migration to Sophos Central encryption?

Hi Gary

Did you get an answer to your question? I'm looking for an remote method to remove the three SafeGuard components and install the complete Endpoint with Device Encryption.

Thanks, Lee

So it turns out that if you're running SafeGuard 8.x you can uninstall the client after deploying an uninstall policy and moving an XML file in to the right location. Then when you install the Sophos Central client it will find that your drive is Bitlocker encrypted and take over management of its keys. If you are running SafeGuard 7.x, however, it won't let you uninstall without decrypting your entire volume. In that case, we've found it quicker to upgrade to 8.x first. Either way, it will require some reboots of the system so you'll definitely want to involve the end user if you're trying to do this remotely. We've found it easier to run them concurrently and whenever we get a SafeGuard system in for maintenance we'll also convert it to Sophos Central at the same time -- which is even easier if we're just re-imaging a machine since our new WIn10 image includes Sophos Central. It's also possible to use SafeGuard and Sophos Central concurrently and have policies in place for all users. You'll quickly see which systems are still using SafeGuard because they'll alert you that it can't run the device encryption service. Please let me know if I've left out any important details.

So it turns out that if you're running SafeGuard 8.x you can uninstall the client after deploying an uninstall policy and moving an XML file in to the right location. Then when you install the Sophos Central client it will find that your drive is Bitlocker encrypted and take over management of its keys. If you are running SafeGuard 7.x, however, it won't let you uninstall without decrypting your entire volume. In that case, we've found it quicker to upgrade to 8.x first. Either way, it will require some reboots of the system so you'll definitely want to involve the end user if you're trying to do this remotely. We've found it easier to run them concurrently and whenever we get a SafeGuard system in for maintenance we'll also convert it to Sophos Central at the same time -- which is even easier if we're just re-imaging a machine since our new WIn10 image includes Sophos Central. It's also possible to use SafeGuard and Sophos Central concurrently and have policies in place for all users. You'll quickly see which systems are still using SafeGuard because they'll alert you that it can't run the device encryption service. Please let me know if I've left out any important details.

Thanks Gary. We are already using 8. Since my post I've been testing and what I've found is that I uninstall the SafeGuard programs using the MSI file and msiexec commands with /norestart, then install Endpoint with the Device Encryption component using -quiet command. All of our clients already have Sophos Central Endpoint (without the device encryption component), so before doing anything I turn off tamper protection in Sophos Central. I found the Bitlocker key was then regenerated and available in SC and the user wouldn't see anything or be prompted to take action. The Endpoint client still needs a restart, as does SafeGuard to complete the removal, but this can happen at any time. I didn't need to to do anything else so curious to know what the XML file is and the purpose of moving it.

Lee