Getting Started overview
How to get started with Sophos Intercept X Endpoint.
SEC to Sophos Central migration tool
This tool helps administrators move the management of protected computers from Sophos Enterprise Console 5.0 or later to Sophos Central.
Sophos Endpoint self help tool
This articles describes what the self help tool is and how to use it.
Sophos Central Admin FAQ
Frequently asked questions about the customer interface in Sophos Central.
CryptoGuard detections and required actions
Information on what CryptoGuard detections mean and how to deal with them.
ML/PE-A detections explained
An explanation of the ML/PE-A detections generated by Sophos Intercept x’s machine learning engine.
Getting started overview
Sophos Central Admin licensing instructions
Sophos Central Admin is the name of the customer interface.
Lost activation email
This article provides information on how to locate the Sophos Central activation email prior to raising a case with Sophos Support.
Installer return codes
This table details a number of possible return codes from the Sophos Central installer (SophosInstall.exe).
Automating the deployment of software to Windows computers
This article provides information on deploying the Sophos Central installer to multiple Window computers.
Sophos Central Admin general information
Links to documents, presentations and a range of knowledge base articles relating to Sophos Central Admin.
Domains and ports required for Sophos Central
Domains and ports required for communication to and from Sophos Central Admin and the Sophos Central-managed client software (Sophos Central Partner).
Precondition checks performed by the Sophos Central Installer
When the Sophos Central Installer runs on a computer, a set of compatibility checks are performed to ensure the installation can continue.
Intercept X system requirements
This article covers the Intercept X system resource utilization and system requirements.
The Sophos Central Migration Tool helps administrators to move management of protected computers from Sophos Enterprise Console 5.0 or later to Sophos Central.
AD Sync
How to synchronized with Microsoft Active Directory.
How to create groups
How to create groups in Sophos Central.
Customizing installers
How to customize your Intercept X Endpoint installers.
How to install the agent
How to install the agent on your devices.
Policies overview
How to set up base policies for endpoint protection.
Advanced web control
This video looks as some of the additional web control features.
Central MacOS Installer: folder insecurity errors during install
Security changes to mitigate a privilege escalation attack on MacOS.
Sophos Central Admin login page
Sophos Central Endpoint documentation
A link to the product documentation. This is also available via the Help link in the top right hand corner of each page in Sophos Central.
How to address an 'Installation is almost Complete' warning
What to do if you get the 'Installation is almost Complete' warning at the end of the Sophos Central Managed Endpoint installer.
Threat Intelligence
How Intercept X Advanced with EDR delivers threat intelligence analysis
Threat Cases
How to get the most from the Threat Cases capabilities in Intercept X with EDR
Threat Search
How to search for potential threats on your network
Process Trace
How to use the Process Trace capabilities to deep dive into attacks
Process Details
How to access on-demand threat intelligence curated by SophosLabs
Block Application
How to block malicious applications
Allow Application
How to allow an application that Sophos has misclassified as malicious
Device Isolation
Understand the different ways to isolate devices
Device Isolation Exclusion
How to set an exclusion policy to identify IP and Port information that is allowed to communicate to an otherwise isolated device
Frequently asked questions about Sophos Central Admin, the customer interface in Sophos Central.
Web Control FAQ
Frequently asked questions about web control.
Sophos Central AD Sync Utility FAQ
Frequently asked questions about the AD sync utility in Sophos Central.
Update Caches and Message Relays FAQ
Frequently asked questions about update caches and message relays.
Content Delivery Network (CDN) migration FAQ
Frequently asked questions following our migration to a new CDN supplier.
What's new in Sophos Central
An overview of all the latest enhancements in Sophos Central.
Sophos Endpoint self help tool - overview
This article describes what Sophos Endpoint Self Help tool is, what can be found on the tool and the links that will help you with troubleshooting each feature.
Sophos Endpoint self help tool - issue with Update
This article provides troubleshooting steps when the utility reports a bad health state against Update.
Extended Anti-Virus support for Windows XP/2003
This article provides information on the extended Anti-Virus support for Windows XP/2003.
Intercept X 2.0: What's new
How to use the new features in Intercept X 2.0.
