Activation Blog

vPro Insights on using Altiris 7 OOB Site Service

terry.c.cutler@intel.com — Tue, 17 Nov 2009 18:11:21 GMT

If you are moving to an Altiris 7 environment (Symantec Management Platform or Dell Client Management platform), and already have familiarity in working with vPro in an Altiris 6 environment - take a look at this article on Symantec Connect

The article provides 4 quick insights:

Pre-defined TaskServer jobs for configuring and maintaining
Checking and fixing the OOB Site Service installation
Once OOB Discovery is enabled, using Filters to determine what systems have Intel AMT
Placement of the remote configuration certificate (different than Altiris 6 environments)

Dell CFI process generate CSV not BIN file

terry.c.cutler@intel.com — Tue, 28 Jul 2009 22:04:11 GMT

How Do I Use the CSV File Generated by Dell CFI Process?

If you've utilized the Dell CFI process for vPro configuration\provisioning, you've likely received a CSV file with a list of preshared keys and password. The normal process of importing the security keys to the Intel SCS database will not work since the import process is prompting for a .BIN file.

One workaround is to directly import the CSV data into the target database - IntelAMT.

Making a direct database modification has inherit risks - thus you may want to test this on a separate system if unsure. The good news - if you test on a separate non-production system, you can then follow the correct key export procedure which will generate a valid setup.bin file. The valid setup.bin file can then be imported to your production server.

For those that want to go directly to database insert - here's what you do:

Check the last index number of IntelAMT database table csti_pid_map.
Modify the CSV file to align to the target database table format (id, pid, pps, current_password, admin_password, used)
For the "used" field, value of zero '0' is unused and will show the values in the console once imported. A value of '1' is used and will hide from console view
Use a bulk SQL import to insert the modified CSV file directly into the database

Explanation of Attached Sample File

In the attached file (convertCSV2BIN.zip) are three sample files for your reference:

samplesetup.csv - Modified CSV file to match the database table structure. Notice that the index starts at 108 - this is because my test system already had generated 107 keys before stepping through this exercise
importcsvPID.sql - Sample SQL script for bulk import of samplesetup.csv to the IntelAMT database table csti_pid_map
samplesetup.bin - Correctly formatted .BIN file for preferred method of import (this is unnecessary if you've decided to directly import)

Concluding Thoughts

My intent in sharing this is to provide a simple workaround method to frustrating situation. Conversations with Dell associates have occurred, yet corrections to the CFI process for vPro provisioning have not yet occurred. Thus in the meantime - if you receive a CSV file - use the workaround.

How does the VeriSign Root Certificate Change Affect Intel vPro

terry.c.cutler@intel.com — Fri, 22 May 2009 22:12:00 GMT

This blog entry is primarily for those who are looking to acquiring a VeriSign certificate for vPro remote configuration. If you've already acquired and are using the certificate, VeriSign will likely be calling you with an update.

On May 17th, VeriSign transitioned to a new root certificate for G1 standard certificates - click here to read statement from VeriSign's website

Without going into great detail - how does this affect vPro remote configuration with a VeriSign certificate?

The good news is that VeriSign certificates are available for vPro remote configuration. Take a look at the landing page - http://www.verisign.com/ssl/intel-vpro-technology/index.html

A few items to note about the May 17th event:

The VeriSign G1 standard certificate has transitioned to their G2 certificate. The G2 root certificate hash is not currently inside the vPro\AMT platform.
The VeriSign certificate available for purchase at the landing site are Secure Site Pro certificates... also referred to as G1 Premium. You will notice a price increase. The G1 Premium certificate root hash is the same as the former G1 standard. The difference is the signing\coding required for Premium level.
If you purchased and are using a VeriSign G1 standard certificate for remote configuration prior to May 17, 2009 - VeriSign will be contacting you before the renewal timeframe (i.e. 1, 2, or 3 years based on what you originally purchased) to discuss options. PLEASE NOTE: The G1 standard certificate is still valid and will work until issued expiration. You simply cannot renew to the same G1 standard certificate... since it's no longer being issued.

If you have questions - please blog back.

Introducing the Intel vPro Technology Reference Guide

michele.gartner@intel.com — Thu, 12 Mar 2009 18:07:09 GMT

We've added a new type of user guide to our documentation roadmap - the Technology Reference Guide. The purpose of this guide is to provide overviews of vPro technologies as they are rolled out. This version of the guide includes information on Intel Anti-Theft Technology (AT-p), Fast Call for Help (also known as CIRA), tools such as Audit Log and IMSS, Intel TPM, and others.

Intel(R) vPro Technology Reference Guide

I'd really like to hear what you think about this guide - if you have feedback, please let me know!

Thanks,

Michele

Upgrading Intel® AMT SCS from version 3.3 to version 5.x?

liesa.harkness@hp.com — Wed, 04 Mar 2009 18:47:26 GMT

If you are gettng ready to upgrade your Intel® Active Management Technology (Intel® AMT) Setup and Configuration Service (Intel SCS or SCS) from version 3.x to 5.x. check out my Intel® AMT SCS V3.3 TO 5.X Upgrade Overview

It covers a couple of items that differ between the versions, especially around locations of your Remote Configuration provisioning certificate.

