Installer command-line options for Windows

You can use the following command-line options with the Sophos Central Endpoint installer for Windows.

Command-line options

These options apply to:

  • Sophos Endpoint Advanced 11.5.11 and later.
  • Sophos Endpoint Standard 11.5.11 and later.


Example usage


Trailing argument



Runs the installer without displaying the user interface.

No proxy detection


Doesn't attempt to perform automatic proxy detection.

No competitor removal


Doesn't attempt to automatically remove competitors. (Only on installation of Sophos Anti-Virus.)


--language=<language ID>

Allows you to manually set the installer language. By default the installer uses the system language.

Language ID


--devicegroup=<Central group>

Specifies the Sophos Central device group to join the endpoint to.

A group to join. If it doesn't exist, it is created.

CRT catalog path

--crtcatalogpath=<path to CRT catalog>

Allows you to specify your own catalog of competitors to remove.

Full path and filename to catalog folder. Example:


Message relays

--messagerelays=<comma-separated message relay list of IPs including the port>

Specifies a list of message relays to use.

The IP address of the message relay must be specified along with the port 8190. Example:


Proxy address

--proxyaddress=<custom proxy address>

Specifies a custom proxy to use.

URL without protocol (will use HTTPS)

Proxy username

--proxyusername=<custom proxy user name>

If a custom proxy has been specified, set the username with this option.

The username of the proxy.

Proxy password

--proxypassword=<custom proxy password>

If a custom proxy and username have been specified, set the password with this option.

The password for the proxy.

Computer name override

--computernameoverride=<override for computer name>

Overrides the name of the computer to be used in Sophos Central.

Custom computer name.

Computer description override

--computerdescriptionoverride=<override for description>

Overrides the description of the computer to be used in Sophos Central.

Custom computer description.

Domain name override

--domainnameoverride=<override for domain>

Overrides the domain name of the computer to be used in Sophos Central.

Custom domain name.

Customer token

--customertoken=<the customer token>

Specifies the token of the Sophos Central customer to associate the endpoint with.

A UUID which maps to a customer.

Products to install

--products=<comma-separated list of products>

Specifies a list of products to install. If you specifiy a product that you don't have a license for, then it isn't installed.

A list of products to install, comma-separated.

Available options are: antivirus, intercept, mdr, deviceEncryption or all.

Local install source


Specifies a local install source to use during installation. This allows an installation to occur without having to download the installer files.

It isn't necessary to populate the local install source, but it is necessary to create a SophosLocalInstallSource folder.

If an empty folder is provided it is populated during the first installation.

If you wish to pre-populate the cache you can take a copy of the files from an already installed endpoint or from your update cache:



Even if a populated local install source is provided, internet access is still required and some files are downloaded. The amount of data downloaded depends on various factors including, for example:

Whether the platform of the installation endpoint differs from the files already populated.

Whether the warehouse has changes since the local install source was populated.

For the purpose of this example SomeContent represents the files and folders within the Warehouse folder.

Go to %ProgramData%\Sophos\AutoUpdate\data\Warehouse\SomeContent.

Using the above path you create:


To install using this local install source you can run:

SophosSetup.exe --localinstallsource="<SharedOrRemovableLocation>"

Message trail logging


Turns on the logging of message content between the endpoint and Sophos Central during installation.

You must switch this option off after installing, see Enabling a diagnostic message trail of Sophos MCS.

Note There is no command-line option for installation from an update cache. The installer automatically assesses connectivity to any update caches set up in the Sophos Central account and installs from them.

Windows examples

Install Sophos Anti-Virus and Intercept X without user interaction:

SophosSetup.exe --products=antivirus,intercept --quiet

Install using a proxy:

SophosSetup.exe --proxyaddress=<ProxyIP/FQDN>:<Port>

Install using a message relay:

SophosSetup.exe --messagerelays=

Language IDs

















Brazilian Portuguese




Chinese Simplified (Mandarin)


Chinese Traditional (Cantonese)


Chinese Hong Kong


Chinese Macau


Chinese Singapore