Intel Communities : Blog List - Intel® vPro™ Expert Center

Do it yourself - Power on, patch, and go back to sleep with 4, free .exes

jacob.gauthier@intel.com — Tue, 24 Nov 2009 19:42:30 GMT

Having worked with Intel Active Management Technology and Intel vPro Technology since version 1.0, it seems to me that there are a whole host of possibilities for those who are do-it-yourself-ers. One is the ability to programmatically wake a system, remotely trigger a process such as a software patch, and then put the system back to sleep. As it turns out, this is not so hard, even for me who has a limited scripting (read batch file) capability. The video chronicles the results of my effort.

Disclaimer: this is not meant as a how-to or best method. Rather, it is an exploration of what’s possible, meant to educate and stimulate conversation. With that out of the way, let’s get to the fun stuff.

To accomplish this goal I knew I'd need some help via command line tools. I did an Internet search and found these 4 freely downloadable tools that made it all possible. They are;

Remote Control Util - to determine the current power state and turn the system on.

PsService - to start a process remotely

PsShutdown - to put the system back to sleep

sleep.exe - so the batch file can sleep while an event takes place.

The setup is simple; 2 systems. One is the console that executes the batch file and these commands. The other is my vPro system. I setup and configured my it using this Use Case Reference design (another of my batch file creations). That is to say, there's no TLS and I'm using only the admin account. I then ran the batch file on the console system which triggered the whole process. The process is as follows:

1. Remote control util gets vPro's original power state via AMT (on, sleep, hibernate, or off)

2. Remote control util power's on vPro via AMT

3. Remote control util get's vPro's new power state to verify it has turned on

4. ping vpro and check the TTL. Once it changes to <=128 the OS has booted. For more info

5. PsService starts a process on vPro. I used notepad but it could be anything, including triggering a download and run of software patch

6. PsService exits when the process finishes

7. PsShutdown gracefully places vPro back to it's original sleep state

8. Remote control util get's vPro's new power state to verify it has returned to it's original power state

Couple of notes.

· I set an auto login on my vPro so I could see the process. However, PsService will work without a user being logged in. Also, it can run processes in the back ground so an end user would not be able to interact.

· I used Notepad as my remote process since it made it easy to see success. However, any process can be started. In fact, PsService supports downloading the executable to run. As such, it may be possible to download and then run a patch or batch file as part of this whole process

· I used a single vPro system. But, with a simple loop the same core batch file could trigger this action on many vPro systems.

Hope you found this post enjoyable and thought provoking. If you have your own do-it-yourself vPro ideas, or want to recreate this one, please share. And, hey, who says batch files are dead?

PC Refresh Cycles and Windows 7 … what’s the financial connection?

webadmin@intel.com — Tue, 24 Nov 2009 04:29:06 GMT

It’s understandable that in today’s economy that you might consider pushing out your PC refresh cycle to save cash today. This is an area of cost cutting that many companies consider so you’re not alone. But if you have considered, or are considering, pushing out your PC refresh cycle, have you factored in all of the costs that impact that decision? These costs include the unexpected costs of supporting older machines once the warranty has expired, higher energy costs compared to new machines, and more. The total cost of ownership starts to increase out in time and will eventually reach a point where it makes more sense to replace your PCs versus continuing to maintain them. But how do you know what the optimal replacement time is? And is delaying your refresh really the best financial decision?

There are strong financial reasons to refresh PCs now and, with the Windows 7 operating system, there are even stronger reasons to do so with PCs powered by Intel® Core™ 2 processors with vPro™ technology. Join me for a webcast on Tuesday, December 1^st, where I’ll walk through our analysis on the PC refresh cycle and the framework we use, discuss the true cost of older PCs and how to assess your own PC refresh cycle, and share our experience with Windows 7 as part of the Technical Adopter Program (TAP). I’ll also be joined by Amy Stephan from Microsoft who will provide more insight into why it makes sense to refresh now and why Windows* 7 and New PCs with Intel® vPro™ Technology are better together.

