Home > Intel Communities > Open Port IT Community > Intel® vPro™ Expert Center > Blog > Tags > centrino_pro
1 2 3 Previous Next

Intel vPro Expert Center Blog

39 Posts tagged with the centrino_pro tag
2

You’re a small businessperson, and the office computer guy (who actually knows nothing about computers, but was selected because he successfully hooked up a game console to his TV last Christmas) tells you that two of your 10 office PCs are down with viruses or “something,” bringing a halt to a customer proposal that’s on deadline. Two others in accounting keep pausing long enough for workers to take coffee breaks while the systems mull over their keystrokes, pushing the billing process into overtime. Revenue is at a standstill.

“What are my options?” you ask. “We could maybe buy some stuff to upgrade them, and call in a computer repair service,” the computer guy shrugs. Buying new computers in the economic downturn seems a questionable call. The computers are only three or four years old and likely you could get another year or two out of them.

Nonetheless, while you’re small, these decisions aren’t just about survival and cutting back spending. They’re about remaining competitive and having an edge when the Dow Jones climbs for real. And the business doesn’t run without computers. So, what do you tell your computer guy?

OK, I’m an Intel PR guy, so you know where this is going. Nonetheless, bare with me for a bit and there might be some ROI. Rob Crooke, VP for Intel’s Business Client Group, recently tackled some of the key questions around this dilemma in conjunction with a press briefing on a new study by Techaisle. The study looks at the financial aspects of maintaining computers for SMBs.

Here’s what the Techaisle study says: The average maintenance cost for a small business on a computer that’s more than three years old is $545. On the average, that includes $326 for maintenance, $99 for those upgrades you’re considering and $120 for out-of-warranty service costs. If you bought the extended warranty, reduce the latter. If you buy a new computer, the maintenance cost drops to $126, the first-year maintenance cost from a study by Jack Gold (Techaisle doesn’t provide a first-year cost.) So, the difference is $419.

“Yeah, sure,” you say, “but I have to buy a new computer!” Yes, but let’s see how that $419 might cut the pain. PDS has Intel Core2 Duo-based desktop PCs starting at $540 and CDW offers notebooks beginning at $700. If you add Intel vPro for additional manageability and security, you could move up for $699 and $830, respectively. So, you can buy the new desktop system for as low as $121, a 15-month payback. Now, if you’re larger than small, say 50-100 employees, you can see from the chart below that the payback is less than a year, and will actually make you a $40 profit. OK, OK, I’m a PR guy, but cut me some slack. I’m not making up the numbers.

Money Foil.jpg

Now that’s just the hard dollars that Techaisle captured. A new PC can have other benefits – reduced downtime from viruses, improved energy efficiency and enhanced productivity to name a few. So, maybe investing a few dollars could save you money in the slightly longer run and possibly help you keep your revenue flowing.

For more information, you might want to look at the Techaisle study. For a quicker overview check out the fact sheet and white paper, or better see the media briefing with Rob Crooke, ASUSTeK and Gigabyte.

2 Comments Permalink
1

While at Symantec ManageFusion 2009, we had a chance to talk with Mike Dunham, Executive Director of Product Management for Incendio Technology. In the video below, he talks about the Incendio vMinder Portal, which allows IT profrossional to utilize the Symantec Altiris Client Management Suite without needing console access. From the Incendio vMinder Portal, the IT professional can access Intel vPro technology features such as reliable remote power control that are part of the Symantec Altiris Client Management Suite.

To learn more about Intel's presence at Symantec ManageFusion 2009, go to: http://www.intel.com/go/managefusion/

1 Comments Permalink
0

While at Symantec ManageFusion 2009, we had a chance to talk with Antwune Gray, a Director at NetX. In the video below, he talks about how the NetX Appliance discovers which PCs in your business environment have Intel vPro technology, as well as the version and setup status of Intel vPro technology.

To learn more about Intel's presence at Symantec ManageFusion 2009, go to: http://www.intel.com/go/managefusion/

0 Comments Permalink
0

While at Symantec ManageFusion 2009, we had a chance to talk to IT executives and managers from Disney International, Fox Interactive Media, Blue Cross Blue Shield and McCormick Spice Company and industry analysts from Enterprise Management Associates and Ptak, Noel & Associates LLC. In this video, they talk about the security benefits of Intel vPro technology - which include the ability to deploy software patches faster into the installed PC base, and the ability to quarantine infected PCs and remotely remediate them.

To learn more about Intel's presence at Symantec ManageFusion 2009, go to: http://www.intel.com/go/managefusion/

0 Comments Permalink
0

Hang Onto That Laptop

Posted by Scott Smith Apr 26, 2009

I attended an eye-opening press briefing the other day where George Thangadurai, strategic planning director for Intel’s Anti-Theft Program, Ponemon Institute founder Larry Ponemon; and Rex Rountree, an encryption expert from Intel’s IT group disclosed details from a study that calculated the actual cost of losing or having notebook computer stolen, a rapidly growing problem.  The basic message to the millions of us mobile workers was: Hang onto that laptop.

