1 year anniversary - YES!

I wanted to start this blog by saying what an interesting, fun, and action packed year it's been for the vPro Expert Center. we had a vision about 1 1/2 years ago to create a community where we could bring all parties together to talk about vPro and really make a difference in the activation and integration of this technology into the IT environment. I know that to be 1 years old in a community is just a small milestone, however for me it has been a blast to connect with a # of folks from the community both in the forums, onsite and at events where we can talk face to face. As I reflect back on the year, here are the top 5 and bottom 5 of what the community did that I think made a difference. (I could have made this the top 50).

TOP 5

• Have seen some of the best bloggers join us online for dialogue (BIG Thank You)

• Had great participation across the board - HW(OEM), SW(ISV), YOU, Intel, etc..

• Started a Radio show on blogtalkradio - check it out (even on itunes)

• Started a few sub zones that are really helping - microsoft, activation, and our latest SMB Talk.

• Partnered with Myitforum.com and started using resources/wiki's for key events (Manage fusion, Microsoft mgmt summit)

Bottom 5

• We published over a dozen tools and then didn't call them free tools and then we pulled one down that folks really cared about (yes it's almost fixed for those that know what I am referring to)

• Implemented an ask the experts section, however we used as a single thread and now it's hard to find past solutions/fixes - (yes this is being fixed)

• Tried to do an online TV show (good luck finding that legacy show anywhere)

• We started a contest and made it to hard to participate - (we took the feedback and will try something soon that is easier to participate)

• We haven't created a points system yet to showcase who's really answering all the questions and if the answers are good one's. (reputation system or something of that nature).

What does this all mean, we still have more work to do to make this community better. I'm committed to making this an awesome community, focused on you and how to make your life easier with vPro. Keep coming back and spreading the word to friends.

I also want to recognize the great community for giving me input on how to make this better over the year and I want to hear more over the next year on what we can do to make this a better community, increased functionality, richer video, tools, etc. If you have input on what you would like to see, what we can improve, what we should stop doing, etc.. please drop me a line by either blogging me back here, or just send me an email - josh@intel.com.

Or if you have product input that is always welcome, for example, on features we should have in the ME (manageability engine) or Software to leverage our silicon.

So.. what's next? I can tell you that I have been planning, thinking, waiting for September 22nd for the last 2 month's, I can't say much, but I can say you will want to be on the vPro Expert Center that day and check out something very exciting. (if I say any more I'll get the PR/Mktg teams yelling at me).. I can say that we will have more video's, more quick start guides and more focus on CIRA (FAst call for help) coming out soon as the HW starts to show up and we can show real life scenario's with rich detail. We are also going to spend more time focused on how to fast track a few use cases, like Going Green with vPro, Remote Repair, & Patching @ Night. After hearing this discussed the last month I believe the community with see value in the output here.

I would also like to give kudos to a # of community peers both inside & outside of Intel that have shared their wisdom, data, approaches and even video editing skills to help me start this community. I think we've only just begun and I am personally looking forward to the road ahead. please give me a shout out to tell me what you think of the community..

Josh H

Community Manager - vPro Expert Center

I am so lucky to experience IDF (thank you Jason Davidson, Josh Hilliker and Kevin Ma). The atmosphere here is amazing. Wide varieties of people are here to enjoy what is new coming out of Intel. Opening key notes were invigorating and exciting. Craig Barrett kicked off the experience with his speech, "Small deeds done are better than great deeds planned," what a simple and powerful saying in Craig Barrett's speech.

Going through show floor area, where the majority of the demos are located, there is so much exciting new stuff, everything from virtualization to new hardware. Let me key you in on something that is going to big with vPro: remote help for your home computer. With this technology, you can have a key stroke on your PC, it will send a signal to several qualified providers that you can choose from, they will receive a code, and the one of your choice can fix your PC remotely. You would not even need to bring in your PC or have a tech come to your place of residence for most problems. Josh Hilliker is going to be putting up w a PDF about it here on the vPro Expert Center. Keep your eye out for some clips and more cool new features from different people on the Open Port site.

(Some cool give-a-ways!!)

Just arrived, checked out the booth and we are ready for this afternoon. Definitely come by @ 6PM in the vPro Zone today.

Stay tuned for more video's from Pat's keynote in a few moments. along with a quick video on the booth.

Josh H

This is officially closed on both Survey Monkey and this site.

Just go to Survey Monkey and take the survey that is shown below.

