Take a look at the posted document on Radmin (Remote Administrator).  This free tool (Viewer) allows technicians to gain access to AMT basic functions and will work with any provisioned ISV under SMB or Non-TLS Enterprise Mode.  This tool can be provided to IT Techicians who may not have access to the ISV console to perform the basic AMT functions on a provisioned client.

http://communities.intel.com/docs/DOC-4309

In IT environments where device naming standards may be coarse, or where users can freely rename their systems at will, you may experience problems managing these clients' AMT firmwares. Since, in order to maintain proper AMT functionality, the OS and AMT hostnames must match, an IT administrator or engineer would likely be interested in finding out which machines do not meet this criteria.

With that in mind, I've written a simple SQL query, that can be run against your Configuration Manager database, to determine what devices have mismatching OS and AMT hostnames. I've pasted the text below, but if you want a more nicely formatted version, please see this link at PasteBin.

/*
Author: Trevor Sullivan

Date: Tuesday, July 21st, 2009

Purpose: Identify devices whose AMT hostname and OS hostname mismatch
   in the Configuration Manager database

*/

select
-- Active Directory site name
[AD_Site_Name0] as 'AD SiteName'
-- AMT hostname (in provisioning record)
, [amt].[HostName] as 'AMT HostName'
-- OS hostname (should match AMT firmware)
, [sys].[Name0] as 'OS Hostname'
-- Retrieve UserID to identify device owner
, [UserName0] as 'UserID'
-- Hardware vendor
, [cs].[Manufacturer0] as 'Vendor'
-- Device model
, [cs].[Model0] as 'Model0'

from v_AMTMachineInfo [amt]

-- Join v_R_System to retrieve AD Site Name field
join v_R_System [sys] on [sys].[ResourceID] = [amt].[MachineID]
-- Joinv_GS_Computer_System to allow us to retrieve make/model information
join v_GS_Computer_System [cs] on [sys].[ResourceID] = [cs].[ResourceID]

where
-- We only want current resource records from ConfigMgr
[sys].[Obsolete0] = 0
-- This condition determines the mismatching hostname in the v_R_System and v_AMTMachineInfo SQL views
and [sys].[Name0] <> [amt].[HostName]

Cheers,

Trevor Sullivan

Systems Engineer

You’re a small businessperson, and the office computer guy (who actually knows nothing about computers, but was selected because he successfully hooked up a game console to his TV last Christmas) tells you that two of your 10 office PCs are down with viruses or “something,” bringing a halt to a customer proposal that’s on deadline. Two others in accounting keep pausing long enough for workers to take coffee breaks while the systems mull over their keystrokes, pushing the billing process into overtime. Revenue is at a standstill.

“What are my options?” you ask. “We could maybe buy some stuff to upgrade them, and call in a computer repair service,” the computer guy shrugs. Buying new computers in the economic downturn seems a questionable call. The computers are only three or four years old and likely you could get another year or two out of them.

Nonetheless, while you’re small, these decisions aren’t just about survival and cutting back spending. They’re about remaining competitive and having an edge when the Dow Jones climbs for real. And the business doesn’t run without computers. So, what do you tell your computer guy?

OK, I’m an Intel PR guy, so you know where this is going. Nonetheless, bare with me for a bit and there might be some ROI. Rob Crooke, VP for Intel’s Business Client Group, recently tackled some of the key questions around this dilemma in conjunction with a press briefing on a new study by Techaisle. The study looks at the financial aspects of maintaining computers for SMBs.

Here’s what the Techaisle study says: The average maintenance cost for a small business on a computer that’s more than three years old is $545. On the average, that includes $326 for maintenance, $99 for those upgrades you’re considering and $120 for out-of-warranty service costs. If you bought the extended warranty, reduce the latter. If you buy a new computer, the maintenance cost drops to $126, the first-year maintenance cost from a study by Jack Gold (Techaisle doesn’t provide a first-year cost.) So, the difference is $419.

