Intel vPro Expert Center Blog

Do it yourself - Power on, patch, and go back to sleep with 4, free .exes

jacob.gauthier@intel.com — Tue, 24 Nov 2009 19:42:30 GMT

Having worked with Intel Active Management Technology and Intel vPro Technology since version 1.0, it seems to me that there are a whole host of possibilities for those who are do-it-yourself-ers. One is the ability to programmatically wake a system, remotely trigger a process such as a software patch, and then put the system back to sleep. As it turns out, this is not so hard, even for me who has a limited scripting (read batch file) capability. The video chronicles the results of my effort.

Disclaimer: this is not meant as a how-to or best method. Rather, it is an exploration of what’s possible, meant to educate and stimulate conversation. With that out of the way, let’s get to the fun stuff.

To accomplish this goal I knew I'd need some help via command line tools. I did an Internet search and found these 4 freely downloadable tools that made it all possible. They are;

Remote Control Util - to determine the current power state and turn the system on.

PsService - to start a process remotely

PsShutdown - to put the system back to sleep

sleep.exe - so the batch file can sleep while an event takes place.

The setup is simple; 2 systems. One is the console that executes the batch file and these commands. The other is my vPro system. I setup and configured my it using this Use Case Reference design (another of my batch file creations). That is to say, there's no TLS and I'm using only the admin account. I then ran the batch file on the console system which triggered the whole process. The process is as follows:

1. Remote control util gets vPro's original power state via AMT (on, sleep, hibernate, or off)

2. Remote control util power's on vPro via AMT

3. Remote control util get's vPro's new power state to verify it has turned on

4. ping vpro and check the TTL. Once it changes to <=128 the OS has booted. For more info

5. PsService starts a process on vPro. I used notepad but it could be anything, including triggering a download and run of software patch

6. PsService exits when the process finishes

7. PsShutdown gracefully places vPro back to it's original sleep state

8. Remote control util get's vPro's new power state to verify it has returned to it's original power state

Couple of notes.

· I set an auto login on my vPro so I could see the process. However, PsService will work without a user being logged in. Also, it can run processes in the back ground so an end user would not be able to interact.

· I used Notepad as my remote process since it made it easy to see success. However, any process can be started. In fact, PsService supports downloading the executable to run. As such, it may be possible to download and then run a patch or batch file as part of this whole process

· I used a single vPro system. But, with a simple loop the same core batch file could trigger this action on many vPro systems.

Hope you found this post enjoyable and thought provoking. If you have your own do-it-yourself vPro ideas, or want to recreate this one, please share. And, hey, who says batch files are dead?

PC Refresh Cycles and Windows 7 … what’s the financial connection?

julie.a.whitcraft@intel.com — Tue, 24 Nov 2009 04:29:06 GMT

It’s understandable that in today’s economy that you might consider pushing out your PC refresh cycle to save cash today. This is an area of cost cutting that many companies consider so you’re not alone. But if you have considered, or are considering, pushing out your PC refresh cycle, have you factored in all of the costs that impact that decision? These costs include the unexpected costs of supporting older machines once the warranty has expired, higher energy costs compared to new machines, and more. The total cost of ownership starts to increase out in time and will eventually reach a point where it makes more sense to replace your PCs versus continuing to maintain them. But how do you know what the optimal replacement time is? And is delaying your refresh really the best financial decision?

There are strong financial reasons to refresh PCs now and, with the Windows 7 operating system, there are even stronger reasons to do so with PCs powered by Intel® Core™ 2 processors with vPro™ technology. Join me for a webcast on Tuesday, December 1^st, where I’ll walk through our analysis on the PC refresh cycle and the framework we use, discuss the true cost of older PCs and how to assess your own PC refresh cycle, and share our experience with Windows 7 as part of the Technical Adopter Program (TAP). I’ll also be joined by Amy Stephan from Microsoft who will provide more insight into why it makes sense to refresh now and why Windows* 7 and New PCs with Intel® vPro™ Technology are better together.

