Migrate Symantec Endpoint 12 to new server

[Migration User]

Hi all.

We have Symantec Endpoint 12. It is deployed on Windows Server 2003 R2. 

We need to migrate it on Windows Server 2012 R2.

And we need to get help us.

[Rafeeq]

do a disaster recovery, upgrade the OS and put back the db,

Follow this document

How to move Symantec Endpoint Protection Manager from one machine to another

 

http://www.symantec.com/business/support/index?page=content&id=TECH104389

[Migration User]

Hot to move SEPM from one server to another server.

 

https://www-secure.symantec.com/connect/articles/hot-move-sepm-one-server-another-server

How to move Symantec Endpoint Protection Manager 12.1 from one machine to another

http://www.symantec.com/docs/TECH171767

[Chetan Savade]

Hi,

Thank you for posting in Symantec community.

I would be glad to answer your query.

Check this article & let me know which scenerio you may have.

https://www-secure.symantec.com/connect/articles/hot-move-sepm-one-server-another-server

1) SEPM is having same hostname and IP address.

2) SEPM server has a different IP and same hostname

OR

SEPM server has a same IP and different hostname.

3) SEPM server has a differenet IP and different hostaname.

Let me know which scenerio you will follow.

Also share total number of clients and number of GUP's if there any.

[ℬrίαη]

Are the hostname/IP staying the same?

[Migration User]

We planing, that our scenerio will SEPM is having same hostname and IP address

[Migration User]

Please see this articles.

How to move Symantec Endpoint Protection Manager 12.1 from one machine to another

 

Article:TECH171767

|

Created: 2011-10-13

|

Updated: 2012-07-10

|

Article URL http://www.symantec.com/docs/TECH171767

 

[ℬrίαη]

Follow this link

http://www.symantec.com/docs/TECH171767

[Chetan Savade]

Hi,

Thanks for the update.

Disaster recovery process will be a possible way if hostanme and IP address are the same.

After successfull migration can think to upgrade to the latest version of SEP.

SEP 12.1 RU4 (12.1.4013.4013) is the latest version.

[Migration User]

Tell me pls. How two servers with an identical name and the address can be in a network at the same time? 

[Migration User]

Tell me pls. How two servers with an identical name and the address can be in a network at the same time? 

You need to use Disaster recovery method,you can remove your first server in network

 

Disaster Recovery method

Symantec Endpoint Protection clients will be able to reach the new SEPM using either unchanged IP or hostname. The management server list will then be updated accordingly and sent automatically to clients. For situation 1, if both servers will have the same IP only one machine may be connected to the network at a time.

 

Disaster Recovery Migration process

1. Follow "Best Practices for Disaster Recovery with Symantec Endpoint Protection" (see Related Articles below) to backup MACHINE_1 and then install a SEPM to MACHINE_2 using the backup.
   Note: If the IP is the same, the new machine must be disconnected from the network until step 7.
2. Log in to the old SEPM on MACHINE_1 and follow the steps below.
3. Click Policies > Policy Components > Management Server Lists > Add Management Server List.
4. Click Add > Priority and a new Priority would get added named as "Priority 2".
5. Add MACHINE_1 under Priority 2 and add MACHINE_2 under Priority 1, and assign this New Management Server List to all the groups.
6. Clients will then move from old SEPM to new one gradually as they check in.
   Note: If the IP is the same you will need to verify the clients have your new Management Server List by confirming that the policy serial number of each client matches the new one in their respective groups in the SEPM on MACHINE_1 before disconnecting it.
7. If both machines have the same IP, disconnect MACHINE_1 from the network and connect MACHINE_2 to the network now, then skip to step 9. All other scenarios skip to step 8.
8. Stop the "Symantec Endpoint Protection Manager" and "Symantec Embedded Database" services on MACHINE_1 to verify that all clients now report to the new SEPM on MACHINE_2.
9. Once you have verified that all the clients are reporting into the new SEPM, and have moved away from the old one, proceed to the next step.
10. Uninstall SEPM from MACHINE_1

Symantec Endpoint Protection 12.1: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

 

http://www.symantec.com/business/support/index?page=content&id=TECH160736

 

[Migration User]

I know this,

In order that clients could pass gradually with 2003 to the new 2012 server, it has to be switched on too, here I and ask how it is possible, what in a network at the same time there would be two switched-on servers with an identical name and address?

[Migration User]

, if both servers will have the same IP only one machine may be connected to the network at a time.

