JRA Posted January 13, 2020 Posted January 13, 2020 Okay, long story short this was given to a tech here who went long-term sick and swore blind it was all getting sorted. Just discovered he did next to nothing on it. I have tried to just run the new installer, tried to reboot then do it, tried to remove the old one then reboot then install the new one. I've tried GP, WPKG, PDQDeploy and I have had absolutely no luck for days getting this STUPID THING to install the new Sophos on my clients. Does anyone have a bulletproof and foolproof way of sorting this out?? Thanks so much for anything.
foofighterjim Posted January 13, 2020 Posted January 13, 2020 Sophos Endpoint? We have a copy of the exe with a batch script, each boot our clients check for the presence of the Endpoint Client and install if it isn't there, we then use GP to push it out: @echo off SET MCS_ENDPOINT=Sophos\Management Communications System\Endpoint\McsClient.exe IF "%PROCESSOR_ARCHITECTURE%" == "x86" GOTO X86_PROG IF NOT EXIST "%ProgramFiles(x86)%\%MCS_ENDPOINT%" GOTO INSTALL exit /b 0 :X86_PROG IF NOT EXIST "%ProgramFiles%\%MCS_ENDPOINT%" GOTO INSTALL exit /b 0 :INSTALL \\\SophosEndpointSetup.exe --quiet Popd Our exe and batch file are in the NETLOGON folder, I'm not saying this is the best way but it is working for us. Remember that in order to remove Sophos Endpoint you will need to disable tamper protection for the client via Sophos Central first. 1
howartp Posted January 13, 2020 Posted January 13, 2020 Are you using the https://www.sophos.com/en-us/support/documentation/sophos-central-migration-tool.aspx 1
JRA Posted January 13, 2020 Author Posted January 13, 2020 Are you using the https://www.sophos.com/en-us/support/documentation/sophos-central-migration-tool.aspx I wasn't, no. I can't seem to sign in with my SCA account to download that tool though. Heavens this is a CHORE... Thanks though everybody.
XiJ Posted January 13, 2020 Posted January 13, 2020 You’ll not thank me for saying this but I found to the upgrade to Sophos Central the easiest of any AV deployment I’ve done before. The downloaded installed with the script just took care of everything, including removing the old Sophos client. The batch file runs in a GPO and deploys to all machines. I setup a local server cache and things “just work” 1
JRA Posted January 14, 2020 Author Posted January 14, 2020 Lol, I'm happy for you but this is killing me. It's so bad I can't even log into a PC here as local admin and uninstall Sophos MANUALLY (objects saying update pending) and running the new exe regardless (either doubleclicking the new exe or running a batch file with the --quiet and the --proxy switches on) plain doesn't work or the exe itself fails to download updates. I've actually know very little to have been as awkward as this. Thanks Sophos...
XiJ Posted January 14, 2020 Posted January 14, 2020 Have you spoken with Sophos? The might be able to help. The exe does need parameters and needs to be called from a script / command line AFAIK 1
JRA Posted January 14, 2020 Author Posted January 14, 2020 Hi - I have yes. Not heard back yet and I'll ring up tomorrow if I need. Bemoaning my bad luck atm. I need a tea... :/
JRA Posted January 14, 2020 Author Posted January 14, 2020 Okay had a little discovery... It looks like the OLD Sophos is somehow reinstalling following the restart. Now the old server is back on (that started the batch file actually uninstalling it too) the uninstall happens, then reboot, then the old version reinstalls itself. Is there any capacity within Sophos itself to do this or am I pulling scripts apart? ...Might it even be worth renaming SAVXP on the old server to see?
JRA Posted January 16, 2020 Author Posted January 16, 2020 Latest from Sophos is they want me to visit EVERY SINGLE PC ON THE NETWORK and boot it into safe mode, then disable tamper protection on it. Whiskey Tango Foxtrot??? Did anyone else have this much misery with it?
Guest Guest Posted January 16, 2020 Posted January 16, 2020 I just disabled tamper protection in enterprise console and pushed the Installer out via SCCM
JRA Posted January 16, 2020 Author Posted January 16, 2020 I just disabled tamper protection in enterprise console and pushed the Installer out via SCCM I don't even seem to have tamper protection on at all. Lol, I'm happy for you though! Wish I'd had it go that way.
JRA Posted January 16, 2020 Author Posted January 16, 2020 We deploy via PDQ [ATTACH=CONFIG]56372[/ATTACH] Ooohhh... I'm going to set this up as you have and get a sandwich and see. Thanks MUCH for that!!