GoDaddy vPro Landing Site

william.york@intel.com — Sun, 22 Nov 2009 12:47:41 GMT

I've been asking GoDaddy for over a year to provide a specific Intel vPro site to help customers buy Remote Configuration Certificates. Glad to see someone was able to get them to add a link on thier site. http://help.godaddy.com/article/5260

TechEd Europe 2009 - Win7

josh.hilliker@intel.com — Fri, 20 Nov 2009 17:21:16 GMT

At TechEd Europe 2009, Microsoft's Keith Mayer outlines how manageability can be achieved with Windows 7, Windows Server 2008 R2 and Intel's Westmere-EP.

vPro: Windows 7 Migration with SCCM SP2

florence.lo@intel.com — Fri, 20 Nov 2009 01:04:00 GMT

Take a look at the posted document for step by step instructions on Windows 7 Migration with SCCM SP2. This document includes how to create an image using SCCM, Installing drivers, Installing Applications, Creating Hardlinks with the User State Migration Tool, and Renaming and Joining the domain. This document allows IT technicians to create an Win 7 image, deploy it to their environment using collections, and upgrade their existing Windows XP clients to Windows 7 clients without having to remove the data and put the data back. Included in this guide is some tips and hints on getting the image deployment to work for your company.

http://communities.intel.com/docs/DOC-4079

Newsletter Published: Radmin, Webinars, Intel AT, and real world examples

michele.gartner@intel.com — Fri, 20 Nov 2009 00:53:47 GMT

This issue of the newsletter has some good content about using Intel vPro Technology. A new use case reference design was published recently; this one has to do with using Radmin to perform basic Intel AMT functions on a managed client. (What's a use case reference design? Read my blog: New stuff in the community: Use Case Reference Designs) You'll also find links to a white paper about Failsafe and Intel Anti-Theft Technology, a registration link for a Windows 7 webinar that's coming up, and some real-world stories about companies that have implemented Intel vPro technology in their environments.

Read the newsletter or subscribe to receive it in your inbox automatically. This newsletter goes out every two weeks.

Enjoy!

Follow-up post on CIRA - we have Lift-Off...

tal.elgar@intel.com — Thu, 19 Nov 2009 16:47:34 GMT

If you're reading this blog posting, hopefully you've read my blog post on CIRA last week -

http://communities.intel.com/community/openportit/vproexpert/blog/2009/11/10/cira-and-fast-call-for-help--what-is-it-where-can-i-find-it

Firstly, I wanted to share with you that over the past week we have actually worked through an entire end to end setup with a real-world customer (i.e. not just inside Intel labs) and now we have CIRA and AMT functionality over CIRA working successfully!

If you're wondering which of the management consoles and MPS/vPro Gateways were used - it was LANDesk 8.8 SP3 in this case (remember that LANDesk bundle their own MPS/vPro Gateway offering). If you're looking to get this to work in your environment (CIRA with LANDesk specifically) please do get in touch and I can share some specific current LANDesk pointers with you (that are not mentioned in this blog posting).

Some of the things we came across last week which are good pointers to pay attention to:

There are 4 ports that get configured with the MPS which are fully configurable (i.e. they are not restricted to being a specific port number) - however, you cannot re-use the same port number, you need to have 4 distinct port numbers (sounds trivial, but it happens).
You can use port 16993 as one of the port numbers, even though that is the port that is used for https connections in AMT (there is no conflict)
In the httpd.conf file - instead of havinga deny all and allow specific IP addresses, you might want to change to allow all
CIRA relies on the DHCP option 15 that is allocated where the vPro client is to be different than what it was pre-configured with - that is how the system knows it is outside the corporate environment. If DHCP option 15 happens to be blank where your vPro clients connect from - that is good enough. Blank is considered different and CIRA works fine.
Currently, you should install the LANDesk agent after provisioning is completed
Check through selecting the 'vPro Status' operation on a provisioned vPro client to ensure all the LANDesk NED settings have been deposited properly on the vPro client prior to taking it out of the corporate environment.

Btw, the CIRA connection is established through a user click at the OS-level using the IMSS utility.

So the bottom line is we now have close to 100 systems that are confirmed to be have full AMT functionality working over a CIRA connection in a real live environment - it works! (

The 2nd part of the blog can be considered a more 'advanced topic' and is devoted to what happens if your management console of choice doesn't currently support CIRA...

One Management Console for example that is currently not supporting CIRA is Microsoft SCCM (even with SP2).