I have been saying so much on what I love about vPro and the cool features that it presents to the public, so now I want to know your perspective. Since you are going to be so nice to put your point of view up here, I am going to give something back to the best answers: a 16GB USB key!! So post what you like best about vPro and I will send you a 16GB USB key All I need to know is:

What I think is cool about vPro:

Company Name:

Number of vPro/Centrino Pro systems:

NOTE: If you have not read parts 1 through 4, please read these before reading this part as this is a continuation of the story begun in the previous sections. Altiris and Intel vPro Use Cases

Learning from previous mistakes, CSO Dan Williams discusses what they can do to better secure the powerful AMT functionality. Since the human factor is the biggest weakness, what can they do to strengthen this? Obviously they can't remove it altogether; might as well shut the company down. In Intel vPro the human factor can be minimized due to available strong security technologies. AMT can be made more secure, but the continuing threats are emphasized when a computer is hijacked. What can be done to regain control?

Mighty Modern Marketing HQ - Boston, Massachusetts

Bright sunlight filtered through the distant windows , overshadowing the bland fluorescent lights lit above. Jessica Langley watched the distant pedestrians seen in a narrow view near the street moving past with varying degrees of enthusiasm. The hot summer held to the south temporarily by a low pressure that brought in the cool Atlantic breezes. She imagined being able to hear the conversations of those passing, wondering what they spoke of, and if any of them had as crazy a life as her.

"Ah, this is the life," Tevita said as he leaned back. He placed his hands behind his head and stretched out his legs, pushing his office chair as far back as possible. With what looked like a deliberately casual gesture he tossed his headset onto his desk.

"You should be worried," Jessica commented dryly.

"Worried? Why?"

Jessica gestured sharply at her phone. "No one can call us with the phones down, so our work is just piling up while we sit here."

"Hey, we have our mobile phones. If it's not important enough for them to look up our numbers, then why worry about it?"

"You know that's not how it'll happen. As soon as the phones get up... WHAM! We're here until the sun drops below the trees in the west."

Tevita's smile lessened, but only a little. "They've been down for two hours. Perhaps they'll be down all day, and we can leave early."

"Right."

The Tongan shrugged, and Jessica briefly envied his ability to shove aside problems when they weren't directly in front of him. He could have two amazingly nasty issues to work on, and he'd easily concentrate on one at a time as if the other issue didn't exist. She wished she could compartmentalize in that manner, but when she had two critical issues to work on they hung over her like a dark shroud. Usually the one she wasn't currently working pressed down as if to accuse her of negligence, but she couldn't do two things at once. It wasn't like knitting while watching TV.

Like now, when she knew issues piled up while their phones remained down. She reached down and pulled up her mobile phone in case she'd missed an incoming call, but nothing showed. She sighed, standing up and stretching. Tevita frowned at her.

"You aren't going to bug the phone people again, are you?" he asked, as if accusing her of turning him in for some crime.

"No," she said. "Daniel Williams wanted to talk to me today so I'm heading up to his office."

"Good. Don't mention the phone issue to the CSO..."

She rolled his eyes at him, but he only smiled, large hands moving deftly across the keyboard. Without phone call interruptions Tevita would clear out the email queue in no time.

She took the stairs, hoping to work off the donut she'd eaten earlier that morning. It seemed no matter how resolute she thought she was to eat healthier, as soon as someone brought in free goodies her willpower vanished and she indulged. She doubted the climb from the first floor to the third made any real difference, but at least her husband wouldn't get on her case about taking the elevator when she had two perfectly working legs.

The door to Daniels office sat closed, and she peeked into the glass valance to the side. Daniel stared at his computer screen, his brows drawn low. He didn't touch the keyboard and mouse, eyes moving across his monitor as if trying to puzzle something out. He just reached for the mouse when she knocked quietly on the window.

He turned, a smile easing his expression. He waved her in, and she quickly hurried through the door."

"You wanted to see me?" she inquired.

"Yes, please sit down," he said, gesturing to one of the empty chairs across his desk. She sat while he turned back to his computer.

"Please watch," he said as he launched Internet Explorer. "I'm going to talk you through what I'm doing, and I don't want you to interrupt until I'm done. Okay?"

Jessica felt a twinge of uneasiness stiffen her spine. "Of course," she responded, trying to instill confidence in her voice. "What are you doing?"

He only smiled. "First, I've discovered what password I can use to access AMT on all our vPro enabled computers..."

She stood up. "What...?"

He held up his hand, not unkindly. "Please humor me."

