Jive Syndication Feed

McAfee Deep Command 2.0: Improving Detection and Configuration of Intel AMT

webadmin@intel.com — Fri, 26 Apr 2013 22:35:31 GMT

Detecting, configuring, and maintaining the Intel AMT configuration across an enterprise requires automation.

Setting up a lab or initial pilot environment through McAfee ePO should be simple without any 3rd party software or infrastructure customization.

Announcing McAfee Deep Command 2.0 Beta

Simple - "One-Click" configuration of Intel AMT from McAfee ePO
Microsoft CA optional - generate and apply Intel AMT certificates via McAfee ePO (including CIRA\Gateway Certificates)
Planning for the future - works with McAfee ePO 4.6.x or 5.0

The beta starts April 30th.

See the introductory video at https://community.mcafee.com/videos/1600

Interested in beta participation? Subscribe to https://community.mcafee.com/groups/epo-direct-beta

New to McAfee ePO Deep Command? See recorded demonstration of version 1.5 at https://community.mcafee.com/videos/1499

Note: Viewing content on McAfee Community will require a logon account.

Can an End User stop a KVM session?

webadmin@intel.com — Sat, 02 Mar 2013 01:10:12 GMT

Yes - This feature is enabled via the Intel Management and Security Status (IMSS) application.

IMSS is installed as part of the Intel AMT driver set. A small icon will appear in the task tray.

The user does need to open or see this icon. The default key sequence to stop a redirection session is Shift+Escape

Shown below is the IMSS screen, on the Intel AMT tab. The hot key can be changed by the user if they so desired.

Note: The IMSS application and hotkey functionality are operating system dependent.

How does a user know if a redirection session is occuring on their computing device?

Two items will show on the screen independent of the host operating system:

Shown in the upper right corner of the screen - a flashing icon
Red border around the screen.
- Note: The red border is more pronounced on Intel AMT 8.x and higher systems, where an alternating red\yellow flashing border occurs.

One final reminder - in many circumstances User Consent must be obtained to establish the initial session. This further helps to protect the privacy of the end user. Shown below is an example of the prompt on the user screen - which will appear regardless of the operating system state.

Why is my certificate template missing from Intel SCS Console?

webadmin@intel.com — Thu, 17 Jan 2013 23:11:33 GMT

When creating an Intel AMT Configuration profile with Transport Layer Security (TLS), a target Microsoft Certificate Authority (CA) and certificate template must be specified. When using TLS with Intel AMT, a Server Authentication certificate must be defined and applied into the firmware of each system. The easiest choice is the WebServer certificate template. In some environments, this template might be disabled or removed due to security policies.

The following steps summarize the required steps.

First - if a valid Server Authentication certificate template has not be published, a screen similar to the following will occur. The certificate template field is blank with no available options

Within the Microsoft Enterprise CA, duplicate the WebServer certificate template. When prompted, select the default option for "Windows 2003 Server, Enterprise Edition"

Provide the details for the certificate template. Shown below the certificate template name is "Intel AMT TLS Cert".

On the security tab, provide access to the template for the logon account of RCSserver. In this example, RCSserver is running under the Network Service Account of a system with hostname SCS8, thus the select "SCS8$". Grant the "Read" and "Enroll" permissions

Next, issue the certificate template. Right click on Certificate Templates under the target Microsoft CA (Note: Required only for Microsoft Enterprise CA to issue certificate templates to the Microsoft Active Directory. Microsoft Standalone CA implementations do not include this option.)

With the certificate template issued...

... in the Intel SCS console, select "Refresh CAs &Templates". Via the pull down list, select the target certificate template.

Two final reminders - ensure the logon account for RCSserver (the server component of the Intel SCS installation) has rights to "Issue and Manage Certificates" along with "Request Certificates" as required for the Web Enrollment process.

And ensure the Policy Module setting allows for automatically issuing certificates

The above information is provided in the Intel SCS User Guide. This article provides a summary and reminder

Intel vPro Session at McAfee FOCUS 2012

webadmin@intel.com — Fri, 26 Oct 2012 22:19:00 GMT

At the McAfee FOCUS 2012 event, Intel vPro Technology with McAfee ePO Deep Command was demonstrated during the CTO Keynote and discussed in more details at one of the breakout session.

