advertisement
Sophos Enterprise Console upgrade guide
Product version:
Document date:
5.2.1
May 2013
2
Contents
upgrade guide
1 About this guide
This guide tells you how to upgrade to Sophos Enterprise Console 5.2.1.
The guide also tells you how to add Sophos Disk Encryption to your Sophos security solution, if you didn't use it before.
There is no upgrade for NAC Manager 3.9 and Compliance Dissolvable Agent 3.9 in this release.
If your license includes Network Access Control (NAC), you can continue using NAC 3.9 after the upgrade to Enterprise Console 5.2.1.
3
4
Sophos Enterprise Console
2 Which versions can I upgrade from?
You can upgrade to Enterprise Console 5.2.1 directly from:
■
Enterprise Console 5.2.0
■
Enterprise Console 5.1
■ Enterprise Console 5.0
■
Sophos Control Center 4.1
■
Sophos Control Center 4.0.1
To upgrade from Enterprise Console 4.x or Enterprise Manager 4.7, you must upgrade to Enterprise
Console 5.1 first. The Enterprise Console 5.1 installer is available from the Sophos Enterprise
Console Downloads page
(
http://www.sophos.com/en-us/support/downloads/console/sophos-enterprise-console.aspx
).
See also
http://www.sophos.com/en-us/support/knowledgebase/119105.aspx
for more information about different upgrade paths.
upgrade guide
3 How do I add Sophos Disk Encryption?
If you use Sophos Disk Encryption and manage it from Enterprise Console, you do not need to do anything. Sophos Disk Encryption will continue to work as before the upgrade.
If you do not use Sophos encryption but would like to add it now:
■ If you are upgrading from Enterprise Console 5.1, you will have to upgrade to Enterprise
Console 5.2.1 first, and then re-run the Enterprise Console 5.2.1 installer to add encryption.
■
If you are upgrading from Enterprise Console 5.0, the installer will display the Manage
Encryption page where you can choose to manage encryption (as described in
(section 9.2)).
After you have added encryption, you need to set up encryption software on endpoint computers as described in
Appendix: Set up encryption software on endpoint computers
5
6
Sophos Enterprise Console
4 What are the steps in upgrading?
Upgrading involves the following steps.
■
Check the system requirements.
■
Check the accounts you need.
■ Check whether you need to change your software subscriptions.
■
Download the installer.
■
Upgrade Enterprise Console or Control Center.
If your license includes encryption and if you haven't used it before the upgrade, you might also want to set up encryption software on endpoint computers after you upgrade Enterprise Console.
upgrade guide
5 System requirements
.NET Framework 4.0
The Enterprise Console 5.2.1 installer installs .NET Framework 4.0, unless it is already installed.
Important: As part of the .NET Framework 4.0 installation some system services (such as IIS
Admin Service) may restart.
After .NET Framework 4.0 is installed, you may receive a message asking you to restart your computer. If you do, we recommend that you restart the computer immediately or shortly after the installation.
For a full list of system requirements, see the system requirements page of the Sophos website
http://www.sophos.com/en-us/products/all-system-requirements.aspx
.
Tip: You can run the Enterprise Console installer to check if your system meets the requirements for the upgrade, even if you do not want to proceed with the upgrade immediately. You can view the results of the system check on the System Property Checks page of the installation wizard.
After you have reviewed the results, click Cancel to close the wizard. For more information about the system check results, go to
http://www.sophos.com/en-us/support/knowledgebase/113945.aspx
.
5.1 Free disk space requirements
The amount of free disk space you need to upgrade Enterprise Console depends on the size of the
Enterprise Console database files (.mdf files) and transaction log files (.ldf files) that are currently in use.
Tip: The file names begin with "SOPHOS" and usually contain Enterprise Console version number.
For information about the database file names for different console versions and how to locate the database files on disk, see Sophos support knowledgebase article 17323
(
http://www.sophos.com/en-us/support/knowledgebase/17323.aspx
).
To ensure that you have sufficient disk space to upgrade Enterprise Console, do the following:
■ Check the disk drive on which the database files (.mdf files) are deployed and ensure that it has free capacity of at least three times the current size of the .mdf files.
■
Check that the disk drive on which the transaction log files (.ldf files) are deployed and ensure that it has free capacity of at least eight times the current size of the database files (.mdf files).
■ If both .mdf and .ldf files are deployed on the same disk, ensure that it has free capacity of at least 10 times the current size of the .mdf files.
If you have upgraded Enterprise Console in the past, you may still have old Enterprise Console databases that are no longer required. You may consider deleting those databases to free up disk space. For more information, see Sophos support knowledgebase article 17508
(
http://www.sophos.com/en-us/support/knowledgebase/17508.aspx
).
7
8
Sophos Enterprise Console
6 The accounts you need
Accounts required to perform the upgrade
Ensure that the user logged on to and running the upgrade on the management server has sufficient rights to all Sophos databases. The user running the management server upgrade should be a member of the "db_owner" role on each of the Sophos databases (members of the server role
"sysadmin" would implicitly have sufficient rights to all databases). These rights are only required temporarily during the upgrade, to check that the new databases have been created and to migrate the data.
