Sophos Deployment Packager for creating Windows installers

Hi,

The manual option would be to zip up the distribution point or previously known as CID and then run setup.exe with the switches required.

Setup switches: https://www.sophos.com/en-us/support/knowledgebase/12570.aspx

This article might provide most of what you need:
https://www.sophos.com/en-us/support/knowledgebase/121318.aspx

It details how you can zip up a "resource", in this case a CID/Distribution point rather than a warehouse and run an exe with switches.

You can extend the VBS if need to call "update now" given the code in: https://www.sophos.com/support/knowledgebase/36262.aspx.  I.e. you just need the 2 lines:

dim objALC : set objALC = CreateObject("ActiveLinkClient.ClientUpdate.1")
objALC.UpdateNow 1,1

Hope it helps.

Regards

Jak

Hello Doug,

the DP is for building no-configuration-required packages thus there is no pre-install GUI.

no automatic update option after install
I'm not sure what you think is missing. Do you mean that there is no update location configured. What's on the endpoint immediately after running the package depends on the options selected when building it. How do you intend to use the packages as there's a number of possible combinations (from a minimal less than 10MB "bootstrapper" to a full package)?

Christian

The manual process covered by Jak has been my solution over the past 9 years with Sophos. That solution is completely custom by me. It provides:

• Checks to make sure the Sophos product installs correctly
• An updater at the end of the install to pull down the latest version from our servers
• Notice a reboot is needed after install to set the changes
• Options for GUI or silent install
• The installer is 140MB in size

Management want to move away from my custom solution and use the SDP option. 

1. When an installer from SDP is used there is no easy way to tell the install completes. This means the tech using the installer will not know when to restart the computer.
2. It does not provide an update option at the end so full install to save network bandwidth does not easily complete the process.
3. The with GUI option does not really provide a GUI

The options of install autoupdate with group path for the console seems to be the only choice I have that would address the failed update or notice of completeness at the end of the install. 

Yet that would not be a good solution for installs that take place off campus.

I hope to learn how you and others work with this Sophos solution to meet the following:

• Off site full install of Sophos
• on site install of Sophos

Thanks,
Doug

Hi Doug,

I think QC covered this pretty well, and just to add to that and address your specific points.

See my answers below

VCU said:

• When an installer from SDP is used there is no easy way to tell the install completes. This means the tech using the installer will not know when to restart the computer.
  •  The tech using the installer can tell when it completed successfully in a number of ways actually: bootstrapper logs (%temp% folder), msi logs (Windows temp directory), Windows Event Viewer, there is also a visual Windows/Toast notification when installation is complete. The reboot might be required upon successful updates, this can also be verified locally on the client in the Sophos Endpoint Security and Control -> Updating->View Updating log. If a restart is required, you will see a warning in there advising on this.
• It does not provide an update option at the end so full install to save network bandwidth does not easily complete the process.
  • SDP DOES provide the option to include the full package or get them via AU. It also provides ways to configure updating using RMS or manually to specify the Update locations.
• The with GUI option does not really provide a GUI
  • If you mean here the Installation type, the options actually provide the following: 
    • silent - no GUI, silent install
    • non-interactive - GUI showing progress with no Cancel option
    • interactive - GUI showing progress with Cancel option

    There are no other configurable options since the design of the tool is to provide "no-configuration-required packages". You could use the standalone installer if you are looking for this.

VCU said:

• Off site full install of Sophos
• on site install of Sophos

As explained, SDP should allow you to configure full packages for both of these scenarios.

Here is a detailed KB on SDP: https://www.sophos.com/en-us/support/knowledgebase/67504.aspx

and here is one on setting up remote/home users: https://www.sophos.com/es-es/support/knowledgebase/63182.aspx 

Please let us know if you had any additional questions.

Good day

V

Hello Doug and V,

V said: It also provides ways to configure updating using RMS or manually
[^o)] IMO this has to be taken with a little bit more than a grain of salt (I might be wrong).

Let me first recap how an install is performed:
setup.exe notes the location it is running from. It prepares the information necessary for the install (like which components should be installed) then runs the AutoUpdate installer from the subdirectory named \sau. setup.exe does not install any of the other components, this is done by AutoUpdate (therefore you can't really tell when the "installation" is complete). To do its work AutoUpdate needs the update location - by default setup sets it to its own location. Note that once AutoUpdate is active it runs asynchronously.