An audio enabled recording of the breakout presentation is available online

The CTO Keynote demo was really cool... sorry if you missed it.

In addition to the breakout session, an index of online materials for Intel vPro Technology with McAfee ePO Deep Command is available by clicking here.

Be sure to check out the integration with McAfee Endpoint Encryption for PCs (Hint: Ability to securely unlock and remotely reset encryption passwords among other items)

Enjoy!

Four Reasons for Using Digest Master Passwords with Intel SCS

webadmin@intel.com — Fri, 21 Sep 2012 14:06:54 GMT

Among the many enhancements with latest generation Intel SCS releases, one that you may have overlooked is Digest Master Passwords

First - some contextual understanding

The idea of a Digest Master Password (DMP) is to provide one password to Intel SCS which is used to randomize the Intel AMT admin password on every system configured.

To help put that in context, shown below is the Intel SCS console view to enable and set the Digest Master Password

Once a Digest Master Password has been established, when defining the Network Setting within a Configuration Profile, a third option appears to "Use Master Password to create a password for each system"

Those who have appropriate permissions to the Intel SCS console can lookup the password of an individual system. As shown below, all of the systems have been configured using Digest Master Password. The per-system Intel AMT password is a unique string. The notepad provides a few example randomized passwords due to Digest Master Password.

With the contextual understanding above, here are the four reasons to use Digest Master Password (DMP)

Simple to add an additional Intel SCS or in disaster recovery scenarios - If you have already configured Intel AMT systems using Digest Master Password, additional Intel SCS instances can start communicating with them immediately. All you need to provide is the DMP in the Intel SCS console. (I'm looking forward to Intel AMT capable applications using DMP)
No Database Required - In the past, a randomized password option could be used with each individual password stored in the Intel AMT database. If you lose or corrupt the database, you lose the passwords. This is not true with DMP - since the randomized password is calculated dynamically per an algorithm. (Again - I hope in the future Intel AMT capable applications will use DMP)
Simplifies reconfiguration, delta configuration, and unconfiguration options - If you have manually typed the ACUconfig commands, you noticed a command option "/Adminpassword". This is the Intel AMT admin password, and if you must directly specify it in the command line there is a security risk. In contrast, if DMP is enabled the ACUconfig command execution will determine the Intel AMT admin password.
Easy to maintain- Intel SCS will remember the last 8 DMP's used. If you update the DMP on the Intel SCS console, the change can be applied to systems in your environment causing a new random Intel AMT admin password per client to be generated and assigned. Until that job has completed, which is complicated with systems that may be disconnected from the network for a period of time, there is a good possibility that some systems may not get the update immediately. No worries - Intel SCS knows the previous DMPs used and can apply those if needed.

Ensure you secure the DMP

A final thought for this blog - be sure to secure the Digest Master Password. As shown above, the individual randomized passwords are accessible via the Intel SCS console. To calculate or obtain the Digest Master Password requires access to the Intel_RCS_Master_Password WMI namespace as shown below

Do you have an additional reason for using Digest Master Passwords? Please do tell

Reporting on Intel AMT Capable Computers

webadmin@intel.com — Tue, 04 Sep 2012 14:00:13 GMT

If you have McAfee ePO 4.6 or higher in your environment today, and you want an accurate summary of your Intel AMT capable systems - try using a free utility provided by McAfee.

The McAfee ePO Deep Command Discovery and Report Module is a free utility that can provide dashboards and related information such as the following

While many Intel AMT detection capabilities provide only a subset of data points, McAfee's Discovery and Report utility captures over 50 data points. Even if the Intel Management Engine Interface (MEI) driver is not present, the McAfee utility will capture basic information including the exact OEM and model of the system.

In addition, the McAfee ePO Discovery and Report tool comes with 15 predefined queries. Adding your own queries in connection with other McAfee ePO collected data is simple.

Learn more about how to discovery and report on Intel AMT capable systems in your environment - https://community.mcafee.com/docs/DOC-3297

Combining McAfee ePO with vPro PowerShell Module

webadmin@intel.com — Wed, 01 Aug 2012 14:03:46 GMT

What if you needed to isolate a client due to a security threat event reported within McAfee ePO console?

