SEC migration from a DC

Question

Hi, need to migrate SEC from Server 2008R2 to new virtual server running Server2016. 
 Problem I have read - Current server is a DC, but the new server will not be a DC. What are the pitfalls and steps with the first server already being a DC. (this is installed way back and has always been ok) 
 Are their instructions about this scenario anywhere please? 
 Many Thanks 
 Trev

Shweta · Accepted Answer

Hi tstan 
 The reason that neither server is assumed to be a Domain Controller is that hosting the Console on a Domain Controller is not considered a best practice. Although the console can run on a DC server, we do not recommend this type of installation because the database installed, will then support the SQL instances of the Active Directory and that of the SEC, which in case of SQL problem internal, would not only bring down the DC System infrastructure but also the antiviral infrastructure. It is good practice that each database is independent of the others. However, it will not negatively impact the Migration. Please note that groups that WOULD have been created locally (Ex: Sophos DB Admins, Sophos Console Admins, etc.) will instead become Domain Groups. This will not affect their permissions or functionality but will cause them to show up in Active Directory.