Have you ever wondered why an the Altiris Real-Time Console responds slowly? This is especially evident when doing training or demonstrations - you double click on a provisioned systems resource, which opens the real-time console. When selecting on the real-time tab - the clock pops up and spins for a little bit... and finally you are able to access the page.

Well - some tuning might help that situation. Take a look at http://juice.altiris.com/node/4071

In case you didn't click on the link - the short answer is that the Altiris console is attempting 4 connections - ASF, AMT, WMI, and SNMP. If all you need is AMT, or perhaps AMT and WMI - save a few threads and time by disabling the unneeded authentications. This is more than just leaving the entries blank in the configuration profile - it also involves registry changes. There are other excellent suggestions\inputs on the page. Click on the link above!

Come see us at ManageFusion 2008 in Orlando!!

October 14-16, 2008

JW Marriott Grande Lakes, Orlando

http://www.managefusion.com/

This is your opportunity to talk with the experts face-to-face, experience the technology, hear how others are utilizing the technology, and more!!

Here's a quick summary of the Intel lineup

Intel Booth (#1)

See compelling Intel® vPro technology demos focusing on: Dynamic Virtual Client (streaming applications), manageability and client-initiated remote access.

Take part in the Intel Passport Program and receive a bamboo running cap. Also, enter to win an Intel® Centrino® notebook.

Participate in the IT Quest and get a T-shirt. And, you can enter to win an Intel® Centrino® notebook.

Tuesday, October 14

Opening Keynote: 9-10:30 am

Gregory Bryant takes part in Steve Morton's road trip.

Hands-On Lab: 10:45 -11:45 am

AP L02: Eliminate Network Attacks during Remote Software Deployment

Abstract: Protecting networks and PCs from potential threats is a full-time job; however, Intel® vPro^TM technology can help IT administrators streamline the process and better protect clients and block network access. Network filtering software is commonly used to protect the network from a client, or protect the client from a potential threat on the network. Intel vPro technology enables IT administrators to easily deploy software without making a deskside visit and even though the filter is engaged, the Notification Server can still manage the client. During this lab, attendees will learn how to deliver software and update the client while the network filters are engaged.

Instructors: John Dickensheets (ITS), Terry Cutler (Intel), Lee Bender (Symantec)

Breakout Session: 2:15-3:15 pm

AP B05: Implement Intel® vPro Technology Today

This session will give you a nuts to bolts overview of what's needed to realize the benefits of implementing Intel® vPro technology. During the session attendees will learn which OEMs are using Intel vPro technology in their PCs, the value of the Intel/Symantec solution along with implementation options and tools that facilitate self activation. If that's not enough, you will also find out which partners can assist in implementation. This is a must-attend session for those who are Intel vPro technology-serious.

Instructors: Tracie Zenti (Intel) and Matt Bingham (Symantec)

Wednesday, October 15

Breakout Session: 10:30-11:30 am

AP B09: What's Keeping You Awake At Night? Interact with Industry Experts and IT Professionals.

Abstract: This session is designed to be an interactive Q&A with the audience. Peter Kastner, industry analyst will act as moderator and attendees will hear his take on industry trends, issues and what companies are facing when it comes to their IT infrastructure. Panel members will also discuss IT pain points and how to meet the ever-changing, end-user management and security needs. Material will also address how Intel and Symantec are helping IT organizations improve efficiencies, reduce costs and prepare for the future. Presentations will be brief with most of the time devoted to taking questions from the audience.

Panel Members: Peter Kastner (Industry Analyst), Chad Perniciaro (Valerent, Inc.), Kevin Unbedacht (Symantec), Josh Hilliker (Intel), and Other participants TBD

Hands-On Lab: 12:45 -1:45 pm

*AP L02: Eliminate Network Attacks during Remote Software Deployment*

Abstract: Protecting networks and PCs from potential threats is a full-time job; however, Intel® vPro^TM technology can help IT administrators streamline the process and better protect clients and block network access. Network filtering software is commonly used to protect the network from a client, or protect the client from a potential threat on the network. Intel vPro technology enables IT administrators to easily deploy software without making a deskside visit and even though the filter is engaged, the Notification Server can still manage the client. During this lab, attendees will learn how to deliver software and update the client while the network filters are engaged.

Instructors: John Dickensheets (ITS), Terry Cutler (Intel), Lee Bender (Symantec)

Through trial and error I've come across a working method for installing Intel's Setup and Configuration Service (SCS) on a server that does not have Notification Server, and thus Out of Band Management, installed. When NS is installed, all rights, etc, are already assumed by logging in as the Application Identity. Intel SCS installs fine this way, but when on a separate server certain prerequisites and configurations need to be met before the installed SCS will function properly.

Introduction

For the best results, the prerequisites should be met before hand. If SCS has already been installed, the necessary components can be added or configuration changed to support it properly. The first section of this article I'll assume we'll do the install from scratch, while with the second I'll cover how to reconfigure SCS if it has already been installed so it works successfully. This is with version 6.2 of Out of Band Management Solution.

New SCS Installation

NOTE: This is for an Intel SCS installation that is not on an existing Notification Server with Out of Band Management installed.

First, we need to prep the system for the actual install of Intel SCS. The following components are required for Intel SCS to function normally:

• Windows 2000 Server, Windows 2003 Server

• Internet Information Services (IIS)

• Microsoft .NET 2.0

Run through the following steps to install Intel SCS. I've assumed the above prerequisites have already been met.

1. Log onto the system as the Application Identity user for Notification Server.

2. Using the ‘Pull' method, install the Altiris Agent from the Server that houses Out of Band Management:

1. Typically the URL is formatted as: http://%3cnsname%3e/Altiris/NS/Agent/AltirisAgentDownload.aspx.

2. Use the resulting page to download and install the Altiris Agent. Typically it takes a few minutes to complete the process of installing and registering with the Notification Server.

3. If needed, provide the App ID account local administrator rights on this Server. In one case this was not the case, and the service was unable to connect to the NS.

4. Browse to the following path on the NS:
   <NS_Name>\NSCap\Bin\Win32\X86\OOB\IntelSCS\

5. Launch the EXE AMTConfServer.exe.

6. Click ‘Next' on the Welcome screen and accept the license agreement and click ‘Next'.

7. Choose ‘Complete' as the type of setup and click ‘Next'.

8. In the User name and Password fields put in the Application Identity for the NS.

9. Check the Web details.

10. Leave ‘Force Secure Connections (HTTPS)' checked if you will use TLS to encrypt AMT traffic, or uncheck it if you will not be using TLS. Click ‘Next'.

11. Under ‘Database Server' select the database name and instance to use. This should be the SQL Server used to install the IntelAMT database when OOB was originally installed on the notification Server, or if the database was never created, this should be the same server and SQL Instance where the Altiris database that hosts Out of Band Management is installed.

12. Check the database details. Click ‘Next'.

13. Click the ‘Install' button to proceed with the install using the parameters set.

14. If the IntelAMT database was previously created, you'll receive a notice saying that the database IntelAMT already exists. Make sure to click ‘Yes' so it uses the existing one. This is especially important if you have provisioned systems already in the database. If no database exists by name IntelAMT, a new one will automatically be created and no prompt will appear.

15. At the Complete screen, leave the ‘Start Intel® AMT Config Service' checked and click ‘Finish'

16. From the Notification Server, at this location:
    <NS_Name>\c$\Program Files\Altiris\OOBSC\, copy the file oobprov.exe to the same path on the SCS Server (default will be C:\Program Files\Altiris\OOBSC\).

17. NOTE! You must use the same path that it used on the Notification Server, this is a limitation with our implementation at this time.

18. Copy to the same folder the attached file Interop.AeXClient.dll.

1. Normally the script (oobprov.exe) is properly registered to the correct path, but if it is not, we must manually change it.
   NOTE: Using this option to install SCS on a different server than the NS often leaves the csti_configuration table poorly configured. If this is the case, the following two steps must be done to fix the problem.

2. Open SQL Query Analyzer or SQL Enterprise Manager. Run the following query:

1. USE IntelAMT
   SELECT Props_script_path, use_props_script
   FROM csti_Configuration

3. Check the path and make sure it matches the remote and local Intel SCS install. Also verify that the use_props_script is set to 1, which means ‘True' (0 means ‘False'). Now run the following query if they need to be updated, but take note to change the path to match your environment:

1. UPDATE csti_configuration
   SET props_script_path = ‘C:\Program Files\Altiris\OOBSC\oobprov.exe'
   SET use_props_script = 1
   WHERE configuration_id = 1

4. Everything should now be in place for the new Intel SCS install to work with systems being provisioned, including all maintenance and post-provisioning actions.

