Skip to content

Installer command-line options for Windows

You can use the following command-line options with the Sophos Central Endpoint installer for Windows.

Command-line options


There is no command-line option for installation from an update cache. The installer automatically assesses connectivity to any update caches set up in the Sophos Central account and installs from them.

For more information on Sophos Central see Frequently Asked Questions (FAQs).

For information on the installers see the following:

Windows examples

Option Description


Runs the installer without displaying the user interface.

No proxy detection


Doesn't attempt to perform automatic proxy detection.

No competitor removal


Doesn't attempt to automatically remove competitors. (Only on installation of Sophos Anti-Virus.)


--language=<language ID\>

Allows you to manually set the installer language. By default the installer uses the system language.

Trailing argument: language ID


--devicegroup=<Central group\>

--devicegroup=<Central group\>\\<Central subgroup\>

Specifies the Sophos Central device group to join the endpoint to.

You can also use this option to add devices to a subgroup.

Trailing argument: group or subgroup to join. If it doesn't exist, it is created.

CRT catalog path

--crtcatalogpath=<path to CRT catalog\>

Allows you to specify your own catalog of competitors to remove.

Trailing argument: pull path and filename to catalog folder.

Example: --crtcatalogpath=C:\\catalog\\productcatalog.xml

Message relays

--messagerelays=<comma-separated message relay list of IPs including the port\>

Specifies a list of message relays to use.

Trailing argument: IP address of the message relay must be specified along with the port 8190.

Example: --messagerelays=IPADDRESS:8190

Registration server

--epinstallerserver <registration server URL\>

Specifies the MCS server to connect to.

Trailing argument: MCS server URL.

Proxy address

--proxyaddress=<custom proxy address\>

Specifies a custom proxy to use.

Trailing argument: URL without protocol (will use HTTPS)

Proxy username

`--proxyusername=<custom proxy user name>

If a custom proxy has been specified, set the username with this option.

Trailing argument: the username of the proxy.

Proxy password --proxypassword=<custom proxy password>

If a custom proxy and username have been specified, set the password with this option.

Trailing argument: password for the proxy.

Computer name override

--computernameoverride=<override for computer name\>

Overrides the name of the computer to be used in Sophos Central.

Trailing argument: custom computer name.

Domain name override

--domainnameoverride=<override for domain\>

Overrides the domain name of the computer to be used in Sophos Central.

Trailing argument: custom domain name.

Customer token

--customertoken=<the customer token\>

Specifies the token of the Sophos Central customer to associate the endpoint with.

Trailing argument: UUID which maps to a customer.

Products to install

--products=<comma-separated list of products\>

Specifies a list of products to install. If you specifiy a product that you don't have a license for, then it isn't installed.

Trailing argument: list of products to install, comma-separated.

Available options are: antivirus, intercept, mdr, deviceEncryption or all.

Local install source


Specifies a local install source to use during installation. This allows an installation to occur without having to download the installer files.

It isn't necessary to populate the local install source, but it is necessary to create a SophosLocalInstallSource folder.

If an empty folder is provided it is populated during the first installation.

If you wish to pre-populate the cache you can take a copy of the files from an already installed endpoint or from your update cache:



Even if a populated local install source is provided, internet access is still required and some files are downloaded. The amount of data downloaded depends on various factors including, for example:

  • Whether the platform of the installation endpoint differs from the files already populated.
  • Whether the warehouse has changes since the local install source was populated.

For the purpose of this example SomeContent represents the files and folders within the Warehouse folder.

  1. Go to %ProgramData%\Sophos\AutoUpdate\data\Warehouse\SomeContent.
  2. Using the above path you create <SharedOrRemovableLocation>\SophosLocalInstallSource\SomeContent
  3. To install using this local install source you can run SophosSetup.exe --localinstallsource="<SharedOrRemovableLocation\>"
Message trail logging


Turns on the logging of message content between the endpoint and Sophos Central during installation.

You must switch this option off after installing, see Enabling a diagnostic message trail of Sophos MCS.

Register only


You use this command to re-register an endpoint that already has Endpoint Protection installed on it.

You may want to do this if you're moving regions in Sophos Central. You can use this option if you're moving devices from one account to another. You can also use this option if you're a partner and you have an endpoint that's registered to the wrong customer. Alternatively, you can use it if you're an Enterprise admin and you want to move endpoints between sub-estates.

To use this command, turn off tamper protection on the endpoint and run the installer from the account you want to move the endpoint to using --registeronly.

Windows examples

Install Sophos Anti-Virus and Intercept X without user interaction:

SophosSetup.exe --products=antivirus,intercept --quiet

Install using a proxy:

SophosSetup.exe --proxyaddress=<ProxyIP/FQDN>:<Port>

Install using a message relay:

SophosSetup.exe --messagerelays=

Install into a subgroup:

SophosSetup.exe --devicegroup=”Application Servers\Terminal Servers”

Puts an installed server into the “Terminal Servers” subgroup of the “Application Servers” group. You must use quotes for any groups that have spaces in their names.

Language IDs

Language ID
English 1033
French 1036
German 1031
Japanese 1041
Spanish 1034
Italian 1040
Polish 1045
Brazilian Portuguese 1046
Korean 1042
Chinese Simplified (Mandarin) 2052
Chinese Traditional (Cantonese) 3076
Chinese Hong Kong 3076
Chinese Macau 3076
Chinese Singapore 2052
Back to top