Sophos Endpoint updates, cache and Message Relay

Sophos Endpoint updates automatically by default. Update Management controls when product versions become available and which software package a device uses. Current detection data for new threats continues to arrive and should not wait for a maintenance window.

A managed Endpoint checks for updates for the first time five minutes after the device starts and then automatically every 60 minutes. This interval cannot be reduced below 60 minutes. Update Now triggers an additional manual run when required, but does not replace a permanently working update source.

Update Cache and Message Relay solve two different problems. The cache avoids repeated downloads, while the relay carries management communication to Sophos Central.

Keep three layers separate

A Message Relay can only run on a server that also hosts an Update Cache.

Update integrity

Sophos downloads update files over HTTPS, uses a Sophos-signed manifest, and installs only binaries that are both listed in that manifest and signed by Sophos. An Update Cache does not change this trust chain; it provides approved content closer to the endpoint.

Do not bypass signature or manifest checks after an integrity failure. Investigate system time, the HTTPS path, proxy or TLS inspection, cache health, and the original source. Custom files or manually changed packages do not belong in the Sophos update path.

Software packages

Under Global Settings > Products and Services > Endpoint and Server > Software packages, available types depend on licence and platform:

• Recommended: current features, automatic maintenance, no expiry
• Fixed term support: stable feature version, normally for at least 120 days with at least 60 days of overlap with the next Fixed Term version
• Long term support: 18 months for critical devices under strict change control
• EAP: early features for test environments
• Special: only with a token and instruction from Sophos Support

Fixed-term and long-term packages expire. If no replacement is selected, devices stop receiving new protection updates after expiry. Track the end date and successor package in patch and change management.

Software packages are not available with Intercept X Essentials. A Special package is added only with a token from Sophos Support. If Sophos finds a critical defect in a fixed package, an additional .1 version can appear; devices do not move to it automatically.

Staged rollout

A robust deployment uses at least:

1. Pilot: representative devices on Recommended or an early content stage
2. Production: the wider estate after a successful pilot
3. Critical: business-critical devices on a later stage or justified support package

The First, Second and Last stage content stages sequence detection data within the Sophos rollout. Global permission to change content timing is required; Sophos limits this feature to Admin and Super Admin roles. Critical does not automatically mean receiving detection data as late as possible. Balance stability and risk deliberately.

Sophos recommends placing a small representative group in the first stage, the majority in the second and critical devices in the third. Do not place all devices in the last stage: otherwise, the organisation discovers an incompatible Content Update only when no later internal wave remains to pause. Without an explicit stage, Sophos uses the second stage when this control is enabled.

The interval between stages is not fixed; depending on urgency and content, it can range from hours to weeks. Central shows neither a device’s exact Content version nor reliably whether it already has the very latest content. Sophos can shorten the interval, but does not skip the selected stage even for critical updates. If a reproducible Content issue occurs, temporarily move the remaining policies to the third stage and provide Sophos Support with device logs and the relevant time window.

Update Management policy

Set the day and time directly in the Central device policy:

1. Open My Products > Endpoint > Policies and create an Update Management policy or open an existing one. This policy type can be assigned to devices, not users.
2. Open the Settings tab and turn the policy on.
3. Enable Scheduled Updates, then use the day and time fields to choose when product updates become available. The time is local to each computer, so devices in different time zones do not start together. A computer that is off updates after it next starts.
4. Under Software packages, select for each operating system the package already tested with the pilot group. If global content timing is enabled, also select the intended content stage. Leave Don’t use update caches off while a device requires an Update Cache or Message Relay.
5. Save the changes and apply them to the pilot group first. Check the effective policy and package in Central and the installed version under About on the endpoint before expanding to the next group.

The selected window is an availability time, not a guaranteed installation to the minute or a complete update block. Update Now performs a full check immediately; licence changes and new software assignments can also override the schedule. Do not assume that Device Encryption or an agent-mode change waits for the normal maintenance window. Automatic protection updates for new threats continue, and Sophos does not skip a selected content stage even for critical updates.

