Sophos Central Migration Tool Help. Product version: 2.0

Transcription

1 Sophos Central Migration Tool Help Product version: 2.0

2 Contents 1 About Sophos Central Migration Tool How does Sophos Central differ from on-premise management? How does migration work? Assessment Migration Get started with migration Consider possible issues with migration Computers are unprotected during migration Policy settings may change Computers may update differently Check the requirements for migration Sophos Central license Supported operating systems Supported features Disable tamper protection Deal with unsupported management tools Install Sophos Central Migration Tool Check which computers can be migrated Computer readiness and migration states Migration states displayed in the on-premise console Warnings for computers that are "Ready" Preserve your computer groups Set up new policies Exclude computers from migration Migrate computers View migrated computers in Sophos Central Migrate the on-premise management server Troubleshooting Migration error "Error (Timed out)" "Migrated with error (Installation failed)" Temporary "Installation failed" errors

3 15.5 "Sophos Central agent installer error" "Not ready": Endpoint Security or AutoUpdate required Uninstall Sophos Central Migration Tool Roll back to on-premise management View a computer readiness report View a computer readiness report in Excel View the logs Change which columns are displayed Technical support Legal notices

4 Sophos Central Migration Tool 1 About Sophos Central Migration Tool Sophos Central Migration Tool helps administrators to move management of protected computers from Sophos Enterprise Console 5.0 and later to Sophos Central. Getting started To get started right away, see Get started with migration (page 10). To read more about the background, see How does migration work? (page 6) Upgrading? You can't upgrade directly from version Use Add/Remove Programs to uninstall the old version before you install version 2.0. Do you need our advanced guide? If any of the following apply to you, read our advanced guide as well. You have a remote Sophos Update Manager. You have a remote Sophos database. You want to preserve your computer groups. You have a large number of computers to migrate. You want to migrate by sub-estate. You want to migrate to multiple Sophos Central accounts. Find the advanced guide at: 4

5 Help 2 How does Sophos Central differ from on-premise management? Sophos Central differs from on-premise management in three ways. Management in the cloud The Sophos Central console is hosted in the cloud by Sophos. You don t need a management server and you don t have to install and update the management console. User-based policies On-premise management applies policies to computer groups. Sophos Central gives you a choice: you can set policies for: Users or user groups. These policies will apply to all a user's computers or other devices. Computers or computer groups. Dedicated protection for servers On-premise management manages workstations and servers the same way. Sophos Central manages servers separately. Server policies apply to particular servers, no matter who logs on. Server protection also automatically recognizes certain common server applications, so you don t need to set complicated scanning exclusions. For more information about Sophos Central, see knowledgebase article For help with the Sophos Central console and policies, see the Sophos Central Help. 5

6 Sophos Central Migration Tool 3 How does migration work? You install and run the migration tool on the server where Sophos Enterprise Console (management server) is installed. Note: To install and run the tool, you must be a member of the the administrators group on the server and have impersonation rights. You can use the tool to: Assess computers (page 6) to see whether they can be migrated to Sophos Central. Migrate computers (page 7). 3.1 Assessment When you run the migration tool, it gets the list of managed computers from the Enterprise Console database. The tool then checks whether the computers are ready for migration to Sophos Central. To do this, it uses a set of rules (for example, rules for the supported operating system). Note: Sophos updates the rules automatically, for example if Sophos Central adds support for new features. The tool can do the check in one of two modes: basic assessment or full assessment. Full assessment requires a Sophos Central account. During a basic assessment, the tool checks that a computer: Runs an operating system supported in Sophos Central. Has only those features enabled or installed that are supported in Sophos Central. Has no unsupported server software or component installed. Has an Endpoint Security and Control version that can be migrated. During a full assessment, the tool does the basic checks, but also compares all features active on the computers against your Sophos Central license. It will alert you if there are any features enabled that you are not licensed to use in Sophos Central. 6

