Installer command-line options for Windows

You can use the following command-line options with the Sophos Central Endpoint installer for Windows.

Command-line options

Quiet

Runs the installer without displaying the user interface.

`--quiet`

No proxy detection

Doesn't attempt to perform automatic proxy detection.

`--noproxydetection`

No competitor removal

Doesn't attempt to automatically remove competitors. (Only on installation of Sophos Anti-Virus.)

`--nocompetitorremoval`

Doesn't attempt to automatically remove competitors. (Only on installation of Sophos Anti-Virus.)

Language

Allows you to manually set the installer language. By default the installer uses the system language.

`--language=<language ID\>`

Trailing argument

Language ID.

Group

Specifies the Sophos Central device group to join the endpoint to.

You can also use this option to add devices to a subgroup.

`--devicegroup=<Central group\>\\<Central subgroup\>`

Trailing argument

A group or subgroup to join. If it doesn't exist, it is created.

CRT catalog path

Allows you to specify your own catalog of competitors to remove.

`--crtcatalogpath=<path to CRT catalog\>`

Trailing argument

Full path and filename to catalog folder.

Message relays

Specifies a list of message relays to use.

`--messagerelays=<comma-separated message relay list of IPs including the port\>`

Trailing argument

The IP address of the message relay must be specified along with the port 8190.

Registration server

Specifies the MCS server to connect to.

--epinstallerserver <registration server URL\>

Trailing argument

MCS server URL.

Proxy address

Specifies a custom proxy to use.

`--proxyaddress=<custom proxy address\>`

Trailing argument

URL without protocol (will use HTTPS)

Proxy username

If a custom proxy has been specified, set the username with this option.

`--proxyusername=<custom proxy user name\>`

Trailing argument

The username of the proxy.

Proxy password

If a custom proxy and username have been specified, set the password with this option.

`--proxypassword=<custom proxy password\>`

Trailing argument

The password for the proxy.

Computer name override

Overrides the name of the computer to be used in Sophos Central.

`--computernameoverride=<override for computer name\>`

Trailing argument

Custom computer name.

Domain name override

Overrides the domain name of the computer to be used in Sophos Central.

`--domainnameoverride=<override for domain\>`

Trailing argument

Custom domain name.

Customer token

Specifies the token of the Sophos Central customer to associate the endpoint with.

`--customertoken=<the customer token\>`

Trailing argument

A UUID which maps to a customer.

Products to install

Specifies a list of products to install. If you specifiy a product that you don't have a license for, then it isn't installed.

`--products=<comma-separated list of products\>`

Trailing argument

A list of products to install, comma-separated.

Available options are:

• antivirus
• intercept
• mdr
• deviceEncryption
• all

Local install source

Specifies a local install source to use during installation. This allows an installation to occur without having to download the installer files.

`--localinstallsource=<path-to-install-source\>`

It isn't necessary to populate the local install source, but it is necessary to create a SophosLocalInstallSource folder.

If an empty folder is provided it is populated during the first installation.

If you wish to pre-populate the cache you can take a copy of the files from an already installed endpoint:

`%ProgramData%\Sophos\AutoUpdate\data\Warehouse`

Or from your update cache:

`%ProgramData%\Sophos\UpdateCache\www\warehouse`

Even if a populated local install source is provided, internet access is still required and some files are downloaded. The amount of data downloaded depends on various factors including, for example:

• Whether the platform of the installation endpoint differs from the files already populated.
• Whether the warehouse has changes since the local install source was populated.

Message trail logging

Turns on the logging of message content between the endpoint and Sophos Central during installation.

You must switch this option off after installing, see Enabling a diagnostic message trail of Sophos MCS.

`--traillogging`

Register only

You use this command to re-register an endpoint that already has Endpoint Protection installed on it.

`--registeronly`

You may want to do this:

• If you're moving devices from one account to another.

• If you're an Enterprise admin and you want to move endpoints between sub-estates.

To use this command, turn off tamper protection on the endpoint and run the installer from the account you want to move the endpoint to using --registeronly.

For more help with the installer, see the following:

• Domains and ports required for communication to and from Sophos Central Admin and the Sophos Central managed endpoint

• Frequently Asked Questions (FAQs)

• New endpoint installer frequently asked questions

• An Internet connection could not be established

• Installer precheck messages

Windows examples

• Install Sophos Anti-Virus and Intercept X without user interaction:

  SophosSetup.exe --products=antivirus,intercept --quiet

• Install using a proxy:

  SophosSetup.exe --proxyaddress=<ProxyIP/FQDN>:<Port>

• Install using a message relay:

  SophosSetup.exe --messagerelays=192.168.10.100:8190

• Install into a subgroup:

  SophosSetup.exe --devicegroup=”Application Servers\Terminal Servers”

  Puts an installed server into the “Terminal Servers” subgroup of the “Application Servers” group. You must use quotes for any groups that have spaces in their names.

Language IDs