Transition from ASF to AMT

terry.c.cutler@intel.com — Fri, 23 Jan 2009 22:15:05 GMT

Do you have a bunch of systems that are Intel AMT capable, yet currently set to ASF Manageability mode? If you're looking for a way to remotely switch these over - take a look at the updated Intel vPro Activator Utility in the Intel SCS v6 preview - http://software.intel.com/en-us/articles/download-the-intel-AMT-SCS-technology-preview/

If you extract out the Activator directory - the exe and dll files are what you want. Test it out on a system. The command is as follows:

activator /transition

You will notice the system's network connection disconnect\reconnect during the transition. Once complete - you're system is not set to AMT manageability mode. If the system supports remote configuration (Intel AMT 2.2, 2.6, 3.x or higher), and your infrasrtucture is ready to support remote configuration, then you can immediate start the provisioning event.

A great new addition to the toolset!

Customer Preparation Checklist for Pro Activation with SCCM

gnszolnx@msn.com — Wed, 19 Nov 2008 21:26:50 GMT

Do you need guidance for infrastructure preparation for Pro platforms?

The following checklist is for customer infrastructure preparation to ensure you can implement Pro platforms within the customer's corporate production environment.

Infrastructure Prep Checklist for Microsoft SCCM

White Papers

gnszolnx@msn.com — Fri, 14 Nov 2008 22:46:05 GMT

Check out these How To White Papers

As you determine how you are going to deploy vPro, why not learn from others who have been in similar circumstances. Browse through the many white papers on a variety of certificate, configuration, wireless, and repair topics.

You can access all of them at White papers.

Case Studies

gnszolnx@msn.com — Tue, 11 Nov 2008 21:28:06 GMT

Learn how Intel has helped top companies, universities, and hospitals shorten the time it takes to do IT, including the following:

Complete an Asset Inventory
Solve Hardware Problems
Solve Software Problems
Protect all PC's by detecting antivirus agents

In many cases Intel has shortened the time it takes to complete these tasks by 25 to 50 percent, saving money, while also developing a more efficient workflow.

Enterprise Client/Mobility Success Stories

Looking for all you need to know about certifications? Checkout everything related to vPro and certifications.

gnszolnx@msn.com — Wed, 29 Oct 2008 17:41:20 GMT

Need information on vPro and certificates? Check out this new wiki.

Go to http://communities.intel.com/docs/DOC-2225.

Implementing network filtering with Symantec Altiris

michele.gartner@intel.com — Fri, 05 Sep 2008 20:16:05 GMT

If you are using Altiris as your management console, then check out this new use case document for implementing network filters!

Altiris Use Case: Network Filtering and System Defense

ROI Analysis - Check out Cleveland Clinic's savings - $442k just in power savings!

michele.gartner@intel.com — Wed, 03 Sep 2008 17:37:30 GMT

Take a look at this ROI Analysis document. It shows that Cleveland Clinic will save $442k in net power savings over 4 years. In addition, they will save 29,000 IT support man-hours by year 4 through improved asset management and reduced deskside visits, remote patch management and reimaging and repair.

ROI Analysis: Improving Productivity and Reducing Energy Costs and Consumption with Intel® vPro™ Technology

Time to get activating - but wait.. is it Secure?

josh.hilliker@intel.com — Sat, 30 Aug 2008 00:46:54 GMT

I was recently asked about the security of vPro and Intel Active Management Technology, therefore I started to pull together all the resources I leverage when discussing this topic and help to alleviate concerns of the Information Security folks in the IT shops. here are those links and if you find additional ones that help please add on to the blog.

Hardening Measures Built into Intel® Active Management Technology

http://softwarecommunity.intel.com/articles/eng/3703.htm

AMT System Defense Usecases

http://communities.intel.com/docs/DOC-1278

Intel® Active Management Technology Protect Use Cases

http://softwarecommunity.intel.com/articles/eng/1031.htm

Intel® Active Management Technology Use Case #7: Hardware-Based Isolation and Recovery (Protect)

http://softwarecommunity.intel.com/articles/eng/1179.htm

If any questions on security of vPro please let me know.

Activating an HP 6910p in Basic mode - and using the Intel System Defense Utility to remotely manage it!

michele.gartner@intel.com — Tue, 26 Aug 2008 23:10:01 GMT

Hi everyone -

Here's new guide that we just finished. Let me know what you think of this new format - we're trying to increase the usability of our documentation - let me know if we're on track!

This guide steps through Basic Mode Activation (formerly known as SMB Mode) of a Hewlett-Packard* 6910p. Once activated, follow the instructions to install the Intel(R) System Defense Utility and start exploring the supported use cases.

Basic (SMB) Mode Activation for the HP 6910p

Underscore is not supported in Intel AMT Hostnames

josh.hilliker@intel.com — Sat, 16 Aug 2008 02:45:26 GMT

If you are seeing any failures in your log around setting the hostname during a Remote configuration it could be due to a underscore in the host name. Check out Terry Cutlers post on altiris juice @ http://juice.altiris.com/tech-tip/1622/underscore-not-supported-in-intel-amt-hostnames . Terry references the RFC952 - DoD Internet host table specification @ http://www.faqs.org/rfcs/rfc952.html. Here are the assumptions from that specification.

ASSUMPTIONS

1. A "name" (Net, Host, Gateway, or Domain name) is a text string up

to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus

sign , and period (.). Note that periods are only allowed when

they serve to delimit components of "domain style names". (See

RFC-921, "Domain Name System Implementation Schedule", for

background). No blank or space characters are permitted as part of a

name. No distinction is made between upper and lower case. The first

character must be an alpha character. The last character must not be

a minus sign or period. A host which serves as a GATEWAY should have

"-GATEWAY" or "-GW" as part of its name. Hosts which do not serve as

Internet gateways should not use "-GATEWAY" and "-GW" as part of

their names. A host which is a TAC should have "-TAC" as the last

part of its host name, if it is a DoD host. Single character names

or nicknames are not allowed.