Chain it to you if you must because if it’s lost or stolen the bill to your company will be $49,264 on the average.  The “Cost of a Lost Notebook,” study was commissioned by Intel and conducted by the Ponemon Institute.  You can find an overview of the findings in the news release.

Intel undertook the study to better understand the problem and devise remedies that are simpler than handcuffing yourself to your notebook.  In January, Intel introduced Anti-Theft Technology as one way to help make laptops less appealing to thieves.  Anti-Theft Technology works by locking a computer reported lost or stolen either from a remote server or from policies embedded into the PC.  Once locked, the computer is useless until recovered at which time IT can issue the owner a password to make it functional once again.

Intel works with computer makers and service providers, such as Absolute, Lenovo, PGP and Phoenix to implement Anti-Theft Technology.  If used in conjunction with a hard-disk encryption service vendor, such as PGP, Anti-Theft Technology can house the encryption keys, which are normally stored on the hard disk, in the chipset.  If the PC turns up missing, the keys can be deleted.  So, even if a thief has the passwords to unencrypt the drive, they are useless and the data protected.  If the thief removes the hard disk from a locked computer in hopes of installing it in another computer to gain access to the data, he leaves the keys locked behind  But, back to the study.

That $50,000 cost, which I suspect has any CFO reading this clutching his chest, results, of course, from this potential compromise of data.  In fact, responding to a data breach is responsible for about 80 percent of the cost, according to the study.  The rest covers investigating the loss, the price tag for any lost intellectual property, legal expenses and making regulatory disclosures.  Let’s also not forget the disruption to an employee whose entire job function likely hinges on his computer.

So, what can a company do?  The study concludes that encryption helps.  It knocks about $20,000 of the bill.  Why doesn’t it eliminate all of the expense?  Encryption depends on who has access to the encryption credentials to decipher the data.  If they’ve somehow been compromised or you’re dealing with a disgruntled employee, then even the most elaborate cipher won’t help.  It also depends on employees actually using the encryption features and on which data they encrypt.

So, in the end, cutting the cost of missing laptops requires a multifaceted blend of technology and practices.  Rex added that training employees how to protect their notebooks goes a long way in cutting the risk as well.

After the briefing, I still had some questions and caught up with George, Larry and Rex for a chat.  If you’d like to listen to the briefing, it’s available at 1-800-475-6701, conference ID# 997098.

Ever had a laptop stolen or have any thoughts on preventing theft?  I’m sure everyone would be interested in your comments.

0 Comments Permalink
0

On October 9th, 2008, a group of Intel Pro’s across the company got together to host a chat session. It was absolutely stellar, with great questions in all different areas of the client. Here is that transcript and I want to apologize for delay in posting this. Our goal was to post in 24 hrs, however we realized that it was not as possible as we liked it to be.

 

Chat Transcript - October 9th, 2008 - output from the chat session

 

ENJOY & stay tuned for a future chat.

 

Josh H

0 Comments Permalink
0

After a longer wait than I planned here are the key screens that your end users may see if they click on the Icon in the Centrino 2 Platform with Intel vPro Technology. They show the different tabs and the difference between Unprovisioned & Provisioned.

 

What's next.. Testing them in the lab and sharing those video's out.. stay tuned for more.

0 Comments Permalink
0

 

NOTE: If you have not read parts 1 through 5, please read these before reading this part as this is a continuation of the story begun in the previous sections. http://juice.altiris.com/book/4687/altiris-and-intel-vpro-use-cases

 

 

 

 

 

The Might Modern Marketing IT team has just seen two suspected competitors encroach on the home turf. What can they do in light of this brazen intrusion? Can Altiris and Intel's vPro help them gain the upper hand when the opposition brings the fight to the very top? In this part of the story we'll learn the final outcome of their major competitor's struggle to gain the majority share of the market through fierce competition and unscrupulous IT sabotage.

 

 

 

Mighty Modern Marketing HQ - Boston, Massachusetts

"Bobby!" Jessica Langley whispered loudly. Or, more accurately, she said loudly to just pierce the cacophony of fans filling the server room. She turned the corner and saw Bobby perched at his desk. His hands rested on his keyboard, as if posed to begin coding at an instant's notice. He seemed to be looking intently at his monitor.

 

"Bobby?" she urged, stepping closer. He didn't respond, and as she watched his head tipped forward. He jerked, a loud snort escaping his nose. He glanced around, blinking bleary eyes, before his eyelids seemed to close of their own volition. He settled back into his chair, hands still poised.

 

 

Jessica tapped him on the shoulder. He didn't respond. She tapped harder, and he shrugged, but his eyes remained closed. She shook the back of his chair, and he jumped, hand flailing out to grab the sides of his desk. He whirled around, staring at her with wide, reddened eyes.

 

 

"Jessica!" he said, blinking rapidly. "Something wrong?"

 

 

She folded her arms. "Yes, something's wrong," she responded tersely. "We're under attack."

 

 

He wiped at his face with his long-fingered hands. "A virus?"

 

 

"No, something a bit more direct. I saw that ninja guy again, and some smooth-slick character with him. He might be Jake, the New Nifty Network CEO."

