Intel vPro Expert Center Blog

Do it yourself - Power on, patch, and go back to sleep with 4, free .exes

jacob.gauthier@intel.com — Tue, 24 Nov 2009 19:42:30 GMT

Having worked with Intel Active Management Technology and Intel vPro Technology since version 1.0, it seems to me that there are a whole host of possibilities for those who are do-it-yourself-ers. One is the ability to programmatically wake a system, remotely trigger a process such as a software patch, and then put the system back to sleep. As it turns out, this is not so hard, even for me who has a limited scripting (read batch file) capability. The video chronicles the results of my effort.

Disclaimer: this is not meant as a how-to or best method. Rather, it is an exploration of what’s possible, meant to educate and stimulate conversation. With that out of the way, let’s get to the fun stuff.

To accomplish this goal I knew I'd need some help via command line tools. I did an Internet search and found these 4 freely downloadable tools that made it all possible. They are;

Remote Control Util - to determine the current power state and turn the system on.

PsService - to start a process remotely

PsShutdown - to put the system back to sleep

sleep.exe - so the batch file can sleep while an event takes place.

The setup is simple; 2 systems. One is the console that executes the batch file and these commands. The other is my vPro system. I setup and configured my it using this Use Case Reference design (another of my batch file creations). That is to say, there's no TLS and I'm using only the admin account. I then ran the batch file on the console system which triggered the whole process. The process is as follows:

1. Remote control util gets vPro's original power state via AMT (on, sleep, hibernate, or off)

2. Remote control util power's on vPro via AMT

3. Remote control util get's vPro's new power state to verify it has turned on

4. ping vpro and check the TTL. Once it changes to <=128 the OS has booted. For more info

5. PsService starts a process on vPro. I used notepad but it could be anything, including triggering a download and run of software patch

6. PsService exits when the process finishes

7. PsShutdown gracefully places vPro back to it's original sleep state

8. Remote control util get's vPro's new power state to verify it has returned to it's original power state

Couple of notes.

· I set an auto login on my vPro so I could see the process. However, PsService will work without a user being logged in. Also, it can run processes in the back ground so an end user would not be able to interact.

· I used Notepad as my remote process since it made it easy to see success. However, any process can be started. In fact, PsService supports downloading the executable to run. As such, it may be possible to download and then run a patch or batch file as part of this whole process

· I used a single vPro system. But, with a simple loop the same core batch file could trigger this action on many vPro systems.

Hope you found this post enjoyable and thought provoking. If you have your own do-it-yourself vPro ideas, or want to recreate this one, please share. And, hey, who says batch files are dead?

vPro: Windows 7 Migration with SCCM SP2

florence.lo@intel.com — Fri, 20 Nov 2009 01:04:00 GMT

Take a look at the posted document for step by step instructions on Windows 7 Migration with SCCM SP2. This document includes how to create an image using SCCM, Installing drivers, Installing Applications, Creating Hardlinks with the User State Migration Tool, and Renaming and Joining the domain. This document allows IT technicians to create an Win 7 image, deploy it to their environment using collections, and upgrade their existing Windows XP clients to Windows 7 clients without having to remove the data and put the data back. Included in this guide is some tips and hints on getting the image deployment to work for your company.

http://communities.intel.com/docs/DOC-4079

Finding AMT Objects in Active Directory

pcgeek86@gmail.com — Wed, 11 Nov 2009 21:03:38 GMT

If you are using Out Of Band (OOB) Management in Microsoft System Center Configuration Manager (SCCM) 2007 SP1 (or greater) to manage your Intel vPro clients, you may have noticed that computer objects are created in your Active Directory domain during provisioning of the Intel vPro firmware. These computer objects are created by the amtproxymgr component of an OOB Service Point, and allow Intel vPro to communicate directory with Active Directory, regardless of the operating system state.

Since these vPro computer objects appear very similar to standard computer objects that are created when joining a Windows OS to an AD domain, it may be hard to distinguish which ones are vPro accounts, and which ones aren't. This situation can be worsened if you somehow have Windows computer accounts mixed into the same OU that contains your AMT objects.

