Overview

This article describes the procedure to prepare Endpoint Security and Control for inclusion in a disk image.

NOTES:

• This procedure only applies to endpoints managed by Sophos Enterprise Console.
  For cloud managed endpoints, see How to install Sophos Central Endpoint on a gold image avoiding duplicate identities


• Attempt the procedure listed under Prerequisites first before you proceed


• The method outlined in this article does not work for including the Sophos Patch Agent in a disk image.


• We do not recommend including Sophos Encryption products in disk images.

The following sections are covered:

• Prerequisites
• How to prepare for inclusion in a disk image
• Related information
• Feedback and contact

Applies to the following Sophos products
Sophos Endpoint Security and Control

Prerequisites

IMPORTANT! You must follow the recommended procedure for inserting Sophos Anti-Virus into a disk image, as listed in Sophos Anti-Virus for Windows 2000+: incorporating Sophos Anti-Virus current versions in a disk image, including for use with cloned virtual machines before you attempt the procedure in this article.

How to prepare for inclusion in a disk image

First create a disk image by installing the Sophos software that you wish to include on the disk image and then remove all components except Sophos AutoUpdate. This will ensure that when the image comes online, the latest version of each component is automatically downloaded and installed from the update location you configured.

IMPORTANT! Always make sure that the Sophos installer package that you use to create the image is less than six months old.  
Where the operating system is Windows Vista or Windows 7, you may need to modify the path e.g. in step 6, if you are running Vista, replace Program Data with Program Files.

1. Install Endpoint Security and Control to a client machine as if it was a fresh install.
   Make sure that it is set to update from the location you want your cloned computers updating from.
   
   
2. After the initial update has finished, stop the Sophos AutoUpdate service and set it to disabled.
   This prevents an update from starting during the procedure. The service will restart automatically at the end of the procedure.
   
   
3. Browse to:
   • 32-bit: C:\Program Files\Sophos\Remote Management System
   • 64-bit: C:\Program Files (x86)\Sophos\Remote Management System
     
     
4. Copy the following files to a location that is outside the Sophos folder:
   • cac.pem
   • mrinit.conf
     
     
5. Go to Add/Remove Programs and check if the Sophos Client Firewall is listed:


6. If the above components are not listed, go to step 7. 
   If they are listed, open the registry editor and export the following key to a safe location as a .reg file:
   • 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Products
   • 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\AutoUpdate\Products


7. Go to Add/Remove Programs and remove the following components (if installed):
   
   • Sophos Network Access Control
   • Sophos Client Firewall
   • Sophos Anti-Virus
   • Sophos Remote Management System (RMS)
   
   
8. If you did not need to export the registry key in step 6, go to step 9. 
   If you needed to export the key, import the key back into the registry by double-clicking the .reg file.
   
   
9. Reboot the system to complete the removal.
   
   
10. Open the cache folder in the following location:
    Windows 2003/XP: C:\Program Files\Sophos\AutoUpdate\
    Windows Vista and higher: C:\ProgramData\Sophos\AutoUpdate\
    
    
11. Delete the contents of the cache folder.
    
    
12. Find and delete the status.xml file from the following location:
    

    Windows 2003/XP: C:\Program Files\Sophos\AutoUpdate\data\status\
    Windows Vista and higher: C:\ProgramData\Sophos\AutoUpdate\data\status\

13. Browse to:
    • 32-bit: C:\Program Files\Sophos\.
    • 64-bit: C:\Program Files (x86)\Sophos
      
      
14. Create a new folder and name it Remote Management System.
    
    
15. Move the files that you copied to a new location in step 4 (cac.pem, and mrinit.conf) to the folder you have just created.
    
    
16. Open Windows Services (Start | Run | type services.msc and press the Enter key).
    
    
17. Set the Sophos AutoUpdate Service to Automatic but leave the service stopped.
    
    
18. Now take the image.

After installing the image and when the new computer is booted, AutoUpdate will update from the server it is configured to update from. The installer will then run and download and re-install the remaining components from the update location.

Related information

• Sophos Anti-Virus for Windows 2000+: incorporating Sophos Anti-Virus current versions in a disk image, including for use with cloned virtual machines
• How to install Sophos Central Endpoint on a gold image avoiding duplicate identities

Feedback and contact

If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article.
This is invaluable to us to ensure that we continually strive to give our customers the best information possible.