LAN Crypt Administration: Migration from On-Premises to the Cloud

• Overview of the cloud migration
• Pre-Check
• Preparing the services
  • Registration and login as an administrator with LAN Crypt Cloud
  • Synchronization of user and group objects from Active Directory
    • Synchronization of Active Directory with Microsoft Entra ID
    • Setting up the Microsoft Entra ID connection to LAN Crypt Cloud
  • (Optional) Setting up a key server
• Performing the migration
  • Export from the On-Premises Environment
  • Import into LAN Crypt Cloud
    • Additional options with the LCCloudImport command-line tool
    • Updating settings
  • Overview of the objects and their handling during migration
• Technical support
• Legal notice

Overview of the cloud migration

This migration guide walks you step by step through the complete process of migrating all users, groups, and encryption rules from an on-premises installation of LAN Crypt Administration to LAN Crypt Cloud Administration.

The migration is divided into three central steps:

Pre-Check

Verification of the technical prerequisites for a successful migration.

Preparing the Services

1. Registration with LAN Crypt Cloud and preparation of the services used before starting the migration.
2. Setting up synchronization between Microsoft Entra ID and Active Directory, followed by connecting Microsoft Entra ID to LAN Crypt Cloud Administration.
3. Optional integration of a Utimaco ESKM for external key management.

Performing the Migration

1. Export of the data from LAN Crypt On-Premises Administration.
2. Import of the data into LAN Crypt Cloud Administration.

Note

• After a successful migration, additional configuration options automatically become available within the Cloud Administration. These supplement the regular configuration options and relate primarily to the management of LAN Crypt Windows clients.

Pre-Check

Before the actual migration process is started, the on-premises instance of LAN Crypt Administration in use should first be checked for compatibility.

Neither LAN Crypt Cloud nor Microsoft Entra ID supports a structural arrangement of groups and users into organizational units (OUs). If your organization uses organizational units within the on-premises Administration, these will not be carried over as part of the migration process.

LAN Crypt Cloud Administration requires a valid email address for every user. Therefore, make sure that locally or manually created users in the on-premises Administration have a valid email address on file. When using Active Directory, the assignment of users to their Entra ID account is performed automatically via a unique identifier - the objectGUID (Active Directory) or the on-premises immutable ID (Entra ID).

Note

• Migration to LAN Crypt Cloud is only possible with LAN Crypt On-Premises Administration version 11 or higher.

• LAN Crypt Cloud exclusively supports AES-256 keys. Keys with other algorithms are not migrated to LAN Crypt Cloud. Files that were encrypted with such keys cannot be read by clients.

Preparing the services

Before the migration can be performed, the following prerequisites must be met:

1. A LAN Crypt Cloud account for administration must be set up.

2. If LAN Crypt On-Premises Administration is used in combination with Active Directory, Active Directory must first be synchronized with Microsoft Entra ID before a connection between Microsoft Entra ID and LAN Crypt Cloud can be established, in order to continue using existing user and group objects.

3. Optionally, an external key server can be prepared in order to store the cryptographic keys outside the cloud on a Utimaco Enterprise Key Management Appliance (ESKM), thereby achieving an even higher level of security.

Registration and login as an administrator with LAN Crypt Cloud

Using LAN Crypt Cloud Administration requires registering a u.trust LAN Crypt Cloud account.

Once you have successfully completed the registration process, an email to activate your account is sent to the address provided. To activate the registered account, the activation link in the email must be opened within the next 24 hours. If the registered account is not activated within this period, the account is automatically deleted. After the account has been activated, the email address provided and the chosen password serve as the login credentials.

Synchronization of user and group objects from Active Directory

Note

• This chapter is only relevant if users and groups from Active Directory are used in LAN Crypt On-Premises Administration. If only local users and groups are used, this chapter can be skipped.

Since LAN Crypt Cloud is operated as a cloud service, direct access to the local Active Directory is not possible. User and group objects from Active Directory must therefore be synchronized with Microsoft Entra ID beforehand in order to make them available in LAN Crypt Cloud Administration in the next step.

Synchronization of Active Directory with Microsoft Entra ID

For synchronizing on-premises Active Directory objects to the cloud, Microsoft provides the tools Cloud Sync and Cloud Connect.

Note

• The use of Cloud Sync is recommended, as it is generally easier to configure and operate, provided there are no special requirements that necessitate the use of Cloud Connect.

