Migrate epo 5.9.1 to 5.10 on a new server

[rbl]

Hello,
I would like to replace my ePo 5.9.1 server, which is running on a Windows Server 2012R2 with epo 5.10, which will run on a Windows Server 2019.
What is the best way to proceed here?
Can I simply transfer the configuration from 5.9.1 to 5.10?
Do the client agents automatically notice the change?
What else needs to be considered during such a move?
Questions about questions...

[cdinet]

There are a couple of ways you can go about this.

1.  Upgrade your existing server to 5.10, then back everything up and restore it to the 2019 server keeping either servername or IP the same as old server.  That should keep everything as it is.

2.  Build new server, then transfer config, policies and tasks first (export/import) so that everything is the same, then transfer the systems.

https://kc.mcafee.com/corporate/index?page=content&id=KB79283

Keep in mind that 5.10 has different tls requirements than 5.9.x and update 11 even has tighter requirements, as old tls versions and ciphers were removed.  Please refer to https://kc.mcafee.com/corporate/index?page=content&id=KB91519 for tls requirements for epo and sql on 5.10.

[rbl]

Thank you for the tips.
I still have one question.
How can I tell the agents on the Windows clients that a different/new ePo server is now responsible for them?

[cdinet]

The transfer systems option gives them the keys and sitelist of the new server for them to connect to.

[rbl]

I found this article and will try it with this.

How to transfer computers from one ePolicy Orchestrator server to another (mcafee.com)

[cdinet]

Yes, that is the KB I gave you in the beginning.  Let us know if you run into any problems.

[rbl]

So, the new ePO server is up and running.
I have now registered the new ePo server on the old server (How to transfer computers from one ePolicy Orchestrator server to another) and want to transfer a test client to the new ePo server.
Unfortunately the client does not appear on the new ePo server 😞
What could be the reason for this? Which logs do I have to look at to find the error?

[rbl]

Maybe the problem is with the secure agent port .
The old server communicated with the agents via port 443 , the new server must use port 444 for communication.

[cdinet]

That should not matter as the transfer systems would give the agent the new sitelist with new port.  Did you also import the agent communication keys from old server into the new server?  Otherwise you need to look at the agent logs for communication problems.  See KB90603

[rbl]

Yes, I have imported the keys as described in the KB article. (Don't be surprised, is a German system ;-))