5. As one last check, let's ensure the Intel SCS installation registered itself in the IntelAMT database. If this part has failed the service AMTConfig will not be able to start, throwing an exception about database connection in the Application Event Log.

6. On the Database Server, run the following query:
   USE IntelAMT
   SELECT * FROM csto_servers

7. You should have one entry for every Intel SCS install you've completed, even the original OOB install if you also installed Intel SCS originally on the NS. Note the server_name column to contain the name of the server you installed Intel SCS onto. If it is not here the problem generally stems from SQL database access rights on the SQL Server. Please ensure the account you are using has rights to create a new database, or update an existing one.

Fixing a Previous SCS Install

If you've already install SCS, and provisioning is not occurring (see the following article group for troubleshooting steps: http://juice.altiris.com/book/3699/troubleshooting-altiris-manageability-toolkit-vpro-technology), we need to go through the steps to provide the remote Intel SCS Install the necessary configuration to properly work with the remote IntelAMT database and Notification Server.

The following steps provide the right changes to ensure everything is setup correctly:

1. Log onto the Server with the NS Application ID.

2. Uninstall the Altiris Agent from the system. If it is not installed simply continue through the steps.

3. Check to ensure the account that is running the Intel SCS service, AMTConfig, has admin rights to the NS. If it does not, add the user to the Admin group on the Notification Server.

4. Check to ensure the Application ID has local administrative rights to the server Intel SCS is installed on.

5. Install or reinstall the Altiris Agent, ensuring it is pointing to the NS where Out of Band Management is hosted.

6. Once the five preceding steps are completed successfully, move to Database server and launch SQL Enterprise Manager against the IntelAMT database.

7. Run the following query:
   USE IntelAMT
   SELECT Props_script_path, use_props_script
   FROM csti_Configuration
   !csti_configuration.jpg!

8. Please note the following details from the resulting line:

• use_props_script - This column needs to be set to TRUE (1). If this is set to 0 no provisioning attempts will even be executed. I've seen this set to 0 at times.

• props_script_path - This value is passed to the Intel SCS service that's available to run oobprov.exe. This must be the same location on both the NS and the remote server.

• props_script_timeout - This timeout should be set at 180.

9. If the values are not set right, use the following query to update the table to have the correct values (note that the props_script_path may be different in your environment. If so, change the query to match your installation setup):
   UPDATE csti_configuration
   SET props_script_path = ‘C:\Program Files\Altiris\OOBSC\oobprov.exe'
   SET use_props_script = 1
   SET prop_script_timeout = 180
   WHERE configuration_id = 1

10. Once the above changes have been made, restart the AMTConfig service on the local Intel SCS Server to have all cached items dropped so the changes are filtered down properly.

Functional Intel SCS

The immediate question after installing and/or fixing an existing install of Intel SCS is are things working correctly? Time will definitely tell, but if you want to know immediately you can use the following process to check the workability of the install:

1. On the Intel SCS server, go into the Services Manager within Administrative Tools. Is the AMTConfig service running? If not, try to start it. Also check the Event Log for failures. If it stays running, it can successfully start and then connect to the IntelAMT database. Note that if it starts but then stops a minute or two later, the database is likely unreachable by the service.

2. On the Notification Server, browse in the Altiris Console from View > Solutions > Out of Band Management > Configuration > Provisioning > Logs > Actions Status. Do you see any successful Provisioning requests since the time you finished configuring the Intel SCS install?

3. If possible, manually configure a system to provision and see if it goes through. The reason the existing ones trying to provision may not work is due to IP Address changes that make it impossible or SCS to connect back to the system. New Hello Packets will remedy this situation in the long-term.

Conclusion

These processes should allow you to properly install and configure Intel SCS on a server that is not where the Notification Server and Out of Band Management are installed and running.

NOTE: If you have not read parts 1 through 4, please read these before reading this part as this is a continuation of the story begun in the previous sections. Altiris and Intel vPro Use Cases

Learning from previous mistakes, CSO Dan Williams discusses what they can do to better secure the powerful AMT functionality. Since the human factor is the biggest weakness, what can they do to strengthen this? Obviously they can't remove it altogether; might as well shut the company down. In Intel vPro the human factor can be minimized due to available strong security technologies. AMT can be made more secure, but the continuing threats are emphasized when a computer is hijacked. What can be done to regain control?

Mighty Modern Marketing HQ - Boston, Massachusetts

Bright sunlight filtered through the distant windows , overshadowing the bland fluorescent lights lit above. Jessica Langley watched the distant pedestrians seen in a narrow view near the street moving past with varying degrees of enthusiasm. The hot summer held to the south temporarily by a low pressure that brought in the cool Atlantic breezes. She imagined being able to hear the conversations of those passing, wondering what they spoke of, and if any of them had as crazy a life as her.

"Ah, this is the life," Tevita said as he leaned back. He placed his hands behind his head and stretched out his legs, pushing his office chair as far back as possible. With what looked like a deliberately casual gesture he tossed his headset onto his desk.

"You should be worried," Jessica commented dryly.

"Worried? Why?"

Jessica gestured sharply at her phone. "No one can call us with the phones down, so our work is just piling up while we sit here."

"Hey, we have our mobile phones. If it's not important enough for them to look up our numbers, then why worry about it?"

"You know that's not how it'll happen. As soon as the phones get up... WHAM! We're here until the sun drops below the trees in the west."

Tevita's smile lessened, but only a little. "They've been down for two hours. Perhaps they'll be down all day, and we can leave early."

"Right."

The Tongan shrugged, and Jessica briefly envied his ability to shove aside problems when they weren't directly in front of him. He could have two amazingly nasty issues to work on, and he'd easily concentrate on one at a time as if the other issue didn't exist. She wished she could compartmentalize in that manner, but when she had two critical issues to work on they hung over her like a dark shroud. Usually the one she wasn't currently working pressed down as if to accuse her of negligence, but she couldn't do two things at once. It wasn't like knitting while watching TV.

Like now, when she knew issues piled up while their phones remained down. She reached down and pulled up her mobile phone in case she'd missed an incoming call, but nothing showed. She sighed, standing up and stretching. Tevita frowned at her.

"You aren't going to bug the phone people again, are you?" he asked, as if accusing her of turning him in for some crime.

"No," she said. "Daniel Williams wanted to talk to me today so I'm heading up to his office."

"Good. Don't mention the phone issue to the CSO..."

She rolled his eyes at him, but he only smiled, large hands moving deftly across the keyboard. Without phone call interruptions Tevita would clear out the email queue in no time.

She took the stairs, hoping to work off the donut she'd eaten earlier that morning. It seemed no matter how resolute she thought she was to eat healthier, as soon as someone brought in free goodies her willpower vanished and she indulged. She doubted the climb from the first floor to the third made any real difference, but at least her husband wouldn't get on her case about taking the elevator when she had two perfectly working legs.

The door to Daniels office sat closed, and she peeked into the glass valance to the side. Daniel stared at his computer screen, his brows drawn low. He didn't touch the keyboard and mouse, eyes moving across his monitor as if trying to puzzle something out. He just reached for the mouse when she knocked quietly on the window.

He turned, a smile easing his expression. He waved her in, and she quickly hurried through the door."

"You wanted to see me?" she inquired.

"Yes, please sit down," he said, gesturing to one of the empty chairs across his desk. She sat while he turned back to his computer.

"Please watch," he said as he launched Internet Explorer. "I'm going to talk you through what I'm doing, and I don't want you to interrupt until I'm done. Okay?"

Jessica felt a twinge of uneasiness stiffen her spine. "Of course," she responded, trying to instill confidence in her voice. "What are you doing?"

He only smiled. "First, I've discovered what password I can use to access AMT on all our vPro enabled computers..."

She stood up. "What...?"

He held up his hand, not unkindly. "Please humor me."

She sat back down, her unease blooming. She clasped her hands in her lap so she wouldn't fidget, usually in the form of smoothing down her already crisp and wrinkle-free dress jacket. She couldn't sit completely still, and found herself tapping her toe. Fortunately the carpet, however uninviting bland, muffled the sound.

"Okay," Daniel continued. "I don't have access to Altiris though I have tried to gain it, unofficially of course."

"Of course," she said, and quickly clamped her teeth together before she asked another question.

Daniel continued, "In light of that I've done some Googling and found that AMT has a web-interface that anyone can access using a browser. I haven't figured out how yet, but I don't think it'll take me long. Let's see... how to access AMT via a browser... This first hit talks about someone who is unable to access it."