The options as I see them, are:

Contact your software vendor and ask them whether they support Intel - Intel works with multiple software vendors on incorporating support for various Intel vPro features (CIRA amongst others) - they can hear it from us, but it is much better if they hear it from you.
Your software vendor might have plans to introduce support for CIRA, however it is further down the line - so it is just a question of time.
Try and engineer something yourself to have CIRA work in the environment you have setup

At least for testing your environment for what CIRA would look like, you could leverage the WebUI tool. You would need to have an MPS installed and configured first of all. Thereafter, all that you need to do is configure the proxy settings in the web-browser you are using to the IP address/FQDN of where you have your MPS installed and also enter the default http proxy port of 8080 - that will be sufficient for getting your WebUI to work over a CIRA connection.

If you use Microsoft Internet Explorer you are limited only to the http proxy portion which will allow several of the AMT operations to work over a CIRA connection, but not SOL/IDER for example.

If you are using Mozilla Fire Fox for example, you can configure a SOCKS proxy as well, which can handle routing SOL/IDER traffic as well.

If we take the example of Microsoft SCCM, what you can do is to use the scripting framework that has been used successfully for something like: providing out of band 802.1x in Microsoft SCCM SP1 (it is natively supported now in SP2) - http://communities.intel.com/message/10877

You can configure the correct settings for the vPro client to be able to contact the MPS Proxy Server and establish a CIRA connection between the MPS Server and the vPro client, however you will still need your management console to integrate and be aware of this CIRA connection to be able to do something useful.

What you could do at this point is to configure a 'transparent proxy' - what that would typically entail is to configure the MPS IP address/FQDN as a proxy routing that will be inserted in the headers of packets that go through the router to which the Server that is hosting the management software. You can use something like Cisco WCCP (Web Cache Control Protocol) to set this up. At this point, Microsoft SCCM will not be aware that the packets it is sending are actually being re-routed through the MPS to the vPro clients (which is aware of the remote vPro client) and that is why this is called a transparent proxy.

A caveat/disclaimer I would add though is that albeit technically feasible you would need to put together the full working solution yourselves and support it yourselves.

Miss the Win7 and Intel vPro technical webinar? Recording now available.

michele.gartner@intel.com — Wed, 18 Nov 2009 22:00:55 GMT

Webinar Recording

If you missed the live event, you can now watch the recording! You can also download the webinar.

Webinar Slides

Want to download the deck? It's attached to this blog post (scroll to the bottom).

Managing Help Desk permissions in vPro with Microsoft Configuration Manager

jacob.gauthier@intel.com — Wed, 18 Nov 2009 17:53:42 GMT

vPro provides many helpful tools for Help Desk support personnel such as the ability to reboot a vPro system to a CD-Rom image. Of course to use it, they must have permissions to access the firmware remotely. Check out this use case reference design: http://communities.intel.com/docs/DOC-4404. It provides a framework to use an Active Directory group to grant and revoke these firmware permissions on all vPro systems through out an environment. For non-SCCM users, this concept may be used with many other software packages such as SCS. Also included in the appendix is a method to reconfigure vPro systems without a full unprovision. Enjoy!

The Intel Manageability Channel: All Manageability, All the Time!

kathy.a.farrel@intel.com — Tue, 17 Nov 2009 22:51:19 GMT

Have you visited the Intel Software Network Manageability Community lately? There have been some recent changes that I’ll speak to in a few minutes. But if you have never been to the community I ask that you check us out. Our community is comprised of software developers and our site serves as an engineering resource for Intel® Active Management Technology (AMT) and Intel® vPro™ Processor Technology, whether you are just learning about the technology (Start Here Guide) or an experienced user (Architecture Guide: Intel® Active Management Technology, Intel® Active Management Technology Use Cases ). At our community site you can download our latest product offerings including the Remote Encryption Management SDK.

Recent Community Changes include:

New Community Manager (that would be me) who wants to provide what you need for successful work. I always welcome feedback!
Some look and feel changes including a kind of Start Here place to help you quickly find what you are looking for as soon as you arrive.
New article links such as that for WS-Man.
Community Member at Large (outside Intel) designation – we’ve chosen one and we’ll be sharing his contributions shortly. This program indicates our strong desire for community participation.

