Upgrading Sophos

[Michael]

Hello all,

 

Birmingham schools (and many others) will shortly need to upgrade to Sophos Enterprise Console 4.5, but here's how to do the complicated bits:

 

Firstly if you're running an older version of MSDE 2000, you need to upgrade to MSDE 2000 SP4: SQL2000.MSDE-KB884525-SP4-x86-ENU.EXE (78.5MB)

 

Extract to the default directory, then from the command prompt run:

 

CD C:\SQL2KSP4\MSDE\

 

then

 

setup /upgradesp sqlrun INSTANCENAME=SOPHOS /L*v c:\msdelog.txt

 

You should restart your server after the upgrade.

 

Proceed to download and install SQL 2008 SP2 Express - SQLEXPR_x86_ENU.exe (100.5MB)

 

When prompted, choose the correct instance EG: SOPHOS and MSDE 2000 will be upgraded to SQL 2008.

 

At this point you should be ready to upgrade to Sophos Enterprise Console 4

[andy_b]

Do you know what "NOTE: PLEASE DO NOT USE THESE NOTES TO INSTALL SOPHOS ENTERPRISE CONSOLE ON A

WINDOWS 2008 SERVER - PLEASE CONTACT THE LINK2ICT SERVICE DESK FOR FURTHER ADVICE" found in the guidance notes is in reference too? I'm still waiting for Link2ICT to get back to me with an answer.

[Michael]

I haven't installed Sophos EC 4.5 on 2008 Server, but I'm speculating it's maybe slight differences with the setup process and/or the additional security in 2008 Server creating an issue.

 

Generally speaking however I have no reason to believe installing Sophos EC on 2003 and 2008 to be that different.

[Dom_]

Not had any issues just wiping the old install and installing 4.5... Didn't they send an email -out a few weeks ago stating that you don't need to upgrade any more, as the 9.5 update will be pushed via 3.1 soon?

[andy_b]

Not had any issues just wiping the old install and installing 4.5... Didn't they send an email -out a few weeks ago stating that you don't need to upgrade any more, as the 9.5 update will be pushed via 3.1 soon?

 

I'm just going by this: http://kb.link2ict.org/display/4/kb/article.aspx?aid=1867

[ricki]

HI

 

The only problem I had with upgrading the console was the upgrading of the sql to 2008. After numerous attempts of the upgrade of sql 2005 to 2008 I got fed up and checked to see if the server had other databases in it and uninstalled sql 2005 and then installed the console and it was a doddle if a little time consuming. The upgrade of the clients however took a little more time and 268 out of 375 refused to upgrade on the first attempt and we had to wipe the old sophos manually and reinstall from about 50.

 

Richard

[Michael]

I don't think that's right, as EC 3.1 is still deploying 7.x to workstations.

 

Once you've changed to EC 4.5 (which looks pretty much the same), it'll deploy 9.5 to workstations.

 

You have until the end of March 2011 to upgrade, however I agree with comments above. It's not a quick process at all.

[Michael]

I thought I'd post back with some updates. I've upgraded several servers so far (on different domains), but none of them have gone smoothly!

 

After performing the steps in post number 1 I performed these steps to get things working:

 

1. Uninstall Sophos Enterprise Console 3.1 (anything Sophos in Add/Remove Programs).

 

2. Open up Regedit, take an export of Sophos under

 

HKEY_LOCAL_MACHINE > Software > Sophos
HKEY_CURRENT_USER > Software > Sophos

 

then delete these entries completely.

 

3. Open up Active Directory and delete any Security Groups and Users associated with Sophos.

 

4. Reboot the server.

 

5. Install Sophos Enterprise Console 4.5.

 

6. All will appear well, apart from the Sophos Management Service will not start and as a result the console will not appear.

 

7. Open up a command prompt and enter:

"%programfiles%\sophos\Enterprise Console\UpgradeDB.exe" -sourceVersion=3

 

8. Open up regedit and create the following key:

HKEY_LOCAL_MACHINE\Software\Sophos\Enterprise Manager

 

9. Start the Sophos Management Service and it should work successfully.

 

10. Open up Enterprise Console 4.5 and make the necessary tweaks to your policies. Force the policies on your workstations and all being well, most should upgrade successfully.