GoDaddy vPro Landing Site

william.york@intel.com — Sun, 22 Nov 2009 12:47:41 GMT

I've been asking GoDaddy for over a year to provide a specific Intel vPro site to help customers buy Remote Configuration Certificates. Glad to see someone was able to get them to add a link on thier site. http://help.godaddy.com/article/5260

TechEd Europe 2009 - Win7

webadmin@intel.com — Fri, 20 Nov 2009 17:21:16 GMT

At TechEd Europe 2009, Microsoft's Keith Mayer outlines how manageability can be achieved with Windows 7, Windows Server 2008 R2 and Intel's Westmere-EP.

vPro: Windows 7 Migration with SCCM SP2

florence.lo@intel.com — Fri, 20 Nov 2009 01:04:00 GMT

Take a look at the posted document for step by step instructions on Windows 7 Migration with SCCM SP2. This document includes how to create an image using SCCM, Installing drivers, Installing Applications, Creating Hardlinks with the User State Migration Tool, and Renaming and Joining the domain. This document allows IT technicians to create an Win 7 image, deploy it to their environment using collections, and upgrade their existing Windows XP clients to Windows 7 clients without having to remove the data and put the data back. Included in this guide is some tips and hints on getting the image deployment to work for your company.

http://communities.intel.com/docs/DOC-4079

Newsletter Published: Radmin, Webinars, Intel AT, and real world examples

webadmin@intel.com — Fri, 20 Nov 2009 00:53:47 GMT

This issue of the newsletter has some good content about using Intel vPro Technology. A new use case reference design was published recently; this one has to do with using Radmin to perform basic Intel AMT functions on a managed client. (What's a use case reference design? Read my blog: New stuff in the community: Use Case Reference Designs) You'll also find links to a white paper about Failsafe and Intel Anti-Theft Technology, a registration link for a Windows 7 webinar that's coming up, and some real-world stories about companies that have implemented Intel vPro technology in their environments.

Read the newsletter or subscribe to receive it in your inbox automatically. This newsletter goes out every two weeks.

Enjoy!

Follow-up post on CIRA - we have Lift-Off...

tal.elgar@intel.com — Thu, 19 Nov 2009 16:47:34 GMT

If you're reading this blog posting, hopefully you've read my blog post on CIRA last week -

http://communities.intel.com/community/openportit/vproexpert/blog/2009/11/10/cira-and-fast-call-for-help--what-is-it-where-can-i-find-it

Firstly, I wanted to share with you that over the past week we have actually worked through an entire end to end setup with a real-world customer (i.e. not just inside Intel labs) and now we have CIRA and AMT functionality over CIRA working successfully!

If you're wondering which of the management consoles and MPS/vPro Gateways were used - it was LANDesk 8.8 SP3 in this case (remember that LANDesk bundle their own MPS/vPro Gateway offering). If you're looking to get this to work in your environment (CIRA with LANDesk specifically) please do get in touch and I can share some specific current LANDesk pointers with you (that are not mentioned in this blog posting).

Some of the things we came across last week which are good pointers to pay attention to:

There are 4 ports that get configured with the MPS which are fully configurable (i.e. they are not restricted to being a specific port number) - however, you cannot re-use the same port number, you need to have 4 distinct port numbers (sounds trivial, but it happens).
You can use port 16993 as one of the port numbers, even though that is the port that is used for https connections in AMT (there is no conflict)
In the httpd.conf file - instead of havinga deny all and allow specific IP addresses, you might want to change to allow all
CIRA relies on the DHCP option 15 that is allocated where the vPro client is to be different than what it was pre-configured with - that is how the system knows it is outside the corporate environment. If DHCP option 15 happens to be blank where your vPro clients connect from - that is good enough. Blank is considered different and CIRA works fine.
Currently, you should install the LANDesk agent after provisioning is completed
Check through selecting the 'vPro Status' operation on a provisioned vPro client to ensure all the LANDesk NED settings have been deposited properly on the vPro client prior to taking it out of the corporate environment.

Btw, the CIRA connection is established through a user click at the OS-level using the IMSS utility.

So the bottom line is we now have close to 100 systems that are confirmed to be have full AMT functionality working over a CIRA connection in a real live environment - it works! (

The 2nd part of the blog can be considered a more 'advanced topic' and is devoted to what happens if your management console of choice doesn't currently support CIRA...

One Management Console for example that is currently not supporting CIRA is Microsoft SCCM (even with SP2).

The options as I see them, are:

Contact your software vendor and ask them whether they support Intel - Intel works with multiple software vendors on incorporating support for various Intel vPro features (CIRA amongst others) - they can hear it from us, but it is much better if they hear it from you.
Your software vendor might have plans to introduce support for CIRA, however it is further down the line - so it is just a question of time.
Try and engineer something yourself to have CIRA work in the environment you have setup

At least for testing your environment for what CIRA would look like, you could leverage the WebUI tool. You would need to have an MPS installed and configured first of all. Thereafter, all that you need to do is configure the proxy settings in the web-browser you are using to the IP address/FQDN of where you have your MPS installed and also enter the default http proxy port of 8080 - that will be sufficient for getting your WebUI to work over a CIRA connection.