Note: For a list of database names per version of the console, see Sophos support knowledgebase article 17323 (
http://www.sophos.com/en-us/support/knowledgebase/17323.aspx
).
Sophos database account
When you upgrade your management console, you might be asked for details of a database account.
This happens if your existing account no longer meets the requirements.
Ensure you have an account that:
■
Can log onto the computer where the management console is installed. For distributed installations of Enterprise Console, the account must be able to log onto the computer where the Sophos Management Server component is installed.
■
Can read and write to the system temporary directory e.g. "\windows\temp\". By default, members of "Users" have this right.
■
Has a UPN (User Principal Name) associated with the account if it is a domain account.
All other rights and group memberships that the account needs are granted automatically during the upgrade.
Sophos recommends that the account:
■
Is not set to expire and does not have any other logon restriction.
■
Is not an administrative account.
■
Is not changed after the upgrade.
For more information, see Sophos support knowledgebase article 113954
(
http://www.sophos.com/en-us/support/knowledgebase/113954.aspx
).
upgrade guide
7 Will I get the same updates as before?
Enterprise Console 5.2.1 supports new options for getting your automatic updates from Sophos and doesn't support some of the old ones. Depending on the software packages you selected when you installed Enterprise Console, you may need to change your software subscription settings before you upgrade.
To open an endpoint software subscription, on the View menu, click Update Managers. In the
Software Subscriptions pane, double-click the subscription you want to check.
To open an update manager software subscription, in the Update managers view, double-click the update manager you want to check. In the Configure update manager dialog box, go to the
Advanced tab.
The following matrix shows whether you can or cannot upgrade with your current settings.
Advice, if applicable Software package Upgrade possible
Endpoint
Recommended (e.g. 10.2
Recommended), default
Previous
Oldest
Extended Maintenance
Recommended
Extended Maintenance Previous
Extended Maintenance Oldest
Yes
Yes
No
Yes
Yes
No
Fixed (e.g. 10.2.7 VDL4.88G) Yes
Resubscribe to a different package, for example,
"Previous".
Resubscribe to a different package, for example,
"Extended Maintenance Previous".
You do not need to do anything immediately, but you should read
(section
7.1).
Update Manager
1 Recommended, default
1 Previous
1 Oldest
Fixed (e.g. 1.3.2.176)
Yes
No
No
No
Resubscribe to "1 Recommended". For more information, read
About Sophos Update Manager upgrade
9
Sophos Enterprise Console
If your software package is no longer supported and you don't change your subscription before upgrading, the installer will warn you about the unsupported subscriptions and you won't be able to proceed with the upgrade. For more information about software packages, see
http://www.sophos.com/en-us/support/knowledgebase/112580.aspx
.
7.1 About fixed version software
Sophos is retiring the use of fixed versions. If you are subscribed to a fixed software version and don't change your software subscription before upgrading, you will still be subscribed to the same fixed version after the upgrade and it will continue to be downloaded. However, you will not be able to subscribe to a different fixed version, and once you unsubscribe from a fixed version, it will be permanently removed from the list of available packages in the Software Subscription dialog box. For more information, see
http://www.sophos.com/en-us/support/knowledgebase/119240.aspx
.
Note: The option Automatically upgrade fixed version software when it is no longer supported
by Sophos is always enabled in Enterprise Console 5.2.1 and you cannot disable it. If you disabled this option in your software subscription, the option will be automatically enabled during the upgrade and the check box in the Software Subscription dialog box will disappear.
7.2 About Sophos Update Manager upgrade
Enterprise Console 5.2.1 supports only one, recommended Sophos Update Manager software package. Update Manager (and any additional Update Managers, if you use them) must be subscribed to the "1 Recommended" package. Otherwise, you won’t be able to upgrade.
If you are not subscribed to the "1 Recommended" package, you will need to subscribe to it and ensure that Update Manager has been updated to the latest recommended version (1.4.2) before upgrading Enterprise Console.
If the Update Manager installer in the share \\Servername\SUMInstallSet on the computer where
Enterprise Console management server is installed is earlier than version 1.4.2, the installer will be updated to version 1.4.2 during the upgrade.
10
upgrade guide
8 Download the installer
This section assumes that you have a MySophos account and that you have associated your license credentials with it. If you need help, see
www.sophos.com/en-us/support/knowledgebase/111195.aspx
.
Note: You can download the installer at any computer and then copy it to the computer where you will use it.
1. Go to
www.sophos.com/en-us/support/downloads.aspx
.
2. Type your MySophos username and password.
You see a web page that shows your licenses.
3. Under your license name, find the Console downloads and download the Enterprise Console installer.
11
Sophos Enterprise Console
9 Upgrade Enterprise Console
9.1 Back up Enterprise Console data and configuration
Before you upgrade Enterprise Console, use the DataBackupRestore.exe tool to back up:
■
Databases: Enterprise Console (core) - SOPHOS5x, Patch - SOPHOSPATCH or
SOPHOSPATCH5x, Encryption - SOPHOSENC5x, and Auditing - SophosSecurity.