Sophos Diagnostic Utility
The Sophos Diagnostic Utility (SDU) collects vital system information as well as log files for all Sophos products that are installed on the computer. This article describes how to locate and download the Sophos Diagnostic Utility.
How to install on a gold image to avoid duplicate identities
How to install Sophos Central Endpoint software on a gold image, so that every instance of a virtual machine run from that single gold image gets its own unique identity.
Endpoint installer command line options
This article provides information about the command line switches that can be used with the Sophos Endpoint Protection installer.
Software deployment methods
This article describes the options available in order to deploy Sophos Central managed software.
Installer log files
This article provides information on the Sophos Central installer log locations for both Windows and Mac.
Installation issue: An Internet connection could not be established
What to do if your installation is unsuccessful because an internet connection could not be established.
How to uninstall Sophos Antivirus for Mac
This article describes the step by step instructions on how you can completely remove the Sophos Anti-virus program on your Mac.
How to uninstall using command line or batch file
This article provides basic information on how to remove the Sophos Central Windows client software either from the command line or as part of a script.
How to remove the read-only Sophos keychain after uninstalling
How to install or uninstall Mac protection using the terminal
This article is only intended for Mac administrators who need to remove the program from a lot of Macs.
Detection of other security software by the endpoint installer
This article provides information on how the Sophos Central Endpoint Security and Control installer detects and removes third-party security software prior to installation.
How to troubleshoot 'Installation is almost Complete' warning
When the Management Communication System (MCS) component fails to register with the server, an unexpected problem with the installation Sophos Endpoint Security and Control occurs. This article describes the steps to troubleshoot the 'Itstallation is almost complete' warning message.
Apple MacOS 10.13 High Sierra support
This article provides information about support for Apple MacOS 10.13 by Sophos Anti-Virus / Endpoint Protection.
Intercept X for MacOS: What's new
An overview of the new features in Sophos Intercept X for Mac.
Root Cause Analysis overview
This article provides information on the required actions when dealing with Root Cause Analysis (RCA) cases, along with links to example cases for various types of infection.
How to submit samples of suspicious files to Sophos
Sophos provides a service to check files that may contain malware.
How to investigate and resolve a potential False Positive / Incorrect Detection
This article covers the steps that you can take to investigate detections they believe might be incorrect.
How to report false positives
This article details how to raise issues for potential false positives with Intercept X, along with the available workarounds.
This article provides information about CryptoGuard detections, what they mean and how to deal with them.
A ML/PE-A detection is generated by Sophos Intercept X’s Machine Learning (ML) engine when it identifies malicious PE (Portable Executable) files.
How to resolve malware detection on pagefile.sys or hiberfil.sys
This article describes how to tackle issues around malware detection on system files such as pagefile.sys, hiberfil.sys or Volume Shadow Copies.
When the Management Communication System (MCS) component fails to register with the server, an unexpected problem with the installation Sophos Endpoint Security and Control occurs. This article describes the steps to troubleshoot the 'Installation is almost complete' warning message.
Microsoft Security Client - Error code: 0x80070002 at logon
What to do if you see the error code: 0x80070002.
License usage and calculation overview
This article describes how license usage and reporting is calculated for Sophos Central managed endpoint protection, Intercept X and Device Encryption.
How to recover a tamper protected system
How to recover a tamper protected system if the tamper protection password is lost and the client cannot receive a new policy with a known password.
How to address a bad health state report
This article provides troubleshooting steps when the utility reports a bad health state against Services.
Basic troubleshooting for endpoints
This article explains how to troubleshoot conflicts with other applications, performance issues, and scanning issues.
Alerts for missing/stopped services for Windows computers
Windows computers and server can report an event that Sophos services are missing or not running with a corresponding Critical Health status.
Email alert: Account not activated
What to do if you keep receiving alert email: "Your Sophos Central Service Account has not been activated".
How to exclude volume shadow copies from scanning
This article shows you how to exclude Volume Shadow Copies from on-access scanning on a server managed by Sophos Central.
Check out our product forums where you can browse a variety of topics, post questions, and get solutions for our entire range of Sophos products.
Discussion Forums
Advisory Articles
Product Information