Automate Sophos Endpoint rollout on Windows

For multiple Windows endpoints, run SophosSetup.exe unattended through software distribution, RMM or a deployment script. More than --quiet matters: Agent Mode, target group, connection path and logging must be defined unambiguously.

The installer is tenant-bound and confidential. Anyone who obtains it can register devices in that Sophos Central account even without portal administration access. After suspected disclosure, old installers can be invalidated under My Environment > Installers. Expire previous installers cannot be undone.

Before bulk rollout

First accept a manual installation on a small pilot. Supported Windows, current patches, administrative rights, open ports and Central connectivity must be available. Existing antivirus is removed through a tested replacement plan.

Choose the target mode explicitly:

• endpoint installs full Endpoint protection without XDR features
• xdr installs XDR and full Endpoint protection
• xdrsensor supplies XDR telemetry alongside separate protection and does not protect against malware itself

Switching to endpoint or xdr can remove competing protection. This is unsuitable as a test across an unvalidated estate.

Basic command

A typical XDR pilot with computer group and tag is:

SophosSetup.exe --quiet --products=xdr --devicegroup="Pilot/Windows" --tag="Rollout-2026"

--devicegroup expects the exact group path. If it does not exist or is wrong, do not assume the intended policy still applies. Verify the effective group in Central after registration.

--nocompetitorremoval skips automatic removal of competing products. Use it only when compatibility and protection responsibility are explicitly resolved. xdrsensor expects separate protection; there is no blanket coexistence promise for full Sophos protection.

Proxy and Message Relay

The installer can receive an explicit proxy, PAC URL or Message Relays. Important options include --proxyaddress, --proxyusername, --proxypassword, --pacurl and --messagerelays.

Passwords must not appear in readable scripts, RMM output or process logs. Supply them at runtime through the deployment platform’s secret facility. Install Message Relay before rollout and make port 8190 reachable.

There is no installer option that directly assigns an initial installation to Update Cache. An existing cache is detected automatically. Where an unprotected device has no direct Sophos access, provide Cache and Message Relay before the first installer run.

Names, token and local source

--computernameoverride and --domainnameoverride replace values registered in Central. Use overrides only with a clear naming strategy because they can obscure mapping to real devices.

--customertoken is intended for automated installation scenarios. --localinstallsource specifies a local installation source. The agent still needs the intended Central communication path.

--traillogging creates a more detailed installation trace for diagnosis. Use it on pilots or targeted failures, not indefinitely for every installation.

Registration without reinstallation

--registeronly registers existing Sophos software with the tenant again. Tamper Protection must first be disabled on the device in a controlled manner. It is particularly relevant for deleted or expired devices but does not repair damaged components. Confirm that the installer belongs to the correct tenant.

Accept the deployment

A successful process code alone is insufficient. On each pilot, check protection status and components locally. In Central verify group, Agent Mode, Health, last activity, effective policies and open installation or restart Alerts.

Installer logs are under C:\ProgramData\Sophos\CloudInstaller\Logs. During diagnosis, retain them with time, command, exit code and network path. Remove credentials before sharing.

Roll out in waves

After the pilot, use small representative waves. Stop when devices are not protected within the expected time, services are missing or restart rates are unusually high. Release the next group only after a stable wave.

The installer can be rerun through RMM or software distribution. Blind continuous retry hides network, proxy or OS problems and creates load. Group failures by cause.

Related articles

The manual basis is Install Sophos Central Endpoint on Windows. Manage Sophos Endpoint Agent Mode and software explains modes. For complete removal use Uninstall Sophos Central Endpoint on Windows.

Frequently asked questions