Follow Microsoft’s instructions to create a Microsoft Entra tenant and synchronize your Active Directory users and groups with Microsoft Entra ID.

All relevant user and group objects must be synchronized with Microsoft Entra ID so that LAN Crypt Cloud can automatically assign keys and assets during the migration. LAN Crypt Cloud does not create users or groups from Active Directory objects. Assigning existing keys is only possible if the objects were previously provisioned via Microsoft Entra ID.

Setting up the Microsoft Entra ID connection to LAN Crypt Cloud

After synchronization of Active Directory with Microsoft Entra ID has been set up, the connection between Microsoft Entra ID and LAN Crypt Cloud can be established.

A detailed description of this process can be found in the corresponding documentation in the LAN Crypt Cloud Admin documentation.

(Optional) Setting up a key server

By default, LAN Crypt Cloud stores all data in the cloud, including the keys for encryption processes. Utimaco employs comprehensive security measures and, in particular, protects the cryptographic keys with a high level of security.

If you do not want to store your encryption keys in the cloud, you have the option of using a Utimaco Enterprise Secure Key Manager (ESKM). With this appliance, the keys can be stored and managed outside the cloud.

Detailed information on ESKM support in LAN Crypt Cloud can be found in the LAN Crypt Cloud Admin documentation.

Note

• The integration of an ESKM server can in principle also be carried out at a later point in time. In this case, however, the external key management applies exclusively to newly created encryption keys. For the migration of on-premises data, it is therefore recommended to make the decision for or against the use of an ESKM before importing the data into LAN Crypt Cloud, and to configure the ESKM server accordingly in the settings of the LAN Crypt Cloud account.

Performing the migration

After a successful Pre-Check as well as the successful setup of all required connections and the completion of all synchronization processes, the migration of LAN Crypt On-Premises Administration can be performed.

The migration is carried out in two consecutive steps:

Step 1: Export of the on-premises administration data

The export of the existing administration data is performed using the command-line tool LCOnPremExport.exe.

Note

• LCOnPremExport.exe is provided on request by customer support.

Step 2: Import of the data into LAN Crypt Cloud

The previously exported data is then imported into LAN Crypt Cloud Administration using the command-line tool LCCloudImport.exe.

Note

• LCCloudImport.exe can be downloaded in LAN Crypt Cloud Administration under Manage account → Downloads.

Export from the On-Premises Environment

Run the command-line tool LCOnPremExport.exe to export the contents of the LAN Crypt administration database to a password-protected migration file.

Since the tool requires direct access to the LAN Crypt database, it must be run on the same system on which the CheckDatabase tool is usually used as well.

In the following example, an export file named LCOnPrem.zip is created using the MSO account:

LCOnPremExport.exe -s MSO -f LCOnPrem

During the export process, you are prompted to enter a password. This password protects the generated ZIP file using AES-256 encryption.

Note

• Remember the password, as it is later mandatorily required for the import into LAN Crypt Cloud.

After the export is complete, the tool outputs a summary of the exported data. At the end, a success message like this should appear:

**** The export file: LCOnPrem.zip was created successfully. ****

The export tool may detect migration issues. In this case, no success message appears, but rather a list of the detected issues:

Import not possible
===================
These items cannot be imported to cloud.

- number of keys (algorithm IDEA): 5.
- number of keys (algorithm DES): 7.

Summary of detected issues
==========================
Checking database telemetry for cloud compatibility detected issues.

- Some data cannot be imported cloud.
- The remaining data can be imported to cloud.

Please review the reported issues carefully.

Run LCOnPremExport again with the switch '-r' to skip the compatibility check.

You can also perform the migration without resolving the listed issues. However, it is strongly recommended to carefully review the reported issues and to identify possible obstacles to your migration. With the -r switch, the export can be forced even when warnings are present and thus continued despite the identified issues:

LCOnPremExport.exe -s MSO -f LCOnPrem -r

Issues and their impact:

Import into LAN Crypt Cloud

To import the previously created export file, use the command-line tool LCCloudImport.exe.

For the tool to run successfully, the following prerequisites must be met:

• Access to the exported ZIP file (LCOnPrem.zip)
• An active internet connection
• Optional: If a key server has been configured within LAN Crypt Cloud Administration, it must also be reachable from the executing system.

