Migration to Kaspersky Security Center Cloud Console

This section describes the process of migration to Kaspersky Security Center Cloud Console from:

• Kaspersky Security Center Web Console of version 12 (or later) running on-premises.
• Kaspersky Endpoint Security Cloud.

About migration from Kaspersky Security Center Web Console

This section describes the process of migration from Kaspersky Security Center Web Console of version 12 (or later) running on-premises to Kaspersky Security Center Cloud Console.

Methods of migration to Kaspersky Security Center Cloud Console

By using the migration feature, you can transfer your networked devices from Kaspersky Security Center under management by Kaspersky Security Center Cloud Console. Your managed devices will be switched without losing the principal settings, such as membership in administration groups; as well as the essential objects, such as policies and tasks related to the managed applications.

You can choose either of the two available methods to migrate your Administration Servers to Kaspersky Security Center Cloud Console:

• Migration without a hierarchy of Administration Servers:
  • Enables transfer of managed devices and related objects to Kaspersky Security Center Cloud Console, even if the Administration Server on-premises is not secondary in regard to Kaspersky Security Center Cloud Console.
  • May require transfer of files (on a removable drive, by email, through shared folders, or in any other convenient way) if Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console are opened on different physical devices.

  You can also perform migration with virtual Administration Servers if your network includes them.

• Migration using a hierarchy of Administration Servers:
  • Enables transfer of managed devices and related objects to Kaspersky Security Center Cloud Console by using only the interface of Kaspersky Security Center Cloud Console, so no physical transfer of files is needed.
  • Requires that the Administration Server running on-premises act as secondary to Kaspersky Security Center Cloud Console. You can create such a hierarchy before starting migration.

For the full disk encryption, Kaspersky Security Center Cloud Console supports only BitLocker.

Scenario: Migration without a hierarchy of Administration Servers

This section describes the migration of the managed devices and related objects (such as policies, tasks, reports) from Kaspersky Security Center Web Console running on-premises to Kaspersky Security Center Cloud Console. You can include a single administration group in the migration scope to restore the same administration group in Kaspersky Security Center Cloud Console.

This group must contain the managed devices of a single operating system. If your network includes the devices of different operating systems or Linux distributives, allocate them in different administration groups, and then migrate each group separately.

After you finish the migration, all Network Agents within the migration scope are upgraded and managed by Kaspersky Security Center Cloud Console.

The steps listed in this section cover the migration process performed when no hierarchy of Administration Servers exists, that is, no connection has been established between Kaspersky Security Center Cloud Console and Kaspersky Security Center Web Console running on-premises.

Prerequisites

Before you start, do the following:

• Upgrade Administration Server running on-premises to version 14.2 or later.
• Install Kaspersky Security Center Web Console version 12.1 or later.
• Upgrade Network Agent on the managed devices to version 12 or later.
• On Windows devices, use Network Agent without an uninstallation password.

  If the password has already been set, do one of the following in Kaspersky Security Center Web Console:

  • Disable the Use uninstallation password option in the Network Agent policy settings.
  • Uninstall Network Agent remotely by using the Uninstall application remotely task. In the Application to uninstall field of the task, select Kaspersky Security Center Network Agent. Do not forget to enter the uninstallation password.
• Upgrade the managed applications to the versions supported by Kaspersky Security Center Cloud Console.
• Make sure that you have policies for the latest versions of the managed applications. If you use outdated policies, create new ones for the application versions supported by Kaspersky Security Center Cloud Console.
• To use actual policies, upgrade the web plug-ins for the applications that you intend to manage through Kaspersky Security Center Cloud Console.
• Uninstall Kaspersky applications from managed devices if these applications are not supported by Kaspersky Security Center Cloud Console.
• Decrypt all the data (disk-level or file-level) that was encrypted by Kaspersky Endpoint Security for Windows on managed devices running the Windows operating system, and disable the encryption feature on the managed devices through the application policy or locally. For more information, see Help for Kaspersky Endpoint Security for Windows.

  If the Windows device still stores any files or folders encrypted through Kaspersky Endpoint Security for Windows, the Network Agent upgrade will be canceled during the migration process. A notification will prompt you to decrypt all data on the device and disable the encryption feature.

Kaspersky Security Center Cloud Console allows for a maximum of 25,000 managed devices per one Administration Server.

Migration stages

Migration to Kaspersky Security Center Cloud Console comprises the following stages:

1. Planning the migration scope and checking the prerequisites

   Estimate the scope of the migration process, that is, review the administration group to export and assess the number of managed devices in it. Also, make sure that all the activities listed as migration prerequisites have been completed successfully.

2. Exporting managed devices, objects, and settings from Kaspersky Security Center Web Console

   Use the Migration wizard of Kaspersky Security Center Web Console running on-premises to export your managed devices together with their objects.