 

11. Create a startup script and call it SAVInstall.bat. Modify the changes for your network below:

 

@ECHO OFF
REM --- Check for an existing installation of Sophos AutoUpdate
if exist "C:\Program Files\Sophos\AutoUpdate\ALsvc.exe" goto _End
if exist "C:\Program Files (x86)\Sophos\AutoUpdate\ALSVC.exe" goto _End
REM --- Deploy to Windows 2000/XP/2003
\\SERVERNAME\SophosUpdate\CIDs\S000\SAVSCFXP\Setup.exe -updp "\\SERVERNAME\SophosUpdate\CIDs\S000\SAVSCFXP" -user "DOMAIN\ADMINISTRATOR" -pwd "PASSWORD" -mng yes
REM --- End of the script
:_End

 

12. Open up Active Directory and open the Default Domain Policy

 

Navigate to: Computer Config > Windows Settings > Scripts (Startup/Shutdown) > Startup > Show Files

 

Paste SAVInstall.bat in here, then close the window. Click Add > Browse > and select SAVInstall.bat

 

That's it, other than monitoring your workstations accordingly

[Little-Miss]

WTF!? I've been ignoring this so far this week as ive been faffing about other things....but thats really put me off now!!!

[themightymrp]

My procedure was almost exactly the same as Michael's above. The Management Service would not fire up after the upgrade and I had to do all that updatedb stuff. However mine was slightly different in that I was going from EC 3.1 to 4.5 which meant I had no direct upgrade path. I had to upgrade to 4.0 and then 4.5 It took ages to get this sorted and I'm also still having problems with some clients not upgrading to 9.5. Out of near 700 machines only 200 upgraded without issue, another 420 upgraded after I made a complicated startup script to force the install and the remaining 70 or so keep failing on downloading updates!!

 

That said I am running this on Server 2008 with SQL 2008 which is probably where the extra hassle has come in.

 

Sophos really sucks when they release new versions! Aaaarrrrrgggghhhh!!!!!

[Michael]

Does anyone have an up-to-date removal script for Sophos v7.x or later? I have an older removal script which isn't working fully. Many thanks.

[themightymrp]

This is one I currently use:

 

@echo off

echo "Starting Removal of Sophos"

 

msiexec.exe /x "c:\program files\sophos\autoupdate\cache\savxp\sophos anti-virus.msi" /q /norestart

msiexec.exe /x "c:\program files\sophos\autoupdate\cache\rms\sophos remote management system.msi" /q /norestart

msiexec.exe /x "c:\program files\sophos\autoupdate\cache\sau\sophos autoupdate.msi" /q /norestart

 

echo "MSI's removed"

 

reg delete HKLM\Software\Sophos /f

reg delete HKCU\Software\Sophos /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Agent" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SavService" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SAVAdminService" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Agent" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Service" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Certification Manager" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos EMLib Update Agent" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SEMscheduler" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Management Service" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sophos Message Router" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SQLAgent$SOPHOS" /f

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\MSSQL$SOPHOS" /f

reg delete "HKLM\System\CurrentControlSet\Services\Eventlog\Sophos" /f

 

echo "Registry cleaned up"

 

rmdir "c:\program files\sophos" /s /q

 

echo "Sophos folder removed"

 

"c:\windows\system32\gpupdate" /force /boot

 

echo "Group Policy updated"

echo "Rebooting"

[Little-Miss]

I just cant bring myself to start this, but Link2ICT are charging £200 for the pleasure!

[Michael]

Thanks themightymrp, I'll give that a whirl.

 

@Little Miss - if you get stuck upgrading Sophos you know where to find me

[digone52]

Hi. I've attempted an upgrade in my test environment from EMC 3 to 4.5, which failed, and also tried a copy of our live server as suggested by a sophos support person, which also failed. When I told him this, he gave me the impression that this often happens, and advised me to start from scratch, which is what we are going to do.

 

Now, if you start from scratch, you need to fully uninstall and reinstall the product on all workstations, due to the certificates.

 

I thought I'd do this as a start up script - thinking that it'd be a dead simple job just to uninstall and reinstall the product. No go. Just to start with, the Sophos update service is active on start-up, and in my experience refuses to be stopped, uninstalled, or well, anything really until the update is finished. I think that it might really hack off our users if their PCs were unusable because the pc was sitting there running a script which was waiting for the update service to stop.

