Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 2 subscribers
  • Views 23746 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Endpoint solution for VDi

Dekkar

Hi, we are moving to a VDI solution and we currently run Sophos on our systems.

Our new VDi setup will run from a golden image, and provision VMs on a daily basis, so Im not too sure of the best approach to having AV on them.

As users log off the VMs they are destroyed, and a new one is spun up. 

Does sophos have some instructions on how to set up their endpoint software in this kind of envoronment?

Thanks,

Nathan

:58128


This thread was automatically locked due to age.
Parents
  • +1

    Hello Nathan,

    I'll spare you the intricacies at the expense of completeness and accuracy, but the exact details are more confusing than helpful.

    A computer object has a number of attributes (which the endpoint sends) which are used to identify it. SEC exposes (visible in the Computer Details tab) Computer name, Computer description, Operating system, and Domain/workgroup (taken from the computer's properties, all but the OS can be overridden at install time or with a registry value). In addition an IdentityTag is created when the installation is initialized.

    If a computer connects and presents a known IdentityTag SEC assumes it's the one it has already seen and updates the other values in the database if necessary. If you do not correctly prepare an image the result is that Computers in Enterprise Console appear to update the same record. 

    If a computer connects and presents a known properties quadruple SEC assumes RMS has been reinitialized and updates the IdentityTag in the existing computer object.

    Thus if you use an image where Sophos is already fully installed and has been initialized all VMs will appear as a single computer which constantly changes its name.

    If you use a correct image but the machines are assigned arbitrary names the database will fill up with mostly disconnected, inactive computers.

    If the machines are started with a fixed set of names (e.g. VM01-VM50) the existing records will be "reused". Note that older alerts (they are accumulated by machine name) might be meaningless. It's also assumed that you don't change the policies in SEC without changing the image (if Sophos is already installed). Otherwise please see Force clients to request policy updates.  

    Christian

    :58161
Reply
  • +1

    Hello Nathan,

    I'll spare you the intricacies at the expense of completeness and accuracy, but the exact details are more confusing than helpful.

    A computer object has a number of attributes (which the endpoint sends) which are used to identify it. SEC exposes (visible in the Computer Details tab) Computer name, Computer description, Operating system, and Domain/workgroup (taken from the computer's properties, all but the OS can be overridden at install time or with a registry value). In addition an IdentityTag is created when the installation is initialized.

    If a computer connects and presents a known IdentityTag SEC assumes it's the one it has already seen and updates the other values in the database if necessary. If you do not correctly prepare an image the result is that Computers in Enterprise Console appear to update the same record. 

    If a computer connects and presents a known properties quadruple SEC assumes RMS has been reinitialized and updates the IdentityTag in the existing computer object.

    Thus if you use an image where Sophos is already fully installed and has been initialized all VMs will appear as a single computer which constantly changes its name.

    If you use a correct image but the machines are assigned arbitrary names the database will fill up with mostly disconnected, inactive computers.

    If the machines are started with a fixed set of names (e.g. VM01-VM50) the existing records will be "reused". Note that older alerts (they are accumulated by machine name) might be meaningless. It's also assumed that you don't change the policies in SEC without changing the image (if Sophos is already installed). Otherwise please see Force clients to request policy updates.  

    Christian

    :58161
Children
No Data