She sat back down, her unease blooming. She clasped her hands in her lap so she wouldn't fidget, usually in the form of smoothing down her already crisp and wrinkle-free dress jacket. She couldn't sit completely still, and found herself tapping her toe. Fortunately the carpet, however uninviting bland, muffled the sound.

"Okay," Daniel continued. "I don't have access to Altiris though I have tried to gain it, unofficially of course."

"Of course," she said, and quickly clamped her teeth together before she asked another question.

Daniel continued, "In light of that I've done some Googling and found that AMT has a web-interface that anyone can access using a browser. I haven't figured out how yet, but I don't think it'll take me long. Let's see... how to access AMT via a browser... This first hit talks about someone who is unable to access it."

Url: (http://softwarecommunity.intel.com/isn/Community/en-US/forums/thread/30249624.aspx).

"Ah, in his post he says, "When I try to access the Web Interface (localhost:16992 or name:16992)... that means I can access my test in the same manner. Let's watch."

Jessica bit her lip to keep from saying anything, determined to keep quiet until he'd finished his demonstration. She really wanted to ask him how he acquired the password, but she supposed she should wait until he validated that claim first. Plus, he'd asked her to keep quiet, and she didn't want the CSO annoyed with her.

Daniel clicked on the address bar, deleting the current address. He then typed in MMMAMT0043:16992 in the address bar. When he hit Enter the page refreshed, showing him the initial AMT login screen. He clicked the ‘Log On' button, which provided a standard Windows security prompt. He entered in Admin as the username, and then typed in a password. Jessica's stomach dropped. She didn't see exactly what he put it, but it did look like he put in the right password.

The Intel Active Management Technology web interface appeared, giving Daniel full access to the system. Jessica reached up and rubbed at her eyes.

"Please tell me you simply asked Tevita for it," she said when he turned to her.

"No, but no need for you or Tevita to worry about that," he said with what Jessica assumed was a reassuring smile. It didn't help. "I believe I used the same methods our traitorous employee working in cahoots with Nifty Networks used to gain these powerful credentials. I'll be conducting security training for our employees soon to try and plug that method."

"So how did you do it?"

Daniel nodded. "Good question, but the better question I'm posing to you is this: how can we better secure the AMT technology? See here under Remote Control? I can remotely reboot this person's system and boot it up into an application I can use to wreak havoc. Nifty, no?"

She swallowed hard. "No, not nifty."

"Good. You see the issue. I'm tempted to not tell you how I did it. Mystery lends me an air of the supernatural, or at least my uber-geekness. Why reveal how? That's like a magician revealing his secrets. Once the how is known, it isn't so magical anymore. Okay, so I'm taking far too much pleasure out of this. I simply watched you and Tevita closely and caught you entering the password. It took several tries before I finally got it right."

The beginning of a migraine colored Jessica's vision. "Great. I thought we had that password locked down..."

"As I said before, don't worry about it. Everyone is too trusting when entering passwords. I'll address that in our upcoming security meeting. What I want to discuss is how we can rectify this situation? Specifically I want to remedy the fact that anyone who does a smidgen of research will know that the administrative username for AMT is admin. We've handed any potential hacker one half of the credential equation."

Jessica nodded. "Yes, I see your point. Luckily I already know how to fix that. It's as simple as making the admin password random on each system and using Kerberos to use our Domain credentials for access."

"Good. The second point is I noticed that I can use a non-secure web address to access this. Can you get SSL enabled for all AMT communication?"

Jessica nodded again. "Yes, specifically AMT uses TLC, the successor to SSL. I believe I saw an article on how to enable that on Symantec Juice."

"Even better. Get those measures in place, and let me know when it's completed."

She nodded, shaking his hand when he offered it. She left his office and headed back down, taking the stairs despite the throbbing in her head. When she reached her cube she noted that Tevita had his headset on, his previous smile absent from his face. She gave him a grin when he glanced over, and this time he rolled his eyes. She should get onto the phones, but she wanted to get those changes implemented as soon as possible so that even Daniel couldn't crack the system... as long as Tevita and she carefully entered their passwords so others couldn't eyeball them.

She sat down and pulled up the Altiris Console. Both of her actions required a new vPro Profile to be pushed down to all the AMT systems, but that was the easy part. She started by enabling TLS on the server. Until she pushed down the new profile the AMT functions would not work. She leaned over to Tevita, and he glanced at her as she rolled closer in her chair.

"AMT will be available for a time," she said.

Tevita reached up and muted his headset. "Why?"