7 Help The tool then displays evaluation results, showing whether the computers are ready for migration and, if they are not, the reason(s) why they cannot be migrated. For more information about requirements, see Check the requirements for migration (page 13). For more information about assessing computer readiness, see Check which computers can be migrated (page 17). 3.2 Migration This section describes how computers are migrated and how they are handled by Sophos Central afterwards. How computers are migrated When you choose to migrate computers: The migration tool downloads the Sophos Central agent software and places it in the update share (bootstrap location). The computers on the migration list get the agent software during their next scheduled update. (You set this in the Updating policy, on the Schedule tab). The Remote Management System (RMS), used for communications between the computer and the on-premise console, is uninstalled. 7

8 Sophos Central Migration Tool The Sophos Central agent software is installed. This includes Sophos Management Communications System (MCS), used for communications between the computer and Sophos Central. Note: The migration process may take up to a couple of hours, depending on the computers updating interval and network connection. What happens after migration When a computer is migrated to Sophos Central, it is treated either as a user s workstation, if it is running a Windows client operating system, or as a server, if it is running a Windows server operating system. When a workstation is migrated: A Sophos Central user account is created based on the last known user of the computer at the time of migration, and is added to the Sophos Central users list. The computer is added to the Computers list in Sophos Central. By default, it is also automatically put into a computer group with the same name and path as its Enterprise Console group. See Preserve your computer groups (page 22). Policies are applied to the computer (by default, the Base policy for each feature). 8

9 Help When a server is migrated: The server is added to the Servers list in Sophos Central. By default, it is also automatically put into a server group with the same name and path as its Enterprise Console group. See Preserve your computer groups (page 22). Server policies are applied to the server (by default, the Base policy for each feature). For more information about the migration process, see Migrate computers (page 25). 9

10 Sophos Central Migration Tool 4 Get started with migration You migrate your computers to Sophos Central by following these key steps. 1. Consider possible issues with migration (page 11). 2. Check the requirements for migration (page 13). 3. Install Sophos Central Migration Tool (page 16) (if you haven't already done so). 4. Check which computers can be migrated (page 17). 5. Set up new policies (page 23). 6. Migrate computers (page 25). 7. Migrate the on-premise management server (page 28) (if you have already migrated all the managed computers). 10

11 Help 5 Consider possible issues with migration Before you start migration, consider these issues, which may affect your planning. Computers are unprotected during migration (page 11). Policy settings may change (page 11). Computers may update differently (page 12). 5.1 Computers are unprotected during migration Your computers will be unprotected for a time during migration. This happens when the on-premise agent software has been uninstalled but the Sophos Central agent software has not yet been installed. We recommend that you do as follows: Migrate the computers when they are not being used. Advise your users to save all their work before migration and leave their computers turned on. After migration, go to Sophos Central to check whether computers need to be restarted. Sometimes a restart is needed for full protection. Run a full system scan of the computers to ensure that they haven t been compromised. 5.2 Policy settings may change When you migrate computers, the policy settings used on them may change. The migration tool does not migrate your policy settings to Sophos Central. Instead, it applies Sophos Central policies as follows: Migrated computers will get the Sophos Central policies you set for the computer (or server) group that the computers are placed in. Note: Computers are placed in groups by the migration tool's "Preserve layout" option (which is on by default), or by Sophos Central AD Sync. If a migrated computer is not associated with a group, or is in a newly-created group, it will get the base (default) Sophos Central policies. Even when migrated computers get group policies, other policies, such as user-based policies, can override them. You should review your Sophos Central policies and check how your policy settings will change after the migration, especially if you have modified the default on-premise policies. For more information on how policy settings will change, see knowledgebase article For information about Sophos Central policies, see the Sophos Central Help. 11

12 Sophos Central Migration Tool 5.3 Computers may update differently When you migrate computers, the way they get updates may change. In Sophos Central, computers download their updates directly from Sophos by default. This can increase your bandwidth usage. You should consider using the Update Cache feature in Sophos Central. This enables you to set up "update caches", which store endpoint updates on a server on your network from which computers can download them. We recommend that you do this before migration to avoid spikes in bandwidth usage. 12

