How do you force a Sophos AV client to update ?

Hi Lestat,

It's really quite simple, it just maps the network drive using a special highly unprivileged user we set up for the purpose, and then runs the setup file directly from the network share.

So, you run the batch file that installs sophos (lets call it InstallSophos.bat) from psexec like so:

psexec \\COMPUTERNAME.DOMAIN.NAME -u DOMAIN\user -p password -c InstallSophos.bat

(where DOMAIN\user is a username with admin privileges on the target COMPUTERNAME)

The contents of InstallSophos.bat look something like this:

net use \\SOPHOSSERVER.DOMAIN.NAME\SophosUpdate /user:SOPHOSSERVER\updateuser password

\\SOPHOSSERVER.DOMAIN.NAME\SophosUpdate\CIDs\S000\SAVSCFXP\setup.exe -i -mng yes -user SOPHOSSERVER\updateuser -pwd password

(where SOPHOSSERVER\updateuser is a user on the domain that the sophos server is on with privileges enough to read the update share)

We're assuming a basic sophos 9 install/update share here - you just need to change the paths on the two network shares above to match the actual location of your install files if you're using sophos 7. And yes, we've tested a basically similar batch file with just the paths changed for doing sophos 7 installs and it worked as well.

As always, YMMV, but it's worked pretty well for us.

As an aside, if you're looking at doing blanket scans and updates (rather than a targeted install on a specific machine), you may want to check to see if Sophos is already installed first. Our test for Sophos 9 already installed looks like:

IF EXIST "C:\Program Files\Sophos\Sophos Anti-Virus\SAVControl.dll" GOTO DONE

IF EXIST "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVControl.dll" GOTO DONE

@REM <insert above InstallSophos.bat code here>

: DONE

You'll need to check for something specific to 7 to test against if you're using that version, of course.

Regards,

Jon (for Phil, who I work with!)

Hi Lestat,

It's really quite simple, it just maps the network drive using a special highly unprivileged user we set up for the purpose, and then runs the setup file directly from the network share.

So, you run the batch file that installs sophos (lets call it InstallSophos.bat) from psexec like so:

psexec \\COMPUTERNAME.DOMAIN.NAME -u DOMAIN\user -p password -c InstallSophos.bat

(where DOMAIN\user is a username with admin privileges on the target COMPUTERNAME)

The contents of InstallSophos.bat look something like this:

net use \\SOPHOSSERVER.DOMAIN.NAME\SophosUpdate /user:SOPHOSSERVER\updateuser password

\\SOPHOSSERVER.DOMAIN.NAME\SophosUpdate\CIDs\S000\SAVSCFXP\setup.exe -i -mng yes -user SOPHOSSERVER\updateuser -pwd password

(where SOPHOSSERVER\updateuser is a user on the domain that the sophos server is on with privileges enough to read the update share)

We're assuming a basic sophos 9 install/update share here - you just need to change the paths on the two network shares above to match the actual location of your install files if you're using sophos 7. And yes, we've tested a basically similar batch file with just the paths changed for doing sophos 7 installs and it worked as well.

As always, YMMV, but it's worked pretty well for us.

As an aside, if you're looking at doing blanket scans and updates (rather than a targeted install on a specific machine), you may want to check to see if Sophos is already installed first. Our test for Sophos 9 already installed looks like:

IF EXIST "C:\Program Files\Sophos\Sophos Anti-Virus\SAVControl.dll" GOTO DONE

IF EXIST "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVControl.dll" GOTO DONE

@REM <insert above InstallSophos.bat code here>

: DONE

You'll need to check for something specific to 7 to test against if you're using that version, of course.

Regards,

Jon (for Phil, who I work with!)