As you'll see below, it's very easy to locate these computers using some simple PowerShell code:

$vprosearcher = [adsisearcher]"(&(objectclass=computer)(serviceprincipalname=*:16993*)(samaccounttype=805306368))"
$vproaccounts = $vprosearcher.FindAll()

These two lines of code simply create a System.DirectoryServices.DirectorySearcher instance, with some LDAP search criteria to identify the accounts, and then assigns the results of this search to a PowerShell variable called $vproaccounts. The default search root is the top-level of your Active Directory domain, and the default search scope is already set to SubTree, so you don't have to specifically configure these settings on the DirectorySearcher. Once you're at this point, you can simply enumerate the accounts, or pipe the results into a PowerShell ForEach loop, and perform some operation against them (for example, givem them a Description attribute value).

Because this code sample uses the "adsisearcher" type accelerator (aka. type shortcut), it will only work with PowerShell v2.0 (included as part of the Windows Management Framework), unless you modify PowerShell v1.0 to include it. There's almost no reason not to be using PowerShell 2.0, now that it has been officially released, however.

I recommend using the free Quest PowerGUI tool to develop and debug PowerShell scripts.

Cheers,

Trevor Sullivan

vPro: Looking for a tool that will work with your ISV?

florence.lo@intel.com — Fri, 06 Nov 2009 00:16:47 GMT

Take a look at the posted document on Radmin (Remote Administrator). This free tool (Viewer) allows technicians to gain access to AMT basic functions and will work with any provisioned ISV under SMB or Non-TLS Enterprise Mode. This tool can be provided to IT Techicians who may not have access to the ISV console to perform the basic AMT functions on a provisioned client.

http://communities.intel.com/docs/DOC-4309

A Closer Look at ConfigMgr SP2

pcgeek86@gmail.com — Wed, 22 Jul 2009 14:51:09 GMT

Matt Royer wrote in June about some of the new AMT-related features being included in Service Pack 2 for Microsoft System Center Configuration Manager 2007. I recently installed ConfigMgr SP2 in my lab environment, and wanted to follow up on Matt's post by sharing some screenshots of the new AMT features, for those of you that may not be beta testing SP2

** The updated AMT Settings screen, which now features the option to set the power package for the management controller.

** The new Provisioning Schedule screen (no more editing your sitectrl.ct0 file!)

** The new main 802.1x & Wireless Profile Configuration screen (there are a couple of detail screens below)

** The new Wireless Profile Detail screen

** The new 802.1x Profile Detail screen

I don't have a provisioned client in my lab yet, but once I do, I will see if I can investigate the updated Microsoft OOB Console, and capture some screenshots. As Matt's post stated, there should be added functionality for inputting information into the 3PDS (Third-party data store), so I assume there will at least be that change.

Cheers,

Trevor Sullivan

Systems Engineer

AMT / ConfigMgr SQL Query: Mismatched Hostnames

pcgeek86@gmail.com — Tue, 21 Jul 2009 18:50:10 GMT

In IT environments where device naming standards may be coarse, or where users can freely rename their systems at will, you may experience problems managing these clients' AMT firmwares. Since, in order to maintain proper AMT functionality, the OS and AMT hostnames must match, an IT administrator or engineer would likely be interested in finding out which machines do not meet this criteria.

With that in mind, I've written a simple SQL query, that can be run against your Configuration Manager database, to determine what devices have mismatching OS and AMT hostnames. I've pasted the text below, but if you want a more nicely formatted version, please see this link at PasteBin.

/*
Author: Trevor Sullivan

Date: Tuesday, July 21st, 2009

Purpose: Identify devices whose AMT hostname and OS hostname mismatch
in the Configuration Manager database

select
-- Active Directory site name
[AD_Site_Name0] as 'AD SiteName'
-- AMT hostname (in provisioning record)
, [amt].[HostName] as 'AMT HostName'
-- OS hostname (should match AMT firmware)
, [sys].[Name0] as 'OS Hostname'
-- Retrieve UserID to identify device owner
, [UserName0] as 'UserID'
-- Hardware vendor
, [cs].[Manufacturer0] as 'Vendor'
-- Device model
, [cs].[Model0] as 'Model0'

from v_AMTMachineInfo [amt]

-- Join v_R_System to retrieve AD Site Name field
join v_R_System [sys] on [sys].[ResourceID] = [amt].[MachineID]
-- Joinv_GS_Computer_System to allow us to retrieve make/model information
join v_GS_Computer_System [cs] on [sys].[ResourceID] = [cs].[ResourceID]

where
-- We only want current resource records from ConfigMgr
[sys].[Obsolete0] = 0
-- This condition determines the mismatching hostname in the v_R_System and v_AMTMachineInfo SQL views
and [sys].[Name0] <> [amt].[HostName]

