reply to this post and I'll get back to you when I can. 
 Cheers, 
 Mark