Import Sophos Connect VPN profile file for all users

I deploy Sophos connect via Intune with a powershell script. I download the installer and .pro file. I then run the installer and then use Invoke-Item to invoke the profile import process.

I also have another block that allows me to deploy new profiles if I ever need to. I just place a checker file in the Sophos connect path to make sure if the powershell script ever executes again that it doesn't re-import the file.

If there is a better way, would love to hear it.

if(!(Test-Path "C:\Program Files (x86)\Sophos\Connect")){
    #URL of SophosConnect.msi
    $url = 
    $dest = 
    Invoke-WebRequest -Uri $url -OutFile $dest
    #URL of .pro config file
    $url2 = 
    $dest2 = 
    Invoke-WebRequest -Uri $url2 -OutFile $dest2
    msiexec.exe /i "c:\SophosConnect.msi" /norestart /qn
    start-sleep -s 15
    Move-Item -Path "c:\Config.pro" -Destination "C:\Program Files (x86)\Sophos\Connect\import\Config.pro"
    Invoke-Item "C:\Program Files (x86)\Sophos\Connect\import\Config.pro"
    Remove-Item "c:\SophosConnect.msi"
    New-Item "C:\Program Files (x86)\Sophos\Connect\CheckerFile.txt"
}
#Below is a handy script for updating the sophos connect client profile config. You will need to update the .txt checker file as well as the name of the connection you want removed.
if(!(Test-Path "C:\Program Files (x86)\Sophos\Connect\CheckerFile.txt")){
    $url2 = 
    $dest2 = 
    Invoke-WebRequest -Uri $url2 -OutFile $dest2
    Start-Process -FilePath "C:\Program Files (x86)\Sophos\Connect\sccli.exe" -ArgumentList "remove -n Old Profile"
    Invoke-Item "C:\Program Files (x86)\Sophos\Connect\import\NewProfile.pro"
    New-Item "C:\Program Files (x86)\Sophos\Connect\CheckerFile.txt"
}

Hi Jesse

Thanks for the response, I was thinking of a similar solution but in the end I just created a scheduled task that runs at each user login and imports the profile using sccli.exe. It's a bit messy and it will run every time a user logs in but it takes less than a second to process so I'll live with it. I also put it in the import folder so the originally logged in user gets the config right away where as others have to reboot.

Start-Process -FilePath "msiexec.exe" -ArgumentList "/i ""SophosConnect_2.2.75.msi"" TRANSFORMS=""SophosConnect_2.2.75.mst"" /qn" -Wait -WindowStyle Hidden

Start-Sleep 15

$Path = "C:\Program Files (x86)\Sophos\Connect\Config"
$Path2 = "C:\Program Files (x86)\Sophos\Connect\import"

$script = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent

If(!(test-path -PathType container $Path))
{
      New-Item -ItemType Directory -Path $Path
}

$profile = "$Path\Profile.pro"

if (-not(Test-Path -Path $profile -PathType Leaf)) {
     try {
         Copy-Item -Path $script\Profile.pro -Destination $Path -Recurse -Force -ErrorAction Stop
     }
     catch {
         throw $_.Exception.Message
     }
 }

$profile2 = "$Path2\Profile.pro"

if (-not(Test-Path -Path $profile2 -PathType Leaf)) {
     try {
         Copy-Item -Path $script\Profile.pro -Destination $Path2 -Recurse -Force -ErrorAction Stop
     }
     catch {
         throw $_.Exception.Message
     }
 }


$ShedService = New-Object -comobject 'Schedule.Service'
$ShedService.Connect()

$Task = $ShedService.NewTask(0)
$Task.RegistrationInfo.Description = 'Sophos Connect Profile Import'
$Task.Settings.Enabled = $true
$Task.Settings.AllowDemandStart = $true

$trigger = $task.triggers.Create(9)
$trigger.Enabled = $true

$action = $Task.Actions.Create(0)
$action.Path = "C:\Program Files (x86)\Sophos\Connect\sccli.exe"
$action.Arguments = "add -f ""C:\Program Files (x86)\Sophos\Connect\Config\Profile.pro"" -n ""VPN"""

$taskFolder = $ShedService.GetFolder("\")
$taskFolder.RegisterTaskDefinition('Sophos Connect Profile Import', $Task , 6, 'Users', $null, 4)

Hi Jesse

Thanks for the response, I was thinking of a similar solution but in the end I just created a scheduled task that runs at each user login and imports the profile using sccli.exe. It's a bit messy and it will run every time a user logs in but it takes less than a second to process so I'll live with it. I also put it in the import folder so the originally logged in user gets the config right away where as others have to reboot.

Start-Process -FilePath "msiexec.exe" -ArgumentList "/i ""SophosConnect_2.2.75.msi"" TRANSFORMS=""SophosConnect_2.2.75.mst"" /qn" -Wait -WindowStyle Hidden

Start-Sleep 15

$Path = "C:\Program Files (x86)\Sophos\Connect\Config"
$Path2 = "C:\Program Files (x86)\Sophos\Connect\import"

$script = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent

If(!(test-path -PathType container $Path))
{
      New-Item -ItemType Directory -Path $Path
}

$profile = "$Path\Profile.pro"

if (-not(Test-Path -Path $profile -PathType Leaf)) {
     try {
         Copy-Item -Path $script\Profile.pro -Destination $Path -Recurse -Force -ErrorAction Stop
     }
     catch {
         throw $_.Exception.Message
     }
 }

$profile2 = "$Path2\Profile.pro"

if (-not(Test-Path -Path $profile2 -PathType Leaf)) {
     try {
         Copy-Item -Path $script\Profile.pro -Destination $Path2 -Recurse -Force -ErrorAction Stop
     }
     catch {
         throw $_.Exception.Message
     }
 }


$ShedService = New-Object -comobject 'Schedule.Service'
$ShedService.Connect()

$Task = $ShedService.NewTask(0)
$Task.RegistrationInfo.Description = 'Sophos Connect Profile Import'
$Task.Settings.Enabled = $true
$Task.Settings.AllowDemandStart = $true

$trigger = $task.triggers.Create(9)
$trigger.Enabled = $true

$action = $Task.Actions.Create(0)
$action.Path = "C:\Program Files (x86)\Sophos\Connect\sccli.exe"
$action.Arguments = "add -f ""C:\Program Files (x86)\Sophos\Connect\Config\Profile.pro"" -n ""VPN"""

$taskFolder = $ShedService.GetFolder("\")
$taskFolder.RegisterTaskDefinition('Sophos Connect Profile Import', $Task , 6, 'Users', $null, 4)

That will work as well. I try to avoid deploying scheduled tasks. You should take a look at Intune's native ability to deploy Powershell scripts. It's also nice because any time you update the script, it redeploys to all users.