This article describes how to prevent disruptions with Symantec Endpoint Protection (SEP) clients when moving Symantec Endpoint Protection Manager (SEPM) to another server. These steps also help prevent the loss of client policies, group memberships, and historical reporting data.
The method used to replace the SEPM will vary depending on whether the SEPM is a member of a site using a Microsoft SQL Server database, or an embedded database site.
For embedded databases
Follow the disaster recovery steps best practices for your SEPM version. Make sure that you gather the database backup and recovery file(s) from your existing manager, and restore the database and recovery files to the new SEPM.
- Disaster recovery best practices for Endpoint Protection 12.1
- Disaster recovery best practices for Endpoint Protection 11
For Microsoft SQL Server databases
- Gather the recovery file from the existing manager. For more information, read Contents of the Endpoint Protection Manager disaster recovery file.
- Decommission the existing manager, making sure that it is no longer able to connect to the Microsoft SQL Server hosting the SEPM database.
- Ensure that the new manager has the same host name as the existing manager.
Note: It is possible to configure the new manager with the same IP address as the existing manager.
- Install the SEPM to the new manager making sure to match the version of SEPM to the existing server.
- Use the following step In the Management Server Configuration Wizard (MSCW):
- On the Welcome screen, select Install an additional management server to an existing Site.
- Check use a recovery file to restore communication with previously deployed clients.
- Browse to the recovery file you exported from the existing manager in step 1 and click Next.
- Ensure the name in the Server name field matches what was entered for the existing server exactly, including all capitalization and punctuation marks.
- Click Next.
- Follow the rest of the prompts in the MSCW, providing the correct Microsoft SQL Server configuration and authentication information, allow the MSCW to update the SEPM database.
In the event that the new SEPM server has a new IP and hostname, customer's need an additional set of steps to migrate clients over using a Management Server List or Communication Update Package (Sylink).
The Symantec Connect forums describes how to use the Management Server List option.
- Follow "Best Practices for Disaster Recovery with Symantec Endpoint Protection" (see Related Articles) to backup and reinstall SEPM on MACHINE_2
- Log in to the old SEPM on MACHINE_1
- Click Policies > Policy Components > Management Server Lists > Add Management Server List
- Click Add> Priority and a new Priority would get added named as "Priority2"
- Add MACHINE_1 under Priority 2 and add MACHINE_2 under Priority 1, and assign this New Management Server List to all the groups.
- Clients will then move from old SEPM to new one gradually
- Stop the "Symantec Endpoint Protection Manager" and "Symantec Embedded Database" service on MACHINE_1 to verify whether all client now report to the new SEPM on MACHINE_2
- Once verified that all the clients are reporting into the new SEPM, and have moved away from the old one, proceed to the next step.
- Uninstall SEPM from MACHINE_1