One approach is to utilize the System Defense capabilities of the Intel vPro technology. A cmdlet within the Intel vPro PowerShell Module can enable the base System Defense filter, view the current System Defense statement, or clear all System Defense filters.

Combining that capability with an Auto Response within McAfee ePO is demonstrated and explained in more detail here - https://community.mcafee.com/docs/DOC-4063

Using Intel vPro to reset a demonstration environment

webadmin@intel.com — Mon, 23 Jul 2012 14:03:46 GMT

In preparing for some future events and training courses, a request was made to easily reset the client systems to original state.

A little bit of background - the "Reset" required each individual client's hardware to be reimaged back to original state. No virtual machines on the client (long story why this requirement... but know that each client's "start state" is unique).

I took a simple approach - reimage for the operating system partition using a locally stored image. To initiate the process, use the IDE-Redirection capability of Intel vPro Technology delivering a scripted bootable ISO image to the client.

A few additional steps were needed - ensuring a separate partition was large enough to store the "backup" image, creating the bootable ISO image, using 2-stage IDER boot to accelerate the boot\load time, and so forth.

But the result - client systems were reset in less than 10 minutes. Here's a quick screenshot of the client, running Ghost software to restore partition image stored in the second operating system partition to "reset" the first partition.

Not too bad... I'm sure there are a few great ideas out there how to further optimize this scenario. One I had - do this with an Intel SSD (I'll have to check and see just how much that helps)

Online Demonstration of McAfee ePO Deep Command

webadmin@intel.com — Thu, 28 Jun 2012 14:03:46 GMT

In October of 2011, McAfee release the ePO Deep Command module for security management beyond the operating system. Deep Command uses Intel AMT to accomplish a variety of tasks.

For a preview of how Deep Command works, see McAfee - Intel Demo A recorded demonstration showing actual usage is provided on the 2nd, 3rd, and 4th tabs.

More information on the product is available at McAfee ePO Deep Command | McAfee Products

Console and Application Interoperability with Intel AMT

webadmin@intel.com — Tue, 26 Jun 2012 20:14:26 GMT

How many consoles can talk to a system where Intel AMT has been configured? Although only one console\session can occur at a time - any number of consoles\applications can talk to Intel AMT. The trick is ensuring the Intel AMT configuration is compliant to the various console\application requirements within your environment.

There are three common steps:

Detection of Intel AMT by the console. This often includes Intel AMT version and configuration state
Configuration of the console\application with appropriate credentials and settings to communicate to Intel AMT
Configuration of Intel AMT to work with the target consoles or applictions within your environment

Some consoles, such as Microsoft SCCM or LANDesk, expect to own the configuration of Intel AMT. Other consoles, such as Altiris CMS or McAfee ePO Deep Command, may have specific Intel AMT configuration requirements yet are flexible in that an external utility (i.e. Intel SCS 8) can configure Intel AMT. Scripts and utilities such as Intel vPro PowerShell Module only require the correct credentials and certificate information are provided at the time of execution.

Last week in my lab, I did a quick test where the LANDesk console configured Intel AMT and a McAfee ePO Deep Command solution was able to use the technology. Recent customer scenarios have led to Altiris\McAfee, SCCM\Altiris, SCCM and RealVNC Viewer Plus, SCCM\Altiris\McAfee, BMC Marimba and vPro PowerShell, and so forth.

Are you interested to know more on how this is done? Write a comment below

Will Intel AMT power system in a bag?

webadmin@intel.com — Mon, 18 Jun 2012 14:07:18 GMT

While discuss the Alarm Clock feature with a customer, an interesting question was raised. "What if the system is in Sleep mode and in the user's bag? Will the Alarm Clock still work and wake the system?"

The quick answer: No - Alarm Clock will not wake the system if in Sleep mode and on battery (i.e. DC) power. The system must be on AC power (i.e. power cord attached)

The reason is provided below with brief explanation. The two windows shown were actually captured at different times.

