We have a requirement to perform in-place migrations of workstations numbering in the tens of thousands. A major barrier to performing these migrations has been the controllability of Sophos Safeguard versions
5.x and 6.x. Our engineering organization has developed some workarounds that enable certain in-place migration scenarios where Safeguard is involved, but other scenarios that have been deemed critical to the success of our mission have remained unaccomplished
due to limits placed on our ability to control Safeguard.

During our past meeting with Sophos engineers, we posed some questions regarding these in place migration scenarios in an effort to receive guidance from Sophos on what is and what is not supported. One scenario
was using Microsoft USMT to perform ‘Hardlink’ data migrations. It was made clear that at this time Sophos does not support performing hardlink migrations when the hard disk is encrypted with Safeguard. The discussion moved on to Sanofi engineer’s attempts
at finding a way to make this scenario work, and the barriers that were encountered. Some scenarios involved using the Safeguard filter drivers in a WinPE disk and utilizing the FltDoNothing utility to unlock the MBR. This enabled scenarios where we could
wipe the disk and build a fresh machine, but still blocked our ability to modify the contents of the hard disk in order to utilize USMT to perform the ‘Hardlink’ data migration. After sharing these tests with Sophos engineers we explored the idea of providing
Sanofi engineers a way to adjust the MBR in order to Boot to WinPE but also allow us read and write access to the encrypted data. If there was a way to work within the encrypted area of the drive, it may be possible to perform the Hardlink data migration,
apply a new operating system image, inject the Safeguard filter drivers into that new operating system and repoint the MBR to the new operating system. It was made clear that at this time no programmatic ability to adjust the MBR without triggering the warning
exists, and that working within the encrypted areas of the disk from WinPE was not supported. This led us to believe that perhaps a feature request may help provide Sanofi with the tools and capabilities needed to create a working solution. We do not wish
to decrypt the drive prior to in-place migration because of the amount of time required to decrypt the drive.

In summary, we would like a SafeGuard feature that will allow us to perform in-place migrations with USMT ‘Hardlink’ data migration on encrypted drives.

I believe this accurately captures the information discussed. Please let me know if anything is unclear or inaccurate.

Here's what I see this feature looking like: When enabled, admins can make changes to the current config, but changes would not be applied to the running system, until the change control is approved.

Approval should be configurable, so that only authorized users can approve a change control, and optionally, require more than one admin's approval to be approved.

Multiple simultaneous change requests should be allowed, and the approval section should report the requested changes, and any changes which conflict with other requests. (i.e. two requests that edit the same object or value)

Once approved, a request should able to be applied manually, or scheduled to be applied during an approved change control window.

Minor system changes should be able to be excluded from change control, like allowed networks for webadmin, or enabling and configuring SSH.

Finally, there should be a persistently visible indicator of some kind, when change control is enabled.

The above list of requirements is the minimum I can see set to fit the needs of the smallest users through to the largest UTM users.

If you blacklist a UTM in the SUM, and then do a factory reset on the hardware, the UTM remains blacklisted. This makes sense.

However, there is a major problem: You cannot tell what UTMs are blacklisted. The only details provided in the SUM is blacklisted UTM's IP and Hostname.

However, the blacklist apparently applies to more than the Hostname/IP combo and will be denied even after a factory reset and reconfiguration.

Therefore, you need to also show in SUM the blacklisted UTM's Serial Number and GUID. If provided it would be easy to determine which item to remove from the SUM's Denied list because you can obtain that information from the UTM.

Thank you,
Travis G
Network Engineer III
Sophos UTM Architect