13 Help 6 Check the requirements for migration To be migrated to Sophos Central, computers must run a supported operating system and not have any Sophos security features that are not supported in Sophos Central. See the full list of requirements and actions you can take in the following subsections. Note: The list of Sophos Central readiness conditions against which the migration tool checks computers is updated automatically, for example when a new operating system or feature becomes available in Sophos Central. 6.1 Sophos Central license You must have a Sophos Central account with a valid license to migrate computers to Sophos Central. You also need a Sophos Central account to carry out a full assessment of computers before migration. If you log in to the account, the migration tool can compare the features on your computers with your Sophos Central license and alert you if there are any features enabled that you are not licensed to use in Sophos Central. Note: You do not need a Sophos Central account if you want to run the tool in the basic assessment mode. What to do if you have unlicensed features If the migration tool detects an active feature that you are not licensed to use in Sophos Central, you can: Change your Sophos Central license to include the feature. For more information about available licenses, see and Disable the feature in the on-premise console or uninstall the feature. To see details of your Sophos Central license or licenses, go to the Sophos Central console, click on your account name (upper-right of the UI) and select Licensing. 6.2 Supported operating systems Computers running the following operating systems can be migrated to Sophos Central using Sophos Central Migration Tool, provided that all the other conditions are met. Windows Vista Windows 7 Windows 8 Windows

14 Sophos Central Migration Tool Windows 10 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Small Business Server 2011 At the time of this release, the migration tool cannot migrate other operating systems that are supported by Sophos Central. To migrate computers that run those operating systems, uninstall the on-premise endpoint software and install the Sophos Central agent software. For a full list of operating systems supported by Sophos Central, see knowledgebase article For information about how to uninstall Sophos products, see knowledgebase article For information about how to install Sophos Central endpoint software, see knowledgebase article and knowledgebase article Supported features Sophos Central may not yet support all the features you manage with Enterprise Console. You must disable or uninstall any unsupported features before migration. For more information, see knowledgebase article Disable tamper protection You must disable tamper protection before migration so that the migration tool can uninstall the on-premise endpoint software on the computer. To disable tamper protection: 1. Check which tamper protection policy is used by the group(s) of computers you want to migrate. In the Groups pane, right-click the group and click View/Edit Group Policy Details. In the group details dialog box, you can see the policies currently used. 2. In the Policies pane, double-click Tamper protection. Then double-click the policy you want to disable. 3. In the Tamper Protection Policy dialog box, clear the Enable tamper protection check box. Click OK. Make sure the updated policy is applied to the computers. In the computer list, the Policy compliance status changes to Awaiting policy transfer, and then back to Same as policy when the updated policy is applied to the computers. After the computers have been migrated, the Sophos Central tamper protection policy will be applied to them. 14

15 Help 6.5 Deal with unsupported management tools You cannot usesophos Central Migration Tool to migrate a computer that: Has Sophos Enterprise Console management server installed. Has Sophos Update Manager installed. Acts as a message relay between endpoint computers (running Endpoint Security and Control) and the Enterprise Console management server. Has one of the following installed: PureMessage for Microsoft Exchange, Sophos for Microsoft SharePoint, or PureMessage for Lotus Domino. How to deal with computers running management tools If you want to migrate these computers, ensure that the Sophos management components are no longer needed and then uninstall them, as follows: Sophos Enterprise Console management server: Uninstall this only after you migrate all the computers it manages. Sophos Update Manager: Uninstall this only after you migrate all computers that update from it. Message relays: Uninstall these only after you migrate all computers communicating through them. For more information, see knowledgebase article

16 Sophos Central Migration Tool 7 Install Sophos Central Migration Tool Requirements You must install Sophos Central Migration Tool on the computer where the Sophos Enterprise Console management server is installed. You must be a member of the administrators group on the server and have impersonation rights. You also need: Windows Installer Framework 4.5 or later. If you don t have it, install it before you install the tool. Extra requirements for complex networks If any of the following apply, see the advice in our Sophos Central Migration Tool advanced guide. You have a remote Sophos Update Manager. You have a remote Sophos database. You want to preserve your computer groups. You have a large number of computers to migrate. You want to migrate by sub-estate. You want to migrate to multiple Sophos Central accounts. Get the installer and run it Go to knowledgebase article This includes a link to the installer and advice on installation. 16