■
Registry settings
■
Account information
■
Configuration files
Important: The DataBackupRestore.exe tool will back up the Sophos management server's configuration only from a default installation location. Backing up or restoring the configuration files will fail if you have installed Enterprise Console to a non-default location. The default location is:
■
Windows 64-bit: %programfiles(x86)%\Sophos\Enterprise Console\
■
Windows 32 and 64-bit: %programfiles%\Sophos\Enterprise Console\
If you use a non-default installation location, see knowledgebase article 114299
(
http://www.sophos.com/en-us/support/knowledgebase/114299.aspx#knownissues
) for advice.
If Enterprise Console databases are on a remote server, you can use Sophos tools BackupDB.bat
and RestoreDB.bat to back up and restore the databases. For more information, see knowledgebase article 110380 (
http://www.sophos.com/en-us/support/knowledgebase/110380.aspx
).
To back up the Enterprise Console data and configuration:
1. Log on as the Administrator to the computer where the Enterprise Console management server is installed.
2. Open Command Prompt (click Start, Run, type cmd, and then press Enter).
3. Browse to the folder containing the tool.
■
In Windows 64-bit, type:
■
cd "C:\Program Files (x86)\Sophos\Enterprise Console\"
In Windows 32-bit, type:
cd "C:\Program Files\Sophos\Enterprise Console\"
12
upgrade guide
4. To back up everything, type:
DataBackupRestore.exe -action=backup
To display the usage options, type:
DataBackupRestore.exe -?
For more information about using the tool, see also knowledgebase article 114299
(
http://www.sophos.com/en-us/support/knowledgebase/114299.aspx
).
You are now ready to upgrade Enterprise Console.
9.2 Upgrade Enterprise Console
Important:
If you have the Sophos Management Database component installed on a separate server, you must upgrade the database component first before upgrading the management server.
You must not make any changes in Enterprise Console (for example, change policy settings) between upgrading the database and upgrading the management server.
For more information about upgrading the database on a remote server, including upgrading on a secure server using a script and upgrading in a clustered SQL Server environment, see Sophos support knowledgebase article 33980
(
http://www.sophos.com/en-us/support/knowledgebase/33980.aspx
).
To upgrade Enterprise Console:
1. At the computer where you want to upgrade Enterprise Console, log on as an administrator:
■
■
If the server is in a domain, use a domain account that has local administrator rights.
If the server is in a workgroup, use a local account that has local administrator rights.
2. Find the Enterprise Console installer that you downloaded earlier.
Tip: The installer file name includes "sec".
3. Double-click the installer.
4. A wizard guides you through the upgrade.
5. If you are upgrading from Enterprise Console 5.0 and want to add Sophos Disk Encryption: a) On the Manage Encryption page of the wizard, select Manage encryption.
b) On the Sophos Encryption page, click New installations. You are prompted to create a password for the certificates backup store. Make a note of the password.
6. Complete the wizard.
13
Sophos Enterprise Console
14
If you have upgraded from Enterprise Console 5.1 and want to add Sophos Disk Encryption, re-run the Enterprise Console 5.2.1 installer. The installer will now display the options for managing encryption, as described in step 5 above.
After you have added encryption, you need to set up encryption software on endpoint computers as described in
Appendix: Set up encryption software on endpoint computers
Important: The new Sophos Auditing database, SophosSecurity, must be present and running side by side with the other Enterprise Console databases, even if you don't intend to use the Sophos
Auditing feature. This is because the database is used for enhanced access control as well as for logging audit events.
9.3 Enhance database security
Audit the database
In addition to the protection built into the Enterprise Console databases, we recommend setting additional protection at the SQL Server instance level (if not already in place) to audit user activities and changes on your SQL Server.
For example, if you are using an Enterprise edition of SQL Server 2008, you can use the SQL Server
Audit feature. Earlier versions of SQL Server support login auditing, trigger-based auditing, and event auditing by using a built-in trace facility.
For more information about features that you can use for auditing activities and changes on your
SQL Server system, see the documentation for your version of SQL Server. For example:
■
SQL Server Audit (Database Engine), SQL Server 2012
■
Auditing (Database Engine), SQL Server 2008 R2
■
Auditing in SQL Server 2008
■
Auditing (Database Engine), SQL Server 2008
Encrypt connections to the database
We strongly recommend that you encrypt connections between any clients and the Enterprise
Console databases. For more information, see the SQL Server documentation:
■
Enable Encrypted Connections to the Database Engine (SQL Server Configuration Manager), SQL
Server 2012
■
Encrypting Connections to SQL Server 2008 R2
■
How to enable SSL encryption for an instance of SQL Server by using Microsoft Management
Console, SQL Server 2005
Control access to the database backups
Ensure proper, restrictive access control to any database backups or copies. This will ensure that unauthorized users cannot access the files, tamper with them, or accidentally delete them.
upgrade guide
Note: The links in this section lead to information maintained by third parties and are provided for your convenience. Although we try to review the accuracy of the links periodically, the links may change without our knowledge.
9.4 Check existing policies
9.4.1 Check policy settings
Note: If you use role-based administration, you must have the Computer search, protection and
groups right to perform these tasks. For more information, see "About roles and sub-estates" in the section "Managing roles and sub-estates" in the Sophos Enterprise Console Help.