 

I then considered doing this as a shutdown task, but if a laptop has sophos uninstalled on shut down and then reinstalled in a startup script, if the PC is a laptop which is taken home between these activities, then the PC is running without AV protection for a time.

 

I'm still considering what to do for the best.

Edited February 4, 2011 by digone52

[eduabncs]

Does anyone have an up-to-date removal script for Sophos v7.x or later? I have an older removal script which isn't working fully. Many thanks.

 

Michael....My usual response here! Call the servicedesk, ask and you shall receive! ;-)

[ricki]

Hi

 

Once the console is running install it from the console.

 

Richard

[Michael]

I just cant bring myself to start this, but Link2ICT are charging £200 for the pleasure!

 

If you follow my guide and you're currently running Sophos EC 3.1 it should work as I describe. I've upgraded multiple schools with success.

 

Hi. I've attempted an upgrade in my test environment from EMC 3 to 4.5, which failed, and also tried a copy of our live server as suggested by a sophos support person, which also failed. When I told him this, he gave me the impression that this often happens, and advised me to start from scratch, which is what we are going to do.

 

There is no direct upgrade from 3.1 to 4.5 which is why it's failing. If you follow my guide I do fully uninstall Sophos EC. You don't actually lose anything as information is stored within the SQL database.

 

Now, if you start from scratch, you need to fully uninstall and reinstall the product on all workstations, due to the certificates.

 

I thought I'd do this as a start up script - thinking that it'd be a dead simple job just to uninstall and reinstall the product. No go. Just to start with, the Sophos update service is active on start-up, and in my experience refuses to be stopped, uninstalled, or well, anything really until the update is finished. I think that it might really hack off our users if their PCs were unusable because the pc was sitting there running a script which was waiting for the update service to stop.

 

Once you've tweaked and updated the new Sophos update policy in 4.5, simply force this on all your workstations. Over time they'll then update from \\SERVERNAME\SophosUpdate instead of \\SERVERNAME\Interchk or alternatively, highlight a group of workstations, right click and select 'Protect Computers'. This'll do all the uninstalling and re-installing for you. I haven't used any uninstall scripts, just an updated script to speed up the process deploying Sophos 9.5.

[TechSupp]

Got to install Sophos on a new server (2008) in a couple of weeks, I'm presuming that as its a new install I should not need to be worried about the previously mentioned issues? Done a few from 3.1 to 4 on 2003 by total uninstall then reinstall and worked fine just wondering if any issues particularily with 2008 install?

[jonbreen]

Thank you Michael, after spending two days trying to upgrade I found your instructions and they worked. The only difference I had to make was making sure that no groups were using 'Legacy updating' - it took me ages to find out what the whole "Em library is still being used" message was all about especially since I had already uninstalled it!

[Michael]

Thank you Michael, after spending two days trying to upgrade I found your instructions and they worked.

 

That's no problem at all

[Mullaney18]

Has anyone come across this; I've finally updated the EC, but when I click "protect computers" the endpoints download packages and install what looks to be EC 9.x but restarts its self and starts again as 7.6.

 

Any clues?

[Michael]

Has anyone come across this; I've finally updated the EC, but when I click "protect computers" the endpoints download packages and install what looks to be EC 9.x but restarts its self and starts again as 7.6.

 

Any clues?

 

Yes I have only seen this behaviour with RM CC3. Even with the latest removal script it didn't work, so I ended up re-imaging quite a few machines. I haven't had this problem on any vanilla network...

[rbance]

Has anyone actually called Sophos for help? I did this last year and there are a few issues to work through, the main one is to do with upgrading to a 64 bit Server OS. I would jump to 2008 R2 at this point in time and bypass 2008 altogether.

You need to go from 3.5 to 4.0 first then to 4.5, but 4.0 is not supported on 64 bit OS. Here is the odd thing, you can get 3.5 working on a 64 bit OS though....

 

It is better to start from scratch with this product I have found.

 

btw...anyone used the Application Control? it seems to work well....

[TechSupp]

Yes had that, ended up uninstalling manually, then running the MS MSI clenup utility, it then went on fine. Only odd few machines though, rest seem to have gone OK even theough they were all from the same image.