Cheers,

Trevor Sullivan

Systems Engineer

New Kids on the Block: TriActive joins the running of ISV's with vPro

kelsey.e.witherow@intel.com — Thu, 16 Jul 2009 21:49:36 GMT

TriActive, Inc., founded in 1997, has recently added AMT (vPro) capabilities to their software. This product is called Systems Management On Demand and you can read more about it here. In their own words, "TriActive was a pioneer of delivering Systems Management solutions using a SaaS (Software-as-a-Service) model to organizations of all sizes for laptops, desktops, servers, and network devices." (from their website) Below we have provided some screen shots of their newly acquired AMT capabilities...

Systems Management Overview Video
- LAN and Web-based remote control & diagnostics
- Intel vPro with AMT support when Microsoft Windows is not running
- Asset hardware, software, security inventory with change history
- Fully integrated SW delivery, Patch mgmt, License Compliance
Case Studies - From Newsweek to the YMCA, they've aquired a pretty good range of customers.
- "We were very keen on getting full infrastructure coverage almost instantaneously. TriActive's hosted service got us up and running within days. We did not have to install any software, and we have no software to maintain. TriActive promised us a solution that worked immediately, and that's what we got, without any of the hassles of typical software installations," says the CTO of Newsweek.

TriActive - Systems Management On Demand - Screen Shots

AMT Remote Options

AMT Status

AMT Event Log

Initiate SOL

SOL Boot to BIOS

AMT PowerOn

AMT PowerOff

To Chuck or Not To Chuck that Old Computer…

scott1.e.smith@intel.com — Wed, 01 Jul 2009 23:39:34 GMT

You’re a small businessperson, and the office computer guy (who actually knows nothing about computers, but was selected because he successfully hooked up a game console to his TV last Christmas) tells you that two of your 10 office PCs are down with viruses or “something,” bringing a halt to a customer proposal that’s on deadline. Two others in accounting keep pausing long enough for workers to take coffee breaks while the systems mull over their keystrokes, pushing the billing process into overtime. Revenue is at a standstill.

“What are my options?” you ask. “We could maybe buy some stuff to upgrade them, and call in a computer repair service,” the computer guy shrugs. Buying new computers in the economic downturn seems a questionable call. The computers are only three or four years old and likely you could get another year or two out of them.

Nonetheless, while you’re small, these decisions aren’t just about survival and cutting back spending. They’re about remaining competitive and having an edge when the Dow Jones climbs for real. And the business doesn’t run without computers. So, what do you tell your computer guy?

OK, I’m an Intel PR guy, so you know where this is going. Nonetheless, bare with me for a bit and there might be some ROI. Rob Crooke, VP for Intel’s Business Client Group, recently tackled some of the key questions around this dilemma in conjunction with a press briefing on a new study by Techaisle. The study looks at the financial aspects of maintaining computers for SMBs.

Here’s what the Techaisle study says: The average maintenance cost for a small business on a computer that’s more than three years old is $545. On the average, that includes $326 for maintenance, $99 for those upgrades you’re considering and $120 for out-of-warranty service costs. If you bought the extended warranty, reduce the latter. If you buy a new computer, the maintenance cost drops to $126, the first-year maintenance cost from a study by Jack Gold (Techaisle doesn’t provide a first-year cost.) So, the difference is $419.

“Yeah, sure,” you say, “but I have to buy a new computer!” Yes, but let’s see how that $419 might cut the pain. PDS has Intel Core2 Duo-based desktop PCs starting at $540 and CDW offers notebooks beginning at $700. If you add Intel vPro for additional manageability and security, you could move up for $699 and $830, respectively. So, you can buy the new desktop system for as low as $121, a 15-month payback. Now, if you’re larger than small, say 50-100 employees, you can see from the chart below that the payback is less than a year, and will actually make you a $40 profit. OK, OK, I’m a PR guy, but cut me some slack. I’m not making up the numbers.

Now that’s just the hard dollars that Techaisle captured. A new PC can have other benefits – reduced downtime from viruses, improved energy efficiency and enhanced productivity to name a few. So, maybe investing a few dollars could save you money in the slightly longer run and possibly help you keep your revenue flowing.

For more information, you might want to look at the Techaisle study. For a quicker overview check out the fact sheet and white paper, or better see the media briefing with Rob Crooke, ASUSTeK and Gigabyte.