   The maximum export file size is 4 GB.

3. Importing the export file to Kaspersky Security Center Cloud Console

   Transfer the information about your managed devices and objects to Kaspersky Security Center Cloud Console. For this purpose, use the Migration wizard of Kaspersky Security Center Cloud Console to import the export file and create a Network Agent stand-alone installation package.

4. Re-installing Network Agent on managed devices

   Go back to the Migration wizard in Kaspersky Security Center Web Console running on-premises to create a remote installation task. You will be able to use this task (immediately or later) to re-install Network Agent on your managed devices and complete the migration process.

Results

Upon finishing with the migration, you can make sure that it was successful:

• Network Agent is re-installed on all managed devices.
• All devices are managed through Kaspersky Security Center Cloud Console.
• All object settings that were effective before migration are preserved.

Migration wizard

This section provides information about the Migration wizard in Kaspersky Security Center Cloud Console and Kaspersky Security Center Web Console of version 12 or later.

Step 1. Exporting managed devices, objects, and settings from Kaspersky Security Center Web Console

Expand all | Collapse all

Migration of managed devices from Kaspersky Security Center Web Console to Kaspersky Security Center Cloud Console requires that you first create an export file containing information about the hierarchy of administration groups that are on your current Administration Server running on-premises. The export file must also contain information about the objects and their settings. The export file will be used for subsequent import to Kaspersky Security Center Cloud Console.

The maximum export file size is 4 GB.

To export objects and their settings from Kaspersky Security Center Web Console:

1. In the main menu of Kaspersky Security Center Web Console, go to Operations → Migration.
2. On the welcome page of the Migration wizard, click Next. The Managed devices to export page opens, displaying the entire hierarchy of administration groups of the corresponding Administration Server.
3. On the Managed devices to export page, click the chevron icon () next to the Managed devices group name to expand the hierarchy of administration groups. Select the administration group that you want to export.

   After migration from Kaspersky Security Center running on-premises to Kaspersky Security Center Cloud Console performed for two administration groups, the Remote installation tasks for these groups appear with the same name.

4. Select the managed applications whose policies and tasks must be transferred to Kaspersky Security Center Cloud Console together with group objects. To select the managed applications whose objects are to be exported, select the check boxes next to their names in the list.

   Although Kaspersky Security Center Administration Server is present on the list, selecting the corresponding check box does not result in the export of its policies.

   To make sure that your managed applications are supported by Kaspersky Security Center Cloud Console, click the corresponding link. It will redirect you to the Online Help topic containing the list of applications managed by Kaspersky Security Center Cloud Console.

   If you select applications that are not supported by Kaspersky Security Center Cloud Console, the policies and tasks of these applications will be exported anyway and then imported, but you will not be able to manage them in Kaspersky Security Center Cloud Console due to unavailability of the dedicated plug-ins.

5. View the list of group objects exported by default and specify non-group objects to be exported together with the selected administration group, if necessary. Configure the export scope by including or excluding various objects, such as global tasks, custom device selections, reports, custom roles, internal users and security groups, and custom application categories. This page includes the following sections:
   • Global tasks

     The list of global tasks of managed applications, as well as global tasks of Network Agent.

     If a global task that you selected applies to a specific object selection, this selection will also be exported.

     Although the global tasks of Administration Server are present on the list, you cannot export them; selecting those tasks does not affect the export scope. Remote installation tasks also remain outside the export scope, because their respective installation packages cannot be exported.

   • Device selections

     The list of custom device selections.

   • Reports

     The editable list of report instances to be exported.

     If a report that you selected applies to a specific object selection, this selection will also be exported.

     Kaspersky Security Center Cloud Console contains the same set of report templates as Kaspersky Security Center Web Console, so you can select for export only the reports that you created manually or reconfigured.

   • Group objects

     The list of group objects to be exported by default. The following objects related to the selected administration group will be exported in their entirety by default:

     • Administration group structure, that is, all subgroups of the selected administration group.
     • Devices that have been included in the administration groups to be exported.
     • Tags that have been assigned to the devices to be exported.

       If a tag was created in Kaspersky Security Center Web Console but never assigned to any device, it will not be exported. The auto-tagging rules will not be exported, either.

     • Group policies of the managed applications that have been selected.

       Administration Server policies and Network Agent policies are not exported.

     • Group tasks of the managed applications that have been selected and Network Agent group tasks.

       Administration Server tasks are not exported.

     You can also prevent certain types of non-group objects from being exported:

     • To cancel export for custom roles (that is, those created by the user only), select the Exclude custom roles from export check box.
     • To cancel export for internal users and security groups, select the Exclude internal users and security groups from export check box.
     • To cancel export for custom application categories with content added manually, select the Exclude custom application categories from export check box.

   If you transfer devices of various operating systems to Kaspersky Security Center Cloud Console, non-group objects only need to be migrated once.