To check that your policy settings have been preserved after upgrading Enterprise Console:
1. Start Enterprise Console.
2. In the Policies pane, double-click a policy type (for example, Anti-virus and HIPS).
3. Double-click the policy you want to check.
4. In the dialog box that is displayed, review the policy settings.
9.4.2 Check policies applied to computer groups
Note: If you use role-based administration, you must have the Computer search, protection and
groups right to perform these tasks. For more information, see "About roles and sub-estates" in the section "Managing roles and sub-estates" in the Sophos Enterprise Console Help.
To check that your groups have the correct policies applied to them after upgrading Enterprise
Console, do the following.
Note: Features not included in your license, which were displayed in previous versions of Enterprise
Console, may not be displayed in Enterprise Console 5.2.1.
1. Start Enterprise Console.
2. In the Groups pane, right-click a group, and then click View/Edit Group Policy Details.
3. In the Group Details dialog box, verify that the group is assigned the right policies. If not, for a policy type, select a different policy from the drop-down list.
You have finished upgrading Enterprise Console.
If you want to set up encryption software on endpoint computers, go to
Appendix: Set up encryption software on endpoint computers
15
Sophos Enterprise Console
10 Upgrade from Control Center to Enterprise Console
10.1 Back up Control Center data and configuration
Before you upgrade Control Center, use the script BackupDB.bat to back up the Control Center database.
1. If Control Center is open, close it.
2. Open Windows Services (click Start, Run, type services.msc, and press Enter).
3. Stop and disable the following three services:
■ Sophos Management Service
■ Sophos Message Router
■
Sophos Update Manager
To disable a service, right-click it and click Properties. On the General tab of the Properties dialog box, in the Startup type field, select "Disabled". Click OK.
4. Open Command Prompt (click Start, Run, type cmd, and press Enter).
5. Browse to the folder containing the tool.
■ In Windows 32-bit, type:
cd "C:\Program Files\Sophos\SCC\DB\"
■
In Windows 64-bit, type:
cd "C:\Program Files (x86)\Sophos\SCC\DB\"
6. Remove any existing backup file. (Otherwise, the new backup file will be appended to it).
For example, if your existing backup file named sophos4db.bak is in the folder
C:\Windows\Temp, type:
del C:\Windows\Temp\sophos4db.bak
7. Back up the database. For example, to create a backup file named sophos4db.bak in the folder
C:\Windows\Temp, type:
backupdb.bat C:\Windows\Temp\sophos4db.bak .\SOPHOS SOPHOS4
To display the BackupDB.bat usage options, type:
backupdb.bat /?
16
upgrade guide
8. Enable and start the following three services:
■
Sophos Management Service
■ Sophos Message Router
■
Sophos Update Manager
To enable a service, right-click it and click Properties. On the General tab of the Properties dialog box, in the Startup type field, select "Automatic". Click OK. Click Start to start the service.
For more information about backing up and restoring the database, see
http://www.sophos.com/en-us/support/knowledgebase/110380.aspx
.
10.2 Upgrade from Control Center to Enterprise Console
To upgrade Control Center, follow the steps below. You can also watch a how-to video demonstration at
http://www.youtube.com/watch?v=0_s72chbxt8
.
1. Before you upgrade, if Control Center is open, close it. On the File menu, click Exit.
2. Open the folder that contains the Enterprise Console installer that you downloaded earlier.
Tip: The installer file name includes "sec".
3. Double-click the installer.
4. A wizard guides you through the upgrade.
On the System Property Checks page of the wizard, check that your computer meets the system requirements for Enterprise Console.
On the Database Details page, enter the details for a Windows user account that Enterprise
Console will use to access the database where it stores information.
The account password should not be modified after the installation. We recommend that you
do not use an administrator account. For more information about the account, see
(section 6).
Complete the wizard.
10.3 Get to know your new console
When the upgrade is complete and Enterprise Console is started for the first time, you will notice that Enterprise Console arranges your computers and settings differently from Control Center.
17
Sophos Enterprise Console
18
To view the computers that you were previously managing in Control Center, on the Dashboard, under Computers, click Managed.
You can also view the managed computers from the Groups pane. Computers that were "locally configured" before are listed in the Unassigned group. Computers that followed the "central configuration" are listed in the Known Computers group.
All your computers are still protected and can be left in these groups.
Your configuration settings from Control Center have been put into "policies". To view a policy, click the plus sign (+) next to a policy type and then double-click the policy name. Your settings have been moved from the Control Center to the "Default" policies. Every policy type has its own default policy.
You can put computers in new groups and create new policies that apply to particular groups. For more information, see the Sophos Enterprise Console Help.
upgrade guide
11 Appendix: Set up encryption software on endpoint computers
Read this section if:
■ Your license includes encryption.
■ You are not currently using Sophos encryption.
■
You have installed Enterprise Console to manage encryption
Warning: When you are installing the Sophos encryption software for the first time, we strongly recommend that you enable and test each setting step by step.
To set up full disk encryption on computers you:
■
Subscribe to encryption software.
■
Prepare to install encryption software.
■ Install encryption software automatically.
■ Install encryption software manually.
Note: Full disk encryption can be installed on Windows XP, Windows Vista and Windows 7 computers but not on Macs.