"I'm enabling TLS. You know, encryption. When I enable it on the server side the clients will not be able to communicate back with the server until I update the profile and they have the right certificates."

He shivered. "Is that such a good idea? Certificates are tricky... we could easily mess up the whole thing and have no AMT access..."

"Tevita, it isn't that complicated. I have all the Altiris documentation on how to do it. Besides, there's a specific article on how to do it after the installation, here: http://juice.altiris.com/article/2737/how-enable-tls-within-out-band-management-after-install. Piece of cake."

"If you say so..."

"Trust me. If we had a hierarchal structure of certificate authorities, it might get a bit dodgy, but I'm just setting up the one root."

"Yeah, and the flux capacitor needs just such and such gigawatts of power..."

"Just read up on it! It's not that hard."

Tevita spoke for a moment into his headset, and took it off. "I don't know anyone who understands it all that well."

She planted her hands on her hips. "It's really simple. We give the root CA, aka the King, the credentials that are acceptable. Secondly, the Altiris server gets the credentials so it can work with the CA and the clients. We then load the matching credentials on the clients via the Provisioning Profile. Now everyone has the credentials."

He smiled. "What about client-side and server-side certificates?"

"Again, simple. Communication is unidirectional for a given parent/child certificate set. With basic TLS in vPro, all the clients have server certificates. The Altiris Server uses a client certificate to authenticate with the client so that the client machine will accept the AMT commands sent it."

"Alright. That sounds simple enough, but what about the CA? What's that for?"

Jessica looked at him, her eyes narrowing. "What's with the third degree? 'Tell me Master Qui-Gon. What are midichlorians'?"

Tevita burst out laughing. "Am I that transparent? I didn't know you liked Starwars..."

"I don't. Like that movie quote, your questions are contrived..."

"Hehe, yeah. I'm just trying to prove a point. It's not that simple..."

"But it isn't that complex, either. The CA tells the server-side component (the AMT Client) if the client connection (from the Altiris Server) is to be trusted. I know having the AMT clients act as the server seems a bit backwards, but since we want AMT functionality to be secure, it makes sense. The Altiris Server that tells AMT what to do needs to prove itself. This ensures a rogue server can't just initiate any AMT functionality without having the proper certificate. So the server provides a client certificate, which the AMT system authenticates with the CA before allowing the Altiris Server ‘in'."

"Okay, okay. That sounds simple enough. I'll be sure to avoid AMT until next week when you get TLS finally working... kidding! Take it easy, I'm just joking."

She wanted to keep the stern look on her face, but a smile cracked through. "You just watch it, Mister."

Jessica turned her attention back to the Altiris Console. She opened up a browser on her second monitor and pulled up the Juice article she'd shown Tevita. She walked through the steps, sometimes checking back on the Altiris Administrator's Guide for Out of Band Management, found at http://www.altiris.com/Support/Documentation.aspx. She finished the processes except for updating the profile since she needed to also update the Admin password settings.

She browsed in the Altiris Console under View, Solutions, Out of Band Management, Configuration, Provisioning, Configuration Service Settings, and clicked on Provision Profiles. She highlighted her active profile and clicked the pencil icon in the icon bar to edit it. Under the General tab, to the right of the window, she changed the Intel® AMT 2.0 password: setting from Manual to Random creation. She then clicked on the TLS tab and, using the previous directions, enabled TLS within the profile.

She sat back as she clicked OK. Now that the Altiris Server was setup properly, she needed to push the new profile out. From her place in the console she backed up into the Provisioning folder, and then expanded the Intel AMT Systems folder and highlighted the Intel AMT Systems node. All Intel AMT Systems showed within the right pane. She clicked on the top one, scrolled down, and, while holding shift, clicked on the bottom one. She right-clicked and selected the ‘reprovision' option.

With a sly smile she glanced over at Tevita. He wore his headset again, though he looked less stressed than before. She rolled over and wrote on his whiteboard "AMT back up in a few hours". For the time being they could rely on the Runtime Profile for authentication. Since Altiris knew all the random passwords for the Admin account, via Altiris they should have no problems with security. However she needed to quickly implement AD integration with Kerberos authentication just in case.

She got up to take a quick break. She stretched, looking out over the cubes. She froze in mid stretch for a moment, before quickly pulling down her arms, her eyes widening. Two men in blue jumpsuits walked nonchalantly through the building, one holding a sheaf of what looked like generic forms and the other with a nondescript box. Despite their "non"-threatening postures, something about them bothered her. At first she simply watched them, trying to figure it out.

