Licensing Sophos Server Protection: Servers, VMs, RDS, and XDR Sensor
Plan Sophos Server Protection against the server product ordered and the servers protected. VMs and RDS are not blanket exemptions; XDR Sensor …
Sophos Server Protection
Guides to protecting Windows and Linux servers in Sophos Fusion (formerly Sophos Central): check licensing and platform support before rollout, group servers deliberately, pilot policies, and verify their effect on each server. Not every feature is available on both operating systems; available features and entitlements depend on the specific agent, tenant, and contract.
Contents
Sophos Server Protection: topic overview
Start by checking licensing and platform support, then move through server groups and pilot policies to updates, integrity monitoring, and investigation. This overview shows the guides assigned here, not every Sophos feature or every task in a server's lifecycle.
Planning and rollout 6
Check server entitlements and supported platforms, plan cloud guest VMs, and prepare a controlled rollout.
Install and deploy Sophos Server Protection on Windows
A Server-owned workflow for individual installation and software deployment with full protection or XDR Sensor, including clear stop and rollback …
Install and deploy Sophos Protection for Linux
Protect Linux servers manually, by script or from a gold image with Sophos Protection for Linux, and validate their registration in Sophos Fusion.
Sophos Server Protection: Check Windows and Linux Platform Support Before Rollout
Check Windows Server generations, resources and legacy restrictions, as well as SPL platforms, before an installation or update wave.
Deploy Sophos Fusion Server Protection on RDS terminal servers
A practical guide to Sophos Server Protection on RDS and Citrix multi-user hosts, with support checks, a pilot, and a rollback path.
Deploy Sophos Server Protection on AWS EC2 and Azure VMs
A controlled guest-agent rollout for cloud servers: choose a protection mode and network path, verify VM identities, and reconcile terminated …
Server groups and policy assignment 1
Create pilot groups, prioritize policies, and verify the effective assignment on each server.
Sophos Server Protection: Assign server groups and policies
A pilot group limits the scope; the first matching server policy wins. Check the actual assignment on the server's Policies tab.
Server protection policies 6
Pilot Threat Protection and Windows-specific policies for peripherals, applications, Unauthorized File Protection, and Web Control.
Sophos Fusion: Set up and verify Server Threat Protection safely
Configure a server protection policy for small pilot groups, distinguish Windows and Linux capabilities, and verify its actual effect on each server.
Roll out Sophos Server Peripheral Control on Windows servers
Monitor Windows server peripherals first, then exempt required devices and test Read Only or Block on the pilot host.
Sophos Server Application Control: detect first, then block
A dedicated server policy first detects controllable applications. Only after reviewing server workloads do you selectively block them in a small …
Safely Roll Out Unauthorized File Protection for Windows Servers
Monitor a small number of Windows servers first, allow legitimate executions selectively, and enable Block only after reviewing the events.
Server Lockdown to Unauthorized File Protection: Pilot and Migration
Document the existing Lockdown estate, test unlocked servers with a cloned Monitor policy, and move groups to Block only after repeated reviews of …
Safely introduce Sophos Server Web Control on Windows
Create a Web Control policy for one Windows server, verify its effective assignment and resolve unexpected blocks without global exclusions.
Linux runtime detection 1
Introduce Linux Runtime Detection as an additional detection capability, with its own policy and verified prerequisites.
Set up and verify Linux Runtime Detection for Sophos servers
Roll out RTD for Sophos Protection for Linux to a small server group, review detections, and narrow down false positives.
Updates and integrity monitoring 2
Plan server updates in a controlled way and review File Integrity Monitoring specifically on Windows servers.
Sophos Fusion: Server Update Management for Windows and Linux
The server policy controls product updates and package selection by operating system. Content updates follow a separate, optionally staged process; a …
Set up File Integrity Monitoring for Windows Server in Sophos Fusion
Pilot FIM on a few Windows servers, limit monitored paths and registry values, confirm changes in server Events, and roll back if the policy generates …
Data collection and investigation 1
Control Data Lake uploads and Live Response for servers separately, and verify that each is effectively enabled.
Set up Sophos Server Data Collection and Investigation
The server policy controls uploads and Live Response separately. A pilot limits their scope only if effective settings outside the pilot group are …
Uninstallation and decommissioning 2
Decommission Windows and Linux servers in a controlled way and check their protection status after removal.
Completely uninstall Sophos Protection for Linux
Remove SPL from Linux servers with its built-in uninstaller, handle empty cgroup directories safely and verify the protection state.
Completely remove Sophos Server Protection from Windows
A safe runbook for completely removing Sophos Server Protection from supported Windows servers.
Where should a server rollout begin?
Before installing, check the specific server license coverage and supported platform. Then choose a small pilot: a server policy assigned only to the pilot group limits its scope. The group alone does not replace checking policy targets and priority or verifying which policy is actually applied to the server. The XDR Sensor does not provide malware protection; verify its XDR entitlement and separate third-party protection before deployment.
The installation guides for Windows Server, Sophos Protection for Linux, and RDS terminal servers are linked directly here. For controlled decommissioning, there are separate guides to Windows server uninstallation and Linux uninstallation.
Do not mistake a policy for universal availability
Server policies are managed under My Products > Server > Policies. The articles listed here distinguish between platforms and tasks: Server Threat Protection covers Windows and Linux, while Server Web Control, Application Control, Peripheral Control, Unauthorized File Protection, and File Integrity Monitoring, for example, are described in their respective guides for Windows servers. Linux Runtime Detection requires an appropriate Linux server configuration and separately verified entitlement. A policy’s presence in the portal does not establish that it is effective on every host or that a license entitlement exists.
When piloting a change, check the effective policy under My Products > Server > Servers > Servername > Policies and the protection status on the affected server. If the change has no effect, first compare the platform, agent mode, group membership, and priority of the relevant policy before relaxing protection features globally.