17 Help 8 Check which computers can be migrated To check whether your computers can be migrated to Sophos Central: 1. Open Sophos Central Migration Tool. Note: Only one instance of the tool can run on the same computer at the same time. 2. In the Connect to Sophos Central dialog, choose from: Full assessment and migration. You will be prompted to log in to Sophos Central and set up a migration password (see next step). Basic assessment. A basic assessment checks the computers operating systems, enabled features, etc. A full assessment also checks whether your Sophos Central license covers the features you currently have. 3. If you selected Full assessment and migration, you see the Create Sophos Central Token dialog. a) Click the link to go to Sophos Central and log on. b) The API Token Management page is displayed and you're prompted to add a token. Enter a token name and passphrase. Click Copy. c) Go back to the migration tool dialog and Paste the token in. From now on, you'll use the migration passphrase when you log on to use the migration tool. Note: If you keep the migration tool open for more than 24 hours, you'll need to re-enter your passphrase. 4. Sophos Central Migration Tool retrieves the list of computers from the on-premise management database, checks them for readiness, and displays the list of results. 5. The migration tool displays a list of your computers, Review the list to see which computers are ready to be migrated and which are not. There are three main readiness states: Ready. The computer can be migrated. If there are warnings, see Warnings for computers that are "Ready" (page 20). Not ready but can be remediated. The computer cannot be migrated in its present state, but you can take remediation actions that will enable migration. For example, you can disable features that are not supported in Sophos Central. Not ready and cannot be migrated. The computer cannot be migrated and no remediation actions are available. For example, the computer is running an operating system that is not supported in Sophos Central. Note: Tamper protection is supported in Sophos Central, but you must disable it. See Disable tamper protection (page 14). For more information about computer readiness and migration states, see Computer readiness and migration states (page 18). 17

18 Sophos Central Migration Tool The results of computer assessment for readiness may look like this: 6. Optionally, you can click Report to generate a more detailed report on computer readiness. See View a computer readiness report (page 34). If you are ready to migrate your computers to Sophos Central, see Migrate computers (page 25). 8.1 Computer readiness and migration states After being assessed by the migration tool, computers may end up in or go through the following states. Note: For more information about the status and remediation actions, if any (for example, for computers that are not ready), click on the computer in the list and view the details in the right pane. Icon Status Description Ready The computer can be migrated. If there are warnings, see Warnings for computers that are "Ready" (page 20) 18

19 Help Icon Status Description Not ready (fixable) The computer cannot be migrated in its present state, but you can take remediation actions that will enable migration. For example, you can disable features that are not supported in Sophos Central. Not ready The computer cannot be migrated. Not ready (excluded) The computer has been excluded from migration by the administrator. See Exclude computers from migration (page 24). Pending The administrator has chosen to migrate the computer, but migration has not started yet. Migrating The computer is being migrated. Migrated The computer has been migrated and has been found in the list of computers managed by Sophos Central. Error An error has occurred during migration. The computer is not yet managed by Sophos Central. See Troubleshooting (page 29). Migrated with error (Installation failed) Migrated with error (Installation failed) The computer has been migrated and is managed by Sophos Central, but an installation error has occurred that has most likely left the computer unprotected. See "Migrated with error (Installation failed)" (page 30). The computer has been migrated and is managed by Sophos Central, but an installation error hasn t been resolved, and the computer has remained unprotected for more than a predefined time interval (by default, 24 hours). See "Migrated with error (Installation failed)" (page 30). 8.2 Migration states displayed in the on-premise console Once a computer has started migration, its migration state is displayed in the on-premise management console, in the Computer description column, for example: The following table shows the correspondence between the migration state shown in the migration tool and the computer description in the on-premise console. 19

