Files
claudetools/.claude/memory/project_av_migration_bitdefender_to_edr.md
Howard Enos 21b198f1ee sync: auto-sync from HOWARD-HOME at 2026-07-04 17:49:31
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-04 17:49:31
2026-07-04 17:49:58 -07:00

1.8 KiB

name, description, metadata
name description metadata
project_av_migration_bitdefender_to_edr AV strategy — migrate all clients from Bitdefender to Datto EDR; ONLY exception is Glaztech
type
project

Standing AV direction (Howard 2026-07-03, scope narrowed 2026-07-04): ACG is moving endpoint AV/security from Bitdefender GravityZone -> Datto EDR for all clients EXCEPT Glaz-Tech Industries (glaztech) — the ONLY client staying on Bitdefender. Dataforth migrates fully (originally excepted; Howard removed the exception 2026-07-04 — Dataforth already runs 51 EDR agents with only 5 BD endpoints left: D1-ENGI-006, DESKTOP-L2LE31M, DATAFORTH-PC, SURFACEOPS, MING-HP).

Why: consolidate on Datto EDR as the security plane; Bitdefender is being retired fleet-wide. Glaztech keeps its large established Bitdefender footprint (~242 BD endpoint records, vs 159 GPS-billed — count includes stale ghosts).

How to apply: whenever setting up or reconciling a client's endpoints (e.g. the GPS->GuruRMM coverage audit), the target end-state per machine is: GuruRMM agent + Datto EDR agent (AV on), and Bitdefender removed. Do NOT deploy new Bitdefender coverage. Use existing Bitdefender inventory only as a discovery source for which machines exist (its company names carry the Syncro CID _NNNNN suffix — exact join key to Syncro customers). Deploy Datto EDR via [[datto-edr]] (create-group -> mint-key -> deploy-cmd, pushed through /rmm).

Migration scope quantified 2026-07-04 (tracker Phase 4): 27 clients / 141 BD endpoints + Dataforth's 5. Datto EDR "Default RMM Org" holds ~35 unassigned agents that belong to real clients (IMC x7, Russo x2, Len's, Rednour, Reliant, etc.) — attribute them to proper orgs as part of the migration.

Related: GPS->RMM audit tracker projects/gps-rmm-audit/tracker.md.