Couple of questions about endpoint protection

Question

H, 
 we have Sophos enterprise console up and running. 
 We would like to install the endpoint protection on laptops remotely but still be able to alter their policies remotely when required eg lock usb out. 
 Using the Sophos endpoint packager, when I install RMS (to administer the laptop remotely etc), it fails to update as the laptop is not within the trusted network but at a remote location. Due to this, it doesn't get the initial updates as they need to come from the RMS server. Not installing the RMS, allows us to get the initial updates from Sophos but this then doesn't allow RMS to work. 
 Anybody came accross this?

QC · Accepted Answer

Hello Louis-M , 
 this is a restriction of the Deployment Packager (and there isn't really a viable solution other than building a modified package, or wrapping it up). 
 alter their policies remotely requires RMS connectivity - if the initial install can't complete due to missing connectivity even if you can work around it you'd subsequently be unable to assign policies. Please see also my reply to your Secondary update location post. 
 Christian