Intel vPro Expert Center Blog

Do it yourself - Power on, patch, and go back to sleep with 4, free .exes

jacob.gauthier@intel.com — Tue, 24 Nov 2009 19:42:30 GMT

Having worked with Intel Active Management Technology and Intel vPro Technology since version 1.0, it seems to me that there are a whole host of possibilities for those who are do-it-yourself-ers. One is the ability to programmatically wake a system, remotely trigger a process such as a software patch, and then put the system back to sleep. As it turns out, this is not so hard, even for me who has a limited scripting (read batch file) capability. The video chronicles the results of my effort.

Disclaimer: this is not meant as a how-to or best method. Rather, it is an exploration of what’s possible, meant to educate and stimulate conversation. With that out of the way, let’s get to the fun stuff.

To accomplish this goal I knew I'd need some help via command line tools. I did an Internet search and found these 4 freely downloadable tools that made it all possible. They are;

Remote Control Util - to determine the current power state and turn the system on.

PsService - to start a process remotely

PsShutdown - to put the system back to sleep

sleep.exe - so the batch file can sleep while an event takes place.

The setup is simple; 2 systems. One is the console that executes the batch file and these commands. The other is my vPro system. I setup and configured my it using this Use Case Reference design (another of my batch file creations). That is to say, there's no TLS and I'm using only the admin account. I then ran the batch file on the console system which triggered the whole process. The process is as follows:

1. Remote control util gets vPro's original power state via AMT (on, sleep, hibernate, or off)

2. Remote control util power's on vPro via AMT

3. Remote control util get's vPro's new power state to verify it has turned on

4. ping vpro and check the TTL. Once it changes to <=128 the OS has booted. For more info

5. PsService starts a process on vPro. I used notepad but it could be anything, including triggering a download and run of software patch

6. PsService exits when the process finishes

7. PsShutdown gracefully places vPro back to it's original sleep state

8. Remote control util get's vPro's new power state to verify it has returned to it's original power state

Couple of notes.

· I set an auto login on my vPro so I could see the process. However, PsService will work without a user being logged in. Also, it can run processes in the back ground so an end user would not be able to interact.

· I used Notepad as my remote process since it made it easy to see success. However, any process can be started. In fact, PsService supports downloading the executable to run. As such, it may be possible to download and then run a patch or batch file as part of this whole process

· I used a single vPro system. But, with a simple loop the same core batch file could trigger this action on many vPro systems.

Hope you found this post enjoyable and thought provoking. If you have your own do-it-yourself vPro ideas, or want to recreate this one, please share. And, hey, who says batch files are dead?

PC Refresh Cycles and Windows 7 … what’s the financial connection?

julie.a.whitcraft@intel.com — Tue, 24 Nov 2009 04:29:06 GMT

It’s understandable that in today’s economy that you might consider pushing out your PC refresh cycle to save cash today. This is an area of cost cutting that many companies consider so you’re not alone. But if you have considered, or are considering, pushing out your PC refresh cycle, have you factored in all of the costs that impact that decision? These costs include the unexpected costs of supporting older machines once the warranty has expired, higher energy costs compared to new machines, and more. The total cost of ownership starts to increase out in time and will eventually reach a point where it makes more sense to replace your PCs versus continuing to maintain them. But how do you know what the optimal replacement time is? And is delaying your refresh really the best financial decision?

There are strong financial reasons to refresh PCs now and, with the Windows 7 operating system, there are even stronger reasons to do so with PCs powered by Intel® Core™ 2 processors with vPro™ technology. Join me for a webcast on Tuesday, December 1^st, where I’ll walk through our analysis on the PC refresh cycle and the framework we use, discuss the true cost of older PCs and how to assess your own PC refresh cycle, and share our experience with Windows 7 as part of the Technical Adopter Program (TAP). I’ll also be joined by Amy Stephan from Microsoft who will provide more insight into why it makes sense to refresh now and why Windows* 7 and New PCs with Intel® vPro™ Technology are better together.

