Sophos Endpoint Upgrade Guide
Sophos Endpoint is a powerful endpoint protection solution that provides comprehensive security for your devices. With its advanced features, Sophos Endpoint helps protect your devices from a wide range of threats, including malware, ransomware, and phishing attacks.
Sophos Endpoint includes the following key features:
- Next-generation antivirus and anti-malware protection: Sophos Endpoint uses advanced machine learning and artificial intelligence to detect and block even the most sophisticated threats.
- Behavioral analysis: Sophos Endpoint monitors the behavior of applications and processes on your devices to identify and block suspicious activity.
Reklaam
Reklaam
Sophos Endpoint Security and Control upgrade guide
For Sophos Enterprise Console users
Product version:
Document date:
10
February 2016
2
Contents
6.2 Configure the update manager to maintain a new subscription..................................9
upgrade guide
1 About this guide
This guide tells you how to upgrade the software that is used to protect your Windows endpoint computers, by changing your software subscription in Sophos Enterprise Console.
Note: If you are using the “Recommended” (default) subscription, you do not need to do anything—your endpoint software is updated automatically.
If you are not using the latest version of Sophos Enterprise Console, we recommend that you upgrade to the latest version. At the time of writing, the latest version of Sophos Enterprise Console is 5.4.0. For instructions on upgrading, see the Sophos Enterprise Console upgrade guide available at http://www.sophos.com/en-us/support/documentation/enterprise-console.aspx
.
For more information about managing software subscriptions in Enterprise Console, see knowledgebase article 110302 .
2 What can I upgrade?
2.1 Endpoint Security and Control
You can upgrade Endpoint Security and Control by changing your software subscription in
Enterprise Console. For information about which version of Endpoint Security and Control or
Sophos Anti-Virus each subscription contains, see knowledgebase article 120189 . To view the release notes, go to http://www.sophos.com/en-us/support/endpoint-release-notes.aspx
.
Software subscription changes
Since version 5.2.1, Sophos Enterprise Console supports new options for getting your automatic updates from Sophos and doesn't support some of the old ones. Depending on the software packages you selected when you installed an older version of Sophos Enterprise Console, you may need to change your software subscription settings before you upgrade Sophos Enterprise
Console. See the section Will I get the same updates as before? in the Sophos Enterprise Console
upgrade guide. For additional information about these changes, see knowledgebase article 119216 .
Labeled versions
If you want to continue using your existing labeled versions (for example, Recommended or
Extended) of Sophos endpoint security software, you can do so while Sophos supports them. If
Sophos stops supporting a labeled version you are subscribed to, you will be warned about this well in advance, and you will eventually be automatically upgraded to a new version.
If you want to evaluate new versions of the software before placing them on your main network, you may want to consider using Preview versions in your test environment.
3
Sophos Endpoint Security and Control
Fixed versions
Fixed versions are regularly updated with new threat detection data, but not with the latest software version.
If you are subscribed to a fixed version of Sophos Endpoint Security and Control, for example,
10.3.1 VDL5.01G, and want to continue using that version, you can do so while Sophos still supports that version.
■ Fixed versions in Enterprise Console 5.2.1, 5.2.2, 5.3.0, or 5.3.1
If you are subscribed to a fixed version in Enterprise Console 5.2.1, 5.2.2, 5.3.0, or 5.3.1, every time you open a subscription that contains a fixed version, you will see a warning message saying that Sophos is retiring the use of fixed versions. If you unsubscribe from a fixed version in Enterprise Console, it will be permanently removed from the list of available versions, unless you have enabled the use of fixed packages in the registry as described in knowledgebase article 117348 .
■ Fixed versions in Enterprise Console 5.4.0
Enterprise Console 5.4.0 brings back fixed version software packages.
By default, on new installations of Enterprise Console 5.4.0, the use of fixed packages is disabled.
If in an earlier version of Enterprise Console you were subscribed to a fixed software version and didn't change your software subscription before upgrading to version 5.4.0, the use of fixed packages will be enabled automatically during the upgrade.
Tip: If you are subscribed to a fixed software version, we recommend that, to ensure best protection, you change your subscription to a "recommended" package.
If you haven’t used fixed version software packages before but want to do so, you can enable the use of fixed packages under Tools > Configure Use of Fixed Packages. When the use of fixed packages is enabled, they are displayed in the Software Subscription dialog box and you can subscribe to them.
