Darren, you should have a dedicated account for sophos updating, the problem with using the domain administrator account as you'll find out sooner or later is that when you change the password for the domain administrator your sophos updating account stops working as you've forgotten to enter the changed password in the sophos client deployment console. Also your clients when deployed use the username and password that you deployed them with to do thier updates from the CID that you specified when you deployed to the client.
So do your self a favour and create a dedicated sophos account with domain admin privileges and make sure the account is a member of the workstation admins account ( It probably already is as an administrator) other wise each time you change the password for the Domain Administrator your sophos clients will fail because their using the wrong password.