Warning: Before you install full disk encryption on computers, you must:
■ Make sure that drives encrypted with third-party encryption software have been decrypted and that the third-party encryption software is uninstalled.
■
Create a full backup of the data on computers.
For a complete list of preparations, see
Prepare computers for installation
11.1 Subscribe to encryption software
Note: We recommend that you create a new subscription for encryption.
To subscribe to the encryption software:
1. In Enterprise Console, on the View menu, click Update Managers.
2. To create a new subscription, in the Software Subscriptions pane, click Add at the top of the pane. In the Software Subscription dialog box, type a name for the subscription in the
Subscription name box. Under Encryption Products, next to Windows XP and above, click in the Version box, and select the latest "Recommended" version (version 5.61 at the time of this release). Click OK.
19
Sophos Enterprise Console
3. To add the subscription to the Update Managers, in the Update managers pane, right-click the update manager and select View/Edit configuration. In the Configure update manager dialog box, on the Subscriptions tab, select the subscription in the Available list and click the
> button to move it to the Subscribed to list. Click OK.
The encryption software is downloaded to the default share
\\<server_name>\SophosUpdate\CIDs\<subscription>\ENCRYPTION.
To download to shares other than the default share, see
Specify where the software is placed
(section
11.2).
To change the default update schedule, see
Note: You cannot have the encryption software installed by applying update polices to a group of computers. You need to trigger the installation of the encryption software yourself.
For further information on the full disk encryption policy, see the Enterprise Console policy setup
guide.
11.2 Specify where the software is placed
After you have selected which software to download, you can specify where it should be placed on the network. By default, the software is placed in a UNC share
\\<ComputerName>\SophosUpdate, where ComputerName is the name of the computer where the update manager is installed.
You can distribute downloaded software to additional shares on your network. To do this, add an existing network share to the list of available shares and then move it to the list of update shares as described below.
To specify where the software is placed:
1. In the Configure update manager dialog box, on the Distribution tab, select a software subscription from the list.
2. Select a share from the “Available” shares list and move it to the “Update to” list by clicking the > button.
The default share \\<ComputerName>\SophosUpdate is always present in the “Update to” list. You cannot remove this share from the list.
The “Available” shares list includes all the shares that Enterprise Console knows about and that are not already being used by another update manager.
You can add an existing share to or remove a share from the “Available” shares list, using the
Add or Remove button.
3. If you want to enter a description for a share or credentials needed to write to the share, select the share and click Configure.
4. In the Share manager dialog box, enter the description and credentials.
20
upgrade guide
The software that you have selected is downloaded to the shares that you have specified during the next scheduled update.
If you want to edit the default update schedule, see
If you want to download the software immediately, select the update manager, right-click and click Update Now.
11.3 Edit an update schedule
By default, an update manager will check for threat detection data updates every 10 minutes. You can change this update interval. The minimum is 5 minutes. The maximum is 1440 minutes (24 hours). Sophos recommends an update interval of 10 minutes for threat detection data, so that you receive protection from new threats promptly after the detection data is published by Sophos.
By default, an update manager will check for software updates every 60 minutes. You can change this update interval. The minimum is 10 minutes. The maximum is 1440 minutes (24 hours).
For software updates, you can either specify an update interval that is used every hour of every day, or you can create more sophisticated schedules, in which each day can be specified independently and each day can be divided into periods with different update intervals.
Note: You can create a different schedule for each day of the week. Only a single schedule can be associated with a day of the week.
If you want to change the default schedule:
■
In the Configure update manager dialog box, on the Schedule tab, enter new update intervals or create a more sophisticated schedule, or different schedules for different days of the week.
You can also change the default settings for the update manager log and self-updating, if you wish.
You do this by editing the settings on the Logging and Advanced tabs, respectively.
11.4 Preparing to install encryption software
Preparing to install encryption software on computers involves the following tasks:
■
Give administrators access on computers after installation.
■
Prepare computers for installation.
11.4.1 Give administrators access to computers after installation
Administrators might need to access and pre-configure computers after you have installed encryption software, for example to install other software. However, the first user who logs on after installation activates the Power-on Authentication.
21
Sophos Enterprise Console
To avoid this, add the respective administrators to a list of exceptions, as follows:
1. In Enterprise Console, in the Policies pane, double-click Full disk encryption. Double-click the Default policy to edit it.
2. Under Power-on Authentication (POA) click Exceptions next to Enable Power-on
Authentication.
3. In Exceptions, click Add, enter the User name and the Computer or domain name of the relevant Windows account(s) and click OK.
You can use wildcards as the first or last character. In the User name field, the ? character is not allowed. In the Computer or Domain Name field, the characters / \ [ ] : ; | = , + ? < > " are not allowed.
4. In the Default policy dialog, click OK.
5. In the Policies pane, select the policy and drag it onto the group to which you want to apply the policy. When prompted, confirm that you want to continue.
11.4.2 Prepare computers for installation
If your license includes full disk encryption, you must do the following before you install encryption software on computers:
■ Make sure that drives encrypted with third-party encryption software have been decrypted and that the third-party encryption software is uninstalled.
■
Create a full backup of the data.
■
Check if a Windows user account with credentials is set up and active for the user on the endpoint computer.
