Sophos Central Migration Tool automatically creates this package for Update Managers on the server where it's installed (as soon as you start your first migration). It puts the package in the folder

\SophosUpdate\CloudMigrationPackage .

It also updates the package each time you select and migrate more computers.

However, Sophos Central Migration Tool doesn’t do this automatically for Update Managers on other servers. You need to run a tool called Sophos Migration Agent to do it.

Configure Update Managers

To configure Update Managers:

1. After you've installed Sophos Central Migration Tool, select computers (including those that update from remote Update Managers) and click Migrate.

You’ll see a message in Sophos Central Migration Tool that says that one or more Update

Managers can't migrate computers.

2. Click the message. This shows the status of all Update Managers, including the local one (you can also see this by selecting View > Update Manager Status.)

When an Update Manager has the status Not Ready (spanner icon) or Out of Date (hourglass icon), go to the server where that Update Manager is installed and run Sophos Migration Agent, as described in the next step.

Icon Status

Ready

Description

The Update Manager can migrate computers.

Not ready (fixable) The Update Manager can't migrate computers until you run Sophos Migration Agent.

Sophos Migration Tool advanced guide

Icon Status

Out of date

Error

Description

The Update Manager has a migration package that is out of date. It can't migrate newly-selected computers.

The Update Manager can't migrate computers because there was a problem creating or updating the migration package.

3. On the server with the remote Update Manager, run Sophos Migration Agent as follows:

• Open a command prompt. If User Account Control (UAC) is on, use the option Run as

administrator.

• Change to "%programfiles(x86)%\Sophos\Migration Agent" (64-bit) or

"%programfiles%\Sophos\MigrationAgent" (32-bit)

• Find SophosMigrationAgent.exe

• Run Sophos Migration Agent with the –p parameter for the path (UNC or local) to the location from which the agent gets the package. For example, if the package is in the default location:

SophosMigrationAgent.exe –p “\\MySecServer\SophosUpdate

\CloudMigrationPackage”

Note

If access to UNC paths is restricted, Sophos Migration Agent can't get the package from the default folder. Copy the contents of CloudMigrationPackage to a new folder on the remote

Update Manager and use -p with the new, local path.

4. Go back to the migration tool. After some time (usually up to 10 minutes), the Update Manager's status should change to Ready. Computers that update from it can now be migrated.

Note

The dialog showing SUM status doesn't automatically refresh. You must close and re-open it to see the updated status. If you can't open the dialog, it means that all your SUMs are ready.

If you plan to migrate computers in batches, we recommend that you now schedule Sophos

Migration Agent to run regularly to update packages.

Schedule updates for the migration package

Each time that a new migration starts, the packages on remote Update Managers become out of date, and newly-selected computers can't be migrated.

To keep the migration packages up to date, we recommend that you set up a Windows scheduled task on the remote Update Manager.

Set the task to run every 15-30 minutes. By default, computers that are Pending time out after 2 hours, so this scheduled task ensures that the migration package always gets updated before the computer times out.

Sophos Migration Tool advanced guide

If the source of the package is trusted, set the task to run as an Administrative account with impersonation privileges. Select "Run with highest privileges".

If the source of the package isn't trusted, or you need to comply with strict security policies, we recommend that you schedule two tasks:

• One task runs with a non-privileged account and copies the migration package from the network to a local folder.

• One task runs Sophos Migration Agent and uses the local folder as the package source.

The task that copies the package must finish before the Sophos Migration Agent task starts.

Note

After you've migrated all your computers, delete the scheduled task(s).

Related concepts

Appendix: Sophos Migration Agent

(page 12)

Sophos Migration Tool advanced guide

3 Prepare a remote database before migration

If your installation of Sophos Enterprise Console uses a remote Sophos database, the Sophos

Central Migration Tool installer can't automatically find and use that database.

Before you install the migration tool, you must install its database schema in the remote Sophos database.

Note

When you finish migration and uninstall Sophos Central Migration Tool, you follow the steps in

Uninstall the Sophos Central Migration Tool database schema .

