Migration from McAfee ePO to CrowdStrike

Problem

A client was in the process of implementing CrowdStrike across their estate. The CrowdStrike configuration had been completed by one of their Service Providers but there was some work needed to complete the migration from McAfee ePO to CrowdStrike and then decommission the ePO servers.

We were asked to scope up and perform the migration.

Challenges

• Timeline - the work needed to be carried out safely before their existing McAfee support contract expired.
• Protection - it was important that the CrowdStrike protection was installed and in place before we removed the McAfee components. This was to ensure systems were protected at all times throughout the transition.
• Endpoints - the endpoints were a mix of on-domain, off-domain, on-premise and remote.

Solution

The first stage was to configure a package in Ivanti EPM that would push out the CrowdStrike agent. The package was tested and then deployed to all endpoints that didn't have the agent.

The next stage was to remove the McAfee component that monitored rogue systems and attempted to install agents to unidentified devices. Once that was complete we setup pilot groups and began the process of automating the removal of the other McAfee components (Data Loss Prevention, File & Removable Protection, Endpoint Security, Advanced Threat Protection). We monitored to confirm this was working for all internal and external endpoints and then progressed the rollout to all other devices across the estate (approx 1000).

The final stage was to create another Ivanti package which removed the McAfee base agent from each device. We were careful to put checks in place to ensure no components were still installed before the agent was removed.

The client was very happy with the results and with the speed we achieved their goal.