The Alarm Clock on a few of my lab systems was set and the systems were put to Sleep
The AC power cord was detached but the network\LAN capable stayed connected.
From a remote system, I attempted to ping the target units. Systems that were in Sleep mode and on DC\battery power did not respond.
Waited until past the Alarm Clock time to confirm no response.
Reconnect the AC\Power cord to the systems.
While the systems were still asleep, I opened a WebUI session (this shows network connectivity and Intel AMT now functioning)
In the Power Policies section of the Intel AMT WebUI, the default policies is shown

Here is a brief explanation of the select power policy:

ON in S0: This means that Intel AMT is fully powered when the system is on (i.e. the S0 system power state)
ME Wake in S3, S4-5 (AC Only): This means that Intel AMT is accessible when the system is in sleep, hibernate, or off... only when AC power is applied. The ME Wake portion of the policy refers to an option of the Intel Management Engine's ability to be active yet in a lower power state as defined during the Intel AMT configuration process.

Hopefully the above explanation will answer that lingering question - "Could Intel AMT power-on my system when I'm boarding my next flight?". Nope - Intel AMT won't. But if you forget to power down your laptop before take-off, you'll simply have a little less battery power during your flight and the stewardess might be upset before you reach 10,000 feet

Remotely unlock McAfee encrypted drives using Intel AMT

webadmin@intel.com — Fri, 15 Jun 2012 15:00:44 GMT

Are you using McAfee Endpoint Encryption for PC (EEPC) today?

Then you are very familiar with the following screen (For those who are not - this is the default McAfee EEPC preboot authentication screen that occurs at system start-up before the host operating system loads)

Later this year, McAfee EEPC v7 will be released. In connection with McAfee ePO Deep Command and Intel AMT, you will have the ability of remote unlock, reset passwords, and set location based unlock policies.

To put that in context - you can power\patch systems with a real-time secure unlock of the pre-boot environment without using the EEPC bypass feature of old. (For those who are wondering - the bypass feature refers to a policy\setting that MUST be applied when the system is on\operational and policies synchronized. What if the system is already off and you need to perform a power\patch immediately? This is where the remote unlock feature is very much needed... and will soon be available )

If you are not already familiar with McAfee ePO Deep Command, please see http://www.mcafee.com/deepcommand. This product includes a gateway\proxy service to connect to Intel AMT over the internet. Overlay the upcoming McAfee EEPC v7 and yes - you also will have the ability to unlock or password reset encrypted drives both inside and outside your enterprise )

Like to see and read more? Check out https://community.mcafee.com/docs/DOC-3921. Be sure to view the two demonstration videos at that link.

One last item - what if you are using a different Intel AMT capable solution for daily Life-Cycle Management of the systems? If the Intel AMT configuration is compatible with McAfee ePO Deep Command, you have the ability to power-on via that non-McAfee solution and still have the secure remote unlock capabilities of McAfee.

Using Intel vPro and upgrading from Intel SCS 7.1 to 8?

webadmin@intel.com — Fri, 27 Apr 2012 23:53:22 GMT

If you have been using Intel SCS 7.1, the upgrade path to version 8 in non-database mode is really simple.

Shown below is an Intel SCS 7.1 instance with 2 profiles present.

After downloading Intel SCS 8 (http://www.intel.com/go/scs), extract the files and find the RCS directory.

Start the IntelSCSInstaller.exe shown in the screenshot below.

The installer will recognize the existing Intel SCS 7.1 instance and prompt for upgrade to version 8

Click Next and complete the installation process. You will be prompted for the service logon account password.

At the completion of the upgrade, the new version of Intel RCS (RCSserver) and console have been installed. Shown below - the same two profile are still available.

Two final items to complete. The Configuration directory provided in the download has a newer instance of ACUconfig.exe. This should be used on the end points that will be configuring Intel AMT and talking to the Intel RCS version 8 instance. In addition, if you exported configuration profiles to run the Intel AMT configuration event locally on the client, re-export the profiles. This will update a few items in the profile.xml.

Shown below is the ACUconfig v8 (top) and v7 (bottom). The ACU.dll and ACUconfig.exe have been updated.

If you used the ACUconfig SystemDiscovery feature with ACUconfig.exe version 7, the version 8 output will include a new format and more details. See the Intel SCS 8 user guide.

