Enterprise console4.5/client9.5 - all PCs greyed out and won't report back, Help please!!

No problem, please let me know if it works out as I'm sure it could be useful for a few customers with a certification mismatch.

I thought about adding an additonal variable so it only ran on machines that had a mismatch. I.e.  Have a variable at the top called for example: strCorrectRouterIdentityKey, e.g.

strCorrectRouterIdentityKey = "qRS2iIVb8f5Ql3Y1SwJgOpB5vU0="

The user would add their value as taken from the server key:

HKLM\Sophos\Certification Manager\CertAuthStore\RouterKey

That way when it is run on a client it would check the value the client had against that, if it was different it would carry on and do a re-init, this way it would only run on clients with essentially a mismatched identity keys.  It's not the end of the workd if it does run on a working client, it just means they will request 2 new certificates and it shoudn't do this more than once as it sets a flag to say it completed ok and prevents subsequent runs (unless the -force switch is passed).

TBH the script is at the limit of the size of a message I can post, so close is it that I had to remove some of the comments so a new function would push it over the edge.

Well if you could try it on a couple of clients first to ensure it works, especially if you decide to add your cac.pem and mrinit.conf into the sctipt as variables as that's where it's most likely to go wrong that would be advisable.

Thanks,

Jak

Update:
The script below has the new variable:

strRouterCertIdentityKey 

It should be set to contain the same string as found on the Sophos Managment server in the following key:

HKLM\Software\[WOW6432NODE]\Sophos\Certification Manager\CertAuthStore\RouterKey

I've left my value in the script to show what it should look like, again this will need to be updated, my string will not work for you :)

This script now has quite a few configuration options, it almost needs a HTA/Script to Auto Configure the script per install!

No problem, please let me know if it works out as I'm sure it could be useful for a few customers with a certification mismatch.

I thought about adding an additonal variable so it only ran on machines that had a mismatch. I.e.  Have a variable at the top called for example: strCorrectRouterIdentityKey, e.g.

strCorrectRouterIdentityKey = "qRS2iIVb8f5Ql3Y1SwJgOpB5vU0="

The user would add their value as taken from the server key:

HKLM\Sophos\Certification Manager\CertAuthStore\RouterKey

That way when it is run on a client it would check the value the client had against that, if it was different it would carry on and do a re-init, this way it would only run on clients with essentially a mismatched identity keys.  It's not the end of the workd if it does run on a working client, it just means they will request 2 new certificates and it shoudn't do this more than once as it sets a flag to say it completed ok and prevents subsequent runs (unless the -force switch is passed).

TBH the script is at the limit of the size of a message I can post, so close is it that I had to remove some of the comments so a new function would push it over the edge.

Well if you could try it on a couple of clients first to ensure it works, especially if you decide to add your cac.pem and mrinit.conf into the sctipt as variables as that's where it's most likely to go wrong that would be advisable.

Thanks,

Jak

Update:
The script below has the new variable:

strRouterCertIdentityKey 

It should be set to contain the same string as found on the Sophos Managment server in the following key:

HKLM\Software\[WOW6432NODE]\Sophos\Certification Manager\CertAuthStore\RouterKey

I've left my value in the script to show what it should look like, again this will need to be updated, my string will not work for you :)

This script now has quite a few configuration options, it almost needs a HTA/Script to Auto Configure the script per install!