20 Sophos Central Migration Tool Migration state Computer description / Status in on-premise console Description Pending {SC:Pending:<jobid>} The computer has been added to the migration list and is awaiting migration. <jobid> is a unique integer associated with the migration request, here and below. Migrating {SC:Migrating:<jobid>} The computer is being migrated. In Central {SC:InCentral:<jobid>} The computer has been found in the list of computers managed by Sophos Central and has successfully updated at least once since then. Error {SC:Error:<jobid>;<error code>} An error has occurred during migration. Timed out {SC:Timeout:<jobid>} The computer has been in the Pending or Migrating state for longer than a predefined timeout interval. For more information, see "Error (Timed out)" (page 29). In Central (error) {SC:FailedInstallation:<jobid>} The computer has been found in the list of computers managed by Sophos Central, but the installation of the Sophos Central agent software has failed. In Central (critical error) {SC:NotProtected:<jobid>} The Sophos Central agent software installation error hasn t been resolved for longer than a predefined time interval (by default, 24 hours). For more information about these states and what actions to take, if necessary, see the details in Sophos Central Migration Tool, in the log (page 35), or in Sophos Central. For information about resolving errors, see Troubleshooting (page 29). 8.3 Warnings for computers that are "Ready" You may see warnings beside computers that are "Ready" for migration. Check the table below to see what the warning means and whether you need to take action. Warning Comments {productname}is not supported by Sophos Central and will be uninstalled during migration Primary update location is not a UNC path. You don t need to take action. After migration, the computer will no longer have the named product installed. Depending on your Enterprise Console setup, migration may not work with this non-unc path. 20

21 Help Warning Comments Primary update location is not updated by the local Sophos Update Manager. Some policy settings may change after migration. The computer has the exploit prevention feature installed. You may need to restart it during the migration. The computer gets updates from a remote Update Manager. You must make changes on that Update Manager before you migrate. See the Advanced Guide. See Policy settings may change (page 11). Restart the computer (if necessary). 21

22 Sophos Central Migration Tool 9 Preserve your computer groups By default, your existing computer groups are preserved when you migrate to Sophos Central. If the groups don't already exist in Sophos Central, they are created with the same names and in the same structure. Note: Sophos Central puts computers and servers in different groups. If an Enterprise Console group includes both computers and servers, migration creates a new computer group and a new server group in Sophos Central. If you use Active Directory synchronization, you should see the Sophos Central Migration Tool advanced guide for advice on handling computer groups. You can turn the option to preserve groups on or off. Select File > Options > Preserve Group Layouts. 22

23 Help 10 Set up new policies The migration tool does not migrate your policy settings to Sophos Central. See Policy settings may change (page 11). Unless you want migrated computers to get your default Sophos Central policies, you should take action. Before migration, apply custom policies to the Sophos Central computer (or server) group that you will migrate computers to. This ensures that computers get the right policies as soon as you migrate them. Note: Computers are placed in Sophos Central groups by the migration tool's Preserve Group Layouts option (which is on by default), or by Sophos CentralAD Sync. Alternatively, you can create and apply custom policies after you migrate computers. 23

24 Sophos Central Migration Tool 11 Exclude computers from migration If you don t want to migrate a computer to Sophos Central, you can add it to the migration exclusion list. That way, it won t be accidentally selected for migration and migrated. Note: Computers that are already managed by Sophos Central cannot be excluded from migration. Any such computers that have been selected will not be added to the exclusion list. To exclude computers from migration: 1. Select the computer or computers in the computer list, right-click and click Add to Exclusion List. 2. In the Exclude computers from migration dialog box, type in the reason for the exclusion, if you wish, to serve as a reminder. Click OK. Excluded computers status will change to Not Ready with a padlock icon. If you later change your mind and decide to migrate the computers, you can remove them from the exclusion list. After you re-include computers in the migration process, they may appear as either Ready or Not Ready, depending on their Sophos Central readiness assessment. 24