Url: (http://softwarecommunity.intel.com/isn/Community/en-US/forums/thread/30249624.aspx).

"Ah, in his post he says, "When I try to access the Web Interface (localhost:16992 or name:16992)... that means I can access my test in the same manner. Let's watch."

Jessica bit her lip to keep from saying anything, determined to keep quiet until he'd finished his demonstration. She really wanted to ask him how he acquired the password, but she supposed she should wait until he validated that claim first. Plus, he'd asked her to keep quiet, and she didn't want the CSO annoyed with her.

Daniel clicked on the address bar, deleting the current address. He then typed in MMMAMT0043:16992 in the address bar. When he hit Enter the page refreshed, showing him the initial AMT login screen. He clicked the ‘Log On' button, which provided a standard Windows security prompt. He entered in Admin as the username, and then typed in a password. Jessica's stomach dropped. She didn't see exactly what he put it, but it did look like he put in the right password.

The Intel Active Management Technology web interface appeared, giving Daniel full access to the system. Jessica reached up and rubbed at her eyes.

"Please tell me you simply asked Tevita for it," she said when he turned to her.

"No, but no need for you or Tevita to worry about that," he said with what Jessica assumed was a reassuring smile. It didn't help. "I believe I used the same methods our traitorous employee working in cahoots with Nifty Networks used to gain these powerful credentials. I'll be conducting security training for our employees soon to try and plug that method."

"So how did you do it?"

Daniel nodded. "Good question, but the better question I'm posing to you is this: how can we better secure the AMT technology? See here under Remote Control? I can remotely reboot this person's system and boot it up into an application I can use to wreak havoc. Nifty, no?"

She swallowed hard. "No, not nifty."

"Good. You see the issue. I'm tempted to not tell you how I did it. Mystery lends me an air of the supernatural, or at least my uber-geekness. Why reveal how? That's like a magician revealing his secrets. Once the how is known, it isn't so magical anymore. Okay, so I'm taking far too much pleasure out of this. I simply watched you and Tevita closely and caught you entering the password. It took several tries before I finally got it right."

The beginning of a migraine colored Jessica's vision. "Great. I thought we had that password locked down..."

"As I said before, don't worry about it. Everyone is too trusting when entering passwords. I'll address that in our upcoming security meeting. What I want to discuss is how we can rectify this situation? Specifically I want to remedy the fact that anyone who does a smidgen of research will know that the administrative username for AMT is admin. We've handed any potential hacker one half of the credential equation."

Jessica nodded. "Yes, I see your point. Luckily I already know how to fix that. It's as simple as making the admin password random on each system and using Kerberos to use our Domain credentials for access."

"Good. The second point is I noticed that I can use a non-secure web address to access this. Can you get SSL enabled for all AMT communication?"

Jessica nodded again. "Yes, specifically AMT uses TLC, the successor to SSL. I believe I saw an article on how to enable that on Symantec Juice."

"Even better. Get those measures in place, and let me know when it's completed."

She nodded, shaking his hand when he offered it. She left his office and headed back down, taking the stairs despite the throbbing in her head. When she reached her cube she noted that Tevita had his headset on, his previous smile absent from his face. She gave him a grin when he glanced over, and this time he rolled his eyes. She should get onto the phones, but she wanted to get those changes implemented as soon as possible so that even Daniel couldn't crack the system... as long as Tevita and she carefully entered their passwords so others couldn't eyeball them.

She sat down and pulled up the Altiris Console. Both of her actions required a new vPro Profile to be pushed down to all the AMT systems, but that was the easy part. She started by enabling TLS on the server. Until she pushed down the new profile the AMT functions would not work. She leaned over to Tevita, and he glanced at her as she rolled closer in her chair.

"AMT will be available for a time," she said.

Tevita reached up and muted his headset. "Why?"

"I'm enabling TLS. You know, encryption. When I enable it on the server side the clients will not be able to communicate back with the server until I update the profile and they have the right certificates."

He shivered. "Is that such a good idea? Certificates are tricky... we could easily mess up the whole thing and have no AMT access..."

"Tevita, it isn't that complicated. I have all the Altiris documentation on how to do it. Besides, there's a specific article on how to do it after the installation, here: http://juice.altiris.com/article/2737/how-enable-tls-within-out-band-management-after-install. Piece of cake."

"If you say so..."

"Trust me. If we had a hierarchal structure of certificate authorities, it might get a bit dodgy, but I'm just setting up the one root."

"Yeah, and the flux capacitor needs just such and such gigawatts of power..."

"Just read up on it! It's not that hard."

Tevita spoke for a moment into his headset, and took it off. "I don't know anyone who understands it all that well."

She planted her hands on her hips. "It's really simple. We give the root CA, aka the King, the credentials that are acceptable. Secondly, the Altiris server gets the credentials so it can work with the CA and the clients. We then load the matching credentials on the clients via the Provisioning Profile. Now everyone has the credentials."

He smiled. "What about client-side and server-side certificates?"

"Again, simple. Communication is unidirectional for a given parent/child certificate set. With basic TLS in vPro, all the clients have server certificates. The Altiris Server uses a client certificate to authenticate with the client so that the client machine will accept the AMT commands sent it."

"Alright. That sounds simple enough, but what about the CA? What's that for?"

Jessica looked at him, her eyes narrowing. "What's with the third degree? 'Tell me Master Qui-Gon. What are midichlorians'?"

Tevita burst out laughing. "Am I that transparent? I didn't know you liked Starwars..."

"I don't. Like that movie quote, your questions are contrived..."

"Hehe, yeah. I'm just trying to prove a point. It's not that simple..."

"But it isn't that complex, either. The CA tells the server-side component (the AMT Client) if the client connection (from the Altiris Server) is to be trusted. I know having the AMT clients act as the server seems a bit backwards, but since we want AMT functionality to be secure, it makes sense. The Altiris Server that tells AMT what to do needs to prove itself. This ensures a rogue server can't just initiate any AMT functionality without having the proper certificate. So the server provides a client certificate, which the AMT system authenticates with the CA before allowing the Altiris Server ‘in'."

"Okay, okay. That sounds simple enough. I'll be sure to avoid AMT until next week when you get TLS finally working... kidding! Take it easy, I'm just joking."

She wanted to keep the stern look on her face, but a smile cracked through. "You just watch it, Mister."

Jessica turned her attention back to the Altiris Console. She opened up a browser on her second monitor and pulled up the Juice article she'd shown Tevita. She walked through the steps, sometimes checking back on the Altiris Administrator's Guide for Out of Band Management, found at http://www.altiris.com/Support/Documentation.aspx. She finished the processes except for updating the profile since she needed to also update the Admin password settings.

She browsed in the Altiris Console under View, Solutions, Out of Band Management, Configuration, Provisioning, Configuration Service Settings, and clicked on Provision Profiles. She highlighted her active profile and clicked the pencil icon in the icon bar to edit it. Under the General tab, to the right of the window, she changed the Intel® AMT 2.0 password: setting from Manual to Random creation. She then clicked on the TLS tab and, using the previous directions, enabled TLS within the profile.

She sat back as she clicked OK. Now that the Altiris Server was setup properly, she needed to push the new profile out. From her place in the console she backed up into the Provisioning folder, and then expanded the Intel AMT Systems folder and highlighted the Intel AMT Systems node. All Intel AMT Systems showed within the right pane. She clicked on the top one, scrolled down, and, while holding shift, clicked on the bottom one. She right-clicked and selected the ‘reprovision' option.

With a sly smile she glanced over at Tevita. He wore his headset again, though he looked less stressed than before. She rolled over and wrote on his whiteboard "AMT back up in a few hours". For the time being they could rely on the Runtime Profile for authentication. Since Altiris knew all the random passwords for the Admin account, via Altiris they should have no problems with security. However she needed to quickly implement AD integration with Kerberos authentication just in case.

She got up to take a quick break. She stretched, looking out over the cubes. She froze in mid stretch for a moment, before quickly pulling down her arms, her eyes widening. Two men in blue jumpsuits walked nonchalantly through the building, one holding a sheaf of what looked like generic forms and the other with a nondescript box. Despite their "non"-threatening postures, something about them bothered her. At first she simply watched them, trying to figure it out.

The man in front emanated confidence like a shiny sword and shield, his smile infectious and full of perfectly white and straight teeth. His strong features seemed chiseled from brilliant marble, as if he'd been carved amid the statues of Rome. Not one of the rich brown hairs on his head stood out of place, his hazel eyes roving over the office as if memorizing all the details. He didn't act suspicious, but his very manner belied the blue-collar worker outfit he wore.