Import of the migration data into LAN Crypt Cloud

LCCloudImport -i LCOnPrem.zip

Sequence of the process:

Step 1: The tool first prompts you to enter the password of the export ZIP file. Step 2: A web browser is then opened automatically to log in to LAN Crypt Cloud. Step 3: The relevant data is uploaded collectively to the Cloud Administration.

Note

• If a Utimaco ESKM has already been integrated, the keys are written to the key server in this step. Depending on the number of keys, this step can take more time (several thousand keys per hour).

Step 4: Only once all data has been transferred successfully do additional migration processes start automatically in the background.

Note

• To view the status of the migration, you can either check it directly in LAN Crypt Cloud Administration or alternatively query it via the command-line tool with the following command: LCCloudImport --status

After the migration is completed or aborted, an audit log entry is automatically created in LAN Crypt Cloud Administration.

Additional options with the LCCloudImport command-line tool

As a rule, only the Import and Status options are needed. In addition, however, further functions are available, e.g. for deleting uploaded data or for manually restarting the migration.

Overview of the options:

LAN Crypt Cloud import tool 14.0.0.0
Imports LAN Crypt OnPrem migration data into LAN Crypt Cloud.
 
Import OnPrem export file:
        LCCloudImport (-i | --import) exportfile [-v | --verbose] [-d | --dryrun]
        exportfile: Path to LAN Crypt OnPrem export file
        verbose: Show detailed information
        dryrun: Simulation mode, data is not uploaded
 
Show import status:
        LCCloudImport (-s | --status) [-v | --verbose]
 
Delete migration data:
        LCCloudImport (-c | --clear) [-v | --verbose]
 
Start migration:
        LCCloudImport (-x | --start) [-v | --verbose]
 
Show help:
        LCCloudImport (-h | --help)

Updating settings

After the migration of users, groups, and encryption rules is complete, the configuration settings should finally be reviewed and aligned.

In LAN Crypt On-Premises Administration, the settings are configured via Group Policy Objects (GPOs) - either through the LAN Crypt Administration application or through the administrative ADMX templates. Many of these settings can now be configured directly in LAN Crypt Cloud Administration under Settings > File encryption. These additional settings are available exclusively to administrators who have migrated from LAN Crypt On-Premises Administration to LAN Crypt Cloud Administration.

If, after a successful migration, the configurations of LAN Crypt Cloud Administration and LAN Crypt On-Premises Administration differ from each other, the settings of the Cloud Administration take precedence. The differing configurations of the on-premises Administration are overwritten in this case.

A small number of rarely used GPO settings have no corresponding option in the LAN Crypt Cloud user interface. These settings can still be configured exclusively via GPO:

• Delay when loading the profile
• Excluded applications
• Default ‘Ignore rule’
• Excluded devices
• Excluded drives
• Antivirus software
• Trusted vendors

Note

• In the current versions of the LAN Crypt ADMX templates, the Supported On field displays the value LAN Crypt Cloud for all GPO settings that are relevant for LAN Crypt Cloud. All other LAN Crypt GPO options should be disabled and, if needed at all, configured instead in the LAN Crypt Cloud settings.

Overview of the objects and their handling during migration

This section describes how objects from u.trust LAN Crypt On-Premises Administration (OnPrem) are migrated to u.trust LAN Crypt Cloud. The following tables provide a structured overview of the mapping of the object types as well as the respective particularities during import.

User and Group Objects

Encryption Rules

Keys

Settings

Technical support

Technical support for Utimaco products can be accessed as follows:

At support.Utimaco.com, maintenance contract customers can access additional information, such as knowledge items.

As a maintenance contract customer, send an email to technical support:

support@Utimaco.com

and specify the version number(s), operating system(s) and patch level of your Utimaco software and, if applicable, the exact wording of any error messages.

Legal notice

Copyright © 2024 - 2026 Utimaco IS GmbH, 2018 - 2024 conpal GmbH, 1996 - 2018 Sophos Limited and Sophos Group. All rights reserved. conpal®, AccessOn® and AuthomaticOn® are registered trademarks of conpal GmbH.

All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

This publication may not be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, unless you either have a valid license to reproduce the documentation in accordance with the license agreement, or you have received written permission from the copyright owner.

For 3rd party copyright information, refer to the 3rd party software document in your product directory.

Last updated 26.06.2026.