■
Make sure that the computer has already been protected with Sophos anti-virus software version
10 before you deploy full disk encryption.
■
Uninstall third-party boot managers, such as PROnetworks Boot Pro and Boot-US.
■ Create a full backup of the data.
■ Check the hard disk(s) for errors with this command:
chkdsk %drive% /F /V /X
You might be prompted to restart the computer and run
chkdsk
again. For further information, see:
http://www.sophos.com/en-us/support/knowledgebase/107081.aspx
.
You can check the results (log file) in the Windows Event Viewer:
Windows XP: Select Application, Winlogon.
Windows 7, Windows Vista: Select Windows Logs, Application, Wininit.
22
upgrade guide
■ Use the Windows built-in
defrag
tool to locate and consolidate fragmented boot files, data files, and folders on local drives:
defrag %drive%
For further information, see:
http://www.sophos.com/en-us/support/knowledgebase/109226.aspx
.
■
If you have used an imaging/cloning tool on the computer, clean the master boot record (MBR).
Start the computer from a Windows DVD and use the command
FIXMBR
within the Windows
Recovery Console. For further information, see:
http://www.sophos.com/en-us/support/knowledgebase/108088.aspx
.
■
If the boot partition on the computer has been converted from FAT to NTFS, and the computer has not been restarted since then, restart the computer. If you do not do this, the installation may not complete successfully.
■
Open Windows Firewall with Advanced Security, using the Administrative Tools item in
Control Panel. Ensure that Inbound connections are allowed. Change the Inbound rules to enable the processes below:
Remote Administration (NP-In) Domain
Remote Administration (NP-In) Private
Remote Administration (RPC) Domain
Remote Administration (RPC) Private
Remote Administration (RPC-EPMAP) Domain
Remote Administration (RPC-EPMAP) Private
When installation is complete and you want to continue using Windows Firewall, you may disables the process again.
11.5 Install encryption software automatically
Warning: If you are installing the Sophos encryption software for the first time, we strongly recommend that you enable and test each setting step-by-step.
Make sure that the endpoints have been prepared for full disk encryption installation, in particular that third-party encryption software has been uninstalled, all data has been backed up and that
Sophos anti-virus software version 10 has been installed.
To install encryption software automatically:
1. In Enterprise Console, select the computers on which you want to install full disk encryption.
2. Right-click the computer, and then click Protect computers. The Protect Computers Wizard is launched.
3. On the Welcome page, click Next.
4. On the Installation Type page, select Encryption software.
23
Sophos Enterprise Console
24
5. If there is more than one encryption subscription and installer location (bootstrap location) available, the Encryption location page is displayed. Select the Encryption subscription and
Address to install from.
6. On the Encryption summary page, check for any installation problems.
7. On the Credentials page, enter details of an account that can be used to install software on computers.
Installation is staggered, so the process may not be complete on all the computers for some time.
The installation of encryption will cause computers to restart automatically within about 30 minutes after installation of the encryption software. If encryption is enabled by policy, it will only take place after the computer's restart.
For further information on the start behaviour of the computer and first logon after installation and activation of encryption, see
First logon after installation
(section 11.7).
11.6 Install encryption software manually
Warning: If you are installing the Sophos encryption software for the first time, we strongly recommend that you enable and test each setting step-by-step.
If you have computers that you cannot protect automatically, protect them by running an installer from the shared folder to which the encryption software has been downloaded. This shared folder is known as the bootstrap location.
Make sure that the endpoints have been prepared for full disk encryption installation, in particular that third-party encryption software has been uninstalled, all data has been backed up and that
Sophos anti-virus software version 10 has been installed.
During the installation of full disk encryption, make sure that only one user session is active on the endpoint. If you do not do this, the installation will fail.
You must log on to the computers that you want to protect as a Windows administrator.
To install encryption software on computers manually:
1. To find out which directory the installer is in, open Enterprise Console and select Bootstrap
locations from the View menu.
In the Bootstrap Locations dialog box, the Location column displays the bootstrap location for each platform. Make a note of the relevant paths.
2. At the computer that hosts the bootstrap location, create a read-only user account.
3. Go to each computer and log on with local administrator rights.
4. Locate the encryption setup program setup.exe in the bootstrap location and double-click it.
The encryption setup program can be found in the following location:
\\<ServerName>\SophosUpdate\CIDs\<Subscription>\ENCRYPTION
5. A wizard guides you through installation of the encryption software.
upgrade guide
For further information on the start behaviour of the computer and first logon after installation and activation of encryption, see
First logon after installation
(section 11.7).
11.7 First logon after installation
After encryption is installed, the computer restarts and the user is prompted to log on. The computer's behavior depends on the kind of account the user logs on with:
■ log on as end user with normal Windows account.
■ log on for administrative tasks with Windows account that has been put on the list of exceptions.
Log on as end user with normal Windows account
The logon procedure only corresponds to the one described here if Power-on-Authentication and encryption have been enabled in the full disk encryption policy.
When the computer restarts, a number of messages (for example, the autologon screen) are displayed. Then the Windows operating system starts. The user logs on to Windows with their
Windows credentials. The user is registered as a Sophos SafeGuard user on the computer.
Note: After successful registration, a tool tip confirming this is shown on the endpoint computer.
