"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
This article provides an example of how to correctly configure an endpoint computer's parent address if the computer moves between different network locations (e.g., different offices or company sites) so that you can continue to manage the computer and receive status messages from it.
Applies to the following Sophos product(s) and version(s) Enterprise Console 5.2.1Enterprise Console 5.2.1 R2Enterprise Console 5.1.0Enterprise Console 5.2.0Enterprise Console 5.2.2Enterprise Console 5.3.0Enterprise Console 5.3.1
The load balancing of message relay servers (i.e., configuring an endpoint computer's reporting address to attempt to connect to more than one message relay server) may cause problems and is not supported.
If a large number of computers are configured to report to more than one relay server a build-up of downstream messages (from the management server) can occur on one or more of the relays. This is due to the management server recording the last known location of the endpoint computer (i.e., which relay the computer last reported from) and will attempt to send all current messages via that relay. If the endpoint computer subsequently reports via a different relay the management server will switch to sending messages to that relay and all previous messages will remain in the envelopes folder on the now inactive relay server.
The diagram shown below shows how you should configure the parent address if the endpoint computer moves between networks.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.