TechEd Europe 2009 - Win7

josh.hilliker@intel.com — Fri, 20 Nov 2009 17:21:16 GMT

At TechEd Europe 2009, Microsoft's Keith Mayer outlines how manageability can be achieved with Windows 7, Windows Server 2008 R2 and Intel's Westmere-EP.

vPro: Windows 7 Migration with SCCM SP2

florence.lo@intel.com — Fri, 20 Nov 2009 01:04:00 GMT

Take a look at the posted document for step by step instructions on Windows 7 Migration with SCCM SP2. This document includes how to create an image using SCCM, Installing drivers, Installing Applications, Creating Hardlinks with the User State Migration Tool, and Renaming and Joining the domain. This document allows IT technicians to create an Win 7 image, deploy it to their environment using collections, and upgrade their existing Windows XP clients to Windows 7 clients without having to remove the data and put the data back. Included in this guide is some tips and hints on getting the image deployment to work for your company.

http://communities.intel.com/docs/DOC-4079

Newsletter Published: Radmin, Webinars, Intel AT, and real world examples

michele.gartner@intel.com — Fri, 20 Nov 2009 00:53:47 GMT

This issue of the newsletter has some good content about using Intel vPro Technology. A new use case reference design was published recently; this one has to do with using Radmin to perform basic Intel AMT functions on a managed client. (What's a use case reference design? Read my blog: New stuff in the community: Use Case Reference Designs) You'll also find links to a white paper about Failsafe and Intel Anti-Theft Technology, a registration link for a Windows 7 webinar that's coming up, and some real-world stories about companies that have implemented Intel vPro technology in their environments.

Read the newsletter or subscribe to receive it in your inbox automatically. This newsletter goes out every two weeks.

Enjoy!

Miss the Win7 and Intel vPro technical webinar? Recording now available.

michele.gartner@intel.com — Wed, 18 Nov 2009 22:00:55 GMT

Webinar Recording

If you missed the live event, you can now watch the recording! You can also download the webinar.

Webinar Slides

Want to download the deck? It's attached to this blog post (scroll to the bottom).

Demonstrating vPro: Internationalization (or the lack thereof)

terry.c.cutler@intel.com — Mon, 16 Nov 2009 22:52:29 GMT

Sharing an experience and looking to validate some of the challenges vPro demonstration might present in markets outside of North America - especially if the original demonstration environment was created in North America.

A few weeks ago I had the opportunity to travel to Germany for a training event. The equipment for the training event was sourced locally in Germany. The result was 13 systems. (For those that are superstitious – you might quickly identify that this will get interesting).

Among those 13 systems, there were 4 different OEMs, 3 different keyboard layouts (US, UK, German), 3 different power connectors, 2 generations of Intel AMT (2.6 and 4.x), 3 different versions of Windows (XP, Vista, and Win7), 2 different versions of VMware workstation, and a single VMware workstation image created in North America. Very little standardization. A perfect recipe for disaster.

This was my first experience in working with differences that went beyond just QWERTY vs. QWERTZ keyboards. The password used for the operating system and applications included the @ key. This was problematic since on a US-based keyboard the location of '@' is Shift-2, yet a German keyboard is AltGr-Q (press and hold key to right of spacebar, then press Q), and a UK-keyboard is Shift-‘ (press and hold shift, then press ‘ key which is located on third row third key from the right side). Fortunately I didn’t have to deal with keyboards outside of Latin letters (i.e. A, B, C, etc) – although there are exceptions like the German letter β.

My first realization of internationalization troubles was that BIOS\MEBx screens and key sequences were US-keyboard QWERTY based regardless of the keyboard layout. I had to ask myself - "Is this always true?". Since the password included the @ symbol - mentally I had to follow the US-keyboard layout, althought the sequence wouldn't match the printed keys on the system.

