How to install Endpoint Security and Control manually on networked computers

Note: This article only applies to computers on which you are installing Endpoint Security and Control (including Sophos Anti-Virus and Sophos Client Firewall and Sophos NAC, if desired) for the first time. It does not apply to computers where you are upgrading installed software.

What to do

On operating systems where you must manually install Endpoint Security and Control or Sophos Anti-Virus, you can either:

• go to each computer in turn, log on as local administrator (inglés), and install it, or
• run the installation program automatically from a script, or with a program like Microsoft SMS. This is particularly useful with large numbers of computers.

Contents

1. Manual installation
2. Scripted and automated installation
3. Computers not always on the network
   

1. Manual installation

You can protect computers by running the installation program manually from the central installation directory (CID) where EM Library places Sophos updates.

1. Checking the location of the CID
   • In Enterprise Console select the group the computers are in and click 'Updating policy'.
   • Select the operating system and click 'Configure'.
   • Make a note of the address shown.
     
     If you use Enterprise Console 3.x
     The default central installation directory for each operating system is
     
     Windows 2000/XP/2003: \\Servername\InterChk\SAVSCFXP
     Windows NT: \\Servername\InterChk\ESNT
     Windows 95/98/Me: \\Servername\InterChk\ES9X
     Mac OS X: \\Servername\InterChk\ESOSX
     Linux: \\Servername\InterChk\SAVLINUX
     
     If you use Enterprise Console 4.x
     The default central installation directory for each operating system is
     
     Windows 2000/XP/2003: \\Servername\SophosUpdate\CIDs\Sxxx\SAVSCFXP
     Windows NT: \\SophosUpdate\CIDs\Sxxx\ESNT
     Windows 95/98/Me: \\Servername\SophosUpdate\CIDs\Sxxx\ES9X
     Mac OS X: \\Servername\SophosUpdate\CIDs\Sxxx\ESOSX
     Linux: \\Servername\SophosUpdate\CIDs\Sxxx\SAVLINUX


2. Installing
   Go to each computer in turn:
   • Log on with local administrator rights.
   • Browse to the CID.
   • For a Windows computer, double-click setup.exe. You can also do a customised installation using command line parameters.
   • For a Mac OS X computer, copy the Sophos Anti-Virus.mpkg file from the central installation directory and double-click it.
   • For a Linux computer, copy the CID to your Linux environment and execute the install.sh file.
3. Further steps on Windows computers
   When installing on Windows computers, you may be prompted to enter user credentials. The account must
   • be able to log on to (browse to) the computers you want to protect
   • have read access to CIDs.
4. Further steps on Mac OS X computers
   After installation:
   • go into 'System Preferences'
   • open the Sophos Anti-Virus preferences pages
   • click the AutoUpdate tab
   • enter the user credentials.

2. Scripted and automated installation

Several knowledgebase articles describe some specialised installation scenarios in more detail:

• installing automatically with Microsoft SMS (inglés)

3. Computers not always on the network

Where computers are not always on the network, e.g. laptops that are sometimes used away from the office, you can configure them to update from an alternative source when they are away.

The alternative source can be an updates folder on a website maintained by your company, or it can be a Sophos website.

1. In Enterprise Console, select the group that contains the computers you want to protect.
2. On the toolbar, click 'Updating policy'.
3. In the 'Set updating policy for computers in the ... group' dialog, select an operating system used by computers in that group, e.g. Windows 2000/2003/XP.
4. Click 'Configure'.
5. Click the 'Secondary server' tab.
6. Enter the Address (UNC path or web address*) from which Endpoint Security and Control will fetch updates if the Primary server cannot be contacted.
7. If necessary, enter the User name and Password for an account that
   • can log on to the computers in the group
   • has read access to (can browse to) the secondary server location.
8. If the User name needs to be qualified to indicate the domain, use the form domain\username.
   
   If the roaming computer is going to need to update its anti-virus protection while not connected to the network, you should ensure that the web address you set up is accessible from outside your network.
   
   Also, if you set up a proxy, make sure that the roaming user will be able to access the proxy from outside your network.

If you access the internet via a proxy server:

1. Click 'Proxy details'.
2. In the 'Proxy details' dialog box, select 'Access the server via a proxy'.
3. Enter the proxy server Address and Port number.
4. Enter a User name and Password that give access to the proxy server.
5. If the user name needs to be qualified to indicate the domain, use the form domain\username.
6. Click OK.