Note: If you use role-based administration, you must have the System configuration right to configure the use of fixed packages.
If you disable the use of fixed packages while you are still subscribed to a fixed package, you will still be subscribed to that package and it will continue to be downloaded until you unsubscribe from it. However, you won’t be able to view or re-subscribe to another fixed package.
If you have remote consoles, changing this configuration option in one of them will take effect in all consoles. If you have enabled the use of fixed packages in the registry as described in knowledgebase article 117348 , the registry setting will take effect only on the computer where it has been configured, and it will take precedence over the configuration option in the console.
Lifecycle of fixed versions
Fixed versions are downloaded for as long as they are available from Sophos. If a fixed version is due to retire, you will see an alert in the Update managers view next to any update managers that are subscribed to that version. If email alerting is active, the administrator will also receive an email alert.
4
upgrade guide
When Sophos stops supporting a fixed version that you are subscribed to, Enterprise Console will automatically redefine the subscription to use the oldest fixed version that is still available.
Your computers will be upgraded automatically.
If you use a version earlier than Enterprise Console 5.2.1, a fixed version that is no longer supported will be upgraded automatically provided that you leave selected the check box
Automatically upgrade fixed version software when it is no longer supported by Sophos in the Software Subscription dialog box. If you don't want Sophos security software on your endpoint computers to be upgraded automatically, you can clear the Automatically upgrade
fixed version software when it is no longer supported by Sophos check box. Be aware, however, that running unsupported software leaves you unprotected against new security threats.
Therefore, we recommend that you upgrade any unsupported versions as soon as possible.
Since Enterprise Console 5.2.1, the option Automatically upgrade fixed version software when
it is no longer supported by Sophos is always enabled and is no longer displayed in the user interface. You cannot disable it.
For more information about labeled and fixed versions of the software, see the Enterprise Console
Help, in the section about configuring software subscriptions.
2.2 Sophos Disk Encryption
There is no upgrade for Sophos SafeGuard encryption agent 5.61. If you use Sophos Disk
Encryption managed by Enterprise Console, the software will continue to work as before.
Note: Sophos Disk Encryption 5.61 is not supported on Windows 8 or later.
Sophos Disk Encryption 5.61 retires at the end of March 2016. If you use Sophos Disk Encryption and manage it via the Full disk encryption policy in Enterprise Console, we recommend that you either upgrade to SafeGuard Enterprise or uninstall it. For details, see the "Sophos Disk
Encryption" section in the Sophos Enterprise Console upgrade guide available at http://www.sophos.com/en-us/support/documentation/enterprise-console.aspx
.
Important:
■ If you use Enterprise Console to manage encryption, do not install SafeGuard Enterprise on the server where the Enterprise Console management server is installed.
■ Do not delete encrypted computers from Enterprise Console. Encryption recovery may not be possible in this case.
3 Check the requirements
If you are going to install Endpoint Security and Control on new computers for the first time, you must prepare the computers for the installation.
Follow the set of instructions relevant to your version of Enterprise Console and network type in the Preparing computers for deployment section of the Sophos endpoint deployment guide .
For a full list of supported platforms, see knowledgebase article 118621 .
5
6
Sophos Endpoint Security and Control
4 Decide which type of upgrade to perform
You can choose between two upgrade approaches when you upgrade the Sophos security software on your endpoint computers:
■ If you want to begin using the latest versions of the security software immediately, you can upgrade your endpoint computers in one step.
See
Upgrade protection immediately
(page 6).
■ If you want to try out the latest versions of the security software before upgrading all computers, you can upgrade your endpoint computers gradually.
See
Upgrade protection gradually (page 8).
5 Upgrade protection immediately
To upgrade your Windows computers immediately, you change your existing software subscriptions to download the new version of the endpoint security software.
To change your existing software subscriptions:
1. In Enterprise Console, on the View menu, click Update Managers.
2. In the Software Subscriptions pane, double-click the subscription you want to change.
The Software Subscription dialog box appears.
3. Under Windows, click in the Version field, and then click again.
upgrade guide
4. In the list of available versions, select the type of update you want to download for Sophos
Endpoint Security and Control.
Normally, you subscribe to the “Recommended” version to ensure that your software is kept up to date automatically. For information about what other types of version are available, see the Enterprise Console Help, in the section about configuring software subscriptions.
The next time Enterprise Console downloads updates, it will download the new version of the endpoint software. Your Windows computers will then upgrade themselves to the latest selected version automatically.