The global Bandwidth Usage setting limits agent downloads on Windows. The default is 256 Kbps. The limit applies neither to the initial installation nor to downloads from an Update Cache. A value set too low can leave Endpoints on an old product version for an extended period.

Plan an Update Cache

A cache helps estates with many devices, constrained WAN bandwidth or sites with repeated downloads. It needs a supported Windows system, at least 5 GB free disk space and reachable TCP port 8191.

For cache and relay together, Sophos recommends Windows Server 2016 or later. A Windows 10 device can be a cache but not a Message Relay. Regardless of minimum documentation, use an operating system currently supported by both Microsoft and Sophos.

Configure it under Global Settings > Products and Services > Endpoint and Server > Manage Update Caches and Message Relays.

Plan a Message Relay

A relay helps devices that cannot reach Sophos Central directly. In addition to TCP 8191 for the cache, it uses TCP 8190 for management communication.

The installer opens these ports in the local Windows Firewall. Network firewalls, VLAN rules and host hardening must still allow the path explicitly.

macOS devices can obtain updates from a cache but cannot use a Message Relay. Linux devices can use both caches and relays, but Central manages them in the Server or workload area rather than through the Endpoint installer. Verify exact platform behaviour before designing an isolated network.

Automatic and manual assignment

Central normally assigns devices automatically to a suitable cache or relay. Special networks can use manual assignment.

Before removing a cache or relay, reassign manually attached devices. Central then removes the component, closes local ports and uses another service where available. Without any cache or relay, devices attempt a direct Sophos connection.

Resilience

A single cache or relay must not become an unnoticed single point of failure. The operating plan includes:

• at least one alternative direct or relayed path
• monitoring of reachability, storage and service state
• documented IP addresses, ports and assigned networks
• maintenance order for multiple caches
• exclusion of this infrastructure from automatic device cleanup

In isolated networks, test the initial installation path after the cache and relay are available. A new endpoint also needs access to the required Sophos components during setup.

Don’t use update caches

An Update Management policy can enable Don’t use update caches. Affected devices update directly from Sophos and stop using Message Relays.

This can suit mobile devices or troubleshooting. In a network without direct Sophos access, it can break communication and updates.

Separate update errors by cause

SophosUpdate.log provides the first reliable error. Clear a cache only after separating the download path, DNS, proxy, file integrity, and component installation.

Error 12007 to the Update Cache

WinHttpSendRequest error 12007 means The server name or address could not be resolved. The endpoint cannot resolve the assigned Update Cache hostname. Check A and AAAA responses, search suffix, split DNS, and name resolution from the affected network. An open port 8191 does not repair missing DNS resolution.

Checksum error and Out of update sources

SUL-Log [E73342] Checksum error followed by Out of update sources means that the downloaded file does not match its expected hash. Download the named file through the same proxy, cache, and security-appliance path and compare its MD5 value with the Sophos object filename. A mismatch proves modification between Sophos and the endpoint, often by a cache, proxy, or web appliance. Correct that intermediate system; do not disable agent integrity checks.

SUL-Log [E59264] Cannot locate server instead indicates an unreachable or blocked update path. A browser download is meaningful only through the same proxy and network devices. If a block page appears instead of the file, allow the current Sophos domains and ports on the responsible control.

Message Relay is mistakenly used as a proxy

If access.rlog shows a 403 for CONNECT dci.sophosupd.com:443 and httpd.rlog contains client denied by server configuration or Maximum connection count exceeded, check the Central proxy configuration. A Message Relay is not a general web proxy and must not be entered as a proxy server. Remove it under Global Settings > Products and Services > Endpoint and Server > Proxy Configuration while keeping its relay assignment separate.

Cache stops working after a licence change

An Update Cache normally holds only the required Endpoint and Server licence identities. After licence expiry, replacement, or renewal, it can retain a Device Encryption identity while the endpoint again requests with the Endpoint identity. Couldn't find DCI for user on the endpoint and differing warehouseUsers on the cache are typical indicators.