   The Migration wizard checks the total number of managed devices included in the selected administration group. If this number exceeds 10,000, an error message appears. The Next button remains unavailable (dimmed) until the number of managed devices in the selected administration group falls within the limit.

6. After you defined the migration scope, click Next to start the export process. The Creating the export file page opens, where you can view the export progress for each type of object that you included in the migration scope. Wait until the refresh icons () next to all items in the list of objects are replaced with green check marks (). The export process finishes and the export file is automatically downloaded to the default download location defined in your browser settings. The name of the export file appears in the lower part of the browser window.
7. When the Export has completed successfully page is displayed, proceed to the next stage performed in Kaspersky Security Center Cloud Console.

   If you use Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console on different devices, you will have to copy the export file to a removable drive or choose other ways of transferring the file.

Step 2. Importing the export file to Kaspersky Security Center Cloud Console

To transfer information about managed devices, objects, and their settings that you exported from Kaspersky Security Center Web Console, you must import it to Kaspersky Security Center Cloud Console deployed in your workspace. This enables you to create a stand-alone installation package and use it for re-installation of Network Agent on your managed devices.

Before you start the Migration wizard in Kaspersky Security Center Cloud Console, make sure its current localization language is the same as the Kaspersky Security Center Web Console language during the export process. Switch the language, if necessary.

If you have previously completed the quick start wizard in your Kaspersky Security Center Cloud Console workspace, the Managed devices group includes policies and tasks created with the default settings. Delete these policies and tasks before importing the ones that you exported from Kaspersky Security Center Web Console.

To import the export file to Kaspersky Security Center Cloud Console:

1. In the main menu of Kaspersky Security Center Cloud Console, go to Operations → Migration.
2. On the welcome page of the Migration wizard, click Import. In the File Explorer window that opens, select the export file by browsing to the folder where it was saved, and click Open. Wait until the refresh icon () next to the file uploading status is replaced with the green check mark ().
3. Click Next. The next page opens, displaying the entire hierarchy of administration groups of the Administration Server in Kaspersky Security Center Cloud Console.
4. Select the check box next to the target administration group to which the group objects must be restored and click Next. The Migration wizard displays a list of Network Agent installation packages available in Kaspersky Security Center Cloud Console.
5. Select the installation package containing the relevant version and localization of Network Agent and click Next.

   Select the Kaspersky Network Agent for Windows installation package only if you have previously completed the quick start wizard in your Kaspersky Security Center Cloud Console workspace and if you perform the migration of Windows devices.

   Wait until the Migration wizard creates a stand-alone installation package. The maximum file size of the stand-alone installation package for Network Agent is 200 MB.

   The file is unpacked and automatically downloaded to the default download location defined in your browser settings. The non-group objects and the group objects are restored to the target administration group.

   When the import completes, the exported structure of administration groups, including the details of devices, appears under the target administration group that you selected. If the name of the object that you restore is identical to the name of an existing object, the restored object has an incremental suffix added.

   If you have imported the entire Managed devices group, we recommend that you rename the newly imported subgroup to avoid confusion:

   1. Go to the Hierarchy of groups section.
   2. Click the name of the subgroup in the groups tree.
   3. In the properties window that opens, in the Name field enter a different name (for example, "Migrated devices").

   We recommend that you check whether the objects (policies, tasks, and managed devices) included in the export scope have been successfully imported to Kaspersky Security Center Cloud Console. To do this, go to the Assets (Devices) section and view whether the imported objects appear on the lists in the Policies & profiles, Tasks, and Managed devices subsections.

   You cannot minimize the Migration wizard and perform any concurrent operations during the import. Wait until the refresh icons () next to all items in the list of objects are replaced with green check marks () and the import finishes. After this, the devices start switching to Kaspersky Security Center Cloud Console.

6. Click Finish to close the Migration wizard window.
7. If you want to find and download the stand-alone installation package again, go to Discovery & deployment → Deployment & assignment → Installation packages and click the View the list of stand-alone packages button. In the list that opens, select the stand-alone installation package that you have created and click the Download button.

   If you use Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console on different devices, you must copy the stand-alone installation package to a removable drive or choose other ways of transferring the file.

Step 3. Re-installing Network Agent on devices managed through Kaspersky Security Center Cloud Console

After you create the Network Agent stand-alone installation package, you can proceed to creation of a remote installation task. Performing this task enables you to re-install Network Agent on all managed devices so that these devices are switched under management through Kaspersky Security Center Cloud Console.

To reduce the risk of data loss, we recommend that you first perform the actions for a small administration group counting up to 20 managed devices located within the corporate network and including no physical servers. After finishing with these actions, check whether re-installation completed successfully and proceed to the full reinstallation scope.