You do not need to perform any other configuration steps:
■ The update manager is already configured to maintain the subscription and distribute the software into update shares on the network.
■ You already have updating policies that refer to that subscription and are applied to your
Windows computers.
Notes
■
■
To deploy the patch agent to your Windows computers, you must reprotect them using the
Protect computers wizard. You must do this even if they have an earlier version of Sophos
Endpoint Security and Control installed. For more information, see Protecting computers in the Sophos Enterprise Console Help.
During the Sophos Client Firewall installation, there will be a temporary disconnection of network adapters. The interruption may cause the disconnection of networked applications, such as Remote Desktop.
7
8
Sophos Endpoint Security and Control
6 Upgrade protection gradually
If you want to test the new software on a small group of computers before releasing it to the network, you can create a new software subscription.
After you have created a new subscription, you will need to perform the following steps:
■
■
■
Configure the update manager to maintain the subscription: that is, download the software from Sophos and put it in network shares from which endpoint computers will update.
Configure your updating policies to update the computers with the software specified in the subscription.
Upgrade endpoint computers by applying the new updating policies to them.
6.1 Create a new software subscription
To create a new software subscription:
1. In Enterprise Console, on the View menu, click Update Managers.
2. In the Software Subscriptions pane, click the Add button at the top of the pane to create a new subscription.
In the Software Subscription dialog box that appears, type in a name for the subscription.
Alternatively, if you want to create a copy of an existing subscription, select the subscription, right-click and click Duplicate Subscription. Type a new name for the subscription and then double-click it to open the Software Subscription dialog box.
3. Under Windows, click in the Version field, and then click again.
A drop-down list of available versions appears.
upgrade guide
4. Select the type of update you want to download for Sophos Endpoint Security and Control.
Normally, you subscribe to the “Recommended” version to ensure that your software is kept up to date automatically. For information about what other types of version are available, see the Enterprise Console Help, in the section about configuring software subscriptions.
After you have created a new software subscription, configure the update manager to maintain it as described in
Configure the update manager to maintain a new subscription (page 9).
You can also set up subscription email alerts. For more information about subscription email alerts, see the topic Set up software subscription alerts in the Setting up alerts and messages section of the Enterprise Console Help.
6.2 Configure the update manager to maintain a new subscription
If you created a new subscription for the new software version, now configure the update manager to maintain this subscription.
To configure the update manager to maintain a new subscription:
1. In the Update managers view, select the update manager, right-click and click View/Edit
Configuration.
9
Sophos Endpoint Security and Control
2. In the Configure update manager dialog box, on the Subscriptions tab, select the software subscription in the list of available subscriptions.
To view the details of the subscription, for example, what software is included in the subscription, click View details.
3. To move the selected subscription to the “Subscribed to” list, click the > button.
10
By default, the software is downloaded to the share \\<ComputerName>\SophosUpdate , where ComputerName is the name of the computer where the update manager is installed. You can specify additional shares as described in
Specify where the software is placed (page 10).
If you want to download the new version immediately, select the update manager, right-click and click Update Now.
6.3 Specify where the software is placed
After you have selected which software to download, you can specify where it should be placed on the network. By default, the software is placed in a UNC share
\\<ComputerName>\SophosUpdate , where ComputerName is the name of the computer where the update manager is installed.
You can distribute downloaded software to additional shares on your network. To do this, add an existing network share to the list of available shares and then move it to the list of update shares as described below.
upgrade guide
To specify where the software is placed:
1. In the Configure update manager dialog box, on the Distribution tab, select a software subscription from the list.
2. Select a share from the “Available” shares list and move it to the “Update to” list by clicking the > button.
The default share \\<ComputerName>\SophosUpdate is always present in the “Update to” list. You cannot remove this share from the list.
The “Available” shares list includes all the shares that Enterprise Console knows about and that are not already being used by another update manager.
You can add an existing share to or remove a share from the “Available” shares list, using the
Add or Remove button.
3. If you want to enter a description for a share or credentials needed to write to the share, select the share and click Configure.
4. In the Share manager dialog box, enter the description and credentials.
The software that you have selected is downloaded to the shares that you have specified during the next scheduled update.
If you want to download the software immediately, select the update manager, right-click and click
Update Now.
6.4 Configure your updating policies
If you created a new software subscription, and then configured the update manager to maintain this subscription, now configure your updating policies to update the computers with the software specified in the subscription.
You can choose either of the following options.