The preferred repair is controlled removal and reinstallation of the Update Cache role. Manually changing cache status, warehouse folders, or licence tokens requires a backup and a current Sophos Support runbook because these files contain credentials and directory names are case-sensitive. Afterwards, start the cache service and manually update a pilot endpoint.

TEMP or TMP prevents component installation

On legacy endpoints, a missing system value TMP can let AutoUpdate download packages but create no component logs in the system temp directory and finish with return code 141. Set TMP to %SystemRoot%\TEMP, restart the device, and run Update Now again.

Core Agent 2023.1 and older could also fail with MoveFile ... The file exists (80) when TEMP or TMP pointed to another drive. Resolve this historical case by moving to a current supported software package. If a legacy system needs a temporary repair, return the system variables to the operating-system drive in a controlled manner and document the dependency in the migration plan.

Operational checks

Monthly, review package expiry, outdated components, cache activity, relay usage, free storage and unreachable infrastructure. Test one device per site after every change.

Locally, About shows installed versions. In Central, the Policies tab links to the effective Update Management policy and selected package.

Pilot, validate and roll back

1. Record the candidate host, free space, DNS name, routed client networks and the permitted paths to TCP 8191; include TCP 8190 only when Message Relay is required. Confirm a direct or second cache/relay path before making the host operationally critical.
2. In Global Settings > Products and Services > Endpoint and Server > Manage Update Caches and Message Relays, filter for Cache Capable Servers or Cache Capable Computers, select one pilot host and choose Set Up Cache or, on a server, Set Up Cache/Relay.
3. Leave automatic assignment in place for the first representative pilot, or use the Using Cache or Using Relay count and Manual assignment when the network requires a specific path. Do not move the wider estate until the page shows cache activity and the expected computers/devices.
4. Validate one device from every relevant network: its effective policy and package in Central, installed products under About, a successful update, and continued Central communication when a relay is involved. Keep the time window and affected device names for comparison with logs and alerts.
5. Expand in small groups and repeat the same checks. A successful cache download alone does not prove that clients can resolve and reach it or that relay traffic works.

For rollback, first reassign manually attached computers. Select Devices with Update Cache or Servers with Message Relay, select the host and choose Remove Cache or Remove Cache/Relay. Central removes the software, cached content and local Windows Firewall openings, then assigns another available service. If none exists, devices try Sophos directly; in a network that forbids direct access this is an outage path, not a safe fallback. Confirm the alternate path before removal and validate a pilot again afterwards.

Treat Release Notes as part of the change process

Sophos publishes separate Release Notes for Windows Core Agent, macOS Endpoint and Device Encryption. A Central label such as Recommended does not replace reviewing them: new certificates, platform limits, security fixes and changed components can require a pilot or a prioritised short-term rollout.

As at 26 August 2026, the relevant Windows Core Agent line is 2026.1. Sophos notes updated component certificates, including the root certificate. Devices with automatic root-certificate updates disabled or custom untrusted certificate management can consequently develop installation and communication problems.

On macOS, version 2026.1.1 fixes, among other issues, a local privilege escalation through a compromised NIB file and XPC. Do not assess such a security fix solely according to a fixed monthly routine. Check the current version, actual rollout stage in the tenant and the organisation’s pilot group together.

Central Device Encryption for Windows is now delivered with Windows Core Agent and therefore uses the same version line. During troubleshooting, nevertheless use the affected CDE component log rather than only the Core Agent version number.

Sources

Official Sophos documentation, retrieved September 11, 2026:

• Update Management Policy – Sophos Central Admin
• Manage Update Caches and Message Relays – Sophos Central Admin
• Software packages – Sophos Central Admin
• Software packages FAQ – Sophos Central Admin
• Content updates FAQ – Sophos Central Admin

Frequently asked questions