(page 5)

Uninstall the Sophos Central Migration Tool database schema

(page 6)

3.1 Install the Sophos Central Migration Tool database schema

To install the Sophos Central Migration Tool database schema on a remote Sophos database:

1. On the Sophos Enterprise Console management server, run the Sophos Central Migration Tool self-extractor scmt_sfx.exe

2. If the Sophos Enterprise Console management server uses a remote database, the installer can't connect to the database and prompts you to look at the setup log.

3. In C:\Windows\TEMP , open the log file scmt-setup.log

. You see entries like these:

<timestamp> -- Processing string segment: Initial Catalog=SOPHOS551

<timestamp> -- Processing string segment: Data Source=

SqlServerHost\SOPHOS

<timestamp> -- Remote database found

<timestamp> -- Database exception: Invalid object name

'CloudMigration.CloudMigrationDataStore'.

<timestamp> -- Unable to connect to the remote migration tool

database.

Exiting...

<timestamp> -- -- BOOTSTRAPPER ENDED –

Make a note of the Data Source (or Server) and the Initial Catalog (or Database) values. They refer to the remote SQL instance name and the Sophos Enterprise Console database name and are used when installing or uninstalling the Sophos Central Migration Tool database schema.

4. Copy the scmt_210 folder to the remote database server.

5. On the remote database server, open a command prompt and change to the folder C:

\scmt_210\resources\DBScripts for the uncompressed installer content.

Sophos Migration Tool advanced guide

Note

If the logged-on account does not have sufficient rights to create the Sophos Central Migration

Tool database schema within the Sophos Enterprise Console database, open the command prompt with the option “Run as different user” and specify an account with sufficient rights.

6. Run the database installation script with the Data Source (or Server) and Initial Catalog

(or Database) values obtained in step 3. For example: InstallDbCloudMigration

SqlServerHost\SOPHOS SOPHOS551 .

If installation is unsuccessful, you'll see a message. Look at the log file

InstallDbCloudMigration.log

in the folder where you ran the script.

7. After installing the schema, go back to the Sophos Enterprise Console management server, and run c:\scmt_210\setup.exe

to install Sophos Central Migration Tool.

3.2 Uninstall the Sophos Central Migration Tool database schema

After you uninstall Sophos Central Migration Tool from a Sophos Enterprise Console server with a remote database, you must manually uninstall the Sophos Central Migration Tool database schema as follows:

1. Open a command prompt and go to the folder c:\scmt_210\resources\DBScripts for the uncompressed installer content.

Note

Note: If the logged-on account doesn't have sufficient rights to drop the Sophos Central

Migration Tool database schema from the Sophos Enterprise Console database, open the command prompt with the option “Run as different user” and specify an account with sufficient rights.

2. Run the database installation script with the “Data Source” (or Server) and the “Initial catalog” (or

Database) you used when you set up the Sophos Central Migration Tool database schema

(see step 3 in Install the Sophos Central Migration Tool database schema ). For example:

UninstallDbCloudMigration SqlServerHost\SOPHOS SOPHOS551 .

(page 5)

Sophos Migration Tool advanced guide

4 Migrate a large number of computers

If you have a large number of computers, plan your migration to avoid high network bandwidth usage.

Migration increases bandwidth usage because:

• Migration downloads and installs a new Sophos Central agent on all computers.

• After migration, computers get updates directly from Sophos (by default).

We recommend that you migrate computers in batches and set up "Update Caches" in Sophos

Central, as described below.

Migrate computers in batches

Sophos Central Migration Tool supports assessment and migration for Sophos Enterprise Console instances that manage up to 5000 computers.

However, to reduce the bandwidth you use, consider limiting the number of computers you select and include in each migration task.

Set up Update Caches

After migration, by default computers get updates directly from Sophos, instead of local update locations (or CIDs) as before.

If you want to avoid this, you can set up Update Caches in Sophos Central.

Update Caches allow your computers to get their Sophos Central updates from a cache on a server on your network, rather than directly from Sophos. This saves you bandwidth, as updates are downloaded only once, by the server.

Computers will automatically update from the nearest available cache.

In Sophos Central, go to Settings > Manage Update Caches and Message Relays.