25 Help 12 Migrate computers Important: Your computers will be unprotected for a time during migration. See Computers are unprotected during migration (page 11). To migrate your computers to Sophos Central: 1. Open Sophos Central Migration Tool, connect to Sophos Central, and check which computers can be migrated. as described in Check which computers can be migrated (page 17). If you haven't set up your migration password for access to Sophos Central yet, you select a "Full" assessment to get set up. 2. Remediate computers that cannot be migrated in their present state. For example, disable features that are not supported in Sophos Central. If you have tamper protection enabled, disable it. See Disable tamper protection (page 14). 3. Select the computers that are ready. To view only the computers that are ready, click Ready at the top of the screen. 4. Filter the computers before migration. You can: Click on the funnel icon in a column header (for example, Group) and type the term you want to filter for. Display different columns that you can use for filtering. Right-click in the table header and select from the menu. See Change which columns are displayed (page 36). When you filter computers, the Ready number doesn't change, but the number in the lower right of the UI shows how many you have filtered. To clear filters, use View > Filters > Clear All. 5. Highlight computers and click Select to select them for migration. 6. Click Migrate, and then click Yes in the confirmation message. The computers go into the Pending state until their next scheduled update. Note: If computers are in the Pending state for too long, you'll see a timeout warning. See "Error (Timed out)" (page 29). When the migration starts, the computers change their state to Migrating. Note: Migration may take up to two hours, depending on the computers updating interval and network connection. It may take longer for computers that update from a remote Sophos Update Manager. Note: Some computers may display a Windows Action Center alert, saying that the computers are unprotected. The alert will disappear after migration. When migration is complete, computers are moved to the In Central view. If migration isn't successful, the affected computers are moved to the Error view, where you can find details. You can now view migrated computers in Sophos Central (page 27). 25

26 Sophos Central Migration Tool Important: You should do as follows. Go to Sophos Central to check whether the computers need to be restarted. The migration tool doesn t show this. Run a full system scan of the computers to ensure that they were not compromised during migration. Check that the computers have the right Sophos Central policies applied. After migrating all the managed computers, you can Migrate the on-premise management server (page 28). Note: After migration, we recommend that you delete the Sophos Central API Token that you set up. 26

27 Help 13 View migrated computers in Sophos Central Once a computer has been migrated to Sophos Central, its details in the migration tool are not updated anymore. For the latest, up-to-date information about the computer, including any protection alerts, go to Sophos Central. 1. In Sophos Central: To view the details for a migrated workstation, go to the Computers page. To view the details for a migrated server, go to the Servers page. 2. In the list of computers or servers, click on the name of the computer to view its full details. For more information, see the Sophos Central Help. 27

28 Sophos Central Migration Tool 14 Migrate the on-premise management server If you have migrated all endpoint computers, you can migrate the on-premise management server to Sophos Central. 1. Uninstall Sophos Central Migration Tool (page 32). 2. Uninstall Sophos Enterprise Console. Uninstall components in this order: Sophos Management Console Sophos Management Database Sophos Management Server Sophos Update Manager Note: Uninstalling the Sophos Management Database component will not remove the databases attached to the SQL Server instance. For a list of databases associated with each console, see knowledgebase article If you are planning to leave the SQL Server instance, the databases will remain attached. See also knowledgebase article Run the Sophos Central agent installer to migrate the server. You can download the installer for Server Protection for Windows from the Protect Devices page in Sophos Central. 28

29 Help 15 Troubleshooting 15.1 Migration error If an error occurs before a computer has been migrated to Sophos Central, you will see: A yellow warning sign: The word "Error" in the Status column next to the computer. See computer details for more information about the error. For more information about the timed out error, see also "Error (Timed out)" (page 29) "Error (Timed out)" If a migration action has timed out on a computer before the computer could be migrated to Sophos Central, you will see: A yellow warning icon: "Error (Timed out)" in the Status column next to the computer. This error appears when: The computer has been in the Pending state for more than a predefined timeout interval. The timeout occurs in two hours (by default) if the computer is connected to the network and communicating with the on-premise management console. If the computer is offline, the timeout will occur in 24 hours. The computer has been in the Migrating state and has not been found in the list of computers managed by Sophos Central for more than a predefined timeout interval (by default, one hour). There are several possible reasons for the timeout error. For example, there may be a connection problem between Sophos Central and the server on which Sophos Central Migration Tool is running. Check in Sophos Central to see if the computer has been migrated and appears in Sophos Central. Note: A computer appears in Sophos Central as soon as it has registered, but it doesn t appear in Sophos Central Migration Tool until it has updated at least once after that and is protected. If the computer appears in Sophos Central, wait several minutes and check the computer entry in Sophos Central Migration Tool again. If it still shows the error, try restarting the tool and logging in to your Sophos Central account again. If the computer hasn t appeared in Sophos Central, go to that computer and check the Sophos Endpoint Security and Control installation status. Try running the Sophos Central agent installer manually on the computer. 29