If enabled by policy, encryption starts on the selected drives. Encryption and decryption are performed in the background without any user interaction. The user may continue working or shut down the computer during the encryption process. No restart is required after encryption is completed.
The next time the user starts the computer, Power-on Authentication is activated. From now on, the user only has to enter their Windows credentials at the Power-on Authentication and is automatically logged on to Windows.
Note: When starting the computer from hibernation, the user needs to enter their Windows credentials at Power-on Authentication and at Windows.
For further information, see the Sophos Disk Encryption user help.
Log on for administrative tasks with Windows account that has been put on the list of exceptions
The logon procedure only corresponds to the one described here if the user logs on with a Windows account that has been put on a list of exceptions and Power-on-Authentication has been enabled in the full disk encryption policy.
When the computer restarts, the Windows operating system starts. The Windows logon is displayed.
The user logs on with their credentials as previously defined in the full disk encryption policy. The user is logged on to Windows as a guest user. Power-on Authentication is not activated. The encryption process does not start. The user can carry out post-installation tasks as required.
25
Sophos Enterprise Console
12 Technical support
You can find technical support for Sophos products in any of these ways:
■
Visit the SophosTalk community at
community.sophos.com/
and search for other users who are experiencing the same problem.
■
Visit the Sophos support knowledgebase at
www.sophos.com/en-us/support.aspx
.
■ Download the product documentation at
www.sophos.com/en-us/support/documentation/
.
■ Send an email to
, including your Sophos software version number(s), operating system(s) and patch level(s), and the text of any error messages.
26
upgrade guide
13 Legal notices
Copyright
©
2013 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos
Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
ACE
™
, TAO
™
, CIAO
™
, and CoSMIC
™
ACE
1
, TAO
2
, CIAO
3
, and CoSMIC by Douglas C. Schmidt
5
4
(henceforth referred to as “DOC software”) are copyrighted
and his research group
6
at Washington University
7
, University of
California
8
, Irvine, and Vanderbilt University
9
, Copyright
©
1993–2005, all rights reserved.
Since DOC software is open-source, free software, you are free to use, modify, copy, and distribute–perpetually and irrevocably–the DOC software source code and object code produced from the source, as well as copy and distribute modified versions of this software. You must, however, include this copyright statement along with code built using DOC software.
You can use DOC software in commercial and/or binary software releases and are under no obligation to redistribute any of your source code that is built using DOC software. Note, however, that you may not do anything to the DOC software code, such as copyrighting it yourself or claiming authorship of the DOC software code, that will prevent DOC software from being distributed freely using an open-source development model. You needn’t inform anyone that you’re using DOC software in your software, though we encourage you to let us
10
know so we can promote your project in the DOC software success stories
11
.
DOC software is provided as is with no warranties of any kind, including the warranties of design, merchantability, and fitness for a particular purpose, noninfringement, or arising from a course of dealing, usage or trade practice. Moreover, DOC software is provided with no support and without any obligation on the part of Washington University, UC Irvine, Vanderbilt University, their employees, or students to assist in its use, correction, modification, or enhancement. A number of companies
12
around the world provide commercial support for DOC software, however.
DOC software is Y2K-compliant, as long as the underlying OS platform is Y2K-compliant.
Washington University, UC Irvine, Vanderbilt University, their employees, and students shall have no liability with respect to the infringement of copyrights, trade secrets or any patents by
DOC software or any part thereof. Moreover, in no event will Washington University, UC Irvine, or Vanderbilt University, their employees, or students be liable for any lost revenue or profits or other special, indirect and consequential damages.
The ACE
13
, TAO
14
, CIAO
15
, and CoSMIC
16
web sites are maintained by the DOC Group
17
at the
Institute for Software Integrated Systems (ISIS)
18
and the Center for Distributed Object Computing
27
Sophos Enterprise Console
of Washington University, St. Louis
19
for the development of open-source software as part of the open-source software community
20
. By submitting comments, suggestions, code, code snippets, techniques (including that of usage), and algorithms, submitters acknowledge that they have the right to do so, that any such submissions are given freely and unreservedly, and that they waive any claims to copyright or ownership. In addition, submitters acknowledgethat any such submission might become part of the copyright maintained on the overall body of code, which comprises the
DOC software. By making a submission, submitter agree to these terms. Furthermore, submitters acknowledge that the incorporation or modification of such submissions is entirely at the discretion of the moderators of the open-source DOC software projects or their designees.
The names ACE, TAO, CIAO, CoSMIC, WashingtonUniversity, UC Irvine, and Vanderbilt
University, may not be used to endorse or promote products or services derived from this source without express written permission from Washington University, UC Irvine, or Vanderbilt
University. Further, products or services derived from this source may not be called ACE, TAO,
CIAO, or CoSMIC nor may the name Washington University, UC Irvine, or Vanderbilt University appear in their names, without express written permission from Washington University, UC
Irvine, and Vanderbilt University.
If you have any suggestions, additions, comments, or questions, please let me
21
know.