Our forums are excellent places for Q&A and we’ve got engineers available to answer your question. Manageability Community Blogs are a great opportunity for members, inside and outside Intel, to share expertise and to initiate and contribute to lively discussions on issues that are currently being experienced in our world. (Here is a great sample that features info on soon-to-be available technology: Intel KVM: This is your SOL on Steroids.) It is also the perfect place to demonstrate leadership and develop professionally.

Please come to visit us and see what we can do for you! Bring your ideas, suggestions, questions and opinions to our party!

Sincerely.

Kathy Farrel

Manageability Community Manager
Intel® Software Network
kathy.a.farrel@intel.com
My ISN Blog
Office - 415.895.1226
Cell - 505.400.2548

Demonstrating vPro: Internationalization (or the lack thereof)

terry.c.cutler@intel.com — Mon, 16 Nov 2009 22:52:29 GMT

Sharing an experience and looking to validate some of the challenges vPro demonstration might present in markets outside of North America - especially if the original demonstration environment was created in North America.

A few weeks ago I had the opportunity to travel to Germany for a training event. The equipment for the training event was sourced locally in Germany. The result was 13 systems. (For those that are superstitious – you might quickly identify that this will get interesting).

Among those 13 systems, there were 4 different OEMs, 3 different keyboard layouts (US, UK, German), 3 different power connectors, 2 generations of Intel AMT (2.6 and 4.x), 3 different versions of Windows (XP, Vista, and Win7), 2 different versions of VMware workstation, and a single VMware workstation image created in North America. Very little standardization. A perfect recipe for disaster.

This was my first experience in working with differences that went beyond just QWERTY vs. QWERTZ keyboards. The password used for the operating system and applications included the @ key. This was problematic since on a US-based keyboard the location of '@' is Shift-2, yet a German keyboard is AltGr-Q (press and hold key to right of spacebar, then press Q), and a UK-keyboard is Shift-‘ (press and hold shift, then press ‘ key which is located on third row third key from the right side). Fortunately I didn’t have to deal with keyboards outside of Latin letters (i.e. A, B, C, etc) – although there are exceptions like the German letter β.

My first realization of internationalization troubles was that BIOS\MEBx screens and key sequences were US-keyboard QWERTY based regardless of the keyboard layout. I had to ask myself - "Is this always true?". Since the password included the @ symbol - mentally I had to follow the US-keyboard layout, althought the sequence wouldn't match the printed keys on the system.

When in the host operating system, the “Regional and Language settings” were commonly set to the origin of that system (expect one system which had UK keyboard with US-based Windows Regional and Language settings). My frustration did not end there – as the VMware environment was set to US-based Regional and Language settings, and had to be adjusted on a per-system configuration basis.

Not all of the windows menus and options were in the same locations between English and German, yet there were similarities. With the differences of languages between BIOS\MEBx, host windows operating system (with VMware workstation), and demonstration environment – some real-time translation or best guess had to be done. I know some German, thus I was able to navigate through menus in the host operating system or VMware application, yet it slowed setup and troubleshooting situations. Fortunately those attending the training knew English better than my German language skills... but frustrating nonetheless.

The good news – the underlying vPro functionality was the same, the training was delivered, and a new perspective was obtained by myself and those who received the training.

In talking with my international associates, a few more points were brought to my attention:

difference of calendars (for example, those that use Buddhist calendaring system) which may affect Kerberos and certificates
application installations may fail when using a foreign language
Remote configuration certificate is issued to one domain (i.e. domain.company.com) yet will not support international domains (i.e. intldomain.company.com.uk)... this one is actually fixed in the latest firmware and will be explained in a separate article

There are likley other subtleties to the challenges of internationalization

Does this all sound familiar to those outside of the US?

The experience was good for me. I gained a brief look into much larger challenges on standardizing a technology solution across the globe.

Windows 7 and vPro - anything I should be aware of?

tal.elgar@intel.com — Fri, 13 Nov 2009 13:47:51 GMT

If you are one of the many organisations that is planning on adopting Windows 7 and are wondering whether there are any implications for your vPro systems, then this blog is for you...

The implications of Windows 7 on vPro can be summarised as relating to at least one or more of the following areas:

1. Management console

2. AMT Drivers

3. AMT Firmware

Let's start with the Management Console...