Right behind him strode the other man. He wore a beard, a hat pulled low over his eyes. She squinted, hunching down a little so she didn't rise so high above the cube walls. He carried the box, his muscles tensed. He walked jerkily, each step seeming just a little unsteady. Sweat beaded on what little she could see of his forehead.

"Tevita," she whispered. "Does that guy look familiar to you?"

He appeared beside her. "Who? Those two delivery guys?"

"Yes. The one carrying the box."

Tevita turned to stare at her. "It's the ninja!"

She shook her head, though the sudden clenching in her stomach belied the action. "No way, he's in jail, right?"

"Probably not. He didn't threaten anyone or do any actual damage, and the price of the hard drives he tried to steal doesn't equal enough to be a felony, especially since he claims he was only after the hardware..."

"But why come back here? We know who he is..."

He just shrugged. "Maybe he's turning a new leaf..."

She gestured at the other man just as they disappeared into the stairwell. "Maybe, but that other guy gives me the creeps. I wouldn't be surprised if his name happens to be Lex Luther."

Tevita nodded. "Let's follow them."

She shook her head. "No way! Let's just call security and let them deal with it."

The Tongan only shook his head slowly. "The security company might be too slow to respond. Heck, they took forever to show up when our ninja friend showed up the first time. You go tell Bobby and I'll shadow these two shifty guys."

Before she could respond he hurried away, surprisingly quiet for his bulky, muscled size. She clenched her teeth together, torn by indecision for a few precious seconds. She then turned and hurried towards the server rooms, hopping Tevita wouldn't get himself into too much trouble.

END Part 5

This concludes Part 5. This cliff-hanger will be continued in an even more unbelievable conclusion, Part 6. Now that the competitor has breached the office once again, can Might Modern Marketing's IT staff protect their infrastructure, data, and themselves from this all out attack?

NOTE: If you have not read parts 1 through 3, please read these before reading this part as this is a continuation of the story begun in the previous sections. Altiris and Intel vPro Use Cases

Security is only as tight as the weakest link in your environment. More often than not it's internally where the security holes are created, either inadvertently from carelessness or intentionally from a disgruntled or disillusioned employee. The hardware and software security can be top of the line, but if the human factor doesn't adhere to policy, it may not make any difference. This part follows the IT team for Mighty Modern Marketing as they try to track down a security hole where productivity is taken down through the very tools used to defend and manage the network.

Mighty Modern Marketing HQ - Boston, Massachusetts

Somehow the air inside the building congealed hotter than the heavy, humid swelter wallowing outside. Tevita, sweat running down the sides of his face, fanned himself with an empty binder. He stared at his screen, the image thereon frozen.

"I think one of the servers seized up," he said. Jessica Langley glanced at her Remote Desktop window. The previously blinking text icon in the script she edited no longer blinked, and as she watched the disconnected icon appeared, the remote screen graying-out. She closed it with a quick click of the white on red X.

She took a long drink of water. "If they don't fix the AC soon, I'm going home," she announced.

"They'll have it up soon. Besides, it's never been so quiet here. I only have one system running, and I think I'm approaching something like Zen. Either that or I'm about to pass out."

"Any more missing application tickets?"

Tevita groaned. "Oh yeah. Five so far today. It's like the uninstall faerie ran around randomly touching computers with her magic star-wand. I've taken care of it."

Jessica stood, feeling sodden. "Thanks. I'll check on Bobby to make sure he hasn't suffered from heat stroke."

The server room actually felt cooler despite the cacophony of running servers that reminded her of the sound and feel of a jet engine escalating towards takeoff. Somehow Bobby had created a wind tunnel with large fans, and she felt her hair whip away from her as she stepped directly in the wind's path. She shielded her eyes and walked to the developer's cube area. The pull of the moving air seemed to try and yank her off her feet by her dress-suit jacket. She folded her arms as she stepped into the relative stillness of the cube.

Bobby looked like a wilted plant. He looked up, and sighed. "What, IM down again?"

"Of course not," she responded with a smile. "You holding up in here?"

He shrugged. "I'll survive, though it reminds me of Phoenix, Arizona, except here it's like standing in front of a vat of boiling water. Phoenix is like standing in front of the open door to a blast furnace."

"The SQL Server locked again."

Bobby nodded. "I did a hard reset just a minute ago. I had to open the case and point a fan right at the CPUs. I think it'll stay up this time."

"Good."

Bobby shrugged again. He looked back at his screen, then back up at her. "You need something else?"

"Not really. You want to go to lunch with Tevita and I? The local Italian place has great AC."

"No, I'm good. My lunch cooked itself in this heat, so I ate already."

"Alright. See you later."

When she returned Tevita still sat in front of his computer, sweating profusely. He looked up as she passed by, a frown on his face.

"The facilities guy just passed by," he said as she sat down. "He says someone deliberately messed with the AC. He's fixed and says it'll be up and running any time now."

"Someone sabotaged the AC?" she inquired.

"Yep."

She sighed. "Just when I thought we were done with the underhanded antics."

Tevita nodded. "The AC guy put thick padlocks on all the control panel cases. Too bad we don't have any way to track who goes in and out of that room. A magnetic badge reader would work."

The next hour passed in receding misery as the AC kicked on and began liberating the employees in Might Modern Marketing's Headquarters from oppressive heat. Jessica checked the Altiris Notification Server Logs, ignoring the SQL errors for the times the SQL server seized up. Except for an occasional error where an event arrived for a package already deleted from the Notification Server, the logs looked clean.

"Mrs. Langley," Edgar's dry tones greeted.

Right on cue, she thought. Despite the heat things had been going too smoothly. She turned around and stood.

"Hello Edgar."

"I wanted to let you know that the budget we set aside for the mess with New Nifty Networks is on target, thanks to everyone's diligence," he said, eyes briefly moving down to the papers clasped in his hands. "We've even been able to devote some resources to Legal. It won't be long before we can put this whole ordeal behind us."

Tevita rolled over in his chair. "What, and I've done nothing?" The expression on his face and tone of his voice took away any sting of the words.

"Both of you have performed exceptionally," Edgar said, shuffling the papers in his hands. "Though it's not official, I believe you will both receive a merit increases for your performances."

"You're kidding!"

"I do not kid, Mr. Tatafu."

"So be honest, was it hard to allow that through?"

The barest hint of a smile touched the corners of Edgar's thin lips. "Yes, adding my approval felt much like pulling out stitches. Now don't you both have work to do?"

He shuffled away, his posture a little bent.

Tevita gave Jessica a thumbs up. "Ha! So some good is coming from this whole competition nightmare."

"Perhaps," she said noncommittally, having trouble suppressing a smile. "It's not over yet, not until this school-friend of Mr. Johnson's finally gives up. I'm hoping it happens soon so we can go back to normal."

"Normal?" countered Tevita. "When is IT work normal? It changes faster than the seasons."

She opened her mouth to respond when her telephone rang. The caller ID noted Johnson. She quickly picked up the handset.

"Mighty Modern Marketing, this is Jessica," she greeted as cheerily as she could.

"Jessica, this is Mr. Johnson," greeted the CEO. "Can you please come up to my office immediately? We have a sensitive matter to discuss."

"Of course. I'll be up right away."

"Please have Tevita join us as well. See you in a minute."

"Will do. Thanks. Bye."

When she looked up Tevita had his day planner in one hand, the other locking his computers.

"Ready for lunch?" he inquired.

"Change of plans," she said, rising. "Mr. Johnson wants to see us in his office immediately."

Tevita stared at her for a moment, then tossed in planner onto his chair, a wry smile twisting his mouth. "Wonderful. Somehow even though everything he says sounds enthusiastic and wonderful, we end up with a pile of work."

"Job security," she responded.

The CEO's office, remarkably, looked very much like the other offices in the entire building. She glanced through the window on the door, then knocked politely. Mr. Johnson, looking as refreshed and lively as ever, waved her in. The building continued to cool, but still hovered near eighty degrees. Though she felt sweaty and rumpled, Mr. Johnson appeared completely unaffected by the heat, his hair perfectly combed and his clothing pressed and clean. He smiled warmly as they sat down in the two chairs set before his desk.

A man sat next to him, and though she knew she should know who he was, she couldn't place his face in her memory.

"Thank you for coming up so quickly," he said, rising to shake their hands. "This is Dan Williams, Chief Security Officer."