OOB Console Error

pcgeek86@gmail.com — Mon, 22 Jun 2009 20:50:08 GMT

Hello vPro Experts!

Are you having trouble getting the Microsoft Out-of-Band (OOB) Console to connect to your Intel vPro clients? If so, one of the first things you should do, is enable verbose logging in your OOBConsole.exe.config file. This file is located in the following folder: %PROGRAMFILES%\Microsoft Configuration Manager Console\AdminUI\bin. If you open this file in Notepad, you should see a line that looks like <source name="OOBConsole" switchValue="Error">. If you change the text Error to Verbose, you will enable verbose logging for the OOB Console. The next time you try to connect to an AMT device, you should start seeing more detailed logging in the OOBconsole.log file, located in: %PROGRAMFILES%\Microsoft Configuration Manager Console\AdminUI\AdminUILog.

If you're seeing this message specifically: GetAMTPowerState fail with result:0x800401F3, then you might have forgotten to install WinRM 1.1 on your Windows XP client running the OOB console. Also make sure that you're running Windows XP Service Pack 3! Once you install WinRM 1.1, this error should magically disappear, and have you well on your way to managing vPro devices!

Cheers,

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

Microsoft OOB Console Requirement

pcgeek86@gmail.com — Mon, 08 Jun 2009 17:24:06 GMT

Hello vPro Experts!

I would like to pass on some information that I discovered a while ago, based on a Microsoft Premiere Support ticket. I was having trouble getting the Microsoft Out-of-Band (OOB) Management Console functioning from a Windows XP system. I tried everything on a fresh, standard build of Windows XP, but nothing would work.

After working with Premiere Support, we finally discovered that Windows XP Service Pack 3 (SP3) was required for proper functioning of the Microsoft OOB console.

This behavior is actually related to some functionality that was added in SP3, specifically in the winhttp.dll library. There is a function called WinHttpSetOption in the WinHttp library, which is called with a parameter enabling the WinHttp Option Flag named WINHTTP_ENABLE_SPN_SERVER_PORT. This flag enables the WinHttp library to include the server port in the Kerberos Service Principle Name (SPN), since the AMT web service is running on a non-standard HTTP port (16993).

The Windows XP Service Pack 2 (SP2) version of the WinHttp library does not include this capability, and consequently fails to authenticate. In order to properly connect to ConfigMgr-provisioned AMT devices with the Microsoft OOB Console, please make sure your helpdesk / support systems are running Windows XP SP3.

If you have any questions, feel free to post them in the comments section, and I will do my best to answer them.

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

Intel AMT DTK: Synchronous Connections

pcgeek86@gmail.com — Tue, 02 Jun 2009 20:17:27 GMT

Hello vPro Experts,

In case you've worked with any of the Powershell code samples I've previously posted, you've probably noticed that the AmtSystem.Connect() method executes asynchronously, and returns immediately. In this case, you'd have to develop some sort of loop in order to determine whether or not the connection was successful. Typically, I would just use this code to prevent a script from continuing before the connection was established:

while ($amtdevice.State -eq "Connecting") { Start-Sleep 1 }

But that's ugly, because, what happens if it never connects? Although it's nice to have the ability to asychronously connect to AMT devices, writing code and understanding the logic, to handle async processes is significantly more difficult than writing code that is synchronous. For this reason, we will look at how to modify and recompile the ManageabilityStack .NET assembly in the Intel AMT Developer Toolkit (DTK) to allow synchronous connections to AMT from PowerShell code.

In order to perform the next steps, you'll need the following:

The Intel AMT DTK source code
Microsoft Visual Studio 2008 (the Express edition is fully functional and free!)
Microsoft Windows PowerShell 1.0 or 2.0 CTP3

Once you've installed these components, continue on:

Download the Intel AMT DTK source code and extract to a folder
Navigate to <Source>\Manageability Stack and open the Manageability Stack.csproj file in Visual Studio 2008
Open the AmtSystem.cs file in the Visual Studio Solution Explorer
Rename the Connect() method to ConnectAsync()
Copy the following code above the ConnectAsync() method:
public void Connect()
{
   if (State != AmtSystemObjState.Disconnected) return;
   ChangeState(AmtSystemObjState.Connecting);
   ConnectEx(this);
}
In the Visual Studio Solution Explorer, right-click the Manageability Stack project, and click Build
Go to your <Source>\Manageability Stack\obj\Debug folder, and grab your new ManageabilityStack.dll .NET assembly

Now that you have a recompiled ManageabilityStack assembly, you can load this into PowerShell, and connect synchronously using the Connect() method!

