1. We need an option under the Enterprise console to view all the endpoints of the entire sub-estate in one place. As an admin, we are finding it very difficult to go inside the sub-estate and view the endpoints.


2. We need an option to move the endpoints from one sub-estate to the other sub-estate.
   (preferably drag and drop)


3. We have a single AD server in place which needs to be synced with all sub-estate.


4. We need a search option in the Add Peripheral Exemptions window.


5. We need a “Model” option in Peripheral Control > peripheral exemptions.


6. We need an option to restart the endpoint system through the Sophos console.

Need to create a canned report to show SVE Virtual servers that are all protected showing version number and the fact that they are protected. In essence to see the vm server that are protected, you must drill down into servers, then sve servers, then virtual machines and click one at a time. WHen you have a hitrust and soc2 audit and they require to see evidence that each individual server is protected, then I have to make 20000 clicks to accomplish this. That is ridiculous. Need a canned report for virtual servers/host names that are protected and what version and such. Not a biggie.

Hi,

Somethimes, managing 1000+ or even 5000+ machine its difficult, even more if we don't have built-in features in the console to remediate/uninstall corrupt/broken installations.

But, the main problem is not that. The problem is that we CANNOT disable Tamper Protection remotely to reinstall/remove Sophos AV, in the following cases:

1) Console was erased/failed and there's no cert/db/registry backup (all Endpoint with Tamper enabled)
2) Broken installations dont apply Tamper Policies (to disable it)
3) Migrated console (don't have the old one).

All this would be solved by having the chance to disable Tamper through Command Line. Example

Case A: Failure in console and no backup.

Solution: Create GPO Policy that disables Tamper with script:

@echo off
c:\program files\Sophos\Sophos Antivirus\DisableTamper.exe /password:TamperPassword
c:\installer\SophosReInit.vbs (to use with migration utility)

Case B: Broken instalation:

Solution: Create SCCM colection that does the following

@echo off
c:\program files\Sophos\Sophos Antivirus\DisableTamper.exe /password:TamperPassword

:: uninstall sophos
MSIEXEC /X{blablabla} /NORESTART
MSIEXEC /X{blablabla} /NORESTART
MSIEXEC /X{blablabla} /NORESTART
....

c:\instaler\SophosEndpoint_Newinstaller.exe

I mean, you get the idea. If I get the chance to disable Tamper through command line, it helps me to do more thing remotely without bothering the final user and the admin people.

Not asking to disable all without any proof that I manage the system, but if I do know the password, I should be able to put it, either GUI or CLI, specially the CLI, to help automatize.

Thanks,

Antonio.

SMTP configuration

Please define global smtp server configuration to use for all mail alerts on policies

You can also define one of global server settings for smtp server. And you can use this setting for all policies by activating related mail alerts.

I have to maintain all of policies and mail configurations, isn’t it ?

It is not best solution to define smtp server policy by policy. As you see as below, I have too many policies and in this solution it is increasing my operation cost .

And review other products feature for smtp alerts as same as mcafee that I used before.

Hello,

when using on-access from the Sophos Enterprise Console (SEC):

• currently 2 modes are possible for exclusions:
  " Exclude Items": Files and directories can be excluded by path.
  " Exclude remote files": Excluding remote files currently excludes the following by filesystem: nfs, cifs, smb, smbfs,coda, afs




• Our customers need possibility in SEC to exclude as much filesystems as the command « ExcludeFileSystems » permits to do in the Sophos Linux agent, which supported FS list is :
  https://community.sophos.com/kb/en-us/118932

Example:
To have possibility to only exclude a filesystem of type "fuse" from the SEC.

Is it an evolution planned in the SEC?

Thanks.
Regards