Sophos Migration Tool advanced guide

5 Migrate sub-estates

You can migrate computers according to the sub-estates they're in.

Note

In Sophos Enterprise Console, a sub-estate is a named part of the IT estate, containing a subset of your computers and groups.

Migrating each sub-estate separately helps you to avoid migrating computers accidentally.

By default, Sophos Central Migration Tool shows you all computers in the default sub-estate. To select a sub-estate:

1. In the migration tool, select View > Select a Sub-Estate.

2. Select a sub-estate from the drop-down list.

The computer list now shows only the computers in that sub-estate. The title bar also shows the name of the sub-estate.

3. Select and migrate computers as usual.

Note

When you restart Sophos Central Migration Tool, this setting isn't kept. The computer list will show all computers again.

Sophos Migration Tool advanced guide

6 Migrate to multiple Sophos Central accounts or sub-estates

You can migrate computers managed by a single Sophos Enterprise Console server to more than one Sophos Central account.

To do this, you must access each account in turn and migrate computers to it.

You must also follow these instructions if you have multiple sub-estates belonging to the same

Sophos Central account.

To migrate, do as follows:

1. In the migration tool, connect to the first Sophos Central account you want to use, and migrate computers.

Note

We recommend that you migrate all the computers that you want to manage with this Sophos

Central account before you migrate to other accounts. You can't easily switch back to using this account.

2. You must make sure that no computers show the Migrating or Pending status (check the

Migrating filter doesn't show any entries).

Skipping this step causes incorrect information to show in Sophos Central Migration Tool when you sign in with a new account.

3. If you've created scheduled tasks to run Sophos Migration Agent on remote Update Managers

(SUMs), turn them off.

4. Give Sophos Central Migration Tool access to another Sophos Central account as follows: a) Restart Sophos Central Migration Tool.

b) In the Connect to Sophos Central dialog, click Set up a new one under the passphrase field.

You need to sign in to Sophos Central, create a new API token, and set a passphrase.

5. When prompted, enter your new passphrase.

6. Sophos Central Migration Tool detects that you're using a new account.

The tool tries to clean up files used for the previous account, including the "migration package" in the local default Update Manager share. If it fails, it prompts you to clean up manually. See Clean up before migration to a new account .

Note

If the new account has fewer licensed features than the old one, computers previously shown as "Ready" may now be shown as "Not ready" and require remediation.

7. If you distributed the migration package to any remote Update Managers, you need to delete it manually. Follow the instructions in Clean up before migration to a new account .

If you copied the package manually to other folders or shares, delete it from those locations.

8. In the migration tool, assess and migrate computers to the new Sophos Central account.

9. If you've created scheduled tasks to run Sophos Migration Agent on remote SUMs, turn them on.

Sophos Migration Tool advanced guide

We recommend that you delete the token for the Sophos Central account you used previously. In

Sophos Central, in Settings > API Token Management, select the token and click Delete.

6.1 Clean up before migration to a new account

When you finish migration to one Sophos Central account, the migration tool tries to clean up old

"migration package" files before you begin migration to another account.

If cleanup doesn't happen automatically, you see this message. You must clean up manually.

Note

If you distributed the migration package to remote Update Managers, you must clean up manually there as well.

To clean up, do as follows:

1. Open a command prompt with admin privileges.

2. Change to the MigrationAgent directory for your computer:

• 32-bit: C:\Program Files\Sophos\MigrationAgent

• 64-bit: C:\Program Files (x86)\Sophos\MigrationAgent

3. Run the following command to try to clean up:

SophosMigrationAgent.exe -action cleanup -t file

4. In File Explorer, go to C:\ProgramData\Sophos\MigrationAgent\Logs and open

MigrationAgent.log

5. Look at the bottom of the log to see what happened when you ran the cleanup. You see an entry like this:

========== Migration Agent started ==========

Invoked with: -action cleanup -t file

6. Check for errors in removing a package from a CIDs directory. Here's an example:

ERROR Failed to remove C:\ProgramData\Sophos\Update Manager\Update

Manager\CIDs\S002\SAVSCFXP\savxp\sav.cfg

7. Go to each CIDs directory and delete the files mentioned in the error message. These files can include any of the following:

• cmanifest.dat

Sophos Migration Tool advanced guide

• migration.csv

• SophosInstall.exe

• RunCloudInstaller.bat

• sav.cfg

8. To save your changes, run the Sophos configuration tool ConfigCID.exe

on the CIDs mentioned in the error message. For details, see How to use the ConfigCID.exe to implement the XML configuration file changes .

