Hello, everyone.
This is Kushal from the Sophos community and today will be migrating endpoints
from Sophos Enterprise Console to Sophos Central.
With enterprise console nearing end of support.
Now is the time to migrate your on premise environment over to Sophos Central.
There are multiple ways to migrate your endpoints.
The main three being Manually Deploying the installer onto your devices,
using an Active Directory Startup Script
to push the installer package over top of the existing AV,
and we'll have an article linked below that details steps on how to do so
or using the Sophos Central Migration Tool.
Today, we'll be using the latter of the three.
Sophos Enterprise Console and Sophos Central
are very different technologies, so they'll have different requirements.
We'll start by breaking down the prerequisites,
then things to keep in mind before migrating.
Installing the migration tool,
then performing the migration.
Some of the prerequisites you'll need to meet before migrating are as follows,
a valid Sophos Central license or trial that matches
or exceeds the feature set of your existing on premise license.
If you don't have an account set up with a license
or trial, the link to do so is in the video description.
Ensure the domains and ports required for communication
aren't blocked by a firewall or any other appliance.
The domains you'll need to whitelist are referenced in the documentation
links below, and the ports are 80 and 443.
A supported operating system will need to be installed on the devices
you are migrating.
We'll have a link for system requirements down below.
Any unsupported on premise components will need to be removed
prior to migrating as well.
That includes network access control, full disk encryption
and any of the components
from the enterprise console, such as Sophos Update Manager,
Sophos Enterprise Console and Sophos Management Server End Database.
The Sophos patch and Sophos client firewall components
will be removed automatically during the migration process.
With version 2.1 of the migration tool, tamper protection actually doesn't need
to be disabled to perform the migration, which is great before you migrate.
There are a few things to keep in mind.
Your devices will all require some form of connection to the internet
for both software updates and communication purposes.
If you have devices that can't connect to the internet directly,
you can configure an update cache and message relay
to be the intermediary between Sophos Central and your network.
The update cache will first download updates from Sophos directly.
Your devices, will then communicate over the local network
to update from the cache.
The message relay component behaves similarly, but for communication purposes.
The link to the documentation for this is in the video description.
The next thing to keep in mind is after migration,
all devices will only have the base policies applied to them.
We recommend to configure policies in Sophos Central
before migrating to ensure a seamless transition.
You can specify for the migration tool to preserve your group layouts
so that a matching group structure is present in Sophos Central
once the migration completes.
There are some limitations to this, however, if Sophos AD
Sync has already been used, we don't recommend selecting this option.
If you've setup custom install parameters with the central migration tool
to specify group memberships, the install parameters will take precedence.
Installing the migration tool is pretty straightforward.
Just keep in mind, you'll need to install it
on the management server for the enterprise console.
You can start the installation by going to the following directory
C Program Data Sophos Update Manager and Working.
The folder names from here might be slightly different on your environment,
but in my test environment, I'll go into this SDDM
folder, into the same folder.
And here we see the Central Migration Tool folder.
You can copy this folder to the desktop for ease of use
or start the installation from here.
Another option is to go to the KBA linked in the video description below
in order to download it directly from our site.
We'll run the installer package and select install,
this will first extract the necessary files.
The installer will then start and we'll select next.
I accept the license agreement.
And install. We'll click finish,
and now we're ready to run the central migration tool.
When you first open the tool.
You will be asked
if you would like to perform a basic assessment or a full assessment.
The basic assessment is if you don't have a Sophos central account yet,
I already do, so we'll select full.
If the tool has not been launched
before, you'll also be asked to set up a migration token.
The link in step one here will open up Sophos
Central for us to create the token.
We'll get signed in.
Enter the 2FA code.
And we will be presented with the following UI.
Enter a token name, I'll call this one Sophos Central Migration
and enter a passphrase.
Entered a second time
and ensured to select the save button, once you've populated the fields.
You will be redirected to the API token we've just created
and you'll need to copy the token info.
We can use the copy button here and paste this into the central migration tool.
Select Continue, then enter the passphrase you used
when creating the token.
When the tool opens, it will give you a report
of the machines detected on the Sophos Enterprise Console,
as well as relevant information to migration.
Now that we've got the tool installed, we're just about ready to migrate.
If you wish to preserve your group layouts as displayed
in the Sophos Enterprise Console, Select File.
Then options and tick the checkbox.
Ensure to select, OK.
If you see some devices that are in a not ready state,
I recommend highlighting those devices by clicking on them
to see what the central migration tool has to say.
The SEC entry, for instance, states that unsupported management tools are present.
Clicking on the link in the right hand tab will take you to our Sophos
Central Migration guide.
We can do a search for the same information presented in the tool,
and it will show us some relevant results.
As we have some devices that are in the ready
state, I'll highlight those devices and click the select button.
Then we can click the Migrate button
and the following notification will come up advising you to review
your policies first, and we'll select Yes to begin the migration.
A notification will come up stating that an update package
is being prepared for migration purposes.
And the Migrating tab now shows the current status of the devices
outlining whether they are in the pending or migrating phase.
Pending means the device is ready to begin the migration.
It only needs to connect to the Sophos update manager
to perform an update with the newly downloaded migration package.
The status will change to migrating once the update has begun
and the Sophos Central AV installation is taking place.
At this point, it's possible to browse through the files
on the system in question to see the installation logs progressing.
If you run into any problems with devices not migrating successfully
or with the installation failing during migration,
this is one of the first places you'll want to check.
Once the installation completes, you'll see the device
show up under the migrated section.
We'll take a look at Sophos Central to verify that the migration completed
successfully and to ensure the devices are now present under the devices list.
If we go to Endpoint Protection. Computers.
Computer groups.
We can see that the company structure folder from the SEC environment
has been created with this same nested group format.
This will only occur automatically if you have selected
the Preserve Group Layouts option.
That just about covers the basics when using the Sophos Central migration tool.
Any documentation links you'll need will be present in the video description.
And we recommend looking over the main article titled Sophos Central Migration
Tool Articles, Documentation and Resources, as this will cover
different scenarios and setups, as well as how to configure your environment
so the migration is able to take place.
Thanks for watching.
If you found this video useful, be sure to hit the thumbs up
button on Sophos TechVids
or on YouTube and post your questions on Community.Sophos.com