When in the host operating system, the “Regional and Language settings” were commonly set to the origin of that system (expect one system which had UK keyboard with US-based Windows Regional and Language settings). My frustration did not end there – as the VMware environment was set to US-based Regional and Language settings, and had to be adjusted on a per-system configuration basis.

Not all of the windows menus and options were in the same locations between English and German, yet there were similarities. With the differences of languages between BIOS\MEBx, host windows operating system (with VMware workstation), and demonstration environment – some real-time translation or best guess had to be done. I know some German, thus I was able to navigate through menus in the host operating system or VMware application, yet it slowed setup and troubleshooting situations. Fortunately those attending the training knew English better than my German language skills... but frustrating nonetheless.

The good news – the underlying vPro functionality was the same, the training was delivered, and a new perspective was obtained by myself and those who received the training.

In talking with my international associates, a few more points were brought to my attention:

difference of calendars (for example, those that use Buddhist calendaring system) which may affect Kerberos and certificates
application installations may fail when using a foreign language
Remote configuration certificate is issued to one domain (i.e. domain.company.com) yet will not support international domains (i.e. intldomain.company.com.uk)... this one is actually fixed in the latest firmware and will be explained in a separate article

There are likley other subtleties to the challenges of internationalization

Does this all sound familiar to those outside of the US?

The experience was good for me. I gained a brief look into much larger challenges on standardizing a technology solution across the globe.

Finding AMT Objects in Active Directory

pcgeek86@gmail.com — Wed, 11 Nov 2009 21:03:38 GMT

If you are using Out Of Band (OOB) Management in Microsoft System Center Configuration Manager (SCCM) 2007 SP1 (or greater) to manage your Intel vPro clients, you may have noticed that computer objects are created in your Active Directory domain during provisioning of the Intel vPro firmware. These computer objects are created by the amtproxymgr component of an OOB Service Point, and allow Intel vPro to communicate directory with Active Directory, regardless of the operating system state.

Since these vPro computer objects appear very similar to standard computer objects that are created when joining a Windows OS to an AD domain, it may be hard to distinguish which ones are vPro accounts, and which ones aren't. This situation can be worsened if you somehow have Windows computer accounts mixed into the same OU that contains your AMT objects.

As you'll see below, it's very easy to locate these computers using some simple PowerShell code:

$vprosearcher = [adsisearcher]"(&(objectclass=computer)(serviceprincipalname=*:16993*)(samaccounttype=805306368))"
$vproaccounts = $vprosearcher.FindAll()

These two lines of code simply create a System.DirectoryServices.DirectorySearcher instance, with some LDAP search criteria to identify the accounts, and then assigns the results of this search to a PowerShell variable called $vproaccounts. The default search root is the top-level of your Active Directory domain, and the default search scope is already set to SubTree, so you don't have to specifically configure these settings on the DirectorySearcher. Once you're at this point, you can simply enumerate the accounts, or pipe the results into a PowerShell ForEach loop, and perform some operation against them (for example, givem them a Description attribute value).

Because this code sample uses the "adsisearcher" type accelerator (aka. type shortcut), it will only work with PowerShell v2.0 (included as part of the Windows Management Framework), unless you modify PowerShell v1.0 to include it. There's almost no reason not to be using PowerShell 2.0, now that it has been officially released, however.

I recommend using the free Quest PowerGUI tool to develop and debug PowerShell scripts.

Cheers,

Trevor Sullivan

Webcast: Spend Smart, Do More & Be More Secure

julie.a.whitcraft@intel.com — Wed, 11 Nov 2009 00:43:19 GMT

In today’s environment, the pressure to justify any investment is high and often, delaying your PC refresh cycle seems like an easy answer. Join me tomorrow for a webinar with Dave Bowers from Dell for a discussion on the financial reasons to renew, redeploy and refresh an aging PC fleet. We’ll cover key areas to consider that can impact the total cost of ownership for your PC fleet – such as energy savings, security, and productivity. We’ll also provide you with access to tools that you can use to develop your own analysis and assist you in your budgeting conversations for next year. Learn more about optimizing your PC refresh cycle and reducing your total costs.