30 Sophos Central Migration Tool 15.3 "Migrated with error (Installation failed)" If an installation error occurs after migration, and a computer might not be protected, you see one of the following icons next to the computer: Icon Status Description Migrated with error (Installation failed) Migrated with error (Installation failed) The computer has been migrated and is managed by Sophos Central, but an installation error has most likely left the computer unprotected. The computer has been migrated and is managed by Sophos Central, but an installation error hasn t been resolved. The computer has been unprotected for more than a predefined time interval (by default, 24 hours). These errors can occur: If the migrated computer needs to be restarted. If the installation takes more than ten minutes (the default time allowed). In this case, the error is displayed only temporarily. See Temporary "Installation failed" errors (page 30) for advice on how to prevent this issue. You can go to Sophos Central to investigate the cause, as described below. Check for errors in Sophos Central Important: In Sophos Central, these error events may not be escalated to a warning and displayed in the Alerts right away. To check the events for a computer, do one of the following: For a workstation, go to Computers, click on the computer name and go to the Events tab. For a server, go to Servers, click on the server name and go to the Events tab. To view events for all computers, go to Logs & Reports > Events, and filter the events by the type Protection > Failed to protect computer or server. If you see an event Failed to install savxp: a reboot is required before the installation can succeed, you must restart the computer to ensure it is protected successfully following the migration. For more information about events and alerts in Sophos Central, see the Sophos CentralHelp, Event Types or Alerts Temporary "Installation failed" errors The "Migrated with error (Installation failed)" error can be displayed temporarily if installation of the Sophos Central agent takes more than ten minutes (the default time allowed before an error is reported). This section tells you how to resolve the error and how to prevent it occurring in future. 30

31 Help To resolve the error: Go to Sophos Central and check that the computer is listed as a managed device. Restart the computer. The error should then be replaced by a successful "Migrated" status. To prevent this timeout problem in future migrations, you can use a registry setting to change the time allowed for installation. See knowledgebase article "Sophos Central agent installer error" The Sophos Central agent installer may report an error preventing migration. In this case, in Sophos Central Migration Tool, you will see "Sophos Central agent installer" error in the Status column next to the computer. In Sophos Enterprise Console, you will see the following status in the Computer description column: {SC:Error:<jobid>;<error code>} where <jobid> is a unique integer associated with the migration request and <error code> is an error code returned by the Sophos Central agent installer. You can look up the error by its error code and read about remediation steps in knowledgebase article "Not ready": Endpoint Security or AutoUpdate required Sophos Central Migration Tool requires that Sophos Endpoint Security and Control and Sophos AutoUpdate be installed and running on the migrated computer. If either cannot be detected, you will see the error The migration requires that you install Sophos Endpoint Security and Control or The migration requires that you install Sophos AutoUpdate. To resolve the error, re-protect the endpoint computer. 1. In Sophos Enterprise Console, select the computers you want to re-protect, right-click, and then click Protect Computers. 2. Follow the steps in the Protect Computers Wizard. Remember not to select any of the features that are not supported in Sophos Central, such as Encryption software, Firewall or Patch. For more information about protecting computers, see the Sophos Enterprise Console Help, Protect computers automatically. 31

32 Sophos Central Migration Tool 16 Uninstall Sophos Central Migration Tool Before you uninstall the tool, complete any migration tasks that are running. If you don't, you may lose information about the progress of migration. To uninstall the tool, use the setup program, as follows. Note: We don't recommend that you use Add/Remove Programs or Programs and Features. If UAC is enabled, this type of uninstallation may not remove the migration tool's data schema. 1. Open a command prompt with administrator rights (right-click Start and select Run as Administrator). 2. Go to the Sophos Central Migration Tool installation files on the server: C:\scmt_ Run Setup.exe/u 32

33 Help 17 Roll back to on-premise management This version of Sophos Central Migration Tool doesn t support automatic rollback. After you have migrated to Sophos Central, you cannot roll back to the on-premise endpoint software (Endpoint Security and Control 10.x for Windows) by using the tool. To roll back, use a script as described in knowledgebase article