Cache Posted January 16, 2020 Posted January 16, 2020 If it's reinstalling everytime, do you have Enterprise console on the server and that is linked into AD and automatically pushing out or some other script that's pushing it there on startup? Using the Cloud Migration Tool as mentioned above did make it really easy to do, only a few failed machines that needed a manual visit to sort. 1
NetworkNinja Posted January 16, 2020 Posted January 16, 2020 I have had to install sophos onto every machine manually. I tried doing it via sccm but it wouldn't work. I think it's because it required Internet connection to install and our users dont get Internet until they are logged into the computer. 1
JRA Posted January 17, 2020 Author Posted January 17, 2020 I have had to install sophos onto every machine manually. I tried doing it via sccm but it wouldn't work. I think it's because it required Internet connection to install and our users dont get Internet until they are logged into the computer. Ouch... :/
sychosis Posted February 21, 2020 Posted February 21, 2020 I have experienced the joy of Sophos migration tool this week, what a piece of wank. Do Sophos not employ network admins, do all there staff have admin rights to pcs. I am now at the point where I am going to have to login remotely to 150 pcs as a network admin to start the script running. Satan help me when we have to migrate the secondary school of over 500 pcs. 1
howartp Posted February 21, 2020 Posted February 21, 2020 I don't understand either of these posts. The migration tool worked fine for us on 900 PCs, with no users needing to be logged on so the issue of staff having admin rights is a moot point. If it needs internet access, then add auth bypass rules on your firewall/filter for sophos destinations, so that no auth is needed.
andy_b Posted February 21, 2020 Posted February 21, 2020 We had about a 95% success rate with the migration tool. The 5% were mostly the old version of Sophos refusing to un-install correctly.
sychosis Posted February 21, 2020 Posted February 21, 2020 So I finally got it doing something, now I have installation errors. Its not a quick tool.
JRA Posted February 22, 2020 Author Posted February 22, 2020 This weekend (my fourth or fifth doing this I don't remember now) I'm getting errors where it can't see Sophos central so just refuses to install. This is out of the blue, it's just stopped working. I wrote the strongest email I possibly could to Sophos and will need them on-site Monday. This is atrocious garbage. If I put out a failure of an update this bad out into the world I should deservedly be fired on the spot. HOW can this be alright???? If I don't get an installer I can automate and removes/updates/installs perfectly and silently by Monday afternoon I am going to dial that ****ing support number every minute throughout the week until someone fixes this. I haven't been this angry at anything in so long. I hope Sophos read this. I want any way out of your useless software I can get and I want my weekends back.
Cache Posted February 22, 2020 Posted February 22, 2020 (edited) So, have you allowed all the ports/urls listed in this KB artical whitelisted access through your firewall/filter? https://community.sophos.com/kb/en-us/121936 Have you setup an Update Cache on one of your servers, that way it only registers with the dashboard intially and should pull the installation files from your onsite server? https://community.sophos.com/kb/en-us/122577#Setup I'm not sure why it's such a big issue, as with others who've posted above for us it just worked apart from an odd computer with a failed/corrupted installation for some reason. While Sophos isn't perfect, the migration was such an easy process to do using the tool. I also did it during working hours/while users were using the machines and that also caused no issues. It just requires a reboot, as it would with initial installation anyway, to finish installation as with any other computer update. Edited February 22, 2020 by Cache 1
JRA Posted March 3, 2020 Author Posted March 3, 2020 So, have you allowed all the ports/urls listed in this KB artical whitelisted access through your firewall/filter? https://community.sophos.com/kb/en-us/121936 Have you setup an Update Cache on one of your servers, that way it only registers with the dashboard intially and should pull the installation files from your onsite server? https://community.sophos.com/kb/en-us/122577#Setup I'm not sure why it's such a big issue, as with others who've posted above for us it just worked apart from an odd computer with a failed/corrupted installation for some reason. While Sophos isn't perfect, the migration was such an easy process to do using the tool. I also did it during working hours/while users were using the machines and that also caused no issues. It just requires a reboot, as it would with initial installation anyway, to finish installation as with any other computer update. Sorry took me so long to reply to this but yes I tried ALL of that and more, and more than Sophos support (who have not replied to my ticket) suggested in the first place before telling me I needed to visit each PC. This has been a nightmare and has had huge knock-ons to my personal life too in the time it's taken away from me.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now