Migrating to a new AD Domain - ePO and MDE 7.2.4.2

[leezard]

Hello All,

Or organization is going to be moving to a new AD domain in the coming months, and we're looking in to any issues that may pop up with ePO. From what I have read, ePO is not dependant on the domain, but Drive Encryption is. Is there a way to migrate everything without having to decrypt/encrypt machines? We have systems with MDE 7.2.4.2 (approx. 8,000+) and we do not have physical access to all of these systems: we manage ePO for our clients. It would be a massive undertaking to follow KB83802. Is there anyway to do it easily, or does it even need to be followed at all?

ePO 5.3.2

note: I am the McAfee "Subject-matter expert" but I am still learning about the role; i didn't have enough time to learn everything I needed from our previous SME before he left, so any help at all would be appreciated!!

[Hawkmoon · Accepted solution]

Hi leezard,

I think what you are looking for is described here:

Statement regarding the migration of managed encrypted systems from one ePolicy Orchestrator server to another
Technical Articles ID: KB83186

At the bottom of the article you will see additional articles that discuss ePO migration as well.

[cdinet]

You also might want to check with the drive encryption team for any additional suggestions. 

[leezard]

thanks, i'll ask there was well.

[leezard]

thanks, i did check those articles originally, but we aren't creating a new ePO server. this is just migrating to a new AD forest, and looking for ways to make this as simple as possible.

thanks!

[cdinet]

I would definitely get with the mde team then.  Anything changing ldap can have some serious consequenses, especially if you are using preboot authentication and user based policies.