Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 1848 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Customizing AutoUpdate

emiliob

We recently received a request to limit Sophos updates on some critical servers to only happen after business hours.

Has anyone successfully implemented something like this?

I was thinking a scheduled task that runs ALUpdate.exe every hour between a set time.

My question is, what account would i set the scheduled task to run as?

Any help or idea is appreciated.  I understand the advantage of updating when the defs are published.

:44563


This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    It is worth mentioning that even if the schedule updating is disabled in the policy, SAU will perform an update check after the Sophos Auto Update service (alsvc.exe) starts.

    By default a few minutes after alsvc.exe starts, it will invoke an update and you'll see alupdate.exe as a child process of alsvc.exe.  This behaviour can be controlled in a couple of ways:

    1. http://www.sophos.com/en-us/support/knowledgebase/1462/8450/1465/7300/27646.aspx - disabling the initial check all together.

    2. Under

    32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate

    64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Sophos\AutoUpdate 

    create a new DWORD called "StartupDelay" (no quotes), the value is the number of seconds alsvc.exe will wait before kicking off alupdate.exe.  You can confirm the change by using something like ProcessExplorer and restart the SAU service.

    Hope it helps.

    Regards,

    Jak

    :44589
Reply
  • 0

    Hi,

    It is worth mentioning that even if the schedule updating is disabled in the policy, SAU will perform an update check after the Sophos Auto Update service (alsvc.exe) starts.

    By default a few minutes after alsvc.exe starts, it will invoke an update and you'll see alupdate.exe as a child process of alsvc.exe.  This behaviour can be controlled in a couple of ways:

    1. http://www.sophos.com/en-us/support/knowledgebase/1462/8450/1465/7300/27646.aspx - disabling the initial check all together.

    2. Under

    32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\AutoUpdate

    64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Sophos\AutoUpdate 

    create a new DWORD called "StartupDelay" (no quotes), the value is the number of seconds alsvc.exe will wait before kicking off alupdate.exe.  You can confirm the change by using something like ProcessExplorer and restart the SAU service.

    Hope it helps.

    Regards,

    Jak

    :44589
Children
No Data