Related information

How to use the ConfigCID.exe to implement the XML configuration file changes

Sophos Migration Tool advanced guide

7 Appendix: Sophos Migration Agent

Sophos Migration Agent is a command-line tool for distributing migration packages to the update locations used by computers that are managed by Sophos Enterprise Console.

Note

A migration package contains the Sophos Central agent installer and other files needed for migration.

Each time you use Sophos Central Migration Tool to migrate computers, it creates a migration package in a "CloudMigrationPackage" folder in the local default Sophos Update Manager share. For example:

\\MySecServer\SophosUpdate\CloudMigrationPackage

You can use Sophos Migration Agent to deploy that migration package to update locations managed by remote instances of Sophos Update Manager.

Installation and updates

Sophos Migration Agent is available on all servers which have SUM installed.

Sophos Migration Agent is in the folder %programfiles(x86)%\Sophos\MigrationAgent (64bit) or %programfiles%\Sophos\MigrationAgent (32-bit). It's installed and updated as part of the SUM self-update process.

Rights needed

Sophos Migration Agent must run as an account that has local administrative rights and user impersonation privileges.

If User Account Control (UAC) is on and you want to run the agent interactively, open the command prompt with Run as administrator and run the agent from it.

Command-line parameters

SophosMigrationAgent [-p[ackagepath] <path>] [-a[ction] <action_name>] [p[ackagepath] <path>] [-d[ebug]] [-t[raceoutput] <trace_method>] [c[idpath] <path>] [-h[elp]]

-a sets the action to be performed. This can be "deploy" (the default) or "cleanup". Deployment puts a package in every CID (Central Installation Directory) updated by the Sophos Update Manager.

Cleanup removes the package.

-p lets you specify the path (either UNC path or a local path) to the root folder of the package that needs to be deployed. The path can't contain any Unicode characters that can't be mapped to

English encoding.

-d sets the trace verbosity to debug level. We recommended that you always use this parameter when running in interactive mode.

Sophos Migration Tool advanced guide

-t selects targets for the trace output: file, console, all, none. By default, trace output is directed both to the console and to a trace file.

-c restricts deployment to a single CID. The path can't contain any Unicode characters that can't be mapped to English encoding.

-h prints a brief description of the parameters and usage.

Package deployment

Package deployment is the default action.

This downloads a migration package, reads the local Sophos Update Manager configuration file, and deploys the package to every CID location updated by Sophos Update Manager.

You must specify a path (either UNC path or a local path) to the root folder of the package that needs to be deployed. For example:

"%programfiles(x86)%\Sophos\MigrationAgent\SophosMigrationAgent.exe" –p “\

\MySecServer\SophosUpdate\CloudMigrationPackage”

SophosMigrationAgent.exe –packagepath “c:\LocalStorage\MigrationPackage” – a deploy

SophosMigrationAgent.exe –p “\\SomeServer\SomeShare\SomeFolder

\MigrationPackage” –action deploy

Note

If access to UNC paths is restricted, an agent on a remote Sophos Update Manager can't get the package from another server. Copy the contents of CloudMigrationPackage to a new folder on the remote Sophos Update Manager and use -p with the new, local path.

Note

The path can't contain any Unicode characters that can't be mapped to English encoding.

The result of the operation is kept in the registry along with the rollout number.

Note

The rollout number is incremented each time the package is updated. The number is checked during migration to ensure that out-of-date migration packages aren't used.

You can use the -c parameter to restrict deployment to only one of the CIDs updated by the local

Sophos Update Manager. For example:

SophosMigrationAgent.exe –p “\\SomeShare\SomeFolder\MigrationPackage” –c \

\SomeOtherServer\SomeFolder\CIDs\S001 .

