Client protection with local Windows Policies Enabled

HI,

You can use that article to pre-stage an account, such that when AutoUpdate installs it will use that rather than create one for you.

Regards,

Jak

Hello Ronnie,

it is not the server which creates this account but the installer on the client. Now I don't know which rules it uses to create the password - but apparently not the required one.

You can predefine the required account as per Manually creating an AutoUpdate account. Personally I'd take this to Support though to get a statement on update account vs. password policies.

Christian

Hey thanks for the reply's

I got a few questions about this:

-So make the account in the register before i protect it with Sophos Client?

-Does the installer not make SophosSAU<computername>1 then instead of 0 which it makes normaly?

-If the installer makes the account + password it does this only localy on the client? Not send anything back to the server ?

-Manually creating the autoupdate account i should do on all clients then (or make image with this reg edit in it)?

-Any script available to do this automatically?

And about the update account vs. password policies.

I couldnt find anything related to this but i guess more people should have expierenced this same problem cause its very common for a company to have a complex password in case of security.

You must create the account before protecting the clients. AutoUpdate will use the preconfigured account (and not create one with another suffix - this is normally only used on DCs). As these are local accounts the action must be performed for each client. Adding the required keys (by whatever method) should be pretty straight forward.

The AutoUpdate service runs as LOCAL SYSTEM and therefore has no access to network resources. In order to download updates it must impersonate an account which does - this is the SophosSAU<COMPUTERNAME>0 user. Acting as this user AutoUpdate then accesses the CID using SophosUpdateManager (or whatever is specified in the policy).

i guess more people should have expierenced this same problem

Yes, but I know of no article or doc specifically addressing this (at least I haven't found one). So I wonder what's the official answer from Sophos, whether a defect has been raised or a suggestion accepted.

Christian

Ok thanks for this information so far im gonna look first if i can find something in the installer which has to do with the Account and Password for the SophosSAU account.

Second i think im gonna call the support of Sophos to ask about this.

And third all info i will find about this i will post in this topic so its clear to do for other people who experience this same problem.

EDIT:

Another question:

Any idea which file or .dll in the installer (Autoupdate) has a commandline with make SophosSAU account with password in it?

This post http://sophos.lithium.com/t5/Sophos-Endpoint-Protection/Problems-updating-clients/td-p/16907

Is also very similiar to my problem with one difference i want to makes thing go automatic so i dont have to change allot of things on the client side.

Solution:

Workgroup Configuration with password policy enabled

First of all i started with a clean Configuration of Windows and Enterprise Console 5 (With 5 you can select a default update account).

The first thing i did was installing alle pre-reqs and after i started to install Enterprise Console.

When Enterprise Console asks for making a SQL instance SOPHOS make it and enter your admin account:

Administrator / Password

The next tab where u have to fill in something which needs attention is the part Update Manager Account(Default Update account):

SophosUpdateaccount / Password ( i did make a complex password for example: P@ssw0rd1

TIP: Remember or write down this password

After this just install Sophos Enterprise Console like u do normal.

After installation update the CID and Warehouse with the newest version in :

C:\Documents and Settings\All Users\Application Data\Sophos\Update Manager\Update Manager

Update your Update Manager in your Enterprise Console with the latest Binaries. And Select which Subcription will be installed on your Clients (under recommended).

On your dashboard also make a folder under Unassigned  like Assigned.

Now search for computers on your network and first let them all stay in Unassigned.

The only thing u can do now is update your server with Sophos Client if u need to cause this one doesnt have password policy's.

Next thing i did is check if my SophosUpdateaccount has read rights on 

C:\Documents and Settings\All Users\Application Data\Sophos\Update Manager\Update Manager

Second i checked that i have a admin account in computer management on the server  which is also admin on the clients for example:

clientadmin / password

This is the account which can install software on the clients when protecting the computers.

Clients part:

On the client i made a account which normally Sophosinstalller makes but cause of the the password policy it cannot:

In computermanagement on the client add the following account:

SophosSAU<Computername>0

I did give this one the same complex password as the SophosUpdateaccount ( i did make a complex password )

Next thing i did is edit regedit before the Sophosinstaller makes the keys:

I made a sophos.reg file with this settings:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service]
"Download User"="SophosSAU<computername>0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service]
"Download Password"="P@ssw0rd1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service]

ObfuscatedPassword" =dword:0000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service]
"UserPreset"=dword:00000001

I put them in the registery before pushing the install from the Server with Enterprise Console

After this u can push a install of Sophos Client to the clients (unassigned) from the Enterprise Console without having problems with password complexity.

Greets Ronnie!!

PS.

Im busy with making this regedit settings and adding accounts go automatically with a script.

When i found out and tested i will post it here. 

Ok as promised here is my script i use for pre configuring clients when password policies enabled:

echo off
REM
REM=====Make Local Account on Client======
REM
net user SophosSAU%COMPUTERNAME%0 <Enter Password here> /add /comment:"Account for updating Sophos" /passwordchg:NO
wmic useraccount where "name='SophosSAU%COMPUTERNAME%0'" set passwordexpires=FALSE
net localgroup "Users" SophosSAU%COMPUTERNAME%0 /ADD
REM
REM
REM======Add Username Regedit=====
REM
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service /v "Download User" /t REG_SZ /d SophosSAU%Computername%0 /f
REM
REM======Add Password Regedit=====
REM
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service /v "Download Password" /t REG_SZ /d <Enter Password here> /f
REM
REM======Add Obfuscated==
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service /v "ObfuscatedPassword" /t REG_DWORD /d 00000000 /f
REM
REM======Add Userpreset==
REM
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate\Service /v "UserPreset" /t REG_DWORD /d 00000001 /f
pause
exit