She said hello, shaking Dan's hand. Funny how she knew the name so well from countless emails and conference calls. She felt she knew him despite only seeing him on rare occasions, all from electronic or audio correspondence. Somehow she'd never put that voice with this face.

"Jessica, Tevita," he said in way of greeting in that familiar voice. "We need to meet more often, especially with how much I depend on both of you."

"Definitely," Tevita responded as he sat down.

Jessica had trouble controlling a laugh that threatened to escape. "Mr. Williams, you don't look like I imagined."

Dan smiled, amusement dancing in his eyes. "What did you think I looked like?"

She blushed. "Well... you sound like Chuck Norris. But you're more like..."

Mr. Johnson started. "Chuck...?" He burst into laughter. Tevita's booming laughter joined in as Dan's smile grew wry. Jessica wondered if someone could faint from embarrassment, and imagined she looked as red as a tomato.

"Sorry, I like yoga, but not much of a martial arts guy," Dan said, trying not to laugh.

"Alright," Johnson said with a deep calming breath. "Without further preamble, I'll let Dan discuss the situation."

Dan nodded. "As you are well aware of our situation with our friends over at New Nifty Networks, what I'm about to show you shouldn't come as much of a surprise. We have a plant."

"A plant?" Tevita inquired. "Like a house plant?"

Jessica covertly elbowed him in the ribs as he chuckled.

Dan continued, undaunted. "Someone here is feeding information to our competitor. We're tracking this using email, etc, but the trail is long and convoluted. We think this spy, for lack of a better term, is also sabotaging our business here. While we're pretty sure he or she disabled the air conditioning, we don't have enough data to even begin to narrow down who it could be. There are other things happening that I believe you'll be able to help us with.

"You see, we believe he's somehow obtain access to your management tools. We've had increased cases where vital software has been mysteriously uninstalled from systems."

Jessica exchanged a look with Tevita. "We have had a large amount of emergency software deployment tickets," she said.

"The tickets always say the shortcut is missing," Tevita added.

"Exactly," Dan continued. "Depending on the user, this can severely hamper our productivity. Since some of the computers are locked behind office doors I'm assuming they're using management software to accomplish this. Is Altiris capable of this?"

"Yes," Jessica answered. "However you need rights to do anything."

"And that will be to our advantage. Please look through any auditing or logging done by Altiris and see if you can figure out how this individual is uninstalling applications, what credentials he or she is using. Any evidence or data you capture please forward to me."

"We will," Tevita responded.

Back at her desk, Jessica pulled up the Altiris Console. Events would allow her to see if any Software Delivery or similar jobs had been schedule to run on the affected systems. They had uninstall-programs setup for most of their managed applications. She browsed in the Altiris Console under View, Solutions, Software Delivery, Tasks, Windows, Software Delivery Tasks. The first task she choose uninstalled their accounting software, one application the spy or whatever he or she was liked to target. She did a quick scan to ensure no new tasks showed up.

She clicked on the Status tab. Once the tab loaded she used the dropdown labeled, "Display computers on which this task ran:" to set it to "All". Once the grid loaded she clicked on the top of the "Attempt Time" column to sort by date, and looked at the last week's runs. Only three showed up, and all of them had been scheduled by either her or Tevita.

"Any luck?" Tevita asked, his head rising above his cube's wall.

"Nothing yet. I guess it's possible they created a task and then deleted it after each execution."

"Yeah, but there's an ItemDeleted table that we can look at to see if that's occurred."

He walked into her cube and sat down on the spare chair. He used her secondary system to open SQL Enterprise Manager and launch a query window. He used the query:

SELECT ItemName FROM ItemDeleted

WHERE ItemName LIKE ‘%Accounting%'

AND ItemClassGuid = ‘D922981C-B8E7-40EE-B6BD-1E6CB354C9FE'

"This class-guid here represents Software Delivery Tasks," Tevita explained as he ran the query. "Nope, nothing. Let me try one more query, this one more generic..."

SELECT * FROM ItemDeleted

WHERE ItemClassGuid = ‘D922981C-B8E7-40EE-B6BD-1E6CB354C9FE'

ORDER BY DeletedDate

"Okay," he continued. "I don't think he used Software Delivery. I don't see any Tasks deleted recently enough to account for all the uninstalls reported."

Jessica nodded. "Hmm. If he didn't use this, then the only other two options I can think of are Deployment Server and Task Server."

Tevita smiled. "No chance with Deployment Server. I've changed the management credentials recently and blocked everyone else out. Since only you and I use it, I figured with all the security stuff going on I'd better be safe, not sorry."

She blinked. "I didn't know you'd locked... I guess DS is your baby."

"You know it. So, do you think Task Server could really be it? Wouldn't he need to know scripting?"

"Not necessarily. There's a ‘Deliver Software' task available that can run any Package-Program we have available in Software Delivery. Let me look through here... I don't see any Jobs or Task Server tasks that reference the uninstall program. The ItemDeleted would have deletions if he'd done that. But you used the standard Software Delivery Tasks, right? Can you do one for Task Server Tasks?"

Tevita scratched his chin. "I think so. In fact we don't delete things that often. Let's try this..."

SELECT * FROM ItemDeleted

ORDER BY DeletedDate

"Okay. A few deletions, but they all look straight-forward. Computers purged, a couple of Software Portal Requests... but nothing that looks like a Task Server task. Wait... what's this? Bobby deleted a task named WOfW? This was last week. If I didn't know better, I'd say he's been playing with Software Delivery and Worlds Of Warcraft."

Jessica grinned. "You think he wants to roll it out company-wide? I can see it now. ‘Productivity hits an all-time low, though the average level of Mighty Modern Marketing exceeds fifty'!"

Tevita laughed, pointing at her. "I didn't know you knew enough about gaming to make a joke like that!"

"Right. Like you don't bring it up every week. It was bound to rub off on me at least a little."

"This looks clean. That doesn't make sense. Perhaps Dan's wrong, and whoever's responsible for this isn't using Altiris."

Jessica shook her head. "He's right, I don't think this could be done at this rate any other way. Either they're using a different method, or they have intimate knowledge of Altiris."

Tevita leaned back, looking up at the ceiling. Jessica placed a fingertip on her lips, thinking furiously. If Software Delivery and Task Server wasn't used, and the evidence suggested such, what other method could you use to remove software? They planned on using PC Anywhere for remote control, but it wasn't up and running yet in the Altiris environment. Tevita used the simple Remote Control feature in Deployment Server, and she still used Carbon Copy. She'd disabled access to it in Altiris and used the stand-alone product that only existed on her system for security reasons. Could they have a rogue copy of Carbon Copy installed...?

"What about vPro?" Tevita inquired abruptly, interrupting her thoughts.

"Serial-Over-LAN doesn't work in Windows currently," she responded. "No other remote application abilities... it's really considered an out of band management interface."

"Yeah, but if you built a remote tool into an ISO, using IDER, couldn't you use that?"

"In theory, yes... In fact if you ran an IDE redirect with something like that you could do whatever you wanted to the system."

"Exactly."

Jessica smiled. "And we have an actual activity log."

In the Altiris Console she browed in View, Solutions, Real-Time Console Infrastructure, Tools, and clicked on "Activity Log". She scanned down the entries.

"Well, well," Tevita said, leaning forward. "Our friend has been busy."

The icon showing a redirection session appears like two plugs plugged together. The other pertinent columns appeared as "client": showing what computer by IP Address is being accessed, "user": what credentials were used to execute the action, Host: as in the hostname of the destination computer, Description: showing the path to the ISO, and lastly Technology showing what method was used. Multiple RTSM sessions showed a redirection to an ISO labeled: RemoteControl.iso. The path led to a UNC share.

Jessica pulled up the contents. "Jackpot."

Tevita shook his head. "Too easy. If they know how to create ISOs of that nature and use RTSM to deploy them, did they actually think there wouldn't be some sort of logging?"

"I don't know. RTSM is unique in that it isn't dependent on an agent at all, so there is no logging client-side. Still... perhaps whoever's doing this didn't create the ISOs and is just in charge of running it. And we aren't done yet. Note that the User is all listed as admin. This means he or she is using the AMT credentials available on all systems."

"Oh. Can't exactly blame the invisible AMT admin..."

"No, but we can change the password easily. Before I do that, I'll send Dan the information on the share. That share should have some sort of user footprint his team can get to."

She quickly sent the email with all the information. She explained that she would change the admin password so that this rogue user could no longer use this method. After sending it she browsed in the Altiris Console to View, Solutions, Out of Band Management, Configuration, Provisioning, Configuration Service Settings, and selected Provision Profiles. She double-clicked on the profile they used for all systems. Under the Administrator Credentials section to the right, she changed the password under the Manual radial option. She clicked OK to save the changes.

