Sophos V5.2 advice needed.

[Kyle]

I was wondering if any one know how to do this or if it is possible. We are testing the new version of Sophos on a test network with around 5 laptops connected to it. We have set up the EM Librabry and EM COnsole and deployed the software. All is well so far, when a student user logs on I know they only get certain access to the Sophos Options by right clicking the shield near the clock or by using the 'start menu>programs route.

 

Is there any way we can stop them having any access by right clicking the sheild near the clock. I can forsee all sorts of problems withthem messing about with certain settings

 

Or do you leave them acces to this, advice needed please.

[ChrisH]

I have had trouble with applications applet things in the tray before. I know disable the tray for students. This can only be done in XP.

[Kyle]

Where is the setting to disable the tray in GP?

[ChrisH]

Have a scan through this spreadsheet you will find it easy in there.

[krisd32]

you can set groups in AD for access to the sophos program i think ou have sophos user, sophos administrator etc... if you take the appropriate groups out of membership to the sophos groups this should either allow or dissalow them access to certain parts of the sophos anti virus program, if set up correctly they shouldn't be able to edit the auto update settings

 

cheers

kris

[IanB]

I think that the groups set up are local on each machine, with users automatically added when the client is installed.

To control user access from AD, I run the AddSophosGroups.cmd script listed below on the DC to create domain groups.

Then I run ModSophosGroups.vbs script, via group policy PC startup script on each workstation to remove the sophos default groups from the local groups. Then I can control access in AD by placing users in the domain groups.

 

ModSophosGroups.vbs:

'Modifies local Sophos Groups on a domain

'=============================================

on error resume next

 

dim sh, key, strComputer, DomainString, LocalString, fso, textfile

 

Set fso = WScript.CreateObject("Scripting.FileSystemObject")

set textfile = fso.CreateTextFile ("C:\Program Files\Sophos\GroupMods.txt",2,true)

set sh = Wscript.CreateObject("Wscript.Shell")

 

'get domain name

key = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon\CachePrimaryDomain"

Domain = sh.RegRead (key)

 

strComputer = "."

 

 

' Add group to Local group and remove

DomainString = "Domain Admins"

LocalString = "SophosAdministrator"

Set objGroup = GetObject _

("WinNT://" & strComputer & "/" & LocalString &",group")

objGroup.Add ("WinNT://" & Domain & "/Sophos " & DomainString)

objGroup.Remove ("WinNT://" & Domain & "/" & DomainString)

textfile.WriteLine LocalString & "Group Modified"

 

 

' Add group to Local group and remove

DomainString = "Domain Users"

LocalString = "SophosUser"

Set objGroup = GetObject _

("WinNT://" & strComputer & "/" & LocalString &",group")

objGroup.Add ("WinNT://" & Domain & "/Sophos " & DomainString)

'objGroup.Remove ("WinNT://" & Domain & "/" & DomainString)

textfile.WriteLine LocalString & "Group Modified"

 

 

' Add group to Local group and remove

DomainString = "Domain PowerUsers"

LocalString = "SophosPowerUser"

Set objGroup = GetObject _

("WinNT://" & strComputer & "/" & LocalString &",group")

objGroup.Add ("WinNT://" & Domain & "/Sophos " & DomainString)

objGroup.Remove ("WinNT://" & Domain & "/Domain Users")

textfile.WriteLine LocalString & "Group Modified"

 

AddSophosGroups.cmd

 

@echo off

rem creates domain groups for Sophos Management

net group "Sophos Domain Admins" /add /comment "member of all local SophosAdministrator groups" /domain

net group "Sophos Domain Users" /add /comment ""member of all local SophosUser groups" /domain

net group "Sophos Domain PowerUsers" /add /comment ""member of all local SophosPowerUser groups" /domain

 

My Sophos V5 deployment is still in development like yours, but I think you should be ok with these scripts

Good luck

modsophosgroups.vbs.txt

adddomaingroups.cmd.txt