Scan Sophos Endpoint on Windows from the CLI

For an individual suspicion, a scan from the local interface is often sufficient. In an RMM Runbook, during Incident Response or for a defined path, the Windows CLI is more precise. It is installed with Sophos Endpoint and also reports Detections to Sophos Central.

Plan and troubleshoot Sophos Endpoint scans covers planning, scheduled scans, runtime analysis and File Scanner health. This article focuses on the Windows CLI and reliable automation.

Path and help

The tool is installed by default at:

C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe

An administrative PowerShell displays the available scan options:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" help scan

The help from the locally installed version is authoritative. The tool belongs to the Windows agent; this path does not apply to macOS.

Run a system scan

A full system scan runs with the permissions of the local system process:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --system --full --noui

A quick system scan focuses on commonly used files, running and recently executed processes, startup items, MBR and memory:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --system --quick --noui

Do not specify additional targets with --system. Files that the local system process cannot access, such as user-bound EFS content, may remain unscanned.

Scan a file, folder or drive

A targeted scan runs with the permissions of the user invoking it:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --noui "C:\Users\Public\Downloads"

A complete drive requires the trailing backslash:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --noui "D:\"

D: without a backslash normally refers only to the current directory on that drive. UNC paths are supported if the invoking account has access.

Wildcards can be used in folder and file names, but not in drive names. Expansion in the final path element is more reliable than a wildcard expression in a parent folder.

Archives and detailed output

--expand_archives opens supported archives and scans their contents. This increases runtime and I/O, so use it selectively.

--noui suppresses the interface and waits for the scan to finish. --verbose is valid only in conjunction with it:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --noui --verbose --expand_archives "C:\IR\Evidence"

Do not write very large verbose output to RMM logs without control. Paths can contain usernames and sensitive project information.

Handle exit codes correctly

When several states occur, the tool returns the most severe code. A non-zero value therefore does not automatically mean malware. Conversely, code 0 does not prove that every conceivable file was accessible and every cloud query succeeded.

JSON for automation

--json writes a structured result to stdout at the end. Except for fatal errors with code 1 or 2, a script can evaluate the summary and affected files directly:

$cli = "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe"
$json = & $cli scan --noui --json "C:\Users\Public\Downloads"
$exitCode = $LASTEXITCODE

if ($json) {
    $result = $json | ConvertFrom-Json
    $result.summary
}

exit $exitCode

For a User Scan, the output includes targets, Detections, scan errors, unsupported, inaccessible, encrypted and damaged files. A system scan provides a more compact summary.

Live Protection and exclusions

Scans use Live Protection for current SophosLabs information. Without network access or when Live Protection is disabled, the assessment is less complete.

A targeted User Scan respects global and policy exclusions. A manually invoked CLI scan does not suddenly inspect an excluded file fully. Before an incident investigation, check which exclusions actually apply.

Secure RMM Runbook

A production Runbook should:

1. Check the existence and version of the CLI.
2. Limit the scope and maximum runtime.
3. Capture stdout, stderr and the exit code separately.
4. Treat code 3 as a Detection and assess other codes individually.
5. Correlate the result with Central Events and Health.
6. Never create an automatic exclusion or deletion solely from the exit code.

After a Detection, follow the Threat Cleanup Runbook. For deeper agent problems, use Endpoint Self Help and SDU.

Frequently asked questions