“Yeah, sure,” you say, “but I have to buy a new computer!” Yes, but let’s see how that $419 might cut the pain. PDS has Intel Core2 Duo-based desktop PCs starting at $540 and CDW offers notebooks beginning at $700. If you add Intel vPro for additional manageability and security, you could move up for $699 and $830, respectively. So, you can buy the new desktop system for as low as $121, a 15-month payback. Now, if you’re larger than small, say 50-100 employees, you can see from the chart below that the payback is less than a year, and will actually make you a $40 profit. OK, OK, I’m a PR guy, but cut me some slack. I’m not making up the numbers.

Now that’s just the hard dollars that Techaisle captured. A new PC can have other benefits – reduced downtime from viruses, improved energy efficiency and enhanced productivity to name a few. So, maybe investing a few dollars could save you money in the slightly longer run and possibly help you keep your revenue flowing.

For more information, you might want to look at the Techaisle study. For a quicker overview check out the fact sheet and white paper, or better see the media briefing with Rob Crooke, ASUSTeK and Gigabyte.

Hello vPro Experts!

I would like to pass on some information that I discovered a while ago, based on a Microsoft Premiere Support ticket. I was having trouble getting the Microsoft Out-of-Band (OOB) Management Console functioning from a Windows XP system. I tried everything on a fresh, standard build of Windows XP, but nothing would work.

After working with Premiere Support, we finally discovered that Windows XP Service Pack 3 (SP3) was required for proper functioning of the Microsoft OOB console.

This behavior is actually related to some functionality that was added in SP3, specifically in the winhttp.dll library. There is a function called WinHttpSetOption in the WinHttp library, which is called with a parameter enabling the WinHttp Option Flag named WINHTTP_ENABLE_SPN_SERVER_PORT. This flag enables the WinHttp library to include the server port in the Kerberos Service Principle Name (SPN), since the AMT web service is running on a non-standard HTTP port (16993).

The Windows XP Service Pack 2 (SP2) version of the WinHttp library does not include this capability, and consequently fails to authenticate. In order to properly connect to ConfigMgr-provisioned AMT devices with the Microsoft OOB Console, please make sure your helpdesk / support systems are running Windows XP SP3.

If you have any questions, feel free to post them in the comments section, and I will do my best to answer them.

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

Serial over LAN, or SOL for short, is a great tool for diagnostics. Combined with IDE redirection, or IDER, there’s a tremendous amount of things you can do remotely to manage clients. One of the areas where SOL can be helpful is for delivering status updates for IDER boot images that use a graphical interface. Instead of asking someone to read what’s on the screen to you, you can have a clear picture of what’s going on.

The key to this is to include the SOL driver in your live CD boot image. The actual process of including this driver will vary depending on the live CD tools you are using. I won’t go into specific details on the steps needed to include the driver in this post. The popular live CD tools, such as the Windows AIK, have a lot of information available on how to include drivers.

Once you have the SOL driver included in your live CD you can begin to take advantage of the SOL interface by sending text output to the SOL serial port. In most cases the port is COM3, but it may be on another COM port. You will need to do some testing to see which COM port your hardware platforms use for SOL.

Here’s one common scenario where this can be very handy. Let’s say you have a live CD that includes an in-band remote access tool, like PC Anywhere or a VNC server. You can include a startup script that echo’s out the computer’s hostname and IP address information to COM3. That way, you will know when the live CD has booted and the information it may have registered with DNS/DHCP. If you are using a Windows based live CD all you need to do is include commands like this:

echo %computername% >com3

ipconfig >com3

You can even incorporate some ANSI control codes to control formatting. For instance, if you want to have the remote SOL terminal clear it’s screen, you can send the Esc+[2J. The trick is generating the “Esc+” part. In order to do this in Windows, you need to hold down the Alt key, press 0027 on the ten key pad (make sure you include the two zeros) and then let the Alt key go. Unfortunately, Notepad does not seem to support this functionality. As an alternative, I recommend using Notepad++. Once you are done, you should have something like this:

echo ^[[2J >com3

Note: The escape character may appear as "^[" or something else altogether, like a little arrow or block character.  It depends on your OS and application.

