For audits, we were reading, displaying, and verifying the values listed in the isched.cfg file according to the information on: https://support.sophos.com/support/s/article/KB-000033520?language=en_US#isched.cfg however, it appears that the file is no longer present on our systems.
Where'd it go?
Thanks for reaching out to us. Could you let me know which Sophos product you're using? Are you inquiring about the One Premise Sophos Endpoint Security and Control, or the Sophos Intercept X Agent managed from Sophos Central?
The AutoUpdate service has now been removed and this functionality has been moved over to the Sophos Endpoint Defense component. You can find some information at the following registry location. - HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\AutoUpdate\UpdateStatus
In the "Details" subkey, you can also find data on what packages have been downloaded. The subkeys and values present here will also tell you what version of the component is currently installed.
This is regarding the Sophos Endpoint Agent managed by Sophos Central
I'm looking specifically for the update frequency. That doesn't seem to be an available key in the registry that you referenced.
Updating will take place once every hour from the time a system powers on. It is not possible to change this from Sophos Central, although it was possible with Sophos Enterprise Console.
In case you are using the Update Management policy from Sophos Central, this policy is more closely related to when update packages are made available to endpoints to download, rather than the schedule on which the update check is performed on the endpoint.
In the latest release, the SED component starts the updates. The config is here:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense Service\ScheduledTasks\SophosLaunchUpdate
Frequency 60 FrequencyStartDelay 5 OverrideStartPrivs ApplicationName 0039:C:\Program Files\Sophos\AutoUpdate\SophosLaunchUpdate.exe CommandLine 003b:"C:\Program Files\Sophos\AutoUpdate\SophosLaunchUpdate.exe" CurrentDirectory 0022:C:\Program Files\Sophos\AutoUpdate TamperProtected SystemIntegrity
Frequency 60 is what you are after and FrequencyStartDelay 5 is the initial delay after the SEDService.exe process starts before it kicks off the first update.