Need to point SUMs at new server.

Hello Andrew,

I don't actually know if they are also Message Relays

as MRs don't appear from nowhere and can't be installed by accidence you should know (unless someone else did the initial install and didn't tell you). Please see Enterprise Console: configuring message relay computers as a start. For further articles search Support for 'message relay', the are also some threads on this board (e.g. Questions regarding the Relay Message Computer(s)).

 How I get them to point to the new server

A litte bit about SUMs:

They find out where to get their updates from as SUM (Sources) the same way they learn about the update location for the endpoint - the management server passes the settings (here Configuration and Policy for Endpoint) via RMS. Thus you could change their configuration from the old server - the same way you could change the Updating policy for all clients

Even though SUM and all the endpoints would then download from the new location(s) they'd still see the old server as their management server. Now you can't install a SUM from SEC (and also not reinstall). But once SUM is installed it shares the RMS component with the Endpoint software. Thus reprotecting (i.e. reinstalling the Endpoint component from the console) a SUM should redirect it to the new server. It should also tell the new server that it is a SUM (although IIRC it doesn't send its configuration upstream). 

In order to move over the clients you'd also have to reprotect them - this requires that SEC can discover them or that you can otherwise import them or that you can deploy an appropriate script to reinstall. Another way is a reinit script which reconfigures just the RMS component.

These are the recommended ways. Not documented is yet another option which requires that the new server has been built with the old server's certificates (if you're not sure check the keys are the same in mrinit.conf in an old and a new CID). You could then use the method from the configuring message relay computers, namely putting and appropriate mrinit.conf (please see here for a brief explanation of the Addresses) into the new CIDs. As the customization of the \rms subdirectory is not propagated you'd have to configure several hundred CIDs though.

Permit me some general thoughts: that you can "recycle" a SUM in 5 minutes suggests that WAN speed isn't a concern - is it the volume you want to cut down? Unless I overlooked something an endpoint reprotect should be your best option - of course provided it is possible. Dunno what your Sophos Technical Specialist thinks should be the best way. Personally I'd consider a full replacement of the old server - i.e. using the same name and if necessary IP as for the old one. You'd have to "roll back" the changed SUMs and also to redo anything you've put into the new database (see Changing domain name, computer name, or network type when the Enterprise Console is installed) though - but as you have access to an STS preserving the database might be an option. If you can seal off your new server and build it up to the point where it can take over the "switch" should take only minutes (but there'd be still enough work left as the SUMs need to be configured).

Christian

Hello Andrew,

I don't actually know if they are also Message Relays

as MRs don't appear from nowhere and can't be installed by accidence you should know (unless someone else did the initial install and didn't tell you). Please see Enterprise Console: configuring message relay computers as a start. For further articles search Support for 'message relay', the are also some threads on this board (e.g. Questions regarding the Relay Message Computer(s)).

 How I get them to point to the new server

A litte bit about SUMs:

They find out where to get their updates from as SUM (Sources) the same way they learn about the update location for the endpoint - the management server passes the settings (here Configuration and Policy for Endpoint) via RMS. Thus you could change their configuration from the old server - the same way you could change the Updating policy for all clients

Even though SUM and all the endpoints would then download from the new location(s) they'd still see the old server as their management server. Now you can't install a SUM from SEC (and also not reinstall). But once SUM is installed it shares the RMS component with the Endpoint software. Thus reprotecting (i.e. reinstalling the Endpoint component from the console) a SUM should redirect it to the new server. It should also tell the new server that it is a SUM (although IIRC it doesn't send its configuration upstream). 

In order to move over the clients you'd also have to reprotect them - this requires that SEC can discover them or that you can otherwise import them or that you can deploy an appropriate script to reinstall. Another way is a reinit script which reconfigures just the RMS component.

These are the recommended ways. Not documented is yet another option which requires that the new server has been built with the old server's certificates (if you're not sure check the keys are the same in mrinit.conf in an old and a new CID). You could then use the method from the configuring message relay computers, namely putting and appropriate mrinit.conf (please see here for a brief explanation of the Addresses) into the new CIDs. As the customization of the \rms subdirectory is not propagated you'd have to configure several hundred CIDs though.

Permit me some general thoughts: that you can "recycle" a SUM in 5 minutes suggests that WAN speed isn't a concern - is it the volume you want to cut down? Unless I overlooked something an endpoint reprotect should be your best option - of course provided it is possible. Dunno what your Sophos Technical Specialist thinks should be the best way. Personally I'd consider a full replacement of the old server - i.e. using the same name and if necessary IP as for the old one. You'd have to "roll back" the changed SUMs and also to redo anything you've put into the new database (see Changing domain name, computer name, or network type when the Enterprise Console is installed) though - but as you have access to an STS preserving the database might be an option. If you can seal off your new server and build it up to the point where it can take over the "switch" should take only minutes (but there'd be still enough work left as the SUMs need to be configured).

Christian