Skip to content

Create gold images and clone new devices

This option might not be available for all customers yet.

When using virtual machines in a Virtual Desktop Infrastructure (VDI), you can create new virtual machines from a gold image. The gold image acts as a template for your virtual machines. You must ensure that each new virtual machine has a different identity from the device being used as the gold image.

You can create gold images from Endpoint Protection or Server Protection to create new virtual machines. Follow these instructions to install Endpoint Protection or Server Protection on a gold image so that every instance of a virtual machine that runs from that single gold image gets its own unique identity. We register these virtual machines as devices in Sophos Central Admin. You can then manage them in Sophos Central Admin.

Restrictions

  • You can't create a gold image for a server yet.
  • You can't create a gold image for a server running Server Lockdown or Update Cache.

For help with installing Endpoint Protection see Endpoint Protection.

For help with installing Server Protection see Server Protection.

For help with setting up your firewall or proxy to communicate between Sophos Central Admin and your managed endpoints, see Domains and ports to allow.

Prepare your image

  1. Update the device you want to use for your image so that the operating system and your apps are how you want them.

Set up your image

You can create a new installation on a new device. To do this, do as follows:

  1. Install Endpoint Protection or Server Protection using the gold image option and any other applicable options.

    • Run the command SophosSetup.exe --goldimage

    This indicates that the device is a gold image and installs all your licensed options.

    You can use some of the Sophos installation command-line options when you create your gold image. You could use the following options:

    • Install selected products on your gold image, using --products.

      Example

      SophosSetup.exe --goldimage --products=antivirus creates a gold image with only the antivirus products installed.

    • Assign your cloned devices to a group, using --devicegroup.

      Example

      SophosSetup.exe --goldimage --devicegroup=Virtual creates a gold image with all your licensed products installed. We add any devices cloned from it to a group called "Virtual" in Sophos Central Admin.

See Installer command-line options for Windows.

When the installation is complete, you can turn off the gold image device.

You can now create your virtual machines or clones. If you want to update the gold image restart the device.

Use an existing device as a gold image

Alternatively you can use an existing device as a gold image. To do this, do as follows:

  1. Go to the device you want to use.
  2. Check the device is set up as you want it.

    • Check the operating system is up to date and any patches are installed.
    • Check that Endpoint Protection or Server Protection is installed.
  3. Run the command SophosSetup.exe --goldimage.

    This designates this device as your gold image.

You can now create your virtual machines or clones. If you want to update the gold image restart the device.

How Sophos determines whether the virtual machine is a clone

When you start a virtual machine, we use a change to the device name to determine whether you're starting a new clone. If a name change has occurred the existing Sophos configuration is cleaned, and we register a new device in Sophos Central Admin. We treat this clone as a unique device.

If no change to the device name occurs we assume you're starting the gold image device.

We wait two minutes, by default, after you start the gold image device before communication with Sophos Central happens. This avoids creating duplicate devices, if changing the identity of a new clone is taking longer than expected.

If the change of the identity is taking longer than the default two minutes, use the --goldimagetimeout option to change the default.

Example

To set the timeout to 4 minutes, add the following option to your installation command:

--goldimagetimeout=240

After this two minute time period, regular communication with Sophos Central starts again for the gold image device. You can then update the operating system, apps, Endpoint or Server Protection.

We check the identity each time you restart the gold image device.

Back to top