Next she browsed back up to Provisioning, and into Intel AMT Systems, selecting the node Intel AMT Systems. When the frame loaded, she clicked on the icon on the icon bar that looked like a system with refresh green arrows surrounding it, labeled: Re-provision. She hadn't selected any systems so she selected the only live option, "All systems". She clicked OK to execute.

"That should do it," she said aloud.

"A re-provision?" Tevita asked.

"It's a simple way to send down the changes in a profile to the systems. It'll take some time to cycle through all the systems, but soon all systems will have the new AMT admin password set."

Tevita leaned back. "So we're done?"

"For now, unless you have any ideas for further tracking this guy...?"

The rest of the day proceeded smoothly, with only one more reinstall helpdesk ticket coming in. By the next day no new tickets had developed, and things had settled down to normal. Dan said he had enough to identify the perpetrator, but said no more on the subject.

He did say one thing very firmly. "All the security we can muster is worthless if those with the right privileges are not careful with their credentials."

Further, he requested they review their procedures concerning the AMT admin password. Was it written down anywhere? Did they ever say it out-loud? Though neither knew how the password got originally stolen, the increased care with which they handled passwords became a driving program within the company. Security was everyone's job.

At the end of the week, as Jessica headed away from Boston on the Redline Commuter Train, she hoped they'd seen the end of the targeted attacks, but in her mind she already looked through her current policies and processes to see where she could increase security.

End Part IV

Altiris provided not only an audit trail to track potential rogue usage of RTSM, but it also provided a very quick and efficient way to change security within AMT when somehow the credentials are compromised. Is this the end of the threats against Mighty Modern Marketing? Only time will tell.

If you have not read Part 1 in this article series, please refer to it as this is a continuation of the story begun there:

http://juice.altiris.com/article/4367/altiris-and-intel-vpro-use-cases-part-1-the-setup

Antivirus is a must for any IT infrastructure. Without it productivity is quickly reduced as viruses run rampant in the environment. Keeping Antivirus installed and up to date is vital to ensure continuity of business services. In Part 2 the IT team for Mighty Modern Marketing is put up to the challenge of protecting their network from viral attacks. Using Symantec End Point Protection, Altiris and the Intel vPro technology, they work to ensure that the viral attack and subsequent virus attempts fall ineffective.

Mighty Modern Marketing HQ - Boston, Massachusetts

The commuter rail stretched out across the Charles River, but Jessica Langley didn't notice. Her eyes remained fixed upon the screen of her smartphone, scrolling through the emails that continued to pour in. The subject lines all contained the same word. Her shoulders hunched, feeling like a tremendous weight settled on them. She closed her eyes briefly, rubbing at them with her left hand, the PDA held forlornly in the right.

When she opened her eyes the word jumped up at her.

Virus.

This wasn't the first time this had happened at Mighty Modern Marketing. Viruses routinely showed up as email links or attachments, and it didn't matter how often she or Tevita sent out stern emails reminding people to leave email attachments and links alone unless they were expecting them. People continued to click that link to see the latest movie trailer, or to run the fun and exciting application their aunt or long-lost friend mysteriously sent them from out of the blue.

This time was worse. She'd painted a large red X on her by pushing the Intel vPro technology, and now it seemed everyone stared at her when anything ill befell the network.

She jumped to her feet the moment the train stopped, snatching up her purse and bolting for the nearest door. As she ran down the platform towards the exit of North Station, others gave her curious looks. She smiled briefly. Normally people ran towards the train to avoid missing it. She often saw them frantically running in high-heels or other dress shoes towards a departing train when the work day was over. Who wanted to run into work?

As she staggered into the main lobby at work, glad for the cool air that greeted her, she vowed to start exercising. She hurried through the building.

"I'm glad you're here early," Tevita said in his deep voice as she fell into her chair. "We're in trouble."

"I noticed," she said in-between deep breaths. "What's the situation?"

"I'm not sure, but somehow a virus was planted on a new system as it came online. It appears deliberate."

"But... we have Symantec End Point Protection (SEP). It should keep everything out..."

Tevita smiled, though his eyes shifted to his own monitor, his shoulders shrugging uncomfortably. "Yes... about that. You see, the base image hasn't been updated yet to include that..."

Jessica stared at him.

He waved a hand at her. "I know, no need to look at me like that. That's what I've been doing; recreating the image so it's there from the get-go."

She tried not to groan. "So how widespread is it?"

He laughed, though no humor made it into his tones. "All over the place. They used a vulnerability in one of Bobby's applets to spread it. Of course the first thing it did was disable the antivirus. If SEP had been installed it has protection against... Anyway, those systems without SEP are all hit."

Tevita's eyes glanced up, and widened. Jessica whirled to see Bobby walking up, his hands shoved in his jean pockets. He stared at the floor, his mouth moving as if he counted his steps.

"Bobby?" she inquired.

He looked up, looking like a boy lost out in the desert.

"It got through my firewall!" he exclaimed, extracting his hands so he could ball his fingers into fists. "It shouldn't have been able to do that. I can't even use IM."

Tevita gestured to an empty chair. "Have a seat."

Bobby slumped into the chair. "Whoever sent us this thing knew what they were doing," he said with a scowl. "The cursed thing used UNC to move about the network. Only someone with intimate knowledge of our network could do that. It has to be New Nifty Networks!"

"Do you really think...?" Tevita began.

"Bobby," Jessica said quickly. "Have you fixed the vulnerability?"

"How can I?" he lamented. "It jumped from computer to computer, and with mine infected I quickly turned it off. I need your to help me get that virus off so I can patch the applet."

Tevita smiled. "You actually walked over here."

Bobby looked up, his frown deepening. "Yeah? So?"

"It's unprecedented... You usually stay in your cave, even during power outages. Does it make you nervous to enter the world of real people?"

A flush bloomed on Bobby's sunken cheeks. "Not everyone's as social as you."

"You should stop by more often so..."

"So you can ridicule me?" he retorted.

"Guys," Jessica said, rolling her eyes. "Focus here. Bobby, do you have one of the new vPro systems?"

"Yes, of course," he responded, "I always get the latest hardware from procurement."

"Hey, why don't I see any of it?" Tevita blurted.

Jessica ignored him. "Good," she responded to Bobby as she turned back to her computer. She launched the Altiris Console. "If you have one, it should already be provisioned. Let's check the All Provisioned Computers collection... is this yours?"

"No, my computer is named Superman."

Tevita laughed, and Bobby managed to turn an even more alarming shade of red. Jessica kept her expression passive despite the twitch in her lips from a potential laugh. The computer name Superman showed in the list, and she double-clicked on it. She clicked on the Real-Time tab, entered her credentials, and loaded the Hardware Management page under the Real-Time System Manager, Administrative Tasks folders.

"I have a boot ISO of Symantec's Antivirus scan," Jessica explained as the hardware management page loaded. "I'll just turn on your machine but use IDE Redirect (IDER) to load the antivirus disk. We'll wipe the virus, and turn the system off."

"That's great," Bobby said as he shrugged his bony shoulders," except the minute you bring it back up the virus will propagate again."

Jessica smiled. "Not if I invoke a Network Filter."

"What's that?" Tevita asked, as if on cue.

"Tevita, we've covered this. It's the Intel System Defense. You know, block all traffic except to certain ports and IP Addresses. If you want to read up on it I'll email you the URL. (http://69.93.2.147/article/2645/hold-mf-utilizing-intel-vpro-amt-technology-task-server-part-5-system-defense-tasks)."

"System Defense!" Bobby exclaimed. "I read up on that technology. I created a script that provides a text interface where you can specify which ports you want to allow. I call the API's provided by Intel's SDK. It's great stuff."

"RTSM and Task Server already have it configured to only use communication to them," Jessica said, trying not to smile.

"Oh." Bobby cleared his throat as he pushed himself up onto his feet. "That sounds good. Do you need me to stick around...?"

She gave him a grin. "Just for a minute while I do this."

Bobby sat back down, but leaned forward, staring at her monitor. Tevita slid over, looking on with interest. She said a quick silent prayer that it would all work like she theorized it would.

She choose the ‘Power on' radial option, and under the Redirection options checked the ‘Perform boot from' checkbox. She also checked the ‘Display task progress and remotely control computer' option. Under the device drop down she left it at CD image, and then click ‘browse' and located the Symantec ISO. She lastly clicked ‘Run Task Now'.