If you are using Microsoft SMS, for example, as your management console then you should be aware that Microsoft officially doesn't support Windows 7 clients with SMS and therefore if you wish to manage your Windows 7 clients you will need to transition to Microsoft SCCM. Therefore, when planning your vPro migration to Windows 7 you need to actually to migrate to SCCM before hand.

For those that do migrate to SCCM there are some additional implications which are indirect for the Windows 7 migration, but are part of the SCCM with vPro package. As this is not a posting on SCCM, I'll only mention briefly that you need to be prepared to have an Enterprise Certificate Authority, potentially have to make use of the WS-MAN translator (if you have any AMT Firmware that is prior to 3.2.1), you will need to upgrade to latest AMT Firmware versions and you will be integrated with Active Directory.

Regarding AMT Drivers (namely HECI/MEI and LMS/SOL)...

As the drivers are installed at the OS level, it doesn't come as a surprise that there might be a requirement for drivers to be able to install on a new operating system.

AMT 2.x based systems - currently no planned official AMT Windows 7 drivers (use compatability mode)
AMT 3.x based systems - official AMT Windows 7 drivers will be available by OEMs in Q1 of 2010 (for now use compatability mode)
AMT 4.x based systems - you will require drivers version number 4.2 (otherwise you could use compatability mode)
AMT 5.x based systems - you will require drivers version number 5.2 (otherwise you could use compatability mode)

If you are not familiar with compatability mode, here is how you do it:

1. Right click on the driver installation file à Properties à Compatibility tab (per sample screen shot below):

2. Select the mode (I guess either Windows Vista or Windows XP SP2 or SP3)

3. Click Apply/OK

4. Right click installation file and run as Administrator and install the drivers (or alternatively prior to step 3 tick the box of run as administrator)

Btw, the exact same process can be used for AMT 4.x and AMT 5.x drivers – i.e. take existing not 4.2/5.2 level drivers and install them in compatibility mode.

It is useful to know that the 4.2 and 5.2 level drivers are actually available for download fromt the OEM sites; take Dell for example: http://support.dell.com/support/downloads/driverslist.aspx?c=us&l=en&s=gen&ServiceTag=&SystemID=LAT_E6400&os=WLH&osl=en&catid=&impid=

and

http://support.dell.com/support/downloads/driverslist.aspx?c=us&l=en&s=gen&os=WLH&osl=en&catid=&impid=&SystemID=PLX_960

Lastly, we have the AMT Firmware...

Strictly technically speaking, Windows 7 doesn't require a different kind of AMT Firmware, since the firmware sits underneath the operating system anyway. What is required though is the latest AMT Firmware (4.2 and 5.2) so that it can interoperate with Microsoft SCCM in the best and most stable manner. Therefore what might initially seemed as no need to upgrade AMT firmware to work with Windows 7 actually becomes a recommendation to do so.

Hopefully this has provided some clarity on the technical requirements around vPro and Windows 7. There are some particular compelling points for having vPro systems and leveraging them for a Windows 7 migration deployment, however this is covered by other blogs and materials out there, such as: http://communities.intel.com/docs/DOC-3096

How vPro proved it’s value even to me

josh.hilliker@intel.com — Thu, 12 Nov 2009 17:58:25 GMT

Here’s the situation, I recently purchased an ATOM set top box for my TV. I purchased this ATOM based box so that I could play my movies, audio and have an internet device for the TV for the family to leverage (facebook, shopping, checking out sites as a family). I was updating the OS, patching, configuring and ended up rebooting it a few times and then of course throw in a few HARD boots in the middle of it all. I then went to boot it on and this popped up ..

Error: "Corrupt file - NTOSKERNEL.exe"

My first comment was “ah bummer”, then I said okay I’ll just do an IDE-R/SOL and just copy the NTOSKRNL.exe file, no big deal. Oh but wait, it wasn’t a vPro system and at that very moment I realized how key vPro is even to me. I then spent 10+ hrs throughout the week at nights, lunch, etc.. building bootable USB’s, CD’s that would replicate vPro functionality, with little success and trust me I was asking everybody for input, thoughts and help. At the end of the week I just pulled the drive, copied the file and then it was back to good again.