To create a remote installation task and re-install Network Agent:

1. Go back to the Migration wizard in Kaspersky Security Center Web Console running on-premises.

   We recommend using the Migration wizard to create a remote installation task to re-install Network Agent as described below. If it is necessary to use a custom remote installation task, you first need to manually create a custom installation package from the Network Agent stand-alone installation package. Please note that when creating a custom installation package, you must specify the "-s" key in the executable file command line. Otherwise, Network Agent reinstallation from this custom installation package completes with an error.

   Depending on the current state of the Migration wizard, you can do one of the following:

   • If you have not closed the Migration wizard after the export and your session has not expired, click the Go to Step 3 of the Migration wizard button. Select the Upload stand-alone installation package check box and click the Select stand-alone installation package button. In the browser window that opens, specify the Network Agent stand-alone installation package.
   • If you have to start the Migration wizard again for any reason, select the Upload stand-alone installation package check box and click the Select stand-alone installation package button. In the browser window that opens, specify the Network Agent stand-alone installation package. After that, the Migration wizard again displays the hierarchy of administration groups of this Administration Server. Select the same group for which you created the export file and click Next.

     The Migration wizard checks again the total number of managed devices included in the selected administration group. If this number exceeds 10,000, an error message appears. The Next button remains unavailable (dimmed) until the number of managed devices in the selected administration group falls within the limit.

2. Wait until the stand-alone installation package is uploaded and click Next. The Migration wizard creates a custom installation package and a remote installation task for it. The task scope will include the administration group that you selected on the Managed devices to export page; the task startup schedule will be set to Manually by default. The Migration wizard displays the creation progress. Wait until the refresh icons () are replaced with the green check marks () and click Next.
3. If necessary, select the Run newly created remote installation task check box (cleared by default) for the devices in the selected administration group of the Administration Server running on-premises and all of its subgroups. In this case, the devices will be switched under management of Kaspersky Security Center Cloud Console—but only after Network Agent installation completes. The full path will be displayed to the administration group in which the task will be run.

   The task must only be started after the import to Kaspersky Security Center Cloud Console finishes. Otherwise, the device names may be duplicated in the list.

4. Click Finish to close the Migration wizard and start the remote installation task for the following purposes:
   • Upgrading the Network Agent instances
   • Switching the Network Agent instances under management through Kaspersky Security Center Cloud Console

   If you have left the Run newly created remote installation task check box cleared, you can start the task later manually, if necessary.

You can check that you can now manage the migrated Network Agent instances through Kaspersky Security Center Cloud Console. To do this, go to Assets (Devices) → Managed devices. Make sure that migrated managed devices have the confirmation icon () in the Visible, Network Agent is installed, and Network Agent is running columns. Also, make sure that these devices do not have the Not connected for a long time status description.

Migration with a hierarchy of Administration Servers

Expand all | Collapse all

This section describes the migration of managed devices and related objects from Kaspersky Security Center Web Console running on-premises to Kaspersky Security Center Cloud Console. The process involves a hierarchy: Kaspersky Security Center Web Console running on-premises acts as the secondary Administration Server and Kaspersky Security Center Cloud Console acts as the primary Administration Server.

Every administration group that you transfer to Kaspersky Security Center Cloud Console must contain the managed devices of a single operating system. If your network includes the devices of different operating systems, allocate them in different administration groups, and then migrate each group separately.

After you finish the migration, all Network Agents in the group within the migration scope are upgraded and managed through Kaspersky Security Center Cloud Console.

Before you start, do the following:

• Upgrade Administration Server running on-premises to version 14.2 or later.
• Install Kaspersky Security Center Web Console version 12.1 or later.
• Upgrade Network Agent on the managed devices to version 12 or later.
• On Windows devices, use Network Agent without an uninstallation password.

  If the password has already been set, do one of the following in Kaspersky Security Center Web Console:

  • Disable the Use uninstallation password option in the Network Agent policy settings.
  • Uninstall Network Agent remotely by using the Uninstall application remotely task. In the Application to uninstall field of the task, select Kaspersky Security Center Network Agent. Do not forget to enter the uninstallation password.
• Upgrade the managed applications to the versions supported by Kaspersky Security Center Cloud Console.
• Make sure that you have policies for the latest versions of the managed applications. If you use outdated policies, create new ones for the application versions supported by Kaspersky Security Center Cloud Console.
• To use actual policies, upgrade the web plug-ins for the applications that you intend to manage through Kaspersky Security Center Cloud Console.
• Uninstall Kaspersky applications from managed devices if these applications are not supported by Kaspersky Security Center Cloud Console.
• Decrypt all the data (disk-level or file-level) that was encrypted by Kaspersky Endpoint Security for Windows on managed devices running the Windows operating system, and disable the encryption feature on the managed devices through the application policy or locally. For more information, see Help for Kaspersky Endpoint Security for Windows.