New stuff in the community: Use Case Reference Designs

michele.gartner@intel.com — Mon, 09 Nov 2009 23:14:47 GMT

We've started to add some new content to the community over the last couple of months that we're pretty excited about - Use Case Reference Designs. Have you checked them out yet? We have a team focused on creating these drop-in solutions that help you start seeing the benefits of Intel vPro technology as soon as possible.

Check Them Out

Radmin* - Help Desk Tool for Use With Intel vPro TechnologyHelp desk personnel don't usually have access to the management console. This use case reference design shows how the help desk tech can use Radmin to perform basic Intel® AMT functions.

Windows* 7 OS, Microsoft* ConfigMgr SP2 and Intel® vPro™ Technology Use Microsoft ConfigMgr to wake up your vPro systems that are running Windows XP, install Windows 7 on them, link the data back & *poof* the machine will be migrated the next time the user logs in.

Intel AMT Firmware Update Using Microsoft Configuration Manager 2007 SP1 and Intel vPro TechnologyThis use case reference design is helpful if you are activating your vPro fleet on your own - and helps you perform Intel AMT firmware version detection and updates using Microsoft Configuration Manager 2007 SP1.

Local Setup and Configuration Using a USB Flash DriveThis is a new one from Jake Gauthier- just published today! This use case reference design shows how a small/medium business can speed up the setup and configuration process.

And here's the library of Use Case Reference Designs:Use Case Reference Designs for Intel vPro Technology

What's Next?

The team has some really cool stuff planned:

Remote remediation solution which will allow a help desk tech to mount the vPro client's drive remotely - the help desk tech could then do things like run local anti-virus software to do a remote scan for threats on the mounted drive.

Remote KVM. The engineers are developing a standalone solution so that you can start using the remote KVM functionality the day that Intel AMT 6.0 launches. Why is this big? Because your management console won't have this support yet!

vPro used for all the wrong reason's

josh.hilliker@intel.com — Fri, 06 Nov 2009 18:07:12 GMT

Thewebsiteisdown.com gives us a new installment. While I agree this is possible from the admin standpoint, I don't encourage you to try it at this scale.

vPro: Looking for a tool that will work with your ISV?

florence.lo@intel.com — Fri, 06 Nov 2009 00:16:47 GMT

Take a look at the posted document on Radmin (Remote Administrator). This free tool (Viewer) allows technicians to gain access to AMT basic functions and will work with any provisioned ISV under SMB or Non-TLS Enterprise Mode. This tool can be provided to IT Techicians who may not have access to the ISV console to perform the basic AMT functions on a provisioned client.

http://communities.intel.com/docs/DOC-4309

Known Issues wiki: LANDesk, MS ConfigMgr, Remote BIOS update, and more.

michele.gartner@intel.com — Thu, 05 Nov 2009 15:19:31 GMT

Here's a compilation of some of the issues that were added in the last few months to the Known Issues, Best Practices, and Workarounds wiki:

Check out the latest newsletter for Intel vPro Technology

michele.gartner@intel.com — Wed, 04 Nov 2009 20:29:34 GMT

Our most recent issue of the Intel vPro Technology Heartbeat was published this morning. This newsletter is a compilation of Intel vPro resources that were collected over the last two weeks. In this issue, check out the article series on Intel Active Management Technology that was published by our partners at the Intel Software Network's Manageability community. We also have a bunch of webinars coming up around Windows 7 and Dynamic Virtual Computing. Registration links are in the newsletter!

Read the newsletter, or subscribe to receive it in your inbox automatically.

vPro: Are you experiencing a very large IntelAMT database?

terry.c.cutler@intel.com — Wed, 04 Nov 2009 15:23:55 GMT

Take a look at a recently posted document providing insights on what might cause a rapidly expanding database, key learnings how to minimize the growth and provide good performance, and more.

http://communities.intel.com/docs/DOC-4306

The document may be updated over time, depending on requests, inputs, and so forth