Douglas C. Schmidt
22
References
1. http://www.cs.wustl.edu/~schmidt/ACE.html
2. http://www.cs.wustl.edu/~schmidt/TAO.html
3. http://www.dre.vanderbilt.edu/CIAO/
4. http://www.dre.vanderbilt.edu/cosmic/
5. http://www.dre.vanderbilt.edu/~schmidt/
6. http://www.cs.wustl.edu/~schmidt/ACE-members.html
7. http://www.wustl.edu/
8. http://www.uci.edu/
9. http://www.vanderbilt.edu/
10. mailto:[email protected]
11. http://www.cs.wustl.edu/~schmidt/ACE-users.html
12. http://www.cs.wustl.edu/~schmidt/commercial-support.html
13. http://www.cs.wustl.edu/~schmidt/ACE.html
14. http://www.cs.wustl.edu/~schmidt/TAO.html
15. http://www.dre.vanderbilt.edu/CIAO/
16. http://www.dre.vanderbilt.edu/cosmic/
17. http://www.dre.vanderbilt.edu/
18. http://www.isis.vanderbilt.edu/
28
upgrade guide
19. http://www.cs.wustl.edu/~schmidt/doc-center.html
20. http://www.opensource.org/
21. mailto:[email protected]
22. http://www.dre.vanderbilt.edu/~schmidt/
Apache
The Sophos software that is described in this document may include some software programs that are licensed (or sublicensed) to the user under the Apache License. A copy of the license agreement for any such included software can be found at
http://www.apache.org/licenses/LICENSE-2.0
Boost
Version 1.0, 17 August 2003
Permission is hereby granted, free of charge, to any person or organization obtaining a copy of the software and accompanying documentation covered by this license (the “Software”) to use, reproduce, display, distribute, execute, and transmit the Software, and to prepare derivative works of the Software, and to permit third-parties to whom the Software is furnished to do so, all subject to the following:
The copyright notices in the Software and this entire statement, including the above license grant, this restriction and the following disclaimer, must be included in all copies of the Software, in whole or in part, and all derivative works of the Software, unless such copies or derivative works are solely in the form of machine-executable object code generated by a source language processor.
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND
NON-INFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR ANYONE
DISTRIBUTING THE SOFTWARE BE LIABLE FOR ANY DAMAGES OR OTHER LIABILITY,
WHETHER IN CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Common Public License
The Sophos software that is referenced in this document includes or may include some software programs that are licensed (or sublicensed) to the user under the Common Public License (CPL), which, among other rights, permits the user to have access to the source code. The CPL requires for any software licensed under the terms of the CPL, which is distributed in object code form, that the source code for such software also be made available to the users of the object code form.
For any such software covered under the CPL, the source code is available via mail order by submitting a request to Sophos; via email to
or via the web at
http://www.sophos.com/en-us/support/contact-support/contact-information.aspx
. A copy of the license agreement for any such included software can be found at
http://opensource.org/licenses/cpl1.0.php
29
Sophos Enterprise Console
ConvertUTF
Copyright 2001–2004 Unicode, Inc.
This source code is provided as is by Unicode, Inc. No claims are made as to fitness for any particular purpose. No warranties of any kind are expressed or implied. The recipient agrees to determine applicability of information provided. If this file has been purchased on magnetic or optical media from Unicode, Inc., the sole remedy for any claim will be exchange of defective media within 90 days of receipt.
Unicode, Inc. hereby grants the right to freely use the information supplied in this file in the creation of products supporting the Unicode Standard, and to make copies of this file in any form for internal or external distribution as long as this notice remains attached.
Loki
The MIT License (MIT)
Copyright
©
2001 by Andrei Alexandrescu
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
OpenSSL cryptographic toolkit
The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact [email protected].
OpenSSL license
Copyright
©
1998–2011 The OpenSSL Project. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
30
upgrade guide
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the following acknowledgment:
“This product includes software developed by the OpenSSL Project for use in the OpenSSL
Toolkit. (http://www.openssl.org/)”
4. The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact [email protected].
5. Products derived from this software may not be called “OpenSSL” nor may “OpenSSL” appear in their names without prior written permission of the OpenSSL Project.
6. Redistributions of any form whatsoever must retain the following acknowledgment:
“This product includes software developed by the OpenSSL Project for use in the OpenSSL
Toolkit (http://www.openssl.org/)”
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS” AND ANY EXPRESSED
OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young ([email protected]). This product includes software written by Tim Hudson ([email protected]).
Original SSLeay license
Copyright
©
1995–1998 Eric Young ([email protected]) All rights reserved.
This package is an SSL implementation written by Eric Young ([email protected]). The implementation was written so as to conform with Netscape’s SSL.
This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4,
RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson
31
Sophos Enterprise Console
Copyright remains Eric Young’s, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the following acknowledgement:
“This product includes cryptographic software written by Eric Young ([email protected])”
The word “cryptographic” can be left out if the routines from the library being used are not cryptographic related :-).
4. If you include any Windows specific code (or a derivative thereof) from the apps directory
(application code) you must include an acknowledgement:
“This product includes software written by Tim Hudson ([email protected])”
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG “AS IS” AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE.
The license and distribution terms for any publically available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution license [including the GNU Public License.]
WilsonORMapper
Copyright
©
2007, Paul Wilson
All rights reserved.
32
upgrade guide
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
■
Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
■
Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33
advertisement
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project