  If the Windows device still stores any files or folders encrypted through Kaspersky Endpoint Security for Windows, the Network Agent upgrade will be canceled during the migration process. A notification will prompt you to decrypt all data on the device and disable the encryption feature.

Kaspersky Security Center Cloud Console allows for a maximum of 25,000 managed devices per one Administration Server.

To perform a migration to Kaspersky Security Center Cloud Console:

1. Estimate the scope of the migration process, that is, review the administration group to export and assess the number of managed devices in it. Make sure that all the activities listed as migration prerequisites have been completed successfully.
2. In Kaspersky Security Center Cloud Console, proceed to the secondary Administration Server for the managed devices that you want to migrate.
3. In the main menu, go to Operations → Migration.

   The welcome page of the Migration wizard opens.

4. On the welcome page, click Next.

   The Managed devices to export page opens, displaying the entire hierarchy of administration groups of the secondary Administration Server.

5. On the Managed devices to export page, click the chevron icon () next to the Managed devices group name, and then expand the hierarchy of administration groups. Select the administration group that you want to export.

   The Migration wizard checks the total number of managed devices included in the selected administration group. If this number exceeds 10,000, an error message appears. The Next button remains unavailable (dimmed) until the number of managed devices in the selected administration group falls within the limit.

6. Select the managed applications whose policies and tasks must be transferred to Kaspersky Security Center Cloud Console together with group objects. To select the managed applications whose objects are to be exported, select the check boxes next to their names in the list.

   Although Kaspersky Security Center Administration Server is present on the list, selecting the corresponding check box does not result in the export of its policies.

   To make sure that your managed applications are supported by Kaspersky Security Center Cloud Console, click the corresponding link. It will redirect you to the Online Help topic containing the list of applications managed by Kaspersky Security Center Cloud Console.

   If you select applications that are not supported by Kaspersky Security Center Cloud Console, the policies and tasks of these applications will be migrated anyway, but you will not be able to manage them in Kaspersky Security Center Cloud Console, due to the unavailability of the dedicated plug-ins.

7. View the list of group objects exported by default. You can also specify non-group objects to be exported together with the selected administration group, if necessary, such as global tasks, custom device selections, reports, custom roles, internal users and security groups, and custom application categories with content added manually. This page includes the following sections:
   • Global tasks

     The list of global tasks of managed applications, as well as global tasks of Network Agent.

     If a global task that you selected applies to a specific object selection, this selection will also be exported.

     Although the global tasks of Administration Server are present on the list, you cannot export them; selecting those tasks does not affect the export scope. Remote installation tasks also remain outside the export scope, because their respective installation packages cannot be exported.

   • Device selections

     The list of custom device selections.

   • Reports

     The editable list of report instances to be exported.

     If a report that you selected applies to a specific object selection, this selection will also be exported.

     Kaspersky Security Center Cloud Console contains the same set of report templates as Kaspersky Security Center Web Console, so you can select for export only the reports that you created manually or reconfigured.

   • Group objects

     The list of group objects to be exported by default. The following objects related to the selected administration group will be exported in their entirety by default:

     • Administration group structure, that is, all subgroups of the selected administration group.
     • Devices that have been included in the administration groups to be exported.
     • Tags that have been assigned to the devices to be exported.

       If a tag was created in Kaspersky Security Center Web Console but never assigned to any device, it will not be exported. The auto-tagging rules will not be exported, either.

     • Group policies of the managed applications that have been selected.

       Administration Server policies and Network Agent policies are not exported.

     • Group tasks of the managed applications that have been selected and Network Agent group tasks.

       Administration Server tasks are not exported.

     You can also prevent certain types of non-group objects from being exported:

     • To cancel export for custom roles (that is, those created by the user only), select the Exclude custom roles from export check box.
     • To cancel export for internal users and security groups, select the Exclude internal users and security groups from export check box.
     • To cancel export for custom application categories with content added manually, select the Exclude custom application categories from export check box.

   If you transfer devices of various operating systems to Kaspersky Security Center Cloud Console, non-group objects only need to be migrated once.

8. After you defined the migration scope, click Next to start the export process. The Creating the export file page opens, where you can view the export progress for each type of object that you included in the migration scope. Wait until each refresh icon (), located next to each item in the list of objects, is replaced with a green check mark (). The export finishes and the export file is automatically saved to a temporary folder. The next page opens, displaying the entire hierarchy of administration groups in Kaspersky Security Center Cloud Console, which acts as the primary Administration Server.
9. Select the check box next to the administration group to which the group objects must be imported, and then click Next. The file is unpacked, and the non-group objects and the group objects are restored to the target administration group.

   If the name of the object that you restore is identical to the name of an existing object, the restored object has an incremental suffix added.

   When the import completes, the exported structure of administration groups, including the details of devices, appears under the target administration group that you selected. The non-group objects are also imported.

