Cleaning AD of old Sophos installations

Hello, Fred_B,

We appreciate your reaching out to the Sophos Community Forum.

So yes, you can delete the old Sophos users and groups that are no longer used. There’s no issue with that. 

The old SEC installers create a local AutoUpdate account using the naming convention 'SophosSAU<machine-name>aaa' instead of 'SophosSAU<machine-name>0.'

The example for your reference if that helps you: 

Sophos NAC
SophosSAU"DC name" aaa
SophosSAU"DC name" aab
SophosSAU"DC name" aac
Sophosupdatemgr1
Sophosupdatemgr2

SophosDBmgr

Let me know if you need any further help: 

Regards, 

Hello, Fred_B,

We appreciate your reaching out to the Sophos Community Forum.

So yes, you can delete the old Sophos users and groups that are no longer used. There’s no issue with that. 

The old SEC installers create a local AutoUpdate account using the naming convention 'SophosSAU<machine-name>aaa' instead of 'SophosSAU<machine-name>0.'

The example for your reference if that helps you: 

Sophos NAC
SophosSAU"DC name" aaa
SophosSAU"DC name" aab
SophosSAU"DC name" aac
Sophosupdatemgr1
Sophosupdatemgr2

SophosDBmgr

Let me know if you need any further help: 

Regards, 

Are any of these still needed:

EMLibrary Users - Security Group

EMLibUser1 - User

SophosAdministrator - Security Group

SophosDomainPowerUser - Security Group

SophosDomainUser - Security Group

SophosEndpointUpdate - User

SophosFirmDataReaders - Security Group

SophosManagement - User

SophosOnAccess - Security Group

SophosPowerUser - Security Group

SophosUser - Security Group

Sweepupd  - User

Regards,

Fred

Hello Fred_B 

Yes, you can delete these. These groups and users are no longer needed for Sophos Central. 

So the Endpoint X product no longer uses AD domain users and Groups? How is it cleaning from non local resources as network shares?

According to this post some still serve a purpose:

 Sophos Windows users and groups - Sophos Central Managed PCs 

On servers, File Integrity Monitoring (FIM) - is a Central feature - that uses SophosFimDataReaders