Scan Sophos Endpoint on Windows from the CLI

For an individual suspicion, a scan from the local interface is often sufficient. In an RMM Runbook, during Incident Response or for a defined path, the Windows CLI is more precise. It is installed with Sophos Endpoint and also reports Detections to Sophos Fusion (formerly Sophos Central).

Plan and troubleshoot Sophos Endpoint scans covers planning, scheduled scans, runtime analysis and File Scanner health. This article focuses on the Windows CLI and reliable automation.

Path and help

The tool is installed by default at:

C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe

Open PowerShell as the account whose access should apply to a targeted scan. The & call operator starts the quoted executable path; help scan displays the scan options in the installed version:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" help scan

The help from the locally installed version is authoritative. The tool belongs to the Windows agent; this path does not apply to macOS.

Execution model before you start

• Shell: All examples below use PowerShell. In cmd.exe, omit the & call operator; do not mix the two syntaxes.
• Privileges: A user scan of a file, folder, or drive inherits the invoking account’s rights. A system scan with --system instead runs with local system process rights.
• Placeholders: Replace the example paths C:\Users\Public\Downloads, C:\IR\Evidence, and D:\ with the approved target path. Do not type angle-bracket placeholders literally.
• Effect: scan starts a scan immediately. Without --noui, a progress dialog appears; results are shown in Sophos Endpoint, and detected threats are reported to Sophos Fusion.
• Output: With --noui, no interface is shown, detections are written to stdout, and the process remains open until the scan finishes. For a non-fatal run, --json replaces normal stdout output with one JSON object.

Run a system scan

A full system scan runs with the permissions of the local system process:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --system --full --noui

A quick system scan focuses on commonly used files, running and recently executed processes, startup items, MBR and memory:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --system --quick --noui

Do not specify additional targets with --system. Files that the local system process cannot access, such as user-bound EFS content, may remain unscanned.

Scan a file, folder or drive

A targeted scan runs with the permissions of the user invoking it:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --noui "C:\Users\Public\Downloads"

A complete drive requires the trailing backslash:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --noui "D:\"

D: without a backslash normally refers only to the current directory on that drive. UNC paths are supported if the invoking account has access.

Wildcards are allowed in folder and file names, but not drive names. Pre-expansion works only in the final path element: C:/Test/Folder/F*le is expanded; C:/Test/F*lder/File is not.

Archives and detailed output

--expand_archives opens supported archives and scans their contents. This increases runtime and I/O, so use it selectively.

--noui suppresses the interface and waits for the scan to finish. --verbose is valid only in conjunction with it:

& "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe" scan --noui --verbose --expand_archives "C:\IR\Evidence"

Do not write very large verbose output to RMM logs without control. Paths can contain usernames and sensitive project information.

Handle exit codes correctly

When multiple errors occur, the tool returns the highest applicable code. Codes 4 to 7 can therefore accompany threat detections. Also check summary.detections and Sophos Fusion events. Code 0 means a successful scan without malware found within its scope; it does not cover excluded files or an unavailable Live Protection check.

JSON for automation

--json writes a structured result to stdout at the end. Except for fatal errors with code 1 or 2, a script can evaluate the summary and, for a User Scan, the affected files directly:

$cli = "C:\Program Files\Sophos\Endpoint Defense\sophosinterceptxcli.exe"
$json = & $cli scan --noui --json "C:\Users\Public\Downloads"
$exitCode = $LASTEXITCODE

if ($json) {
    $result = $json | ConvertFrom-Json
    $result.summary
}

exit $exitCode

For a User Scan, the output includes targets, Detections, scan errors, unsupported, inaccessible, encrypted and damaged files. A System Scan JSON object contains only type and summary; it does not include file lists.

Live Protection and exclusions

Scans use Live Protection for current SophosLabs information. Without network access or when Live Protection is disabled, the assessment is less complete.

A targeted User Scan respects global and policy exclusions. A manually invoked CLI scan does not suddenly inspect an excluded file fully. Before an incident investigation, check which exclusions actually apply. The Endpoint exclusions guide explains how to check the effective scope.

Validation and escalation

A production Runbook should:

1. Before starting, confirm that the CLI exists at the documented path and use help scan to verify the locally available options.
2. Limit the scope and maximum runtime.
3. Capture stdout, stderr and the exit code separately.
4. Treat code 3 as a Detection and assess other codes individually.
5. Correlate the result with Central Events and Health.
6. Never create an automatic exclusion or deletion solely from the exit code.

The run is validated when the process has finished, its exit code has been captured separately, and the expected output is available. Correlate code 3 with Sophos Fusion events and escalate through the Threat Cleanup Runbook. For codes 4 through 7, review the listed files from a User Scan. A System Scan returns no file list, so preserve and escalate its JSON and console output. Investigate codes 1 or 2 and recurring agent failures with Endpoint Self Help and SDU. These conditions are not interchangeable malware findings.

Frequently asked questions