Redirecting/Reprotecting MacOS Endpoints Post-SEC Migration

Hello David D1,

you can use mrinit.custom to redirect the Macs - provided you use the same certificates on the new server.

Christian

QC,

If i'm understanding the documentation correctly, i'll need to configure the custom mrinit.custom file to point to the new management SEC before the actual migration? That way the endpoints can receive the redirect and then after the migration is complete they should begin checking in/reporting to the new console? Thanks for your help.

Regards,

DD

Hello DD,

with the mrinit.custom pointing to the new SEC the Macs will immediately try to contact it (and no longer the old). They'll appear disconnected in old. Once new is there you'd see these Macs and can make them comply with the appropriate updating policy.

You can also do it the other way round. From old assign an updating policy pointing to new. Put the mrinit.custom in the new CIDs.

Christian

Hello QC,

is there a way to redirect MacOS endpoint to a new server if certificates of old and new server server differ ?

Regards,

Holge

Hello QC,

is there a way to redirect MacOS endpoint to a new server if certificates of old and new server server differ ?

Regards,

Holge

Hello Holger,

my remark about the same certificates comes from deduction. As you see it isn't explicitly mentioned in the article. The ReInit script for Windows has to fiddle with the keys.

The official way is a reinstall. I'm not a Mac expert, it looks like something similar to EMU could be written (but nobody has done it yet).
Again just speculating what the basic steps could be:
• stop (at least) the SophosManagementxxxxxxx daemons, perhaps also SophosServiceManager. (don't ask me how to do it)
• replace cac.pem in \Library\Sophos Anti-Virus\RMS\
• delete the three .config and the two .private files
• run clientmrinit
• start the daemons
Guess this can be scripted - assuming it works. The ReInit.vbs created by the EMU sets a marker to avoid repeated execution, optionally the GroupPath, and checks if it's running on a Relay or SUM - doesn't apply to Macs anyway.  

Heard there's a vacant pedestal in the Hall Of Fame ... or rather two small ones, for the script and the generator, or a tall one for the complete solution [;)]

Christian

Hi QC,

I already have a scripted solution ready. It works this way:

• download cac.pem and mrinit.conf from a webcid managed by the new server
• replace both files in /Library/Sophos Anti-Virus/RMS
• run /Library/Sophos Anti-Virus/RMS/clientmrinit -uninstall
• run /Library/Sophos Anti-Virus/RMS/clientmrinit -install
• restart SophosManagementAgent and SophosMessageRouter

Unfortunately the script needs to be executed on the client. This can be a problem if the user ignores the admin.

For this reason I'm wondering if there is another approach which doesn't require user cooperation. :-)

Regards,

Holger

Hello Holger,

gr8! Didn't think of the -uninstall.

doesn't require user cooperation
actually on Windows the ReInit also has to be executed on the endpoint. Automatic execution of relies on the ability to (if necessary copy and) run the script remotely, i.e you need administrative rights and some kind of remote access has to be enabled.

Christian