Migration wizard

This section provides information about the Migration wizard in Kaspersky Security Center Cloud Console and Kaspersky Security Center Web Console of version 12 or later.

Step 1. Exporting managed devices, objects, and settings from Kaspersky Security Center Web Console

Expand all | Collapse all

Migration of managed devices from Kaspersky Security Center Web Console to Kaspersky Security Center Cloud Console requires that you first create an export file containing information about the hierarchy of administration groups that are on your current Administration Server running on-premises. The export file must also contain information about the objects and their settings. The export file will be used for subsequent import to Kaspersky Security Center Cloud Console.

The maximum export file size is 4 GB.

To export objects and their settings from Kaspersky Security Center Web Console:

1. In the main menu of Kaspersky Security Center Web Console, go to Operations → Migration.
2. On the welcome page of the Migration wizard, click Next. The Managed devices to export page opens, displaying the entire hierarchy of administration groups of the corresponding Administration Server.
3. On the Managed devices to export page, click the chevron icon () next to the Managed devices group name to expand the hierarchy of administration groups. Select the administration group that you want to export.

   After migration from Kaspersky Security Center running on-premises to Kaspersky Security Center Cloud Console performed for two administration groups, the Remote installation tasks for these groups appear with the same name.

4. Select the managed applications whose policies and tasks must be transferred to Kaspersky Security Center Cloud Console together with group objects. To select the managed applications whose objects are to be exported, select the check boxes next to their names in the list.

   Although Kaspersky Security Center Administration Server is present on the list, selecting the corresponding check box does not result in the export of its policies.

   To make sure that your managed applications are supported by Kaspersky Security Center Cloud Console, click the corresponding link. It will redirect you to the Online Help topic containing the list of applications managed by Kaspersky Security Center Cloud Console.

   If you select applications that are not supported by Kaspersky Security Center Cloud Console, the policies and tasks of these applications will be exported anyway and then imported, but you will not be able to manage them in Kaspersky Security Center Cloud Console due to unavailability of the dedicated plug-ins.

5. View the list of group objects exported by default and specify non-group objects to be exported together with the selected administration group, if necessary. Configure the export scope by including or excluding various objects, such as global tasks, custom device selections, reports, custom roles, internal users and security groups, and custom application categories. This page includes the following sections:
   • Global tasks

     The list of global tasks of managed applications, as well as global tasks of Network Agent.

     If a global task that you selected applies to a specific object selection, this selection will also be exported.

     Although the global tasks of Administration Server are present on the list, you cannot export them; selecting those tasks does not affect the export scope. Remote installation tasks also remain outside the export scope, because their respective installation packages cannot be exported.

   • Device selections

     The list of custom device selections.

   • Reports

     The editable list of report instances to be exported.

     If a report that you selected applies to a specific object selection, this selection will also be exported.

     Kaspersky Security Center Cloud Console contains the same set of report templates as Kaspersky Security Center Web Console, so you can select for export only the reports that you created manually or reconfigured.

   • Group objects

     The list of group objects to be exported by default. The following objects related to the selected administration group will be exported in their entirety by default:

     • Administration group structure, that is, all subgroups of the selected administration group.
     • Devices that have been included in the administration groups to be exported.
     • Tags that have been assigned to the devices to be exported.

       If a tag was created in Kaspersky Security Center Web Console but never assigned to any device, it will not be exported. The auto-tagging rules will not be exported, either.

     • Group policies of the managed applications that have been selected.

       Administration Server policies and Network Agent policies are not exported.

     • Group tasks of the managed applications that have been selected and Network Agent group tasks.

       Administration Server tasks are not exported.

     You can also prevent certain types of non-group objects from being exported:

     • To cancel export for custom roles (that is, those created by the user only), select the Exclude custom roles from export check box.
     • To cancel export for internal users and security groups, select the Exclude internal users and security groups from export check box.
     • To cancel export for custom application categories with content added manually, select the Exclude custom application categories from export check box.

   If you transfer devices of various operating systems to Kaspersky Security Center Cloud Console, non-group objects only need to be migrated once.

   The Migration wizard checks the total number of managed devices included in the selected administration group. If this number exceeds 10,000, an error message appears. The Next button remains unavailable (dimmed) until the number of managed devices in the selected administration group falls within the limit.

6. After you defined the migration scope, click Next to start the export process. The Creating the export file page opens, where you can view the export progress for each type of object that you included in the migration scope. Wait until the refresh icons () next to all items in the list of objects are replaced with green check marks (). The export process finishes and the export file is automatically downloaded to the default download location defined in your browser settings. The name of the export file appears in the lower part of the browser window.
7. When the Export has completed successfully page is displayed, proceed to the next stage performed in Kaspersky Security Center Cloud Console.

   If you use Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console on different devices, you will have to copy the export file to a removable drive or choose other ways of transferring the file.

Step 2. Importing the export file to Kaspersky Security Center Cloud Console

To transfer information about managed devices, objects, and their settings that you exported from Kaspersky Security Center Web Console, you must import it to Kaspersky Security Center Cloud Console deployed in your workspace. This enables you to create a stand-alone installation package and use it for re-installation of Network Agent on your managed devices.

Before you start the Migration wizard in Kaspersky Security Center Cloud Console, make sure its current localization language is the same as the Kaspersky Security Center Web Console language during the export process. Switch the language, if necessary.

If you have previously completed the quick start wizard in your Kaspersky Security Center Cloud Console workspace, the Managed devices group includes policies and tasks created with the default settings. Delete these policies and tasks before importing the ones that you exported from Kaspersky Security Center Web Console.

