Sophos Endpoint updates, cache and Message Relay
Sophos Endpoint updates automatically by default. Update Management controls when product versions become available and which software package a device uses. Current detection data for new threats continues to arrive and should not wait for a maintenance window.
A managed Endpoint checks for updates for the first time five minutes after the device starts and then automatically every 60 minutes. This interval cannot be reduced below 60 minutes. Update Now triggers an additional manual run when required, but does not replace a permanently working update source.
Update Cache and Message Relay solve two different problems. The cache avoids repeated downloads, while the relay carries management communication to Sophos Central.
Keep three layers separate
| Layer | Purpose | Common mistake |
|---|---|---|
| Update Management policy | timing and package by target | treated as a total update block |
| Update Cache | download once and distribute internally | deployed without capacity or failover |
| Message Relay | broker Central communication | confused with a proxy or cache |
A Message Relay can only run on a server that also hosts an Update Cache.
Software packages
Under Global Settings > Products and Services > Endpoint and Server > Software packages, available types depend on licence and platform:
- Recommended: current features, automatic maintenance, no expiry
- Fixed term support: stable feature version, normally for at least 120 days with at least 60 days of overlap with the next Fixed Term version
- Long term support: 18 months for critical devices under strict change control
- EAP: early features for test environments
- Special: only with a token and instruction from Sophos Support
Fixed-term and long-term packages expire. If no replacement is selected, devices stop receiving new protection updates after expiry. Track the end date and successor package in change management.
Software packages are not available with Intercept X Essentials. A Special package is added only with a token from Sophos Support. If Sophos finds a critical defect in a fixed package, an additional .1 version can appear; devices do not move to it automatically.
Staged rollout
A robust deployment uses at least:
- Pilot: representative devices on Recommended or an early content stage
- Production: the wider estate after a successful pilot
- Critical: business-critical devices on a later stage or justified support package
The First, Second and Last stage content stages sequence detection data within the Sophos rollout. Global permission to change content timing is required. Critical does not automatically mean receiving detection data as late as possible. Balance stability and risk deliberately.
Sophos recommends placing a small representative group in the first stage, the majority in the second and critical devices in the third. Do not place all devices in the last stage: otherwise, the organisation discovers an incompatible Content Update only when no later internal wave remains to pause. Without an explicit stage, Sophos uses the second stage when this control is enabled.
The interval between stages is not fixed; depending on urgency and content, it can range from hours to weeks. Central shows neither the number of stage transitions nor a customer-adjustable delay. Stage selection is therefore a risk classification, not an exact deployment schedule.
Update Management policy
Select the operating-system package, maintenance time and content stage under My Products > Endpoint > Policies > Update Management.
Some actions can override scheduled timing, including Update Now, licence changes and new software assignments. Do not assume that Device Encryption or an agent-mode change waits for the normal maintenance window.
The global Bandwidth Usage setting limits agent downloads on Windows. The default is 256 Kbps. The limit applies neither to the initial installation nor to downloads from an Update Cache. A value set too low can leave Endpoints on an old product version for an extended period.
Plan an Update Cache
A cache helps estates with many devices, constrained WAN bandwidth or sites with repeated downloads. It needs a supported Windows system, at least 5 GB free disk space and reachable TCP port 8191.
For cache and relay together, Sophos recommends Windows Server 2016 or later. A Windows 10 device can be a cache but not a Message Relay. Regardless of minimum documentation, use an operating system currently supported by both Microsoft and Sophos.
Configure it under Global Settings > Products and Services > Endpoint and Server > Manage Update Caches and Message Relays.
Plan a Message Relay
A relay helps devices that cannot reach Sophos Central directly. In addition to TCP 8191 for the cache, it uses TCP 8190 for management communication.
The installer opens these ports in the local Windows Firewall. Network firewalls, VLAN rules and host hardening must still allow the path explicitly.
macOS devices can obtain updates from a cache but cannot use a Message Relay. Linux devices can use both caches and relays, but Central manages them in the Server or workload area rather than through the Endpoint installer. Verify exact platform behaviour before designing an isolated network.
Automatic and manual assignment
Central normally assigns devices automatically to a suitable cache or relay. Special networks can use manual assignment.
Before removing a cache or relay, reassign manually attached devices. Central then removes the component, closes local ports and uses another service where available. Without any cache or relay, devices attempt a direct Sophos connection.
