Customizing AutoUpdate

Hello emiliob,

I understand the advantage of updating when the defs are published

I won't rub it in yet another time, promised :smileyvery-happy:

Do the thread  Manual Update Via Command Line/Script and the article Sophos AutoUpdate: significant files and registry entries give you the information you need?

Christian

This is great.  Now I just need to know if I can run this as System or need admin creds?

Also, is something like this supported by Sophos?

Hello emilio,

the interface to the ALSvc.exe service is supported (otherwise you wouldn't find it in the article). SYSTEM should be fine.

Christian

Hi,

It is worth mentioning that even if the schedule updating is disabled in the policy, SAU will perform an update check after the Sophos Auto Update service (alsvc.exe) starts.

By default a few minutes after alsvc.exe starts, it will invoke an update and you'll see alupdate.exe as a child process of alsvc.exe.  This behaviour can be controlled in a couple of ways:

1. http://www.sophos.com/en-us/support/knowledgebase/1462/8450/1465/7300/27646.aspx - disabling the initial check all together.

2. Under

32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate

64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Sophos\AutoUpdate 

create a new DWORD called "StartupDelay" (no quotes), the value is the number of seconds alsvc.exe will wait before kicking off alupdate.exe.  You can confirm the change by using something like ProcessExplorer and restart the SAU service.

Hope it helps.

Regards,

Jak