Here’s an example of the output I get from a Live CD I built using Bart’s PE Builder.

While at Symantec ManageFusion 2009, we had a chance to talk with Antwune Gray, a Director at NetX. In the video below, he talks about how the NetX Appliance discovers which PCs in your business environment have Intel vPro technology, as well as the version and setup status of Intel vPro technology.

To learn more about Intel's presence at Symantec ManageFusion 2009, go to: http://www.intel.com/go/managefusion/

I attended an eye-opening press briefing the other day where George Thangadurai, strategic planning director for Intel’s Anti-Theft Program, Ponemon Institute founder Larry Ponemon; and Rex Rountree, an encryption expert from Intel’s IT group disclosed details from a study that calculated the actual cost of losing or having notebook computer stolen, a rapidly growing problem.  The basic message to the millions of us mobile workers was: Hang onto that laptop.

Chain it to you if you must because if it’s lost or stolen the bill to your company will be $49,264 on the average.  The “Cost of a Lost Notebook,” study was commissioned by Intel and conducted by the Ponemon Institute.  You can find an overview of the findings in the news release.

Intel undertook the study to better understand the problem and devise remedies that are simpler than handcuffing yourself to your notebook.  In January, Intel introduced Anti-Theft Technology as one way to help make laptops less appealing to thieves.  Anti-Theft Technology works by locking a computer reported lost or stolen either from a remote server or from policies embedded into the PC.  Once locked, the computer is useless until recovered at which time IT can issue the owner a password to make it functional once again.

Intel works with computer makers and service providers, such as Absolute, Lenovo, PGP and Phoenix to implement Anti-Theft Technology.  If used in conjunction with a hard-disk encryption service vendor, such as PGP, Anti-Theft Technology can house the encryption keys, which are normally stored on the hard disk, in the chipset.  If the PC turns up missing, the keys can be deleted.  So, even if a thief has the passwords to unencrypt the drive, they are useless and the data protected.  If the thief removes the hard disk from a locked computer in hopes of installing it in another computer to gain access to the data, he leaves the keys locked behind  But, back to the study.

That $50,000 cost, which I suspect has any CFO reading this clutching his chest, results, of course, from this potential compromise of data.  In fact, responding to a data breach is responsible for about 80 percent of the cost, according to the study.  The rest covers investigating the loss, the price tag for any lost intellectual property, legal expenses and making regulatory disclosures.  Let’s also not forget the disruption to an employee whose entire job function likely hinges on his computer.

So, what can a company do?  The study concludes that encryption helps.  It knocks about $20,000 of the bill.  Why doesn’t it eliminate all of the expense?  Encryption depends on who has access to the encryption credentials to decipher the data.  If they’ve somehow been compromised or you’re dealing with a disgruntled employee, then even the most elaborate cipher won’t help.  It also depends on employees actually using the encryption features and on which data they encrypt.

So, in the end, cutting the cost of missing laptops requires a multifaceted blend of technology and practices.  Rex added that training employees how to protect their notebooks goes a long way in cutting the risk as well.

After the briefing, I still had some questions and caught up with George, Larry and Rex for a chat.  If you’d like to listen to the briefing, it’s available at 1-800-475-6701, conference ID# 997098.

Ever had a laptop stolen or have any thoughts on preventing theft?  I’m sure everyone would be interested in your comments.

While at Symantec ManageFusion 2009, we had a chance to talk to IT executives and managers from Disney International, Fox Interactive Media, Las Vegas Sands Corporation and McCormick Spice Company and industry analysts from IDC, Enterprise Management Associates and Ptak, Noel & Associates LLC about Intel vPro technology and industry trends.  In the video below, they discuss the impact of Intel vPro technology on power consumption reduction and energy cost reduction.

To learn more about Intel's presence at Symantec ManageFusion 2009, go to: http://www.intel.com/go/managefusion/