Lockdown for Domain Controllers

Question

Question for those more experienced than me: 
 
 I just got Sophos Central and I'm getting ready to deploy it on my servers. I know there is the option to lock down, but with AD databases, SQL databases, and such, I'm wary to select that option for those servers. What do you guys do for those servers? 
 
 Also, does the lockdown prevent Windows Updates for routine maitenance? I assume it does, but I thought I'd make sure. 
 
 Thanks!

StephenMcKay · Accepted Answer

Hello, 
 We certainly have cusotmers running Lockdown on domain controllers etc; we would always recommend testing the deployment first if you can. We have an FAQ here; https://community.sophos.com/kb/en-us/121910 with links off to other useful articles. 
 At the bottom of the Server Protection page you will find a video showing how easy Lockdown is to enable as well as giving some useful information on how it functions: https://www.sophos.com/en-us/products/server-security.aspx 
 With regards to your Windows Update question, as mentioned in the video, this would be allowed on a Locked server because Windows Update is an updater and trusted by Lockdown. 
 I hope this helps. 
 Please let us know how you get on. 
 Regards, 
 Stephen