Would I have paid for vPro in this box prior, Probably not, would I now pay extra for it, that would be a YES!. if it fails again I’m going to just pull the drive, but seriously what a distraction that was to unhook cables, take out the drive, hook up to another system, copy file, replace, rehook, power up.

So now as I explore more devices in the home, I’m thinking more about “What if?” it needs to be remotely managed – what would I do, what is my baseline requirement.

Intel AT Update

mike.schulien@intel.com — Thu, 12 Nov 2009 14:09:32 GMT

Intel AT - that's Antitheft for most of us, the ability to "brick" or lock the PC at the hardware level - effectively turning it into a brick if it is lost or stolen. Intel AT has been available in the Lenovo ThinkPad line of laptops for just over a year:

Lenovo ThinkPad R400/500, T400/400s/500, and W400 along with the X200/200s/200 tablet and the X301.

New Product SKU's available now include:

Fujitsu Lifebook T5010 and the E6420
Panasonic Toughbook series (not all models are AT capable)

As we move into 2010 more OEM's will be bringing Intel AT support to their lineup as well; HP, Dell, Acer and ASUS will all have support for AT in early 2010. Other OEM's and regional LOEM's will also be bringing products to market later in 2010 - most of these will be be for the EMEA and APAC countrys.

Intel AT requires a service in order to utilize the features in the antitheft engine (part of the AMT Management Engine); Absolute Software offers its Computrace application that takes full advantage of Intel AT and allows the IT department to set both the lock down and timer parameters. Phoenix Software is another solution that is coming online (will be available late Q4 '09)and offers many of the features as Absolute. Both Absolute and Phoenix are SaaS solutions and require specific BIOS and Firmware in the PC - check with your OEM to make sure the service and Intel AT is available in the model PC you are planning to utilize. As we move into 2010 there will be other software vendors (ISV's) that will offer support for Intel AT as well as take advantage of new AT features, hard drive encryption keys that will be stored in the Management Engine (ME) there-by completely disabling both the PC and the hard drive once the PC is "Bricked" (the Hard Drive would not be able to be restored in another PC with out the Encryption keys). As we move closer to 2010 I will update this blog to include new features of Intel AT and the new ISV's as they come online.

Finding AMT Objects in Active Directory

pcgeek86@gmail.com — Wed, 11 Nov 2009 21:03:38 GMT

If you are using Out Of Band (OOB) Management in Microsoft System Center Configuration Manager (SCCM) 2007 SP1 (or greater) to manage your Intel vPro clients, you may have noticed that computer objects are created in your Active Directory domain during provisioning of the Intel vPro firmware. These computer objects are created by the amtproxymgr component of an OOB Service Point, and allow Intel vPro to communicate directory with Active Directory, regardless of the operating system state.

Since these vPro computer objects appear very similar to standard computer objects that are created when joining a Windows OS to an AD domain, it may be hard to distinguish which ones are vPro accounts, and which ones aren't. This situation can be worsened if you somehow have Windows computer accounts mixed into the same OU that contains your AMT objects.

As you'll see below, it's very easy to locate these computers using some simple PowerShell code:

$vprosearcher = [adsisearcher]"(&(objectclass=computer)(serviceprincipalname=*:16993*)(samaccounttype=805306368))"
$vproaccounts = $vprosearcher.FindAll()

These two lines of code simply create a System.DirectoryServices.DirectorySearcher instance, with some LDAP search criteria to identify the accounts, and then assigns the results of this search to a PowerShell variable called $vproaccounts. The default search root is the top-level of your Active Directory domain, and the default search scope is already set to SubTree, so you don't have to specifically configure these settings on the DirectorySearcher. Once you're at this point, you can simply enumerate the accounts, or pipe the results into a PowerShell ForEach loop, and perform some operation against them (for example, givem them a Description attribute value).

Because this code sample uses the "adsisearcher" type accelerator (aka. type shortcut), it will only work with PowerShell v2.0 (included as part of the Windows Management Framework), unless you modify PowerShell v1.0 to include it. There's almost no reason not to be using PowerShell 2.0, now that it has been officially released, however.

I recommend using the free Quest PowerGUI tool to develop and debug PowerShell scripts.

Cheers,

Trevor Sullivan