Deploy Sophos Connect centrally on Windows

Sophos Connect can be installed and provisioned on Windows with computer startup scripts through GPO. Keep three tasks separate: the MSI installs the client, the .pro file controls retrieval of the permitted VPN configurations, and SCCLI reads or changes individual connections. This makes the package, profile, and automation independently verifiable and reversible.

For one workstation, start with Install Sophos Connect on Windows. The provisioning guide explains the structure and security of a .pro file; version selection and upgrade order belong in the Sophos Connect update guide.

Prerequisites and rollout decisions

Decide the following before distribution:

• the Windows release and architecture supported by Sophos and the approved Sophos Connect release;
• IPsec, SSL VPN, or both, including authentication, MFA, and SSO;
• a reachable VPN portal with a certificate trusted by the client;
• a verified MSI and an approved .pro, .scx, or .ovpn source;
• computer-account read access to the startup script, MSI, and profile source where applicable;
• a pilot OU or device group, a maintenance window, and a second administration path;
• the previous, still-supported MSI and matching profile source for rollback.

A software-distribution platform can run the same verified package in the local system context. This does not imply support for a specific Intune or RMM package, detection rule, or return-code implementation. Test the invocation, execution account, detection, and restart handling with the actual deployment tool during the pilot.

Protect the package and profiles

Keep the MSI, script, and profiles in versioned storage that only the responsible administrators can change. Target computers receive read-only access. Before approval, verify the digital signature, product version, and an internally recorded hash. Never replace an approved file under the same name.

A .pro file normally contains no user password, but it can disclose internal gateway names, the VPN portal port, and provisioning settings. .scx, .ovpn, certificate, or preshared-key files can be more sensitive. Do not put them on generally readable shares or in email attachments or tickets. Do not place SCCLI passwords in scripts or process arguments, where processes, logs, and deployment output may expose them.

1. Install the client through GPO

Sophos documents a computer startup script that detects scvpn.exe and silently starts the MSI when the client is absent. Replace the UNC path and the complete MSI filename with the approved source:

@echo off
set "Sophos_Connect=Sophos\Connect\scvpn.exe"
if exist "%ProgramFiles(x86)%\%Sophos_Connect%" exit /b 0

rem Replace the UNC path and filename with the approved MSI source.
msiexec.exe /i "\\WINSERVER\Software\SophosConnect\SophosConnect_x64.msi" /qn
exit /b %ERRORLEVEL%

Add the script in Group Policy Management Console > Computer Configuration > Policies > Windows Settings > Scripts > Startup. gpupdate /force refreshes policy; the startup script runs when the computer next starts.

The file check follows Sophos’s simple pattern, but cannot detect an incorrect or outdated version. Software inventory must therefore verify the installed product version as well. Script code 0 only says that msiexec reported no error; verify the version and service state separately. Treat other MSI results, especially 1641 and 3010, as installer restart results rather than SCCLI codes.

2. Deliver the provisioning file under management

Sophos documents a second startup script. It waits for the scvpn service, downloads the .pro file, and copies it to C:\Program Files (x86)\Sophos\Connect\import\. Sophos Connect imports the file, removes it from this folder, and then retrieves the IPsec and SSL VPN configurations permitted for the user from the VPN portal.

The official pattern waits indefinitely. For a production rollout, this example limits the wait to two minutes and returns the download or copy error when either operation fails:

@echo off
set /a WAIT_COUNT=0

:WAIT_FOR_SCVPN
sc query scvpn | findstr /C:"RUNNING" >NUL
if not errorlevel 1 goto DOWNLOAD_PROFILE
set /a WAIT_COUNT+=1
if %WAIT_COUNT% GEQ 24 exit /b 50
timeout /t 5 /nobreak >NUL
goto WAIT_FOR_SCVPN

:DOWNLOAD_PROFILE
powershell.exe -NoProfile -Command "$ErrorActionPreference='Stop'; Invoke-WebRequest 'https://software.example.net/vpn/company.pro' -OutFile '%TEMP%\company.pro'"
if errorlevel 1 exit /b %ERRORLEVEL%
copy /Y "%TEMP%\company.pro" "C:\Program Files (x86)\Sophos\Connect\import\company.pro" >NUL
exit /b %ERRORLEVEL%

software.example.net is a placeholder. The real HTTPS host needs a trusted certificate and restrictive access controls. During the pilot, compare the downloaded content with the approved source. Local code 50 in this startup script identifies its self-imposed timeout and is not an SCCLI code. Maintain the JSON structure, vpn_portal_port, MFA fields, and multiple gateways in the provisioning guide.

3. Automate SCCLI under control

SCCLI is typically located in C:\Program Files (x86)\Sophos\Connect. The official help uses sccli ? to list commands. Read the version and existing connections as follows:

cd /d "C:\Program Files (x86)\Sophos\Connect"
sccli show -v
if errorlevel 1 exit /b %ERRORLEVEL%
sccli list -d
set "SCCLI_RC=%ERRORLEVEL%"
exit /b %SCCLI_RC%

Add a locally staged profile with a unique name as follows:

sccli add --file "C:\ProgramData\Company\VPN\branch.scx" --name "Company VPN" --overwrite
set "SCCLI_RC=%ERRORLEVEL%"
exit /b %SCCLI_RC%

add fails where policy does not permit unmanaged connections. remove --name "Company VPN" can only remove connections created with add, not managed connections. enable and disable change tunnel state; enable prompts interactively when required credentials are absent. An unattended process must not simply supply a clear-text value through --password.

Documented SCCLI return codes

Save the code immediately after every SCCLI call. A later command can overwrite %ERRORLEVEL%.

Some deployment systems represent -1 as an unsigned process code. Test the evaluation with the exact wrapper intended for production. Treat unknown codes as failures; log the time, client version, device context, and command without secrets.

Pilot, release, and rollback

A version change can interrupt active VPN connections. Test silent removal and installation with the specific MSI or its version-dependent product ID. Keep standard MSI results separate from SCCLI results.

The pilot covers every Windows architecture, profile type, and authentication path being approved. Verify:

1. Signature, hash, and installed target version.
2. scvpn and Sophos Connect startup after a restart and user sign-in.
3. Successful .pro import or the expected SCCLI output.
4. Sign-in, MFA or SSO, and the assigned VPN address.
5. Internal DNS resolution and one permitted and one deliberately blocked destination.
6. Reconnection after a network change and after signing in again.
7. Deployment, MSI, and SCCLI codes in the central log.

Only then proceed through staged rings. After each ring, compare the package version and profile name with the intended state, run sccli list -d, and test the expected data path. A green client status alone does not prove DNS, authorization, or return traffic.

If an incident occurs, stop further distribution and first preserve the time, codes, client version, and support data. Remove the faulty version through the approved uninstall path, install the saved and still-supported MSI, and restore its matching profile source. Repeat the full pilot test to confirm the rollback.

If rollback also fails, continue with Sophos Connect troubleshooting on Windows. Check firewall rules and the data path separately with Test a firewall rule instead of changing the package or profile on suspicion.