Sophos Endpoint

Discussions Windows Updates and Server Lockdown

Sophos Endpoint requires membership for participation - click to join

Thread Info

State Verified Answer
Locked Locked
Replies 5 replies
Subscribers 15 subscribers
Views 3480 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Windows Updates and Server Lockdown

Crackers 4 months ago

Hello,

Is anyone successfully installing Windows Updates whilst lockdown is enabled?

My understanding is that server updates need to be installed before the server is locked down:https://support.sophos.com/support/s/article/KB-000035355?language=en_US but someone mentioned it might be possible to install Windows Updates even if the server is locked.

Thanks

This thread was automatically locked due to age.

Top Replies

GlennSen 4 months ago +1 verified

Hello Crackers, Thank you for reaching out to our community forum. It’s not possible to install Windows updates while Server Lockdown is turned on the server. Server lockdown hardens your server, so…

+1 GlennSen 4 months ago

Hello Crackers,

Thank you for reaching out to our community forum.

It’s not possible to install Windows updates while Server Lockdown is turned on the server. Server lockdown hardens your server, so any changes especially on drive C, won't take effect unless you disable it first.

Glenn ArchieSeñas (GlennSen)

Global Community Support Engineer

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up +1 Vote Down

Cancel
0 LHerzog 4 months ago

It does work to install updates with SLD enabled. But it's not reliable and also the Server might have issues later.

If you enable SLD also keep an eye on performance on the Server console.

Due to other issues that occour with it enabled we decided not to use SLD anymore after it ran for 2 years on a few servers
Cancel
Vote Up 0 Vote Down

Cancel
0 Crackers 3 months ago in reply to GlennSen

Thanks Glenn, this is what I suspected.
Cancel
Vote Up 0 Vote Down

Cancel
0 Speedfish 3 months ago in reply to LHerzog

Thats very interesting that you drop SLD fully.
Do you have an example how exactly did it restrict your servers performance wise?
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog 3 months ago in reply to Speedfish

yes, install SLD on a recent Windows OS VM or physical, log on the Server console and feel like on a 1 core 256MB RAM computer
Cancel
Vote Up 0 Vote Down

Cancel