34 Sophos Central Migration Tool 18 View a computer readiness report A computer readiness report shows you whether computers are ready to migrate. To generate a report, click the Report button (in the lower left of the user interface). An HTML report is displayed, containing details of all computers (not just computers you have selected), their readiness state, and required remediation actions, if any. If you want to view the report in Excel, see View a computer readiness report in Excel (page 34) View a computer readiness report in Excel The Report button in the migration tool generates an HTML report that is displayed to you, but also generates an XML copy of the report, report.xml, in the following location: C:\ProgramData\Sophos\Cloud Migration Tool\ The file report.xml is updated every time you click Report. If you want to view the computer Sophos Central readiness report as an Excel spreadsheet, follow these steps: 1. Open Excel. 2. In Excel, on the File menu, click Open. Browse to C:\ProgramData\Sophos\Cloud Migration Tool\ and open the file report.xml. Note: ProgramData or Application Data is a hidden folder. Therefore, you have to either type in the full path when browsing for the file or disable hidden folders in Windows Explorer. 3. When prompted, choose to open the file without applying the stylesheet. Click OK. 4. When prompted, choose to open the file as an XML table. Click OK. 5. In the message saying that no schema is present, click OK or Cancel. This will produce an Excel table with the computers you selected before you clicked Report and their readiness status. You can sort and group the entries in the table. 34

35 Help 19 View the logs You can find the Sophos Central Migration Tool log file in the following location. C:\ProgramData\Sophos\Cloud Migration Tool\Logs\CloudMigration.log Note: ProgramData is a hidden folder. Therefore, you have to either type in the full path when browsing for the file or disable hidden folders in Windows Explorer. The logs created during installation or uninstallation of the tool can be found under C:\Windows\Temp. The logs are: mtc-dbinstall.log mtc-dbuninstall.log mtc-install.log mtc-setup.log scmtcl_<timestamp>.log 35

36 Sophos Central Migration Tool 20 Change which columns are displayed You can add columns to the migration tool s computer list view to display more information about the computers, such as the computer description, operating system, or server role. The Name, Domain/workgroup, Status, and Group columns are always displayed. You cannot hide them. To change which columns are displayed: 1. On the View menu, click Columns (or right-click anywhere in the table header) and then click on the name of the column you want to display or hide. The columns that are displayed in the view have check marks next to their names. 2. After you have added the columns to the view, you can: Drag and drop the column headings to rearrange the order in which the columns are displayed. Change the width of a column by dragging the boundary on the right side of the column heading. Sort the list of computers by any column by clicking on its heading. Note: If you generate a computer readiness report, it includes all information about computers, irrespective of the columns displayed in the computer list when the report is generated. 36

37 Help 21 Technical support You can find technical support for Sophos products in any of these ways: Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem. Visit the Sophos support knowledgebase at Download the product documentation at Open a ticket with our support team at 37

38 Sophos Central Migration Tool 22 Legal notices Copyright 2017 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner. Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners. BCrypt.Net New BSD License (BSD) Copyright (c) 2006, 2010, Damien Miller <djm@mindrot.org>, Ryan Emerle All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the <organization> nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Boost Software License Permission is hereby granted, free of charge, to any person or organization obtaining a copy of the software and accompanying documentation covered by this license (the "Software") to use, reproduce, display, distribute, execute, and transmit the Software, and to prepare derivative works 38

39 Help of the Software, and to permit third-parties to whom the Software is furnished to do so, all subject to the following: The copyright notices in the Software and this entire statement, including the above license grant, this restriction and the following disclaimer, must be included in all copies of the Software, in whole or in part, and all derivative works of the Software, unless such copies or derivative works are solely in the form of machine-executable object code generated by a source language processor. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. FastJSON, Log4net fastjson log4net Apache License Version 2.0, January TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. 39

40 Sophos Central Migration Tool "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: a. You must give any other recipients of the Work or Derivative Works a copy of this License; and b. You must cause any modified files to carry prominent notices stating that You changed the files; and c. You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and d. If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed 40