Intel Communities : All Content - Microsoft Manageability

Microsoft SCCM SP1 & vPro - Native Support

webadmin@intel.com — Thu, 21 May 2009 00:14:37 GMT

This paper provides IT managers with a high-level overview of the technical benefits of native support

for Intel vPro technology in System Center Configuration Manager 2007 SP1, and includes illustrative

examples of how the integrated solution can be leveraged by IT staff to reduce

management overhead and increase productivity.

Remote Configuration Certificate getting ready to Expire on my SCCM SP2 Site server

william.york@intel.com — Mon, 23 Nov 2009 15:42:14 GMT

On mmy SCCM Site server, I was looking througurah my AMTOPMGR.log and I noticed the following entry:

Error: The provisioning certificate with the thumbprint 55B7AF313A725CA10BB47A382494A3BD2927D1FB will expire in 1 day(s). Please ensure that this certificate is renewed. (CertID = 1)

In looking at my Provisioning Certificate loaded on my SCCM SP2 site server, I did find out the expiration date was about to hit.

So I will let this cert expire so I can report out what happens to an environment that has their provisioning certificate expire. I will add more of these learnings after this expiration date hits. More to come....and then type for me to re-purchase this cert so my lab continues to provision.

Microsoft System Center Configuration Manager SP2 Wireless Support Overview

webadmin@intel.com — Tue, 17 Nov 2009 17:30:23 GMT

One of the new additions to Config Manager SP2 is native support of wireless access for managing clients with AMT. Microsoft has built in support for configuring enterprise level wireless profiles such as WPA2-Enterprise. These are wireless profiles that support RADIUS authentication using an authentication server to decide whether or not a given client is allowed to access the network. Config Manager SP2 does not support wireless profiles that use pre-shared keys (PSK). If you use security standards like WPA2-PSK/WPA2-Personal in your environment you will need to use the scripting framework tool to generate a script that can configure this option outside of Config Manager.

Mohan Veeramachaneni has put together several guides that explain how to configure the back-end RADIUS authentication components and access point configuration.

Cisco ACS

Configure Cisco ACS Server for Navigating Secure Networks with AMT/vPro

Microsoft NPS

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 1

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 2

Microsoft IAS

Step-by-step Guide for Navigating Secure Networks (802.1x) with Intel® AMT™ using Microsoft® SCCM SP1 & Microsoft® Radius (IAS)

Matt Royer has a blog entry that covers wireless profile management in Config Manager SP2. The process he outlines is still the same in the release version of SP2.

http://communities.intel.com/community/openportit/vproexpert/microsoft-vpro/blog/2009/06/05/a-closer-look-at-sccm-sp2-beta-oob-wireless-management-wireless-profile-management

Key things to remember about wireless management with Config Manager

Config Manager will not update a wireless profile that is currently in use.
Config Manager now uses DNS entries to resolve client names. You may run into a case where a client has switched between a wired or wireless connection and AMT is temporarily inaccessible due to delays in DNS update propagation. DNS caching on your Config Manager server can also cause this to occur. You can try running the “ipconfig /flushdns” command from a command prompt to clear the local DNS cache on your Config Manager server.
Launching a Serial-over-LAN session over a wireless connection while the client’s OS is using that same connection will cause the wireless network to be cut off to the OS.

Getting Started with SCCM Advertisements

webadmin@intel.com — Fri, 28 Aug 2009 20:15:53 GMT

Wireless Power-on & Patch using Windows XP Clients over Secure Networks

webadmin@intel.com — Wed, 30 Sep 2009 20:56:51 GMT

A Known Method for managing wireless patch deployment for XP clients using SCCM Console

Applies to SCCM SP1 & SP2

Also applies to open networks without 802.1x

When AMT wakes up a windows XP client using out of band wireless connection SCCM will launch and run the Advertisement as the local system account. However, in order for a successful launch of the Advertisement the client needs to maintain the wireless connection at the OS level prior to any user logging in. With an XP supplicant there is no way to maintain the wireless connection without having a user logging in

The solution lies in setting up an administrator profile that will allow machine authentication prior to any user logging in enabling advertisements to run successfully.

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 2

webadmin@intel.com — Thu, 05 Nov 2009 21:38:43 GMT

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 1

webadmin@intel.com — Thu, 05 Nov 2009 21:31:54 GMT

Issue with AMT provisioning with internal (subordinate) ca

webadmin@intel.com — Tue, 03 Nov 2009 13:50:32 GMT

yes, it is possible and I have done that. You need to install the subCA. I had my CA on the domain controller and my subCA on the SCCM SP1 server and the corresponding templates created with site server full control permission. in hte OOB management component you need to point to the CA for the web server template. I have not done issuing internal provision certificate from SubCA but I would think that also should work.

AMT OU in AD is empty

webadmin@intel.com — Mon, 02 Nov 2009 15:42:02 GMT

Hello tlchan,

thanks for the support. We have tried and this, but that wasn't helpfull. In the meantime we have opened a ticket in MS, as this issue is MS related in our opinion and here what they said:

=============================================================================================

“We do not support disjoint namespaces with AMT and ConfigMgr SP1. Those types of scenarios were not tested and as we’ve now discovered, may have problems associated as well. At this time there is no support for this configuration with ConfigMgr SP2 either. However we will investigate what it would take to offer that support and make a determination at a later date”

“The answer to this problem would be to allow your clients to register in the correct DNS namespace that matches up to your AD LDAP path specified.”

=============================================================================================

So currently there is no workaround for this problem with disjoint namespaces.

Thank you to all for your cooperation.

With best regard,

Kin

Configure WS-MAN Translator to Use Runtime Account for Kerberos Delegation

webadmin@intel.com — Thu, 29 Oct 2009 00:47:54 GMT

Slide 3

•
WS-MAN Translator is needed on Configuration Manager to manage AMT systems below FW 3.2.1.

•Translator is needed for PID/PSK support.

•Translator is installed using a simple MSI program.

•Once installed Translator should be configured.

•Configuration Manager OOB component should be configured to use Translator as well.

•
Translator is supported in two modes during run time.

–SCCM site server can be trusted for Kerberos delegation for Translator.

–An independent account can be used for Kerberos delegation instead of site server.

This document gives an overview of installation and configuration of WS-MAN Translator using an independent run time account for Kerberos delegation.