A new window popped up, showing the computer boot. It loaded the CD and a textual menu showed up giving her scan options. She initiated the scan.

"Looks like it's working," Tevita said.

Bobby nodded. "I had my doubts since I've been unable to ever get Wake-On-LAN to work across my router..."

"Wake-On-LAN packets don't get by any of our switches are routers," the Tongan responded. "I believe you're the one who recommended the network security scheme we use."

"I know, but Altiris did have an Altiris Agent mechanism to try and deal with it, but I couldn't get it to work in my environment. This vPro stuff sure made that easy. I didn't have to touch the router."

"That's the point," Jessica said with just a hint of exasperation in her voice. "Were both of you sleeping when I gave my presentation on vPro last month?"

Tevita smiled, tugging at his collar. "Have I ever mentioned I don't like PowerPoint?"

"Only twice daily. But I showed demos... oh who am I kidding? That's the last time I supply lunch before a presentation."

The two men exchanged glances with sheepish grins, and then focused back on the screen. She looked back to the scan. It finished quickly, showing the virus as detected and quarantined. She closed the remote window and clicked on the Network Filtering node under Administrative Tasks in the Real-Time Console. She checked the ‘Override default solution settings' checkbox and changed the radial selection to ‘Filter network traffic other than to and from the Notification Server'. She clicked Apply. When the page finished refreshing it contained the message, "Machine was successfully moved into quarantine".

"Alright Bobby. I'll use the Power Control to boot your machine up so you can Patch your applet and install SEP. You head back and get it done ASAP. Once it's patched I'm going to mass-remediate all the vPro systems doing the same actions we just did except on a mass scale with Task Server."

Bobby jumped to his feet. "Sounds good. IM me if you need anything..."

"Except IM won't make it through the Network Filter," she responded dryly.

"Ah... yes. Well... you know where I am."

"Quick question, how long will it take you?"

"Less than an hour."

As Bobby walked away Tevita smiled hugely, some of his natural humor finally flowing back into his features. "He's a real gem."

"You should cut him some slack," she scolded.

"Bobby? I'm holding back, really I am. It's just too much of a temptation. He's classic nerd. But he is a master at what he does, so I'll be sure to keep it friendly."

"I'm reassured," she said, rolling her eyes for the third time that day. She then gave him a sly smile.

"What?" he said, his smile drooping. "You have that look."

"Regardless of blame, even though you should have updated the image weeks ago to include Symantec Endpoint Protection so I blame you for this mess, I need you to create a CD out of the Antivirus boot ISO and load SEP on a flash drive so you can manually remediate those systems without vPro."

Tevita swallowed. "Hey, we've had a pretty busy workload..."

She softened her look. "I know, sorry. Anyway... when you get to each system, yank the network cable, use the ISO to clean the virus, then load SEP, and then put the cable back in. I'd even suggest making several copies so you can do a handful at a time. And here's a printout of all non-vPro systems."

Tevita took the printout and nodded. "I'm on it."

Jessica focused back on the Altiris Console after Tevita left clutching ten copies of the ISO and SEP installer. She browsed under Manage, Jobs, Tasks and Jobs, right-clicked on Jobs, and choose ‘New Folder'. She right-clicked on the new folder and choose ‘New > Task/Job'. In the resulting window she choose ‘Server Job' under the ‘Jobs' folder. The first element popped up a message from a VB script stating that an emergency procedure would fire in 60 seconds, and instructing the user to save all data. Her second task was a ‘Boot Redirection Task' that booted up a modified ISO that automatically ran the scan and took any appropriate actions against detected threats. The third task invoked the Network Filter, allowing only NS and Task Server communication capability with the system. For the fourth Task she located the SEP install Tevita had made with Altiris Software Delivery Solution and put it into a Task Server Deliver Software Task. Finally she created the fifth and sixth tasks that removed the filter and invoked a reboot to finish the process.

She saved the job and selected her own system to test it.

"Mrs. Langley," a familiar voice prompted. Normally she caught movement in the mirror mounted on her flat panel monitor when someone walked up to her, but she'd been so focused that this time she started almost violently in surprise, whirling around in her chair.

Edgar Watts stood behind her, his hands conspicuously empty of printouts. Her first impulse was to point to her screen and tell him she had a plan with vPro to take care of the virus in a timely manner.

She rose to her feet, trying to place a polite and not strained smile on her face. "Hello Mr. Watts."

"Since my computer is down, I've been using my laptop to research the impact of viruses to corporations, specifically impacts to finances."

He frowned, briefly rubbing a forefinger along his jaw. He didn't immediately continue, his vexed expression seeming to say he was seeing those numbers again and loathing what he saw.

"We're working on it," she said, trying not to sound defensive.

"I know," he responded. "I'm astounded at the amount of this company's hard-heard cash flow flowing down the drain."

"We'll have your and all vPro enabled systems up within the hour," she said, forcing that smile to remain on her face."

"One hour?" he responded, looking down at his watch as his brow drew low over his eyes, almost like a thundercloud.

She braced for some kind of outburst, feeling sour in the pit of her stomach. It seemed like her stomach wanted to remain clenched, and she couldn't relax the muscles in her shoulders. What more could she do? She often woke in the middle of the night, her sleep-clouded mind immediately whirling through all the issues she needed to address immediately. She needed to prove vPro, identify and eliminate any threat from their nefarious competitor, keep Edgar's expense-cutting knives away from her department, and still find enough time to enjoy time with her husband. Lying awake at night, trying to will herself to sleep, got old fast. Two days ago her husband had recommended quitting.

That seemed wrong. She'd never given up on anything in the past, and she didn't want to give up on this now, especially when all of Mighty Modern Marketing needed her at this critical time.

When Edgar looked back up from his watch he smiled, a rare sight that stilled her thoughts, her breath catching in her throat.

"All vPro capable systems, you say?" he asked.

"Yes sir," she responded after a moment of stunned silence.

"I came down to wish you luck, but perhaps you don't need that luck after all. Good day, Jessica."

He turned around and walked away, and she stood and stared at him. She almost chuckled, but she still felt too emotionally invested and she just might break down and tear up. She slowly sat back down, staring at the Altiris Console. With renewed vigor she tested her job, made a few tweaks to the command-line of the rollout job, and then brought up a Run Now window, selecting All Provisioned Systems. Her mouse hovered over the Run Now button.

"Come on Bobby," she whispered. The few minutes before the IM popped up declaring "Applet is patched" seemed like an eternity.

She clicked the Run Now button.

She got up and took a quick water break, grabbing a drink and throwing it down as if a shot in a drinking contest. She didn't want to return to her desk. What if it failed on most systems, especially the executive team's? What if she hadn't accounted for different hardware platforms in her job? What if?

She squared her shoulders, throwing off the ‘what if' game. She walked resolutely back to her desk and sat down, refreshing the job.

Ninety percent success rate brought a smile to her lips.

For the next few hours she used RTSM to connect to and patch those systems where the Task Server job failed for whatever reason. Most she could figure out the issue by using RTSM, aided by the article, http://69.93.2.147/article/4075/troubleshooting-altiris-manageability-toolkit-vpro-technology-part-5-real-time-console-, since RTCI was the component that executed most Task Server and RTSM commands against AMT.

Toward the end of the business day she leaned back. All vPro capable systems, a good 75% of the environment, was patched. Just as she shut down her computer Tevita showed up. His natural good humor managed to put a smile on his face. His long-sleeved dress shirt had the sleeves rolled up, his tie loose and top button of his collar undone. Sweat glistened on his forehead, remnants of computer dust bunnies streaked on his hands and forearms.

"Hi!" she said, unable to keep from smiling in amusement at him.

"Let me guess," he said, his smile twisting a little, "you've managed to patch all vPro systems."

"Yes," she responded, putting her purse back down on her desk. "How's the other systems coming?"

"I'm... uh... half done."

She nodded, picking up her phone. "Tevita, give me just a moment. Hi, Rob? I'm fine, though it looks like I'll be here a while. It's mostly under control, but we have a few more systems to fix. I know, I'm sorry. I'll see you later tonight, honey. Love you too, bye."

"What are you doing?" Tevita asked, frowning.

"We need to finish up, right?"

"Well... yes. But you don't really have to..."

"I'm thinking your wife wants to see you at least some time tonight. I'll take the third floor, you finish up the second, and the last one done has to bring donuts tomorrow."

Tevita looked relieved. "Deal. Thanks, Jessica."

Bobby walked up, a laptop case in his hands. "I'm heading out. Thanks for getting me back up so fast."

Jessica turned to him, her smile growing. "Bobby, we need your help," she said without preamble. "We have a few more systems to remediate..."

