How to create a standalone or custom installer package

This article explains how to create a standalone or custom installer package, or off-site installer, that will install endpoint software, without needing an active connection to the updating server or Sophos.

 

NOTE: The creation of a standalone installer package is permitted only for the actual licensee of the Sophos Licensed Product. Home use licenses are not permitted to exercise this functionality as noted in the Sophos End User License Agreement that governs use of the Licensed Product.

Known to apply to the following Sophos product(s) and version(s)
Enterprise Console 4.5.0
Enterprise Console 4.7.0
Sophos Enterprise Manager 4.7.0
Enterprise Console 5.0.0

What to do

Choose the installer method

1. Sophos Deployment Packager Tool
   
   This is for basic package creation which uses default policies and will update from a location specified in the Deployment Packager Interface. Sophos cannot be configured as an update location. This tool can only be used from version 9.7.6 VDL4.71G of the endpoint software.
   
   
2. Manually create an installer package
   
   This is to be used for advanced package creation where preconfigured policies can be applied to the installer. Sophos can be configured as an update location using this method. This method can be used with all versions of the endpoint software.

1. Sophos Deployment Packager Tool

1. Download the Sophos Deployment Packager utility
2. Follow the instructions supplied in the Deployment Packager guide to create the package

2. Manually create an installer package

This procedure:

• Uses a command line tool called ExportConfig.exe to export your existing policies. For more information about this tool, and how to use it, please refer to: Using ExportConfig.exe to create XML configuration files.
• Uses a command line tool called ConfigCID.exe to implement your exported policies into the package.  For more information about this tool, and how to use it, please refer to: Using ConfigCID.exe to implement XML configuration file changes.
• Assumes that you are using the default installation locations for Enterprise Console/ Manager and your update locations. Please substitute your folder names and paths, if appropriate.

Prepare the installer

1. Create a folder on the desktop called savinst.
2. Browse to \\server\SophosUpdate\CIDs\S000\ and copy the SAVSCFXP folder to the folder you created on desktop. Type "%userprofile%\Desktop\savinst\SAVSCFXP" if using a command prompt.
3. Create a copy of the SAVSCFXP folder and rename the copy to SAVSCFXPXML.  You should now have two folders inside the 'savinst' folder on the desktop - one called SAVSCFXP and the other SAVSCFXPXML, both with the same contents.
4. Using ExportConfig.exe export from the Console the policies you wish to apply to the endpoint.  An example for Enterprise Console 4.x is shown below.
   "%programfiles%\Sophos\Enterprise Console\exportconfig.exe" -type AU -policy [PolicyName] -output "%userprofile%\Desktop\savinst\SAVSCFXPXML\sau\sauconf.xml"
5. Ensure all output files, for each policy exported, are saved to the associated SAVXPSCFXML subfolder.  Example:  For the updating policy place the sauconf.xml file in: %userprofile%\Desktop\savinst\SAVSCFXPXML\sau\sauconf.xml
6. Integrate the XML files created in step 4 into the package with the ConfigCID.exe tool.  An example for Enterprise Console 4.x is shown below. "%programfiles%\Sophos\Enterprise Console\SUM\configcid.exe" "%userprofile%\Desktop\savinst\SAVSCFXPXML"
7. To save space, you can now delete the following files and folders, if they exist:
   • From the savinst\SAVSCFXP folder on the desktop: all of the NAC, RMS, SAVXP and SCF subfolders
   • From the savinst\SAVSCFXPXML folder: crt instmsiw.exe setup*.*
8. You can also delete any component that will not be installed (e.g. nac, scf) from the SAVSCFXPXML folder.

Create a self-extracting archive that executes setup.exe with the appropriate parameters

See also Command line parameters used by Setup.exe if you would like to customize the setup parameters.

For the purpose of this article WinRAR will be used, but any other tool that accomplishes the same job is acceptable.

1. Inside the savinst folder, select both SAVSCFXP and SAVSCFXPXML, then right-click and choose “Add to archive…”
2. Under Archiving options, select “Create SFX archive” and select “Create solid archive”
3. In the Advanced tab, click the “SFX options…” button
4. Specify in the “Path to extract” text field:%SystemRoot%\Temp\savinst
5. Do one of the following:
   • Managed (client will report to the console):- specify in the “Run after extraction” text field:SAVSCFXP\setup.exe -mng yes -ni -s -crt R -updp %SystemRoot%\Temp\savinst\SAVSCFXPXML
     If the client has to report across a WAN network please see: Using Sophos message relays in a public WAN.
   • Unmanaged (the client will not report to the console):- specify in the "Run after extraction" text field:SAVSCFXP\setup.exe -mng no -ni -s -crt R -updp %SystemRoot%\Temp\savinst\SAVSCFXPXML
6. In the Modes tab, select “Hide all”
7. In the Update tab select “Overwrite all files”
8. Click OK to accept the options
9. Click OK to generate the self-extracting installer

Run the self-extracting installer on all machines where SESC is to be deployed.