The man in front emanated confidence like a shiny sword and shield, his smile infectious and full of perfectly white and straight teeth. His strong features seemed chiseled from brilliant marble, as if he'd been carved amid the statues of Rome. Not one of the rich brown hairs on his head stood out of place, his hazel eyes roving over the office as if memorizing all the details. He didn't act suspicious, but his very manner belied the blue-collar worker outfit he wore.

Right behind him strode the other man. He wore a beard, a hat pulled low over his eyes. She squinted, hunching down a little so she didn't rise so high above the cube walls. He carried the box, his muscles tensed. He walked jerkily, each step seeming just a little unsteady. Sweat beaded on what little she could see of his forehead.

"Tevita," she whispered. "Does that guy look familiar to you?"

He appeared beside her. "Who? Those two delivery guys?"

"Yes. The one carrying the box."

Tevita turned to stare at her. "It's the ninja!"

She shook her head, though the sudden clenching in her stomach belied the action. "No way, he's in jail, right?"

"Probably not. He didn't threaten anyone or do any actual damage, and the price of the hard drives he tried to steal doesn't equal enough to be a felony, especially since he claims he was only after the hardware..."

"But why come back here? We know who he is..."

He just shrugged. "Maybe he's turning a new leaf..."

She gestured at the other man just as they disappeared into the stairwell. "Maybe, but that other guy gives me the creeps. I wouldn't be surprised if his name happens to be Lex Luther."

Tevita nodded. "Let's follow them."

She shook her head. "No way! Let's just call security and let them deal with it."

The Tongan only shook his head slowly. "The security company might be too slow to respond. Heck, they took forever to show up when our ninja friend showed up the first time. You go tell Bobby and I'll shadow these two shifty guys."

Before she could respond he hurried away, surprisingly quiet for his bulky, muscled size. She clenched her teeth together, torn by indecision for a few precious seconds. She then turned and hurried towards the server rooms, hopping Tevita wouldn't get himself into too much trouble.

END Part 5

This concludes Part 5. This cliff-hanger will be continued in an even more unbelievable conclusion, Part 6. Now that the competitor has breached the office once again, can Might Modern Marketing's IT staff protect their infrastructure, data, and themselves from this all out attack?

Listen in as your hosts talk with Dave McCray, Intel's IT Program Manager. Intel IT is a leader in the activation and use of AMT. They have activated & provisioned over 10k machines - hear how they did it, why they are doing it & how to make your integration better based on Intel IT's best known methods.

Stream from blogtalkradio or click play below to hear it now...

Now that Centrino2 with vPro is coming out, amongst the new features that it will carry is Client Initiated Remote Access (CIRA). I thought to myself "what is this?" My internet digging, tells me that it is a way for the server to communicate to the client via AMT, offsite through a Management Presence Server (MPS). When a user initiates a CIRA request to their MPS, then the MPS is able to reach the client, passing through Virtual Private Networks (VPN). Then it will be able to go through the same AMT communication channels as any Pro system that is on the local network. On the laptop that is wireless that notebook can be anywhere as long as it's plugged in to power, and can connect to the VPN.

Josh Hilliker did a blog about a month ago, and it has a great diagram showing everything I have said. Centrino 2 - Digging in deeper into CIRA

Another great video to look at is the Intel Centrino2: C.T. Phone Home video.

Sleep state manageability is another feature that Centrino2 will carry. It will be able to turn on and off the notebook remotely without it being turned on but it does still need to be in the VPN. The device needs to be plugged in; it can't be running on the battery for this to work. You wouldn't want to try to turn on your computer and find out it's dead because all of the battery power is taken up trying to update your licenses or fixing any problems. The Centrino2 has energy saving features the notebook is using less energy with this new feature, and it is enabled at the times that make sense to your battery.

One feature that people will notice is the clear video technology so items like Hulu.com will look so much better. In addition, it will have more of graphics usage so you wouldn't have to purchase more graphics cards. It will look so good you will want to put your hands all over it!

Now I will not have to look like this when my laptop is on freak out mode. I can just call up IT and they can take care of it!

And if you want to know more go to the Intel Developer Forum Aug 19-21, 2008 in San Francisco. I will be there with my blogging skills!!

Our Partners over at myitforum.com created a new service that helps with community sharing of large files for troubleshooting or sharing with others. I encourage you to check out their new upload capability and use this is an option when sharing out to other members.

http://myitforum.com/cs2/blogs/rtrent/archive/2008/08/02/the-new-myitforum-com-community-file-share-service-unveiled.aspx