Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 7933 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Update, Update Policy via Group Policy

JoeHurley

Roughly 25% of our computers are not reporting back to the Sophos Enterprise Console. I strongly suspect that a previous mis-configuration has these computer looking to the wrong place to connect to the console.

I'm looking for a way to get this information updated on a couple hundred computers - Can I push out the Sophos 'Updating Policy' via Group Policy? If so where is the Updating Policy stored? and/or the Primary Server Address and Credentials? IS there a better way?

I went so far as to delete our existing computers, and then re-discover them, setup synchronization & its ability to install Sophos automatically. This works brilliantly for a fresh build newly joined to the domain, it does not work for an existing computer with mis-configured update Policy.



This thread was automatically locked due to age.
Parents
  • +1

    There are 2 communication channels for a SEC managed client:

    1. Updating (Sophos AutoUpdate).
    2. Remote Management System (RMS).

    You can configure updating policy in 2 ways:

    1. RMS, management server can send a policy via RMS to AutoUpdate.
    2. From the CID using exportconfig/configcid. https://community.sophos.com/kb//13111 and https://community.sophos.com/kb//13112 

    Not reporting back to SEC is a different issue than being able to update.

    When you install SEC, it creates a file called mrinit.conf.  This file exists in the distribution points or CIDs as they were previously known.
    When you install the client software, this file (along with cac.pem) is copied to the client and the values are added to the registry by clientmrinit.exe as part of the RMS installer.

    In the first instance I would check:

    1. the ParentAddress values on the client in the registry (hklm\software\wow6432node\sophos\messaging system\router\) is pointing at the SEC server and the client can resolve at least one address listed to the management server.
    2. port 8192 and 8194 TCP are available to the clients.
    3. Can we see the last router log of a failing client (\programdata\sophos\remote management system\3\router\logs)?

    If you can regain management of the clients with RMS you can set the updating policy through SEC.

    This might also be worth a mention: Re-init the clients as per: https://community.sophos.com/kb/en-us/116737.  

    Regards,

    Jak

     

Reply
  • +1

    There are 2 communication channels for a SEC managed client:

    1. Updating (Sophos AutoUpdate).
    2. Remote Management System (RMS).

    You can configure updating policy in 2 ways:

    1. RMS, management server can send a policy via RMS to AutoUpdate.
    2. From the CID using exportconfig/configcid. https://community.sophos.com/kb//13111 and https://community.sophos.com/kb//13112 

    Not reporting back to SEC is a different issue than being able to update.

    When you install SEC, it creates a file called mrinit.conf.  This file exists in the distribution points or CIDs as they were previously known.
    When you install the client software, this file (along with cac.pem) is copied to the client and the values are added to the registry by clientmrinit.exe as part of the RMS installer.

    In the first instance I would check:

    1. the ParentAddress values on the client in the registry (hklm\software\wow6432node\sophos\messaging system\router\) is pointing at the SEC server and the client can resolve at least one address listed to the management server.
    2. port 8192 and 8194 TCP are available to the clients.
    3. Can we see the last router log of a failing client (\programdata\sophos\remote management system\3\router\logs)?

    If you can regain management of the clients with RMS you can set the updating policy through SEC.

    This might also be worth a mention: Re-init the clients as per: https://community.sophos.com/kb/en-us/116737.  

    Regards,

    Jak

     

Children
Unfiltered HTML