SDP offers a number of options, I'll mention only those applicable here: include in the package or download, with or w/o RMS, and specification of the update location(s). Not all combinations give consistent and expected results though.
Include: In order for include to work AutoUpdate (AU from now on) must perform the first update (actually the install of the components) from the temporary directory extracted from the package. This works but doesn't set the actual update location. If you specify one or two locations with SDP they are set by the install script - 45 seconds after completion of the AU installation the locations are set. The result is that AU attempts to install from the remote location instead of the package_temp. In case there's no network SAV (and other components) are not installed. Thus you can't perform a full install from the package and then set the location for updates (though with some additional logic in the install script -which you can't modify - it should be possible).
RMS: If RMS is installed it is assumed that it fetches the appropriate updating policy. The product won't update though before the endpoint has successfully registered (and additionally received a policy, i.e. it is in a group other that Unassigned) - thus an RMS connection must be possible for off-site endpoints. I assume that AU "freezes" the update locations for the duration of a cycle thus the initial install would always be from the package.

@Doug: Management should be aware that an SDP package would need an additional wrapper to provide the functions of your custom solution. SDP is a convenient way to build no-questions-asked packages. For on-site I'd just Configure AU to download components. For bandwidth-friendly full packages please see above.

HTH

Christian

Hi Christian and V,

I had hoped the Sophos installer design had improved since 2006. It appears the Sophos installer design has not changed since 2006. I had the challenge of manually packing all the files together and providing a GUI installer for the managed Sophos antivirus solution since 2006. I was tasked in supporting over 30,000 end users, many with no computer technical skills. Now we have moved to a different design which places me into a position of providing Sophos to computer technical staff for installing without the complex installer design I have been using in the past.

Below is what I have learned from your responses. Let me know if this is correct.

1. The Sophos Deployment Packager tool "SDPT" is the only automated solution Sophos provides for creating a Sophos for Windows installer.
2. The SDPT provides two options; 1,full install with no policy or update which relies on post install policy from console or 2, install only the update component which pulls the 140MB plus software over the network.
3. The SDPT provides no installer GUI, provides no easy way to automatically tell if the installation is complete, and does not do an automatic update on completion.
4. The option to manually put together all the Sophos files and extracted policies to create a custom installer is completely left to the customer to make. 
5. The manual process requires creating two separate folders of example "ESXP" with 17 subfolders and 122 files and "SXML" with 130 subfolders  and 1,163 files that need to be copied together and provided into an installer with a batch file or script to run the commands for the install.

What batch file or VB script solutions have others used to install Sophos for Windows?

Thanks,
Doug

Hello Doug,

my previous response was somehow exaggerated. The perceived shortcomings are by design, the design is not arbitrary though. It's based on AutoUpdate (AU) being responsible for installing and updating all components. There are (mostly undocumented) interfaces which provide the information you see on the local GUI. Providing an installation script using these interfaces would disclose them - apparently Sophos doesn't want to do this for whatever reasons.

As to your points:

1. Correct AFAIK
2. If full means including RMS then you can't configure the update policy (one might think that sauconf.xml could be used but it is applied when AU is initially installed thus the remaining components would be downloaded). IMO setting the locations from the package's script (as with a non-managed install) should be safe (in the worst case you endpoint would be non-compliant) but I might have missed an important point here.
3. Several points here [:)]. Which functionality should the GUI provide, component selection? Clearly not the updating location and credentials. The installation is complete when AU has successfully completed its first updating cycle. As said this information is only available via undocumented interfaces or the icon hover message and the local SESC GUI.
   The installation does update (a downloaded installation is of course up-to-date), for a managed install only after RMS has received a policy though. This requires not only an RMS connection but also use of the -g GroupPath parameter.
4. and
5. I have to be careful here. Even in time of Gigabit connections, omnipresent streaming, and social (multi)media bandwidth seems to be an issue even for companies. A one-time 100-200MB shouldn't be an issue on a decent LAN but obviously it is. The basic procedure is running setup.exe from the CID or a local copy. The challenge is to specify the location for subsequent updates which has to be done after AU has completed the installation. Assuming mainly managed installs RMS should take care of this. For (larger) existing customers deploying AV is often part of the provisioning process, usually on the LAN, minimal exposure, and a shutdown (thus a reboot) before the computer is delivered. There's a number of deployment methods and a sophisticated installer might not suit anyway.

I've already mentioned what we use, if you want more info (there isn't much) or discuss some undocumented things (me? I don't know any) feel free to PM me.

Christian