[Chetan Savade]

Hi,

Q. How two servers with an identical name and the address can be in a network at the same time?

--> It's not possible, need to decommision old server first and provide same hostname and IP address to the new server. While following disaster recovery clients will be offline till the time disaster recovery process completes.

 

[Migration User]

How-Clients will then move from old SEPM to new one gradually as they check in.

[Migration User]

You need to follow this process

Symantec Endpoint Protection 12.1: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

 

http://www.symantec.com/business/support/index?page=content&id=TECH160736

[Migration User]

Ok. Iam trying...

[Chetan Savade]

Clients will try to contact SEPM using hostname & IP address.

 

 

[Migration User]

Hi.

Note: If the IP is the same you will need to verify the clients have your new Management Server List by confirming that the policy serial number of each client matches the new one in their respective groups in the SEPM on MACHINE_1 before disconnecting it.

Tell me pls- how can i check it: you will need to verify the clients have your new Management Server List 

[pete]

check the group where you have applied new MSL list.

THe policy serial number is changed after appalying it to group. You need to ensure the same policy serial number should be taken by the client.From the SEPM console you should be able to confirm it.

[Migration User]

Check the policy no.

Checking the policy serial number on a client

 

Article:HOWTO55604

|

Created: 2011-06-29

|

Updated: 2011-11-17

|

Article URL http://www.symantec.com/docs/HOWTO55604

 

[Migration User]

Tell me pls.

1. I will  backup database  on the old SEP

2. Copy this base on a new server SEP

3. Restore this database on a new server SEP

4. I will appoint the address and a name to the new server same as was at old and I will switch off the old

After this clients can to connect a new server???

[Migration User]

Yes you can follow this process as per below articles

Symantec Endpoint Protection 12.1: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

 

http://www.symantec.com/business/support/index?page=content&id=TECH160736

[pete]

yes the things will work.client will communicate to the new SEPM (with same IP and hostname). Use the same encryption key to install.

[Migration User]

What do mean :Use the same encryption key to install.? You mean, that i use recovery_timestamp.zip from old server, when i will restore database and configure a new server??

[pete]

yes the certificates used with the existing server.

follow the steps as mentioned in this KB

http://www.symantec.com/business/support/index?page=content&id=TECH160736

[Migration User]

Yes.

The recovery file includes the encryption password, keystore files, default domain ID, certificate files, license files, and port numbers. After you install the management server, copy the compressed recovery file to another computer. By default, the file is located in the following directory:

Drive:\\Program Files\Symantec\ Symantec Endpoint Protection Manager\Server Private Key Backup\recovery_timestamp.zip

[Migration User]

Thanks all, friends!!! I migrated my SEP to 2012!!!

But some clients, have offline status. Can i  force to communicate forcibly them  with SEP?

[Migration User]

Restoring client-server communications by using a client installation package

http://www.symantec.com/docs/HOWTO80762

https://www-secure.symantec.com/connect/articles/sep-121-ru2-and-reset-client-communication

[Migration User]

Very thanks- i did it and clients have status online)))

[Migration User]

Most Welcome

Please don't forget to update your thread
 

[Chetan Savade]

Good to know issue has resolved.

[Migration User]

Friends, tell me pls, where i can download distribut LiveUpdate for me SEP?

[Migration User]

Can you explain more ?

Do you want LUA or you need to configure live update ?

http://www.symantec.com/connect/articles/how-configure-proxy-settings-symantec-endpoint-protection-manager-sepm-121

 

How to obtain the latest version of Symantec LiveUpdate Administrator (LUA) 2.x

 

Article:TECH134809

|

Created: 2010-01-09

|

Updated: 2013-12-20

|

Article URL http://www.symantec.com/docs/TECH134809

 

[Migration User]

Yes, i need LUA. 

The SEP updatings are on other server, not on SEP. That server we be too on 2012. Therefore ,it will be necessary to establish LUA on the new server and to adjust its work with SEP

[Migration User]

LUA are not supported windows 2012.

LUA 2.x is typically shipped with many major Symantec products.  For example, the installer (LUAESD.exe) can be found in the LiveUpdate folder of the Symantec_Endpoint_Protection_12.1.x_Part2_Tools_EN.zip file available on fileconnect

 

Best Practices for LiveUpdate Administrator (LUA) 2.x

 

Article:TECH93409

|

Created: 2009-01-13

|

Updated: 2012-11-28

|

Article URL http://www.symantec.com/docs/TECH93409

https://www-secure.symantec.com/connect/blogs/liveupdate-administrator-lua-version-232-now-available

[Migration User]

Than, i dont know, how i can deploy liveUpdate Adminstration on other server 2012- not SEP

[Migration User]

how i can deploy liveUpdate Adminstration on other server 2012-

LUA are not supported windows 2012.