Update: I attached the AmtSystem.cs file to this blog post, if you're not comfortable modifying source code yourself! You'll still need to replace the file, open the project, and recompile the library though

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

Leveraging Serial over LAN for Live CD status updates

daniel.w.brunton@intel.com — Thu, 07 May 2009 23:59:26 GMT

Serial over LAN, or SOL for short, is a great tool for diagnostics. Combined with IDE redirection, or IDER, there’s a tremendous amount of things you can do remotely to manage clients. One of the areas where SOL can be helpful is for delivering status updates for IDER boot images that use a graphical interface. Instead of asking someone to read what’s on the screen to you, you can have a clear picture of what’s going on.

The key to this is to include the SOL driver in your live CD boot image. The actual process of including this driver will vary depending on the live CD tools you are using. I won’t go into specific details on the steps needed to include the driver in this post. The popular live CD tools, such as the Windows AIK, have a lot of information available on how to include drivers.

Once you have the SOL driver included in your live CD you can begin to take advantage of the SOL interface by sending text output to the SOL serial port. In most cases the port is COM3, but it may be on another COM port. You will need to do some testing to see which COM port your hardware platforms use for SOL.

Here’s one common scenario where this can be very handy. Let’s say you have a live CD that includes an in-band remote access tool, like PC Anywhere or a VNC server. You can include a startup script that echo’s out the computer’s hostname and IP address information to COM3. That way, you will know when the live CD has booted and the information it may have registered with DNS/DHCP. If you are using a Windows based live CD all you need to do is include commands like this:

echo %computername% >com3

ipconfig >com3

You can even incorporate some ANSI control codes to control formatting. For instance, if you want to have the remote SOL terminal clear it’s screen, you can send the Esc+[2J. The trick is generating the “Esc+” part. In order to do this in Windows, you need to hold down the Alt key, press 0027 on the ten key pad (make sure you include the two zeros) and then let the Alt key go. Unfortunately, Notepad does not seem to support this functionality. As an alternative, I recommend using Notepad++. Once you are done, you should have something like this:

echo ^[[2J >com3

Note: The escape character may appear as "^[" or something else altogether, like a little arrow or block character. It depends on your OS and application.

Here’s an example of the output I get from a Live CD I built using Bart’s PE Builder.

Video Demo of Incendio vMinder Portal: Operational Integration of Intel® vPro™ Technology

justin.van.buren@intel.com — Mon, 04 May 2009 21:19:38 GMT

While at Symantec ManageFusion 2009, we had a chance to talk with Mike Dunham, Executive Director of Product Management for Incendio Technology. In the video below, he talks about the Incendio vMinder Portal, which allows IT profrossional to utilize the Symantec Altiris Client Management Suite without needing console access. From the Incendio vMinder Portal, the IT professional can access Intel vPro technology features such as reliable remote power control that are part of the Symantec Altiris Client Management Suite.

To learn more about Intel's presence at Symantec ManageFusion 2009, go to: http://www.intel.com/go/managefusion/

Intel® vPro™ Technology Readiness Reporting with NetX Appliance

justin.van.buren@intel.com — Mon, 04 May 2009 21:07:47 GMT

While at Symantec ManageFusion 2009, we had a chance to talk with Antwune Gray, a Director at NetX. In the video below, he talks about how the NetX Appliance discovers which PCs in your business environment have Intel vPro technology, as well as the version and setup status of Intel vPro technology.

To learn more about Intel's presence at Symantec ManageFusion 2009, go to: http://www.intel.com/go/managefusion/

Video Testimonials from Fortune 1000 IT Managers on the Security Benefits of Intel vPro Technology

justin.van.buren@intel.com — Mon, 04 May 2009 21:03:02 GMT

While at Symantec ManageFusion 2009, we had a chance to talk to IT executives and managers from Disney International, Fox Interactive Media, Blue Cross Blue Shield and McCormick Spice Company and industry analysts from Enterprise Management Associates and Ptak, Noel & Associates LLC. In this video, they talk about the security benefits of Intel vPro technology - which include the ability to deploy software patches faster into the installed PC base, and the ability to quarantine infected PCs and remotely remediate them.

To learn more about Intel's presence at Symantec ManageFusion 2009, go to: http://www.intel.com/go/managefusion/