Distribution of definitions to offline endpoints

Hello RandomDiceMan,

non tech staff inserting the media and  hopefully clicking on an executable that will update their defs
well, AV software and its definitions are system files - have these users administrative rights?

Anyway, the machines are truly disconnected from any larger network and threats would come only via removable media? As you ask in the UTM forum I can't say which Endpoint version is available to you. In principle one would copy the AutoUpdate cache from a regularly updating connected endpoint to the medium, on the offline endpoints configure the drive and the path to the cache folder on it as the update location, insert the medium and from the taskbar Sophos icon request Update now.  

Christian

Hello RandomDiceMan,

non tech staff inserting the media and  hopefully clicking on an executable that will update their defs
well, AV software and its definitions are system files - have these users administrative rights?

Anyway, the machines are truly disconnected from any larger network and threats would come only via removable media? As you ask in the UTM forum I can't say which Endpoint version is available to you. In principle one would copy the AutoUpdate cache from a regularly updating connected endpoint to the medium, on the offline endpoints configure the drive and the path to the cache folder on it as the update location, insert the medium and from the taskbar Sophos icon request Update now.  

Christian

Thanks for the prompt response QC,  found your previous post on a similar topic....

https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/10776/internet-isolated-installation---manually-updating

Firstly Yes the users will have admin level rights.

I'm assuming (sorry i don't know) there will be a range of different client versions and potentially a range of OS's (Windows 32 and 64 bit, server and desktop) - does this matter from a definition point of view, i.e. do I need to source multiple different defs from say 32bit system and a 64 system or various different OS levels such as XP or server 2003.

Can Sophos use a CLI based commands (for scripting purposes) to identify the 'Autoupdate cache' location and run an 'Update now'?

All endpoints should be using a 10.x solution.

Thanks again.

M

Moved from Sophos 9.0 UTM forum to endpoint security and control forum

Hello M,

there's only one set of definitions for all products and platforms, furthermore there's only one software package for all supported OS versions an OS "family" (like Windows) - if there's a bitness dependency there are specific subfolders.

the users will have admin level rights
they are careful, aren't they?

CLI based commands
I have a script intended to be run from a stick. On an online machine it should copy the cache to the stick, on an offline configure the update location and trigger an update. Perhaps needs some refinement. Won't post it here (style's embarrassing) but I can send it via private message.

Christian

Very kind of you QC, thankyou.

Are they careful? your guess is as good as mine, will have to ask them....let's be honest 'remind' them.

Thanks again.

M

How does one "trigger an update" for Sophos from the cli?

Hello Chris Reinking,

please see the Sophos AutoUpdate article.

Christian