   You cannot minimize the Migration wizard and perform any concurrent operations during the import. Wait until each refresh icon (), located next to each item in the list of objects, is replaced with a green check mark () and the import finishes. After this, the devices start switching to Kaspersky Security Center Cloud Console.

10. After the import completes, the Migration wizard displays a list of Network Agent installation packages available in Kaspersky Security Center Cloud Console for an appropriate operating system. Select the installation package containing the relevant version and localization of Network Agent.

    Select the Kaspersky Network Agent for Windows installation package only if you have previously completed the quick start wizard in your Kaspersky Security Center Cloud Console workspace and if you perform the migration of Windows devices.

11. Click Next.

    The Migration wizard creates a new stand-alone installation package (or uses an existing one) and a custom installation package based on it, as well as the corresponding remote installation task. The task scope includes the administration group that you selected on the Managed devices to export page. The task startup schedule is set to Manually by default. The Migration wizard displays the creation progress.

12. Wait until each refresh icon () is replaced with a green check mark (), and then click Next.
13. If necessary, select the Run newly created remote installation task check box (cleared by default) for the devices in the selected administration group in Kaspersky Security Center Web Console running on-premises and all of its subgroups. After the Network Agent installation completes, you can manage the selected devices through Kaspersky Security Center Cloud Console. The full path is displayed to the administration group in which the task is to be run.

    The remote installation task must only be started after the import to Kaspersky Security Center Cloud Console finishes. Otherwise, the devices may be duplicated.

14. Click Finish to close the Migration wizard and start the remote installation task for the following purposes:
    • Upgrading the Network Agent instances
    • Managing the Network Agent instances through Kaspersky Security Center Cloud Console

    If you have left the Run remote installation task check box cleared, you can start the task later manually, if necessary.

You can check that you can now manage the migrated Network Agent instances through Kaspersky Security Center Cloud Console. To do this, go to Assets (Devices) → Managed devices. Make sure that migrated managed devices have the confirmation icon () in the Visible, Network Agent is installed, and Network Agent is running columns. Also, make sure that these devices do not have the Not connected for a long time status description.

Scenario: Migration of devices running Linux or macOS operating systems

This section describes how to migrate devices running Linux or macOS operating systems from Kaspersky Security Center Web Console running on-premises to Kaspersky Security Center Cloud Console. The basic scenarios of migration without a hierarchy of Administration Servers and migration with such a hierarchy allow transferring all devices and related objects to Kaspersky Security Center Cloud Console. However, if your network includes devices running not only Windows, but also Linux or macOS, you need to transfer the devices of each operating system type separately. As a result, you have to perform the migration several times.

Prerequisites

Before you start, do the following:

• Upgrade Administration Server running on-premises to version 12 Patch A or later.
• Install Kaspersky Security Center Web Console of version 12.1 or later.
• Upgrade Network Agent on managed devices to version 12 or later.
• Upgrade the managed applications to the versions supported by Kaspersky Security Center Cloud Console.
• Make sure that you have policies for the latest versions of the managed applications. If you use outdated policies, create new ones for the application versions supported by Kaspersky Security Center Cloud Console.
• To use actual policies, upgrade the web plug-ins for the applications that you intend to manage through Kaspersky Security Center Cloud Console.
• Uninstall Kaspersky applications from managed devices if these applications are not supported by Kaspersky Security Center Cloud Console, and then replace the uninstalled applications with supported ones.

Kaspersky Security Center Cloud Console allows for a maximum of 25,000 managed devices per one Administration Server.

Migration stages

Migration to Kaspersky Security Center Cloud Console comprises the following stages:

1. Grouping managed devices by their operating systems

   If your network includes devices running different operating systems (Windows, Linux, or macOS), place the devices of each operating system in separate administration groups in Kaspersky Security Center Web Console. Also, create an administration group for each Linux distribution. For example, if you have Debian and Red Hat Linux devices, allocate them in different administration groups. This will allow you to perform the migration successfully because different Network Agent installation packages are required for various operating systems.

2. Perform separately the migration of every administration group and its application objects

   The managed devices of each operating system must migrate separately, to include their policies and tasks. For example, if you have Windows, macOS, Ubuntu, and CentOS devices, first, transfer the devices running the Windows operating system to Kaspersky Security Center Cloud Console, then macOS, then Ubuntu, and eventually, CentOS. You can transfer the managed devices in any order.

   To do this, perform the migration without the hierarchy of Administration Servers or migration with such a hierarchy, depending on whether your network includes secondary Administration Servers. During the migration, use the Network Agent installation package corresponding to the operating system of the transferred devices. For example, select the Kaspersky Security Center 13.2 Network Agent for Linux devices to perform the migration successfully.

   Note that non-group objects, such as global tasks, custom device selections, or reports, only need to be migrated once.

