This knowledge base article answers the common questions related to SophosSAU account.
Applies to the following Sophos products and versions Sophos Endpoint Security and Control
SophosSAU is an impersonation account created for use by the Sophos AutoUpdate service.
Sophos AutoUpdate user accounts are created in the format SophosSAU[machinename]aaa
To avoid collision when installing on DCs with account replication, the last three characters are alphabetic as opposed to a single integer of zero to nine. These characters start with aaa and ascend their way through the alphabet sequence (both lower and upper case) if Sophos AutoUpdate's installer recognizes a collision. Once a character reaches the upper case letter Z, the next iteration will be created with the next significant letter increased to the next letter in the alphabet.
SophosSAU[machinename]aaa ... SophosSAU[machinename]aaZ SophosSAU[machinename]aba ... SophosSAU[machinename]aZZ SophosSAU[machinename]baa ...
In earlier versions of Sophos AutoUpdate, the SophosSAU account format is SophosSAU[machinename]0-9
AutoUpdate connects to the CID (Central Installation Directory) of the Sophos Enterprise Console via UNC, and if resources can be seen and connected to (as verified by the SophosSAU account), the AutoUpdate process will progress and use the username and password specified within the AutoUpdate policy and connect to the CID.
To determine the CID, open Sophos Enterprise Console then click View followed by Bootstrap Locations.
Enter the account to be used for impersonation in Download User in the following:
Follow the steps in the KBA 111665.
Sophos does not delete this account during uninstall. Keeping in mind that this account's location differs on an endpoint and a domain controller, if required it can be deleted manually.
Sign up to the Sophos Support SMS Notification Service to get the latest product release information and critical issues.
If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article. This is invaluable for us to ensure that we continually strive to give our customers the best information possible.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.