■ Create new updating policies
You can create new updating policies that will refer to the new subscription and point to the update shares set up for it in the update manager. For information on how to do this, see
Create a new updating policy (page 11).
If you choose this option, you will then need to apply the new policies to endpoint computers to upgrade them and keep up to date with the new version.
■ Change your existing updating policies
You can change your existing updating policies to refer to the new subscription. For example, if you want to do a staged rollout, you can change one policy at a time. For information on how
to do this, see Change a subscription in an existing updating policy
(page 13).
If you choose this option, your endpoint computers will be upgraded to the new version next time they check for updates.
6.4.1 Create a new updating policy
1. In the Endpoints view, Policies pane, right-click Updating, and then click Create policy.
11
Sophos Endpoint Security and Control
2. Type the name for the new policy.
3. Right-click the new policy, and then click View/Edit Policy.
4. In the Updating policy dialog box, click the Subscription tab, and then select the subscription for the software you want to keep up to date.
12
5. On the Primary server tab, in the Address field, accept the default or specify a different share
(UNC path or web address) from which endpoint computers will usually download updates.
By default, computers update from a UNC share \\<ComputerName>\SophosUpdate, where
ComputerName is the name of the computer where the update manager is installed.
Important: If you choose to use an HTTP location (for example, a web update share) or a share that is not maintained by a managed update manager, Enterprise Console will not be able to check that the software specified in the subscription policy is available at that address.
You must manually ensure that the share contains the software that is specified in the subscription policy. Otherwise, computers will not be updated.
6. If you have Macs that you want to manage from Enterprise Console and you specified a UNC path in the Address field, under Mac OS-specific options, select a protocol that Macs will use to access the update share.
7. If necessary, in the Username field, enter the username for the account that will be used to access the server, and then enter and confirm the password. This account should have read rights to the share you entered in the address field above.
Note: If the username needs to be qualified to indicate the domain, use the form domain\username.
upgrade guide
8. If you access the update source via a proxy server, click Proxy details. In the Proxy details dialog box, select Access the server via a proxy. Then enter the proxy server Address and
Port number. Enter a Username and Password that give access to the proxy server. If the username needs to be qualified to indicate the domain, use the form domain\username.
You can now apply this policy to a group or groups of computers to keep them up to date with
your chosen security software. Go to Apply a new updating policy to a group of Windows computers
(page 13).
You can also limit the bandwidth used, set up an alternative source for updates, or change the default schedule, logging, and initial install source details, if you wish. For more information about configuring updating policies, see the section Configuring the updating policy in the Sophos
Enterprise Console Help.
6.4.2 Apply a new updating policy to a group of Windows computers
To apply a new updating policy to a group of computers:
1. In the Policies pane, highlight the updating policy.
2. Click the policy and drag it onto the group to which you want to apply the policy. When prompted, confirm that you want to continue.
Alternatively, you can right-click a group and select View group policy details. You can then select policies for that group from drop-down menus.
During the next update, computers will be upgraded to the new version of the security software.
Notes
■
■
To deploy the patch agent to your Windows computers, you must reprotect them using the
Protect computers wizard. You must do this even if they have an earlier version of Sophos
Endpoint Security and Control installed. For more information, see Protecting computers in the Sophos Enterprise Console Help.
During the Sophos Client Firewall installation, there will be a temporary disconnection of network adapters. The interruption may cause the disconnection of networked applications, such as Remote Desktop.
6.4.3 Change a subscription in an existing updating policy
If you created a new software subscription, and then configured the update manager to maintain this subscription, now change your existing updating policies to refer to the new subscription.
1. In the Endpoints view, Policies pane, right-click the policy you want to configure, and then click View/Edit Policy.
13
Sophos Endpoint Security and Control
2. In the Updating policy dialog box, click the Subscription tab, and then select the subscription for the software you want to keep up to date.
14
7 Technical support
You can find technical support for Sophos products in any of these ways:
■ Visit the SophosTalk community at community.sophos.com/ and search for other users who are experiencing the same problem.
■
■
■
Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx
.
Download the product documentation at www.sophos.com/en-us/support/documentation.aspx
.
Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/support-query.aspx
.
upgrade guide
8 Legal notices
Copyright © 2012–2015 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos
Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
15
Laadi alla
Avalik link on uuendatud
Teie vestluse avalik link on uuendatud. You may view and manage your chat links after registration here.
Dokumendi avalik link
Reklaam