How to temporarily disable SUMs in order to run the cloud migration tools?

Hi,

If you just wanted to perform an assessment without taking action, I guess you could set all but one SUM computers as deleted in the database.  

For example, on the database computer, if SOPHOS is the name of the local instance in use - the default configuration.
See: https://www.sophos.com/en-us/support/knowledgebase/113030.aspx for more info.

sqlcmd -E -S .\sophos -d SOPHOS540 -q "update ComputersAndDeletedComputers set deleted=1 where name='SUM1'"

Change the Sophos 'Core' database name from SOPHOS540 as needed depending on your version of SEC.  See the following article for more information: https://www.sophos.com/en-us/support/knowledgebase/17323.aspx

Change SUM1 to the name of a secondary SUM computer for example.  Repeat the command changing the name of the SUM to hide all but one SUM.

You should be able to then run the tool.

Once an assessment has been performed you can run:

sqlcmd -E -S .\sophos -d SOPHOS540 -q "update ComputersAndDeletedComputers set deleted=0 where name='SUM1'"

Run this to hide each SUM hidden in the previous command, i.e. changing the name as before.

I would suggest before doing this it would be wise to create a backup of the Sophos 'Core' database. 2 ways to do it:

Using a tool: https://www.sophos.com/en-us/support/knowledgebase/114299.aspx

Using the batch file: https://www.sophos.com/en-us/support/knowledgebase/110380.aspx

Regards,

Jak

Hi Jak,

Thank you for your response. Can I take a snapshot of the VMWare VM instead of creating a backup of the Sophos 'Core' database?

Also, my database version is 521. Is it ok to proceed?

Provider=SQLOLEDB;Integrated Security=SSPI;Initial Catalog=SOPHOS521;Data Source=(local)\SOPHOS;

And If it's a real deal, Do I have to actually delete these SUUMs in order to run the tool?

If yes, where can I set the bootstrap to download the Cloud Agents for client machine?

Cheers,

Jimmy

Hi Jak,

Thank you for your response. Can I take a snapshot of the VMWare VM instead of creating a backup of the Sophos 'Core' database?

Also, my database version is 521. Is it ok to proceed?

Provider=SQLOLEDB;Integrated Security=SSPI;Initial Catalog=SOPHOS521;Data Source=(local)\SOPHOS;

And If it's a real deal, Do I have to actually delete these SUUMs in order to run the tool?

If yes, where can I set the bootstrap to download the Cloud Agents for client machine?

Cheers,

Jimmy

Also, my database version is 521. Is it ok to proceed?

Provider=SQLOLEDB;Integrated Security=SSPI;Initial Catalog=SOPHOS521;Data Source=(local)\SOPHOS;

A snapshot of the computer would also do. I can see from the connection string it's a local SOPHOS instance so everything is on the same computer.

The SQL is fine for the SOPHOS521 database, which means you are currently running one of these version of SEC:

5.2.1
5.2.1 R2
5.2.2
5.3.0
5.3.1

The deleted flag in the database just as well might be called hide.  When you delete a computer in SEC, you're just setting this deleted flag to 1.  This is to hide it from view but to keep the report history.

So based on the above you would want to run in an administrative command prompt:
sqlcmd -E -S .\sophos -d SOPHOS521 -q "update ComputersAndDeletedComputers set deleted=1 where name='REMOTESUM1'"
sqlcmd -E -S .\sophos -d SOPHOS521 -q "update ComputersAndDeletedComputers set deleted=1 where name='REMOTESUM2"
sqlcmd -E -S .\sophos -d SOPHOS521 -q "update ComputersAndDeletedComputers set deleted=1 where name='REMOTESUM3"

Obviously change the REMOTESUM1, REMOTESUM2, REMOTESUM3, etc  and add as many commands and you have SUMs.  Just leaving the local SUM on the management server as is.

Once you've run the tool to create an assessment set them back to deleted = 0.

sqlcmd -E -S .\sophos -d SOPHOS521 -q "update ComputersAndDeletedComputers set deleted=0 where name='REMOTESUM1'"
sqlcmd -E -S .\sophos -d SOPHOS521 -q "update ComputersAndDeletedComputers set deleted=0 where name='REMOTESUM2"
sqlcmd -E -S .\sophos -d SOPHOS521 -q "update ComputersAndDeletedComputers set deleted=0 where name='REMOTESUM3"

I would suggest that you change the state to deleted run the tool and change it back as quickly as you can to avoid any issues.

In-terms of actually performing the migration you can use the tool, which will, once you've added your Sophos Central details, be able to pull down an installer and place it in the distribution point.  Perform some magic on the CID and on the next update the clients will download the installer and those which are eligible for migration will run the installer.  They will appear in Sophos Central and have a state in SEC as migrated.

You don't need to use the tool to deploy the Sophos Central installer.  You can just log in to the Sophos Central account and download it from there.  See: https://www.sophos.com/en-us/support/knowledgebase/119265.aspx for more information.

Regards,

Jak

Thank you Jak. First thing first. I'll run the migration tool to get the readiness report end let you know the result. [:D]

Have a great day,

Jimmy