Results

Upon finishing with the migration, you can make sure that it was successful:

• The proper version of Network Agent is re-installed on each managed device running the Linux or macOS operating system.
• All Linux or macOS devices are managed through Kaspersky Security Center Cloud Console.
• All object settings that were effective before migration are preserved.

Scenario: Reverse migration from Kaspersky Security Center Cloud Console to Kaspersky Security Center

You may want to migrate the managed devices from Kaspersky Security Center Cloud Console to Kaspersky Security Center Administration Server. For example, this process can be used to roll back migration to Kaspersky Security Center Cloud Console.

Prerequisites

Before you start, make sure that the following prerequisites are met:

• Kaspersky Security Center Cloud Console is available and has managed devices connected.
• Kaspersky Security Center 14.2 (or later) Administration Server is available and has a Network Agent installation package of version 13 or later.

Reverse migration stages

Reverse migration comprises the following stages:

1. Creating a Network Agent stand-alone installation package in Kaspersky Security Center Administration Server on-premises

   In Kaspersky Security Center Administration Server running on-premises, create a Network Agent stand-alone installation package.

   During the creation process, you can select the Move unassigned devices to this group option to specify an administration group to which you want to move Network Agents after installation. If you have specified the administration group, an automatic moving rule is created that will move to the target administration group all Network Agents installed with this stand-alone installation package.

   To ensure correct reverse migration, make sure that you select the Network Agent version that is equal to or later than the version used in Kaspersky Security Center Cloud Console.

2. Creating a custom installation package in Kaspersky Security Center Cloud Console

   In Kaspersky Security Center Cloud Console, create a custom installation package based on the stand-alone installation package that you created and saved from Kaspersky Security Center Administration Server running on-premises.

   To enable package installation in silent mode, in the Executable file command line field, specify the -s key.

3. Creating a remote installation task

   In Kaspersky Security Center Cloud Console, create a remote installation task using the custom installation package that you have created.

4. Running the remote installation task

   Start the remote installation task that you created. The task initiates the re-installation of all Network Agents in the specified administration group; and it also switches the Network Agents under management of Kaspersky Security Center Administration Server running on-premises by changing the connection address and modifying other connection settings.

   If you did not specify any target administration group during creation of the stand-alone installation package, all devices are moved to the Unassigned devices group.

Results

Upon finishing with the migration, you can make sure that it was successful:

• All devices within the scope of the remote installation task that were previously managed through Kaspersky Security Center Cloud Console are now managed by Kaspersky Security Center Administration Server running on-premises.
• The devices are automatically moved to the administration group specified in the installation package settings.

The remote installation task in Kaspersky Security Center Cloud Console cannot be completed: it has no more target devices since all of them have modified connection settings. You have to stop the task manually after you make sure that the error icon () has appeared in the Visible column of the Managed Devices list for all devices from the migration scope.

Migration with virtual Administration Servers

If you have virtual Administration Servers in your existing Kaspersky Security Center on-premises infrastructure, you cannot migrate from Kaspersky Security Center on-premises to Kaspersky Security Center Cloud Console by using the Migration wizard. Also, you will be able to migrate only your customers' devices. You will have to create policies, tasks, and reports manually.

You can perform one of the following migration scenarios:

• By moving your client devices from virtual Administration Servers to a primary Administration Server
• By performing manual migration from virtual Administration Servers

Scenario: Migration with virtual Administration Servers by moving devices

To perform the migration from Kaspersky Security Center Web Console running on-premises to Kaspersky Security Center Cloud Console, you can move your devices from virtual Administration Servers to a primary Administration Server.

Prerequisites

Before migration, you must perform a number of actions, including upgrading Administration Server running on-premises to version 12 or later and upgrading the managed applications to versions supported by Kaspersky Security Center Cloud Console.

Migration scenario

The scenario proceeds in stages:

1. Creating an administration group for each of your virtual Administration Servers

   You create the group in your Kaspersky Security Center running on-premises.

2. Moving your customers' devices

   In Kaspersky Security Center running on-premises, move your customers' devices from each virtual Administration Server to the respective administration group created at the previous stage.

3. Migration

   Perform migration as described for the network without a hierarchy of Administration Servers.

4. Moving devices under management of virtual Administration Servers (optional step)

   If you want to manage your customers through virtual Administration Servers, move the devices from the administration groups under management of virtual Administration Servers.

5. Creating policies, tasks, and reports

   Create policies, tasks, and reports as required.

Results

Upon finishing with the migration, you can make sure that it was successful:

• Network Agent is re-installed on all managed devices.
• All devices are managed through Kaspersky Security Center Cloud Console.
• All object settings that were effective before migration are preserved.

Scenario: Manual migration with virtual Administration Servers

You can migrate from Kaspersky Security Center Web Console running on-premises to Kaspersky Security Center Cloud Console manually.