If you use Microsoft Internet Explorer you are limited only to the http proxy portion which will allow several of the AMT operations to work over a CIRA connection, but not SOL/IDER for example.

If you are using Mozilla Fire Fox for example, you can configure a SOCKS proxy as well, which can handle routing SOL/IDER traffic as well.

If we take the example of Microsoft SCCM, what you can do is to use the scripting framework that has been used successfully for something like: providing out of band 802.1x in Microsoft SCCM SP1 (it is natively supported now in SP2) - http://communities.intel.com/message/10877

You can configure the correct settings for the vPro client to be able to contact the MPS Proxy Server and establish a CIRA connection between the MPS Server and the vPro client, however you will still need your management console to integrate and be aware of this CIRA connection to be able to do something useful.

What you could do at this point is to configure a 'transparent proxy' - what that would typically entail is to configure the MPS IP address/FQDN as a proxy routing that will be inserted in the headers of packets that go through the router to which the Server that is hosting the management software. You can use something like Cisco WCCP (Web Cache Control Protocol) to set this up. At this point, Microsoft SCCM will not be aware that the packets it is sending are actually being re-routed through the MPS to the vPro clients (which is aware of the remote vPro client) and that is why this is called a transparent proxy.

A caveat/disclaimer I would add though is that albeit technically feasible you would need to put together the full working solution yourselves and support it yourselves.

Miss the Win7 and Intel vPro technical webinar? Recording now available.

webadmin@intel.com — Wed, 18 Nov 2009 22:00:55 GMT

Webinar Recording

If you missed the live event, you can now watch the recording! You can also download the webinar.

Webinar Slides

Want to download the deck? It's attached to this blog post (scroll to the bottom).

Managing Help Desk permissions in vPro with Microsoft Configuration Manager

jacob.gauthier@intel.com — Wed, 18 Nov 2009 17:53:42 GMT

vPro provides many helpful tools for Help Desk support personnel such as the ability to reboot a vPro system to a CD-Rom image. Of course to use it, they must have permissions to access the firmware remotely. Check out this use case reference design: http://communities.intel.com/docs/DOC-4404. It provides a framework to use an Active Directory group to grant and revoke these firmware permissions on all vPro systems through out an environment. For non-SCCM users, this concept may be used with many other software packages such as SCS. Also included in the appendix is a method to reconfigure vPro systems without a full unprovision. Enjoy!

The Intel Manageability Channel: All Manageability, All the Time!

webadmin@intel.com — Tue, 17 Nov 2009 22:51:19 GMT

Have you visited the Intel Software Network Manageability Community lately? There have been some recent changes that I’ll speak to in a few minutes. But if you have never been to the community I ask that you check us out. Our community is comprised of software developers and our site serves as an engineering resource for Intel® Active Management Technology (AMT) and Intel® vPro™ Processor Technology, whether you are just learning about the technology (Start Here Guide) or an experienced user (Architecture Guide: Intel® Active Management Technology, Intel® Active Management Technology Use Cases ). At our community site you can download our latest product offerings including the Remote Encryption Management SDK.

Recent Community Changes include:

New Community Manager (that would be me) who wants to provide what you need for successful work. I always welcome feedback!
Some look and feel changes including a kind of Start Here place to help you quickly find what you are looking for as soon as you arrive.
New article links such as that for WS-Man.
Community Member at Large (outside Intel) designation – we’ve chosen one and we’ll be sharing his contributions shortly. This program indicates our strong desire for community participation.

Our forums are excellent places for Q&A and we’ve got engineers available to answer your question. Manageability Community Blogs are a great opportunity for members, inside and outside Intel, to share expertise and to initiate and contribute to lively discussions on issues that are currently being experienced in our world. (Here is a great sample that features info on soon-to-be available technology: Intel KVM: This is your SOL on Steroids.) It is also the perfect place to demonstrate leadership and develop professionally.

Please come to visit us and see what we can do for you! Bring your ideas, suggestions, questions and opinions to our party!

Sincerely.

Kathy Farrel

Manageability Community Manager
Intel® Software Network
kathy.a.farrel@intel.com
My ISN Blog
Office - 415.895.1226
Cell - 505.400.2548