[Migration User]

But, how to update my SEP now? I need that server where will be store updates will other server and have OS 2012 -how as to make it? Pls)

[Migration User]

You need to configure LUA other Windows server OS (except Windows 2012)

System Requirements for LiveUpdate Administrator 2.3 (LUA 2.3)

 

Article:TECH173272

|

Created: 2011-10-31

|

Updated: 2013-03-20

|

Article URL http://www.symantec.com/docs/TECH173272

 

[Migration User]

But i can do it, we transfer all our servers  2003 on 2012....

[Migration User]

Below are system requirement of LUA.You can try to install Windows 7 otherwise you can upgrade be sep proxy setting

•  
• Windows 2008 Server (including R2).  
• Windows 2003 Server or Advanced Server with Service Pack 2 or higher
• Windows 2000 Server or Advanced Server with Service Pack 4 or higher
• Windows XP Professional with Service Pack 3
• Windows Vista
• Windows 7
• Java™ Runtime Environment (JRE) 1.6 (32-bit). 64-bit Java not supported on any OS.
• Internet Explorer 8.0, 7.0 and 6.0, Firefox 3.x.
• TCP/IP network protocol

Please note that LiveUpdate Administrator is not supported on Server Core, the minimal server installation option for Windows Server 2008 or later

http://www.symantec.com/business/support/index?page=content&id=TECH177544

 

http://www.symantec.com/connect/articles/how-configure-proxy-settings-symantec-endpoint-protection-manager-sepm-121

 

 

[Migration User]

Ok. How to realize control of updating using only 2012?  Dont use (2003,2008,....)

Is it possible?

[Migration User]

In base Of LUA not possible,

You can configure proxy and update SEPM

http://www.symantec.com/connect/articles/how-configure-proxy-settings-symantec-endpoint-protection-manager-sepm-121

[Migration User]

Thanks.

Prompt. I absolutely got confused. Now we have SEP on 2102, and LUA on 2003. I want that at me updatings would be downloaded and extended from one SEP 2012. Also I want to remove 2003. What steps I need to take - prompt please

[Migration User]

You can Configure Your SEPM to update  OLD LUA ((2003)server .You can't configure LUA in server 2012.

If you want to upgrade your server 2003.you can upgrade server 2003 to server 2008.

[Migration User]

If I don't want to use 2003 and 2008 - as I will be updated ny SEP?

[Migration User]

If you don't want to Use 2003/2008 for LUA,You can wait LUA new version.

And you will be update your SEPM direct internet.

You can configure proxy and update SEPM

http://www.symantec.com/connect/articles/how-configure-proxy-settings-symantec-endpoint-protection-manager-sepm-121

[Migration User]

You mean to use pery option For Proxy server and Symantec Endpoint Protection Manager communication settings?

And subordinate SEP servers in branch, won't have problems with updating downloading? They downloaded them earlier from the server where LUA is established.

[Migration User]

Before you have configure your SEPM server are update LUA Right ?

Once SEPM update sep client will update SEPM.

LiveUpdate Administrator (LUA) are not able to install Windows 2012 server because it's not supported.

[Migration User]

Ok. I have one question. After server creation we renamed it and replaced the address. The site became correct, it became old, and the server name in the SEP console didn't change

[Migration User]

Where you have changed server name and IP address ?

 

Install LUA (Live Update Administrator) and Configure for Symantec Endpoint Protection

http://www.symantec.com/connect/videos/install-lua-live-update-administrator-and-configure-symantec-endpoint-protection

Knowledgebase Articles for Liveupdate Administrator (LUA)

 

http://www.symantec.com/connect/articles/knowledgebase-articles-liveupdate-administrator-lua

[Migration User]

Where you have changed server name and IP address ? - In OS

Once again.

We created the new server. Transferred to it old base. Replaced ip and a name of the new server with the old. Disconnected the old. And so, in the Admin-Servers console the name of a site became as at the old server, and the name of the server remained from new.

[Migration User]

So you can install LUA on supported OS and configure to SEPM update for LUA.Some , Good articles i have already provided.

[Migration User]

Thanks James007, video is very good))

Tell me pls, when the release of the new LUA version is planned?

[Migration User]

Till now no Information you can wait till time :)

[Migration User]

Do you need more help here ?