Sophos Anti Virus Service And Ghost

[6Foot2]

We use Sophos as our Anti-Virus solutions and Symantec Ghost 7.5 to image the stations. When the station image has been completed and the new image is sent to the station I invariably have to go to each station in turn to modify the Sophos Anti-Virus service logon properties (see attached picture) It is always set to logon with 'This account' (NT AUTHORITY\LocalService) no natter how I prepare the image. This works fine on the virus detection side of thing as far as I can tell, but gives problems when the station is reporting back to Sophos Console. When I adjust this setting to logon with 'Local System account' the issue is resolved.

 

Sophos details: Sophos Enterprise Console Version: 2.0.0.1447

Sophos Anti-Virus version: 6.0.5

 

Windows details: Windows XP Pro SP2: All security patches upto date.

 

How can I prepare the images so that I do not have to go through this song and dance evey time I re-image?

[limbo]

Could you instead create the image without Sophos and then set it to install when it is first booted up? This way if ever they make a major change to the software (like the one earlier in the year) then it will not effect the ghost image.

 

We do not use Ghost anymore to set up our machines, but even when we did Sophos was always an "afterwards" install just to make certain it was up to date.

 

We push it out through GP so that any PC that connects to the domain has no choice but to install it no matter where the OS got installed.

[6Foot2]

Could you instead create the image without Sophos and then set it to install when it is first booted up?

 

Yes this is a possibility, and one I think I may have to go with. But not yet, as we are in the middle of some major network changes and I don't want to add more complications to a job which is already badly screwed. As I said in the original post Sophos works well enough, I think, it's just reporting I am worried about, So I will limp on am I am for now.

[plexer]

Is allocating it via a gpo better than pushing it out with the sophos console?

 

I suppose it would be because no matter when a pc was rebuilt then it would always install the sophos msi.

 

Use the sophos em library to keep the interchk share up to date and use gpo to install the software from that share.

 

Ben

[limbo]

we find the GPO better because it needs no intervention - when we reinstall a PC (which is pretty rare these days) or put a new one on the network (90 this half term and counting) you see it install just before the login box comes up so you know it is done.

 

What we actaully do is install just sophos update at this point, and then that does the rest.

 

Then a once a week check on the sophos console to make sure everything is working to double check.

[john]

Sophos's KB has some info on Ghosting / Imaging machines iwth Sohpos. Each machine is issues with a GUID from RMS on the Sophos Server, each machine you ghost, even when SID changing still has that same GUID, so the console sees all your machines as identical machines and goes OMG AAARGH!!!!! Basically its 2 reg keys to delete and a couple of files if I remember correctly from when I used to do it that way. I now just deploy straight from the console, much easier.

[Lord_Edam]

the batch file I use to fire off sysprep includes these lines to cure the duplicate sophos GUID problem (it then goes on to copy the c:\sysprep folder depending on which mini-setup I want it to run when it reboots)

 

net stop "Sophos Anti-Virus"
net stop "Sophos Anti-virus Status Reporter"
net stop "Sophos Message Router"
net stop "Sophos Agent"
net stop "Sophos AutoUpdate Agent"
net stop "Sophos AutoUpdate Service"

reg delete "HKLM\Software\Sophos\ALC Agent\Private" /v pkc /f
reg delete "HKLM\Software\Sophos\ALC Agent\Private" /v pkp /f
reg delete "HKLM\Software\Sophos\Messaging System\Router\Private" /v pkc /f
reg delete "HKLM\Software\Sophos\Messaging System\Router\Private" /v pkp /f
reg delete "hklm\Software\Sophos\Remote Management System\ManagementAgent\Private" /v pkc /f
reg delete "hklm\Software\Sophos\Remote Management System\ManagementAgent\Private" /v pkp /f
del "c:\Program Files\Sophos\Sophos Anti-Virus\cidsync.upd"

[mattpant]

Hi Folks,

 

It appears that we are getting the same issue with our Ghost Images and Sophos not talking to the Remote Server correctly (i.e. Seeing all the stations as the same machine!)

 

Do you know if I can use the batch file that "Lord_Edam" has provided on computers AFTER they have all been sysprep'ed and working. I.E. can I run it from a GPO as a Startup or Login script on the computers all will this cause further problems once the machines are connected to the domain.

 

If so, are there any other methods of fixing this problem VIA a script/GPO to all our machines that have been imaged without having to go to each machine and re-install SOPHOS.

 

Thanks

 

Matt

[mattpant]

I tried it out anyway and it seems to be working OK. set it up as a computer startup script, but just added at the end of the script some NET START commands to kick the services back in again!

 

Cheers

 

Matt