The path must match exactly one of the CID paths from the Sophos Update Manager configuration file. To find out the paths stored in the configuration file, do as follows:

• Use a text editor to open %programfiles(x86)%\Sophos\Update Manager\config.xml

(64-bit) or %programfiles%\Sophos\Update Manager\config.xml

(32-bit).

• Search for the XML element tag <NewCidDir> .

Sophos Migration Tool advanced guide

Note

CIDs in the default share of Sophos Update Manager are not shown as UNC paths but as local file paths. For example <NewCidDir>C:\ProgramData\Sophos\Update Manager\Update

Manager\CIDs\S001</NewCidDir> .

Note

The path can't contain any Unicode characters that can't be mapped to English encoding.

Results of actions

The operation is successful if the package is deployed without problems to all the CIDs managed by the local Sophos Update Manager.

If the operation is successful, Sophos Migration Agent will subsequently skip deployment unless the source package content has been updated with higher rollout number.

If new shares or CIDs have been added since the last successful deployment, we recommend that you use the Sophos Central Migration Tool menu option Actions > Refresh Migration Packages to generate the package again with higher rollout number. Then run Sophos Migration Agent to deploy it to the new update locations.

The operation is reported as unsuccessful if it fails to deploy to one or more CIDs. The error code and the package rollout number are reported to Sophos Enterprise Console by a prefix added to the computer description string.

Logging

You can find the log file here: %ProgramData%\Sophos\MigrationAgent\Logs

\MigrationAgent.log

Sophos Migration Tool advanced guide

8 Get additional help

To get help from Sophos Support:

• Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.

• Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx

Sophos Migration Tool advanced guide

9 Legal notices

Copyright © 2020 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos

Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

Bonjour ! Je suis un chatbot IA spécialement formé pour vous aider avec le Sophos Migration Tool Guide de référence. J'ai soigneusement étudié le document et je peux vous aider à trouver les informations dont vous avez besoin ou expliquer le contenu en termes clairs et simples. Que vous recherchiez des conseils sur des fonctionnalités spécifiques, des étapes de dépannage ou une utilisation générale, n'hésitez pas à poser vos questions. Plus vous fournissez de détails sur vos préoccupations ou besoins, plus je pourrai vous aider avec précision et efficacité.

Assistant en train d''écrire

L''assistant n''est plus disponible. Veuillez réessayer plus tard.

Table des matières

Il semble que vous ayez accédé à un document rédigé en plusieurs langues, dont une qui n''est pas votre langue maternelle. Vous pouvez utiliser les liens suivants pour masquer temporairement les pages sans la langue que vous préférez.

Sophos Migration Tool advanced guide

Contents

1 About this guide

2 Prepare remote Update Managers before migration

Why do you need to configure Update Managers?

Configure Update Managers

Schedule updates for the migration package

3 Prepare a remote database before migration

3.1 Install the Sophos Central Migration Tool database schema

3.2 Uninstall the Sophos Central Migration Tool database schema

4 Migrate a large number of computers

Migrate computers in batches

Set up Update Caches

5 Migrate sub-estates

6 Migrate to multiple Sophos Central accounts or sub-estates

6.1 Clean up before migration to a new account

7 Appendix: Sophos Migration Agent

Installation and updates

Rights needed

Command-line parameters

Package deployment

Results of actions

Logging

8 Get additional help

9 Legal notices

Associés

Sophos Migration Tool Benutzerhandbuch

Sophos Migration Tool Manuale utente

Sophos Migration Tool Manual de usuario

Sophos Migration Toolアドバンスガイド | AIチャット&PDFダウンロード

Sophos CONTROL 9 Owner Manual

Sophos Antivirus Version 10 Setup Guide | AI Chat & PDF Download

Sophos Enterprise Console Upgrade Guide

Sophos Enterprise Console 5.1 Guide

Sophos Enterprise Console Server to Server Migration Guide

Sophos Enterprise Console server to server migration Guide

Sophos Enterprise Console server to server migration Guide

SafeGuard Easy Administrator Help