To import the export file to Kaspersky Security Center Cloud Console:

1. In the main menu of Kaspersky Security Center Cloud Console, go to Operations → Migration.
2. On the welcome page of the Migration wizard, click Import. In the File Explorer window that opens, select the export file by browsing to the folder where it was saved, and click Open. Wait until the refresh icon () next to the file uploading status is replaced with the green check mark ().
3. Click Next. The next page opens, displaying the entire hierarchy of administration groups of the Administration Server in Kaspersky Security Center Cloud Console.
4. Select the check box next to the target administration group to which the group objects must be restored and click Next. The Migration wizard displays a list of Network Agent installation packages available in Kaspersky Security Center Cloud Console.
5. Select the installation package containing the relevant version and localization of Network Agent and click Next.

   Select the Kaspersky Network Agent for Windows installation package only if you have previously completed the quick start wizard in your Kaspersky Security Center Cloud Console workspace and if you perform the migration of Windows devices.

   Wait until the Migration wizard creates a stand-alone installation package. The maximum file size of the stand-alone installation package for Network Agent is 200 MB.

   The file is unpacked and automatically downloaded to the default download location defined in your browser settings. The non-group objects and the group objects are restored to the target administration group.

   When the import completes, the exported structure of administration groups, including the details of devices, appears under the target administration group that you selected. If the name of the object that you restore is identical to the name of an existing object, the restored object has an incremental suffix added.

   If you have imported the entire Managed devices group, we recommend that you rename the newly imported subgroup to avoid confusion:

   1. Go to the Hierarchy of groups section.
   2. Click the name of the subgroup in the groups tree.
   3. In the properties window that opens, in the Name field enter a different name (for example, "Migrated devices").

   We recommend that you check whether the objects (policies, tasks, and managed devices) included in the export scope have been successfully imported to Kaspersky Security Center Cloud Console. To do this, go to the Assets (Devices) section and view whether the imported objects appear on the lists in the Policies & profiles, Tasks, and Managed devices subsections.

   You cannot minimize the Migration wizard and perform any concurrent operations during the import. Wait until the refresh icons () next to all items in the list of objects are replaced with green check marks () and the import finishes. After this, the devices start switching to Kaspersky Security Center Cloud Console.

6. Click Finish to close the Migration wizard window.
7. If you want to find and download the stand-alone installation package again, go to Discovery & deployment → Deployment & assignment → Installation packages and click the View the list of stand-alone packages button. In the list that opens, select the stand-alone installation package that you have created and click the Download button.

   If you use Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console on different devices, you must copy the stand-alone installation package to a removable drive or choose other ways of transferring the file.

Step 3. Re-installing Network Agent on devices managed through Kaspersky Security Center Cloud Console

After you create the Network Agent stand-alone installation package, you can proceed to creation of a remote installation task. Performing this task enables you to re-install Network Agent on all managed devices so that these devices are switched under management through Kaspersky Security Center Cloud Console.

To reduce the risk of data loss, we recommend that you first perform the actions for a small administration group counting up to 20 managed devices located within the corporate network and including no physical servers. After finishing with these actions, check whether re-installation completed successfully and proceed to the full reinstallation scope.

To create a remote installation task and re-install Network Agent:

1. Go back to the Migration wizard in Kaspersky Security Center Web Console running on-premises.

   We recommend using the Migration wizard to create a remote installation task to re-install Network Agent as described below. If it is necessary to use a custom remote installation task, you first need to manually create a custom installation package from the Network Agent stand-alone installation package. Please note that when creating a custom installation package, you must specify the "-s" key in the executable file command line. Otherwise, Network Agent reinstallation from this custom installation package completes with an error.

   Depending on the current state of the Migration wizard, you can do one of the following:

   • If you have not closed the Migration wizard after the export and your session has not expired, click the Go to Step 3 of the Migration wizard button. Select the Upload stand-alone installation package check box and click the Select stand-alone installation package button. In the browser window that opens, specify the Network Agent stand-alone installation package.
   • If you have to start the Migration wizard again for any reason, select the Upload stand-alone installation package check box and click the Select stand-alone installation package button. In the browser window that opens, specify the Network Agent stand-alone installation package. After that, the Migration wizard again displays the hierarchy of administration groups of this Administration Server. Select the same group for which you created the export file and click Next.

     The Migration wizard checks again the total number of managed devices included in the selected administration group. If this number exceeds 10,000, an error message appears. The Next button remains unavailable (dimmed) until the number of managed devices in the selected administration group falls within the limit.

2. Wait until the stand-alone installation package is uploaded and click Next. The Migration wizard creates a custom installation package and a remote installation task for it. The task scope will include the administration group that you selected on the Managed devices to export page; the task startup schedule will be set to Manually by default. The Migration wizard displays the creation progress. Wait until the refresh icons () are replaced with the green check marks () and click Next.
3. If necessary, select the Run newly created remote installation task check box (cleared by default) for the devices in the selected administration group of the Administration Server running on-premises and all of its subgroups. In this case, the devices will be switched under management of Kaspersky Security Center Cloud Console—but only after Network Agent installation completes. The full path will be displayed to the administration group in which the task will be run.

   The task must only be started after the import to Kaspersky Security Center Cloud Console finishes. Otherwise, the device names may be duplicated in the list.

4. Click Finish to close the Migration wizard and start the remote installation task for the following purposes:
   • Upgrading the Network Agent instances
   • Switching the Network Agent instances under management through Kaspersky Security Center Cloud Console

   If you have left the Run newly created remote installation task check box cleared, you can start the task later manually, if necessary.

You can check that you can now manage the migrated Network Agent instances through Kaspersky Security Center Cloud Console. To do this, go to Assets (Devices) → Managed devices. Make sure that migrated managed devices have the confirmation icon () in the Visible, Network Agent is installed, and Network Agent is running columns. Also, make sure that these devices do not have the Not connected for a long time status description.