4.5. to 5.1 SEC upgrade - SEC and SEC DB Server on same DC?

Hi Nikola,

Thanks for the question. That video was created to show one of the more complicated upgrade scenarios. In your case where the Enterprise Console and Management components are installed on the same server as the database it is actually very straight forward. 

Providing I have understood you correctly, if you have the Enterprise Console and the Database both installed on the same DC and don't have any other remote Enterprise Consoles installed anywhere. Then all you need to do is download the SEC 5.1 installer from Sophos.com and work through the installation/upgrade wizard. It will detect that the database is on the same server and run the correct upgrade for your enviroment.

If you then want to install a remote console on a different computer what you will need to do is take that same SEC 5.1 installer file to your remote computer and run it again. This time as SEC or the DB aren't installed on that computer it will ask you which components you want to install (i.e. Console, Management server or Database) you will need to choose only the Console option and then confirm the name of your main SEC server.

As a final note, depending on your version of .NET and SQL the upgrade may need a reboot of the server to complete, it will prompt you first though.

The SEC 5.1 upgrade guide can be found here: http://www.sophos.com/en-us/medialibrary/PDFs/documentation/sec_51_ugeng.pdf

Let me know how you get on.

Thank you very much for fast response!

In the video I posted in second phase (upgrade of Console itself)

you first need to create an account to connect to Sophos database.

Seraching through accounts on AD I've found that previously

there was manually created only one acount called sophos update (during update or instalation of SEC 4.5, I don't recall).

Additionally, in this video there is a part (4:05) where you need to create new account on AD

that will use to access the DB. It's shown that it was not previously needed in older versions.

What about this account? Do I need to create it?

Thanks in advance!!!

Everything went smoothly.(((:

I needed to create SopohosManagement account on domain.

Although I've uninstalled EmLibrary it's stated after the start of Console

that it (EmLibrary) manages update and there is a start

of install and configuring of UpdateManagers (roles).

I suppose I will need to add SophosUpdate account too

and that will be it (beside configuration of Update Managers).

Thank you for your help!

Hi Nikola,

Glad to hear it all went smothly. Sorry I didn't get back to your second comment in time but it sounds like you have it all under control.

Just to clarify if you do still have EmLibrary installed you can remove it as it isn't used any more.

Hi Peter!

Yes EmLibrary is still installed (although I've uninstalled through Add/Remove programs (in Add/Remove programs is not shown) and restarted server) and on ran of Console it says it still manages updates before I update Update Managers (as I recall the message).

End machines are updating regulary, but with Console do I need to create update account

or use old one "sophos update" i mentioned before? I don't remember it's password, that's a problem.:(

Thanks in advance for your help!

This is info I get when i run Console:

Hello NikolaFBA,

I would suggest you continue with this wizard - migrations are non-destructive i.e. they will not change or interrupt a working configuration. But then, it does seem strange that the wizard fires. IIRC, SUM has been introduced with SEC 4.0 and thus it should have already performed the migration.

So for now just cancel the wizard. Check if you still have legacy policies (please see chapter 20 in the SEC4.5 Console Help) and also find out the account used in the regular updating policies - this might be the sophos update account you've mentioned. As the password should have "survived" migration you don't have to know it (it should be "pre-set" in the Default updating policy). But you can change it if you wish - please see How to change the password for Sophos Update Manager (SUM) (and you might want to (re-)read User accounts required by Sophos Enterprise Console).

Did you ever get rid of EM Library (apart from uninstalling it)? Please see these threads for details. While the 5.x manuals no longer mention EM Library (at least I've found no reference) and it was expected that you remove it in one of the later 4.x versions 5.x would still have to be able to handle a situation where it seems to be there. But guess it just consults the database and does not verify that the program's existence.

HTH

Christian

Hello Christian,

Ok, thank you for your help, I will go through links you've provided.

For now, I will cancel wizard, and check legacy policies beside links.

You're probably right about EM Library and its database.

Thank you for your help!

I will be free to ask for further assistence if I'll need it.

Best regards,

Nikola

Hello Christian,

I have another question. Sorry for bothering you.:)

Now, when i start Console Wizard doesn't start.

All states of updating of computers in Console are

Unknown (although every single one

of them is updating regulary with no problem whatsoever).

Primary Update manager DC1 (after going under Policies>

View/Edit policies) has "old" user sophsoupdate

and Secondary DC3 has new one SophosUpdateMgr used for updating.

Firts one (DC1, on which console has been installed) hasn't been updated

since of console upgrade on 28/06, and second one since 16/07.

I've clicked on them right click and forced them to update but nothing happens...

What to do to update them and what to do to get Up to date

instead of Unknown state for end computers in Console?

Thanx in advance for your help!

Nikola

P.S. And yes, after install of Sophos on new computer this computer is not shown under Unmanaged eithet Connected

computers in Console.:( I've installed it going to CID folder on DC3.

Hello Nikola,

Wizard doesn't start

you should be able to configure the SUMs from the Update managers view (there you'll also see the Last updated dates, the Download status and potential Alerts and Errors. Perhaps you can provide a screenshot?

If you've always canceled the wizard the configuration might be incomplete. Going to View/Edit Configuration check the Sources tab - are both updating from Sophos or does DC3 update from DC1? Also check Subscriptions and Distribution.

Christian