Resilience
A single cache or relay must not become an unnoticed single point of failure. The operating plan includes:
- at least one alternative direct or relayed path
- monitoring of reachability, storage and service state
- documented IP addresses, ports and assigned networks
- maintenance order for multiple caches
- exclusion of this infrastructure from automatic device cleanup
In isolated networks, test the initial installation path after the cache and relay are available. A new endpoint also needs access to the required Sophos components during setup.
Don’t use update caches
An Update Management policy can enable Don’t use update caches. Affected devices update directly from Sophos and stop using Message Relays.
This can suit mobile devices or troubleshooting. In a network without direct Sophos access, it can break communication and updates.
Separate update errors by cause
SophosUpdate.log provides the first reliable error. Clear a cache only after separating the download path, DNS, proxy, file integrity, and component installation.
Error 12007 to the Update Cache
WinHttpSendRequest error 12007 means The server name or address could not be resolved. The endpoint cannot resolve the assigned Update Cache hostname. Check A and AAAA responses, search suffix, split DNS, and name resolution from the affected network. An open port 8191 does not repair missing DNS resolution.
Checksum error and Out of update sources
SUL-Log [E73342] Checksum error followed by Out of update sources means that the downloaded file does not match its expected hash. Download the named file through the same proxy, cache, and security-appliance path and compare its MD5 value with the Sophos object filename. A mismatch proves modification between Sophos and the endpoint, often by a cache, proxy, or web appliance. Correct that intermediate system; do not disable agent integrity checks.
SUL-Log [E59264] Cannot locate server instead indicates an unreachable or blocked update path. A browser download is meaningful only through the same proxy and network devices. If a block page appears instead of the file, allow the current Sophos domains and ports on the responsible control.
Message Relay is mistakenly used as a proxy
If access.rlog shows a 403 for CONNECT dci.sophosupd.com:443 and httpd.rlog contains client denied by server configuration or Maximum connection count exceeded, check the Central proxy configuration. A Message Relay is not a general web proxy and must not be entered as a proxy server. Remove it under General Settings > Proxy Configuration while keeping its relay assignment separate.
Cache stops working after a licence change
An Update Cache normally holds only the required Endpoint and Server licence identities. After licence expiry, replacement, or renewal, it can retain a Device Encryption identity while the endpoint again requests with the Endpoint identity. Couldn't find DCI for user on the endpoint and differing warehouseUsers on the cache are typical indicators.
The preferred repair is controlled removal and reinstallation of the Update Cache role. Manually changing cache status, warehouse folders, or licence tokens requires a backup and a current Sophos Support runbook because these files contain credentials and directory names are case-sensitive. Afterwards, start the cache service and manually update a pilot endpoint.
TEMP or TMP prevents component installation
On legacy endpoints, a missing system value TMP can let AutoUpdate download packages but create no component logs in the system temp directory and finish with return code 141. Set TMP to %SystemRoot%\TEMP, restart the device, and run Update Now again.
Core Agent 2023.1 and older could also fail with MoveFile ... The file exists (80) when TEMP or TMP pointed to another drive. Resolve this historical case by moving to a current supported software package. If a legacy system needs a temporary repair, return the system variables to the operating-system drive in a controlled manner and document the dependency in the migration plan.
Operational checks
Monthly, review package expiry, outdated components, cache activity, relay usage, free storage and unreachable infrastructure. Test one device per site after every change.
Locally, About shows installed versions. In Central, the Policies tab links to the effective Update Management policy and selected package.
Treat Release Notes as part of the change process
Sophos publishes separate Release Notes for Windows Core Agent, macOS Endpoint and Device Encryption. A Central label such as Recommended does not replace reviewing them: new certificates, platform limits, security fixes and changed components can require a pilot or a prioritised short-term rollout.
As at 26 August 2026, the relevant Windows Core Agent line is 2026.1. Sophos notes updated component certificates, including the root certificate. Devices with automatic root-certificate updates disabled or custom untrusted certificate management can consequently develop installation and communication problems.
On macOS, version 2026.1.1 fixes, among other issues, a local privilege escalation through a compromised NIB file and XPC. Do not assess such a security fix solely according to a fixed monthly routine. Check the current version, actual rollout stage in the tenant and the organisation’s pilot group together.
Central Device Encryption for Windows is now delivered with Windows Core Agent and therefore uses the same version line. During troubleshooting, nevertheless use the affected CDE component log rather than only the Core Agent version number.