Endpoint Protection

 View Only
  • 1.  Decommissioning First SEPM In Multi-Server Environment

    Posted Apr 18, 2017 01:43 PM

    Here are the stats:

    • 600 clients
    • SQL DB on DB1
    • 2 Management Servers (MS2k3 & MS2k8) running 2003 and 2008 R2
    • Management Servers are set up for load balancing, no replication currently
    • No current requirements for replication, all systems served by primary site.  Future need may be required.
    • Currently installed Version is 12.1.6 RU5

    What I am trying to accomplish:

    • Eliminate MS2k3, which was installed ~ 3 years prior to 2k8 server, and add a Management Server running 2012 (MS2012)
    • Perform this elimination gracefully, being able to transition clients off of the MS2k3 and into the current cluster (or at least be able to bring MS2k3 back online with MS2012 still online)
    • Goal is to eventually end with Current Release of 12.1.6 RU7 once the MS2k3 is eliminated, but I have installers for RU5 for new server

    I have found and understand how to add MS2012 into the load balancing and to pull MS2k3 out of the load balancing and leave as a redundant server.  I get that I have to install the same version as currently deployed

    Where I am getting hung up is the decommissioning process of a first installed Managent Server (MS2k3).  I am finding information outside of these articles, in forums, that seem to indicate that the first installed server in a cluster (MS2k3 in this case) has some special "halo" around it that can cause some issues if you don't decomission gracefully, but I can't really find any indications in KBs that in a cluster, where all three can be running for a couple of days, that this is the case. Of course though, I see some sparks and don't want to set fire to the whole thing, so I am hoping that I can get some clarification on what I have found:

    • Question 1: Is the first installed server truly special?
    • Question 2: A post by Ghent (Symantec Emp) refers to a simple replication process of site partners and distinguishes that from replication partners, but I can not find any mention of site partners outside of that post.  Is Site Partners different from replication partners, and will Site Partners provide me with the expected result?
    • Question 3: I have seen some mentions that if I do this as a replication, then remove the original server, I will get most of the way to my goal, with one issue, if I want replication in the future, I won't be able to use it because I have a broken replication.
    • Question 4: If I go with the Disaster Recovery procedure (suggested as a solution for some questions), it sounds like an either or situation. Either I have MS2k3 online, or I take a second server, which I also name the same Host Name / FQDN as MS2k3, with the same IP address as MS2k3 and have that online.  With Disaster Recovery, I am all or none with bringing everyone over to the new server, and it doesn't seem like I can go back if something is off. Is there a way to use DR to reach my intended outcome without going "all the way"

     

     



  • 2.  RE: Decommissioning First SEPM In Multi-Server Environment
    Best Answer

    Trusted Advisor
    Posted Apr 19, 2017 03:18 AM
    • Question 1: Is the first installed server truly special? - No the first SEPM server is the same as any other SEPM you install
    • Question 2: A post by Ghent (Symantec Emp) refers to a simple replication process of site partners and distinguishes that from replication partners, but I can not find any mention of site partners outside of that post.  Is Site Partners different from replication partners, and will Site Partners provide me with the expected result? - Partner sites and replication are literally the same thing
    • Question 3: I have seen some mentions that if I do this as a replication, then remove the original server, I will get most of the way to my goal, with one issue, if I want replication in the future, I won't be able to use it because I have a broken replication. - Once replication is setup you will need to adjust managment server list. Policies > Policy Components > Management Server List. Make your new SEPM the priority 1 SEPM this will make all machines use that as the main SEPM once you are happy that all machines or the majority are checking into the new SEPM you can then decommision the old one without any issues. Delete replication before decomissioning. 
    • Question 4: If I go with the Disaster Recovery procedure (suggested as a solution for some questions), it sounds like an either or situation. Either I have MS2k3 online, or I take a second server, which I also name the same Host Name / FQDN as MS2k3, with the same IP address as MS2k3 and have that online.  With Disaster Recovery, I am all or none with bringing everyone over to the new server, and it doesn't seem like I can go back if something is off. Is there a way to use DR to reach my intended outcome without going "all the way" - Disaster recovery is an option but the process above makes it easier to control the migration of the machines that you want doing it by Managment Server List. 


  • 3.  RE: Decommissioning First SEPM In Multi-Server Environment
    Best Answer

    Posted Apr 19, 2017 08:51 AM

    Thanks for the reply GeoGeo.  Based on your reply, I did some more research into replication.  I found the articles:

    I learned a couple of things from these articles, that I am documenting here for others who may be looking for this information

    • Replication is syncing:
      • Policies and Groups (Required Bidirectional)
      • Client Packages and Content Updates (Optional bidirectional)
      • Logs (optional bi or unidirectional
    • Site partners and replication partners are different
      • Replicaiton partner creates a second copy of the database (embedded or SQL) and indepently operates off of this second DB
      • Site partners share the same SQL DB.  No secondary DB is created