Additional information on suggested commands and approach to Intel SCS 8 Deployment are available via the Deployment Guide at http://www.intel.com/go/scs

Webinar Feb 16: Security Management Beyond the Operating System

webadmin@intel.com — Mon, 06 Feb 2012 17:36:47 GMT

Learn more about McAfee ePO Deep Command and Intel AMT at the next Intel® IT Center Talk to an Expert webinar series

The webinar will occur February 16th at 9am Pacific Standard Time.

Click Here to Register

IT threats are more advanced. Users are more advanced. Relying on old methods of IT security isn't going to stand up to these new levels of complexity. You need to fortify your software-based security with hardware-based solutions.

Two experts on the cutting edge of security will highlight the latest ways to use remote security management to take infrastructure and data protection beyond the operating system.

Ed Metcalf, director of Product Marketing at McAfee, and Intel Enterprise Solution Architect Terry Cutler will show you how the latest software works with innovations in hardware-based security to help you:

Get automatic "blanket" protection that shields against escalation-of-privilege attacks.
Enjoy stronger authentication and validation that's simple for users.
Enable the highest levels of encryption without sacrificing performance.
Empower your IT staff to remotely diagnose, isolate, and repair infected clients—regardless of their operational state.

Join us for the discussion and add your voice to the conversation during our Q&A session.

Click Here to Register

Managing Encrypted Drives Out-of-Band with McAfee

webadmin@intel.com — Tue, 03 Jan 2012 15:06:32 GMT

An early Christmas present arrived yesterday - the release of McAfee EndPoint Encryption for PCs version 7 (EEPC7)!

Why am I so excited about it? Customers that need a true power\patch with full disk encryption, easy encryption password reset, or remotely remediate common issues can now do so with the integration of McAfee ePO Deep Command and EEPC7. Plus - all of the functions can be enabled for Internet-based clients using connectivity via the McAfee ePO Deep Command Gateway Services.

Four articles with additional details and video demonstrations are shown below. Contact your McAfee or Intel representative for more information and request an onsite demonstration

Securely Unlock the Pre-boot Authentication environment - Enables unattended power\patching. The schedule and policy can be changed even when the client is already powered off. More information at https://community.mcafee.com/community/business/data/epoenc/blog/2012/12/19/how-to-use-out-of-band-unlock-pba
Reset a User's Encryption Password - Instead of using challenge code sequences and belabored processes, enable your helpdesk to set a session specific password reset that is simple to communicate and will help expedite the resolution. More information at https://community.mcafee.com/community/business/data/epoenc/blog/2012/12/19/how-to-use-eepc-out-of-band-user-management
Remote Remediation of Common Full Disk Encryption Errors - If the master boot record (MBR) gets corrupted, you experience 92h error, or similar - this can now be resolved remotely without requiring a technician to physically touch the system. For more information see https://community.mcafee.com/community/business/data/epoenc/blog/2012/12/19/how-to-use-eepc-remote-remediation
Deliver the McAfee Recovery Tool (EE Tech) Remotely - Additional remote recovery options available via the traditional McAfee EE Tech utility. Using ePO Deep Command including the McAfee KVM Viewer, you can now deliver this utility and have interactive remote remediation sessions. For more information see https://community.mcafee.com/community/business/data/epoenc/blog/2012/12/19/how-to-use-ee-tech-remotely

The above capabilities will work on clients across multiple versions of Microsoft Windows operating system. In addition, McAfee ePO Deep Command works with Intel AMT configured clients over 802.11 wireless.

For an index of resources on McAfee ePO Deep Command, see https://community.mcafee.com/docs/DOC-4157

But wait - there's more!

Starting with version 6, McAfee EEPC is optimized for Intel AESNI for improved encryption performance
Starting with version 7 and in connection with 3rd Generation Intel® Core™ vPro™ processors, McAfee EEPC is optimized with Intel Secure Key. Instead of a software generated encryption key, a higher entropy hardware generated key is used.
EEPC7 combined with an Intel SSD - fantastic response times when using full disk encryption. (Coming soon - OPAL with Intel SSD drives... even better performance)

Give it a try!