Prerequisites

Before migration, you must perform a number of actions, including upgrading Administration Server running on-premises to version 12 or later and upgrading the managed applications to versions supported by Kaspersky Security Center Cloud Console.

Migration scenario

The scenario proceeds in stages:

1. Creating an administration group for each of your virtual Administration Servers

   In Kaspersky Security Center Cloud Console, create an administration group that corresponds to each of your virtual Administration Servers.

2. Creating a stand-alone installation package for Network Agent

   Create a stand-alone installation package for Network Agent. During creation, specify the administration group that you created at the previous stage. This means that you must create an individual stand-alone installation package for each administration group.

   This stage occurs in your Kaspersky Security Center Cloud Console.

3. Downloading the stand-alone installation packages

   Download the stand-alone installation packages that you created at the previous stage. This stage occurs in your Kaspersky Security Center Cloud Console.

4. Creating an archive with each stand-alone installation package

   Available archive types are: ZIP, CAB, TAR, or TAR.GZ.

5. Creating custom installation packages for Network Agent

   Create custom installation packages for Network Agent. During creation, use archives that you created at the previous stage.

   This stage occurs in your Kaspersky Security Center running on-premises.

6. Creating remote installation tasks

   Create remote installation tasks to install Network Agent from the created custom installation packages.

   When creating a task, specify a corresponding administration group.

   This stage occurs in your Kaspersky Security Center running on-premises.

7. Running the created remote installation tasks

   Network Agents are updated. The Kaspersky Security Center Cloud Console Administration Server takes over the management of them.

   All devices are migrated to Kaspersky Security Center Cloud Console and are placed in administration groups that were specified when you created stand-alone installation packages for Network Agent.

8. Moving devices under management of virtual Administration Servers (optional step)

   If you want to manage your customers through virtual Administration Servers, move the devices from the administration groups under management of virtual Administration Servers.

9. Creating policies, tasks, and reports

   Create policies, tasks, and reports as required.

Results

Upon finishing with the migration, you can make sure that it was successful:

• Network Agent is re-installed on all managed devices.
• All devices are managed through Kaspersky Security Center Cloud Console.

  All object settings that were effective before migration are preserved.

Scenario: Moving devices from administration groups under management of virtual Servers

You may want to manage your customers through virtual Administration Servers. If you migrated devices and other items from Kaspersky Security Center on-premises to Kaspersky Security Center Cloud Console, the devices are located in administration groups. To manage the customers' devices through virtual Administration Servers, you must move the devices from the administration groups under the management of virtual Administration Servers.

Prerequisites

You have created a virtual Administration Server for each of your customers.

All devices of each customer are located in an individual administration group.

Stages

The scenario proceeds in stages:

1. Creating a stand-alone installation package for Network Agent

   Switch to each of the created virtual Administration Server, then create a stand-alone installation package for Network Agent. You can switch Administration Servers in the main menu by clicking the chevron icon () to the right of the current Administration Server name, and then selecting the required Administration Server.

2. Downloading the stand-alone installation packages

   Download the stand-alone installation packages that you created at the previous stage.

3. Create an archive with each stand-alone installation package

   Available archive types are: ZIP, CAB, TAR, or TAR.GZ.

4. Creating custom installation packages for Network Agent

   Create custom installation packages for Network Agent. During creation, use archives that you created at the previous stage.

   This stage occurs on the primary Administration Server.

5. Creating remote installation tasks

   Create remote installation tasks to install Network Agent from the created custom installation packages.

   When creating a task, specify a corresponding administration group.

   This stage occurs on the primary Administration Server.

6. Run the created remote installation tasks

   Network Agents are updated. The devices are moved under management of virtual Administration Servers.

7. Creating policies, tasks, and reports

   Create policies, tasks, and reports as required.

Results

You can now manage the migrated customers' devices by using virtual Administration Servers.

About migration from Kaspersky Endpoint Security Cloud

You can migrate your workspace from Kaspersky Endpoint Security Cloud to Kaspersky Security Center Cloud Console.

For a detailed description of the migration procedure, refer to the Kaspersky Endpoint Security Cloud Help.

After the migration is finished, a new workspace is created in Kaspersky Security Center Cloud Console, and you receive a corresponding email notification. The new workspace has the same name as the workspace in Kaspersky Endpoint Security Cloud.

Go to the new workspace and make sure that the objects are transferred:

• Kaspersky Next license is displayed in the Licensing section and in the Administration Server properties window.
• In the main menu, go to Assets (Devices) → Managed devices.

  All the devices running Windows and macOS are displayed in the list of managed devices.

  The transferred devices are automatically connected to the workspace created in Kaspersky Security Center Cloud Console. This may take a while.

• In the main menu, go to Assets (Devices) → Policies & profiles.

  In the list of policies, the Network Agent policy is displayed with the password protection configured.