Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 1 subscriber
  • Views 4974 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AD Sync Automatic Deployment Retry

platham

Hello, we are looking to migrate from McAfee VSE 8.7/EPO 4.5 to Sophos ES&DP 9.5/EC 4.5. At the moment I have our EPO server set to synchronise with AD at 1AM, run a query to see what systems are discovered are unmanaged by the server, then every two ours it tries to push out the McAfee agent to any unmanaged systems in the database. This works great, even catches the people with laptops who rarely plug them in to the network for more than a few hours a month. I've set up a 30 day trial Sophos server and can't seem to replicate this functionality. I set up a Container, set it to Synchronise with an OU in AD, Automatically protect clients etc, Synchronise every 60 mins (also set it to 5 for testing). If the PC is turned off or not on the network when EC first discovers it via AD sync it then logs an error 0000002e but then that's it, it never tries again - is this correct? Is there no way to get the EC to re-try the push either next synchronisation or every two hours or something? If not then it will require us to manually contact the user, get them to plug it in, then Right click > Protect computers (or delete all the errored devices several times a day) - this is obviously no good. Another option of course is AD logon scripts or deploy with Zenworks or SMS but that's just rubbish compared to the EPO set up, I want as much automation as possible with little administrator interaction.

Anyone any ideas?

Thanks,

Paul

:3728


This thread was automatically locked due to age.
Parents
  • 0

    You could run ADSync to keep the structure synced in SEC and use start-up scripts, it wouldn't be worth using the auto-deploy part of ADSync as well though in my opinion.

    Auto protect from within ADsync will not attempt deployment to a machine that has been protected or attempted to be protected.  

    The downside for me using AD sync is, unless your AD container hierarchy mirrors your intended policy assignment you might have to create additional AD containers and move machines to them just to be able to assign new policies.  

    For example purposes, if I you have an AD container: "\germany\servers\".  That container might have a SQL server and an AD server.  This means you can only apply one AV policy to both machines.  So you have to exclude all the files you need to exclude on each for both in the one policy.  Unless you start creating:

    \germany\servers\SQL\

    \germany\servers\AD\

    create 2 SAV policies and link them, which might be fine or might end up making your AD more complex than needed.  This is just one example.

    Also unless you create single sync points on specific containers you'll be creating more groups in SEC than you require and I've found increasing the number of groups can slow down Enterprise Console GUI.  We're talking 1000+ but on a large AD structure this could happen.

    Ultimately the decision to use AD sync depends on the individual company structure in AD and if based on that structure it is possible to have one Sophos policy of each type per container.

    Jak

    :6779
Reply
  • 0

    You could run ADSync to keep the structure synced in SEC and use start-up scripts, it wouldn't be worth using the auto-deploy part of ADSync as well though in my opinion.

    Auto protect from within ADsync will not attempt deployment to a machine that has been protected or attempted to be protected.  

    The downside for me using AD sync is, unless your AD container hierarchy mirrors your intended policy assignment you might have to create additional AD containers and move machines to them just to be able to assign new policies.  

    For example purposes, if I you have an AD container: "\germany\servers\".  That container might have a SQL server and an AD server.  This means you can only apply one AV policy to both machines.  So you have to exclude all the files you need to exclude on each for both in the one policy.  Unless you start creating:

    \germany\servers\SQL\

    \germany\servers\AD\

    create 2 SAV policies and link them, which might be fine or might end up making your AD more complex than needed.  This is just one example.

    Also unless you create single sync points on specific containers you'll be creating more groups in SEC than you require and I've found increasing the number of groups can slow down Enterprise Console GUI.  We're talking 1000+ but on a large AD structure this could happen.

    Ultimately the decision to use AD sync depends on the individual company structure in AD and if based on that structure it is possible to have one Sophos policy of each type per container.

    Jak

    :6779
Children
No Data