For audits, we were reading, displaying, and verifying the values listed in the isched.cfg file according to the information on: https://support.sophos.com/support/s/article/KB-000033520?language=en_US#isched.cfg however, it appears that the file is no longer present on our systems.
Where'd it go?
This is regarding the Sophos Endpoint Agent managed by Sophos Central
In the latest release, the SED component starts the updates. The config is here:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense Service\ScheduledTasks\SophosLaunchUpdate
Frequency 60 FrequencyStartDelay 5 OverrideStartPrivs ApplicationName 0039:C:\Program Files\Sophos\AutoUpdate\SophosLaunchUpdate.exe CommandLine 003b:"C:\Program Files\Sophos\AutoUpdate\SophosLaunchUpdate.exe" CurrentDirectory 0022:C:\Program Files\Sophos\AutoUpdate TamperProtected SystemIntegrity
Frequency 60 is what you are after and FrequencyStartDelay 5 is the initial delay after the SEDService.exe process starts before it kicks off the first update.