Bobby shook his head, his expression tightening. "No way, I have a Halo 3 party..."

"Bobby, you can't abandon us..."

Bobby looked down at the case in his hands. "Ah nuts! You don't know what this does to me. I'll lose my leader spot..."

"You'll make it up," Tevita said confidently. "If we get this done quickly imagine how impressed they'll be when you join late and still take the top spot."

Bobby's stricken look abated. "Yes. Yes, that would be impressive. Ok, I'll help."

Hours later Jessica left the building, running towards North Station to catch one of the late trains home, her shoulders feeling much lighter than when she'd rode in.

End Part II

Having minimized the damage of the first attack, the IT staff will continue to prepare in anticipation of more cyber attacks.

Check out the recent post on Altiris Juice for Kerberos authentication to Intel vPro systems.

The article provides background, how-to, known issues, and future considerations.

http://juice.altiris.com/node/4492

The Task Server contains AMT function tasks that give you the ability to integrate AMT functionality into Task Server Jobs. This allows you to use AMT in conjunction with Software Delivery, Scripting, and any other Task Server supported function. Understanding how to troubleshoot the AMT side of a Task Server job will help resolve issues so that AMT can be utilized. This includes the following technologies:

• System Defense - Network Filtering

• Reliable Power Management

• IDE redirect for boot redirection

Introduction

This is the concluding article for the series: Troubleshooting the Altiris Manageability Toolkit for vPro Technology. The first four articles covered the setup and configuration of AMT systems, while parts 5 and 6 covered RTCI and RTSM respectively. This final article discusses troubleshooting the AMT integration into Task Server when issues arise.

As an introduction, the actual SOAP or API calls made to the AMT system is invoked through Real-Time Console Infrastructure, the same as when they are invoked through the Real-Time tab for RTSM. Though the calls are from the same place, how those calls are made differ. The following subjects will be covered:

• Determining Cause of Failure

• AMT Detection Issues

• Authentication Issues

Determining Cause of Failure

Often you'll known the general symptom that tells you a job or task in Task Server didn't execute as expected. For example a power management task may have shown as run but the AMT system never woke up. A failure is not shown except deep within a series of status windows.

To determine the returned error, use the following steps. Task Server's actual failure code is buried deep in a series of status windows, as shown in the screenshot after the steps.

1. Under the Task or Job that failed, double-click on the general status row for the specific execution attempt.

2. If within a job, double-click on the line that represents the task or AMT function that failed.

3. Note the numbers of successes versus failures. Click the ‘View Report' link.

4. Now you'll get a grid with the status of the Task, including the status and return code, if present.

AMT Detection Issues

When Task Server reaches a Task that involves AMT, it makes direct calls to AMT in those systems targeted in the task or job. Detecting AMT and subsequently executing the scheduled function requires success at both junctures. The following sections discuss potential issues and solutions in this process.

Power State Unknown

One common problem we see is when a power management task fails due to the failure message: Generic error, FromState detected as unknown:14. This will cause the power action to fail. The causes vary, but the following list contains the most common:

• System unreachable - The target system is not available on the network

• AMT failed to be detected - See the subsequent section ‘AMT not detected'

• Authentication failed - See the subsequent section ‘Authentication Troubleshooting'

• AMT is unavailable - If a system is not provisioned, or AMT is not functioning on that system

Use the following process to determine what the issue is:

1. If RTSM is available, try connecting to the target system using RTSM, specifying the same credential profile.

2. If that fails, try manually putting in credentials until you find one that works.

3. If Step 1 succeeds, try creating a different connection profile with only AMT functions provided.

4. If no RTSM is available, still try the profile with only AMT functions to see if it works.

5. Try other AMT functions, such as Collect Intel AMT Inventory to see if they succeed.

6. If other functions succeed, try using another method to reboot the system to reset the power state stored in the Intel ME. One way to accomplish this is using the Task Server Power Management Agent to send down a standard reboot command to the PC.

7. If no other AMT functions are successful, AMT might not be properly setup on this system. Ask the question: Has this system gone through the provisioning process?

8. If unknown, use the Out of Band Discovery Task to see if AMT is available and to identify what state it is in. See the steps provided under the ‘AMT Not Detected' section following.

9. If all else fails (generally this is on a system-by-system basis, rarely do a collection of systems encounter this level of this issue) try reprovisioning the system by fully unprovisioning and going through the provisioning process again.

AMT Not Detected

Normally a non-vPro system will receive the return code that AMT was not detected. This is accurate, but when it happens to valid managed vPro systems, the issue must be troubleshot to determine why the applying Task Server cannot detect AMT on the system. Out of Band Discovery is a great way to determine what state the system is in. Use the following steps to take stock of the systems:

1. In the Altiris Console, browse to View > Solutions > Out of Band Management > Configuration > Out of Band Discovery > and select the ‘Out of Band Discovery' policy.

2. Enable the policy if it is not yet enabled. If it is enabled, set a schedule to run the discovery again so you have updated information on your systems.

3. On the AMT system in question, go to the Altiris Agent and bring up the Agent UI by double-clicking on the system tray icon or by launching C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe.

4. Highlight the ‘Out of Band Discovery Package.

5. Click the ‘Out of Band Discovery' link under Application Tasks.
   !OOBDiscoveryRun.jpg!

6. Once completed, now check back at the server and double-click the system within a collection to bring up Resource Manager.

7. Click on the Inventory tab and browse to Out of Band Management, and select the data class OOB Capability. This will give you the details of AMT.

If AMT is disabled, it needs to be enabled in the BIOS. A BIOS update from the vendor may provide you a remote way to enable AMT, by using Software Delivery for example. If it is all enabled, next check the provisioning status. Provision as necessary.

Authentication Issues

As with RTSM, Task Server uses the same basic authentication method when executing against a computer. Task Server also includes another option to add additional credentials to the execution to be used when contacting the protocol, which is AMT in this case.

Authentication Methods

Since RTCI controls the authentication, much of the same method is used whether the execution of an AMT command is issues from the Real-Time console or from Task Server, however there are some differences.

Runtime Profile - The Runtime profile contains he following information:

• All known good credentials used to connect via RTSM to a system

• The Intel SCS AMT password sent to systems when provisioning occurs

• Previously successfully used credentials from past RTSM sessions

• Previously successfully used credentials from a Task that succeeded

User-defined Profiles - Profiles can be created that specifically provide credentials for the four types of technologies:

• WMI digest or Domain account

• AMT digest or Kerberos-authenticated user

• ASF digest or Domain account

• SNMP community strings

Task-specified Credentials - When a user setups up a job or task, the user can specify specific credentials to be used when executing AMT-related functions through the profile interface. This option is per job or task, and applies to all AMT functions invoked during the job or task. The Interface allows this as shown in the following screenshot:

Authentication Troubleshooting

The following method will help identify issues and offer ways to work-around and solutions. These have been compiled through experience when troubleshooting issues with failed authentication with Task Server.

1. First, how do you determine if your task or job is failing due to authentication? Use the previous section under Introduction labeled ‘Determining Cause of Failure'.

2. In the Altiris Console browse to View > Solutions > Real-Time Console Infrastructure > Configuration > select Manage Credentials Profiles, or in the Task click the ‘Run Now', and on the subsequent page click on the pencil icon next to the credential profile being used.

3. Where does the green checkmark fall? This is the default profile that will be used when connecting via a Task Server task.

4. Create a new profile by clicking the blue + on the icon bar in the right-hand pane.

5. Under the Intel® AMT tab check the box ‘Enable this technology in the profile'.

6. Supply the admin user credentials set when the managed vPro systems were provisioned.

7. Under the WMI tab also check the box as above and provide a user that has admin privileges to the target system.

8. Give the profile a name and then save it.

9. Back at the main screen check the box under the ‘Default' column until the green check-mark uses your new Profile, or if you are in a job interface select the profile to be used for the run. Note that this does not require you to make it the default profile, allowing another profile to remain the default credentials.

10. Run the task or job to see if the authentication failure has been resolved.

11. If it is not, try rerunning with the Runtime Profile. This contains all known good authentication attempts to the system from either Task Server or RTSM.

12. In one case we supplied only AMT credentials in the Profile which allowed it to authenticate to AMT while a multiple protocol authentication profile failed. If your Task or Job does not contain any of the other protocols, this is recommended.

Conclusion

This concludes the Troubleshooting article series for the Altiris Manageability Toolkit for Intel vPro Technology, version 6. While this doesn't cover all issues, it should resolve most of the common issues we've seen.