Ok, its been a long time since I have been on EPO 3.6 so I am trying to do this out of memory. I would recommend talking to mcafee support first but here is what I remember doing. Make sure to backup the database and make a copy of the epo directory too.
1. Read through the EPO 4.0 setup guide very carefully. When I setup EPO when it first came out there was a glitch that would stop the installation if you used windows authentication to your SQL and the password you used had complex characters. This can be identified in step 2 for testing if its going to happen. Also look at what products are supported by EPO 4 and which are not. See if you are using any of them that are not. If you are then you need to see if there are newer version that you need to import and distribute in EPO after the installation, if you dont need them remove from epo prior to upgrading. Do you use Rogue sensors? The old version sensors will not work and there is not an upgrade path, so you should remove the old ones first, plan on redistributing sensors.
2. First thing I would do is to test the migration on a vmware setup. Load epo 3.6 on a vmware box, load sql on the vmware box and attach a backup of your database. Point the 3.6 server to the database and make sure you can sign in and see hosts, reports, etc. Test the upgrade to make sure all is well there and indentify any problems.
3. Upgrade to EPO 4.0. Make sure if it asks you to create an administrators account you remember it and the password. forgetting will put a show stopper on the project real quick. Perhaps using a simple password intially until you can get in after the install is succesful and change it.
4. Where are all of my events? This freaked me out when doing the upgrade. There is a task you run to import the old events into EPO 4.0. They are not in EPO 4.0 by default after the upgrade.
4. If upgrade goes well I would suggest upgrading to at least sql 2005 after the installation. (you might be able to do before the upgrade you would just need to make sure you change the database to be in compatibility mode)
Is the SQL hosting anything except the epo instance? That adds some more fun. Have you played with EPO 4.0 yet and got fimiliar with it. In the testing phase I mentioned if you can setup vmware with a copy of your database you can premake most of your reports, export them and just import them when you are ready to go live.