 

 

"The ninja? The guy I thumped with the laptop??"

 

 

"Yes."

 

 

Bobby looked at her wide-eyed. His eyes darted about, and he finally picked up a power strip, gripping the plug and cord. He twirled a few times, and Jessica backed away.

 

 

"What are you doing?" she demanded.

 

 

"I need something in case he comes after me for revenge!"

 

 

"Is that supposed to be a ball and chain?"

 

 

He glanced down at the strip, the empty black slots seeming to stare back up at him forlornly.

 

 

"Yes. No. Maybe... I don't know!"

 

 

She reached out and took it from him. "Tevita's following them, but we need to lock things down."

 

 

Bobby rubbed his hands together, his expression tightening a little. "I always have things locked down," he said. "You're insulting my..."

 

 

"No time for that. Lock up all the servers, and backup all databases right now. If possible bring non essential applications down until we get these guys out of here. And call security."

 

 

Bobby nodded. "There's a ton of locks. Can you help while I call?"

 

 

As Jessica set locks on the server's chassis and covers, she watched the door leading into the server room. She couldn't seem to keep her eyes away from it, half expecting one of the suspects to barge in waving a bat around and demanding their most sensitive data. Halfway through the process Bobby gave her a large key ring full of small metal keys with short-stubby teeth.

 

 

"Go check the server racks and lock any covers that are open with those," he instructed.

 

 

She stared at him. "There are a hundred keys here, and none of them are labeled!"

 

 

"I know. I keep meaning to get around to label them, but... well... how fun would that be?"

 

 

"Yeah, how fun?" she mumbled as she headed around the corner. She started down the row, checking the front of the cases. She made it almost halfway around before she found one that opened. She looked down at the mass of keys and sighed.

 

 

She only had inserted about thirty keys, all without budging the lock, when her mobile phone rang. She quickly fished it out of her jacket pocket, glancing at the number before putting it to her ear as she pushed the answer button.

 

 

"Tevita?" she prompted.

 

 

"Jessica! They're up here on the executive level!" he said in a loud whisper, and she had to press her phone hard against her ear to hear.

 

 

"Bobby called security..."

 

 

"These guys are really delivering packages as if they're legit, but that taller guy, the slick one, keeps looking around as if expecting to see something."

 

 

"Why don't you go tell Mr. Johnson? I think that's Jake Wells."

 

 

"That's a good idea. I'll call back if I need anything..."

 

 

"Just be careful..." she started to say when the line dropped. She locked the keypad and slipped the phone back in her pocket. She stared down at the keys on her other hand, and finally decided she had better things she could do. She walked quickly to Bobby's office. He started intently at his screen, his fingers flying over the keyboard so fast they seemed to blur in her vision. She placed the key ring on his desk and he looked up.

 

 

"The first half of them are secure," she said, not mentioned she hadn't needed the keys for any of those.

 

 

"That was fast..."

 

 

"I got a call from Tevita. I think I need to secure some of the more vital PCs in the office, here. Did you ever finish those network filters I asked for?"

Bobby nodded. "I did. I still need to test the last one..."

 

 

"But the accounting and executive filters are ready?"

 

 

He nodded again. "Yes. I'll email them to you now. It wasn't easy, what with the limitation on how many filters I can apply, but I weeded out the nonessentials. Instant Messenger won't work, nor will standard Internet Explorer stuff, but all the applications the two groups will use respectively are available."

 

 

"Email?"

 

 

"I think so... it's not reliable..."

 

 

She shrugged. "Better than nothing. Thanks!"

 

 

She hurried out the door. Her eyes looked around the office as she walked tensely back towards her desk. She expected to see signs of stress or something, but everyone acted normally. Several even said hi, and she managed to smile back, though the smile felt stiff on her face. Why couldn't she have a normal IT job where emergencies consisted of no coffee in the break room, or typical, non-intentional application crashes? Couldn't someone simply forget their domain password for the highlight of the day? That kind of stress she could handle without her stomach tying itself into knots.

 

 

She sat down as a new email came in from Bobby. She opened the email, and downloaded the attachments to a share on the Notification Server. She quickly initiated a Remote Desktop to the Notification Server. When she clicked connect, she received a message indicating the max number of session had been reached. She stared at the screen.

 

 

"No way," she muttered as she jumped to her feet. She hurried over to Tevita's desk, but he'd locked all his systems. Definitely wise, but If he had sessions open she'd be unable to close them. She hurried back and launched the Altiris Console on her own desktop. She'd wanted to add the filters in the right places on the drive of the server, but it wasn't necessary. The console came up, and she browsed through Manage, clicked on Jobs, browsed through Tasks and Jobs, Server Tasks, Real-Time System Manager, and clicked on Network Filtering Task.

 

 

Jessica right-clicked on the Task and choose "Clone". She named it "Accounting Network Filtering Task" and clicked OK. The new filtering task appeared, the task configuration loading in the right pane. She clicked the Edit button on the icon bar with the small pencil symbol. Under the section ‘Filter network traffic other than to and from the Notification Server' she changed the radial selection to ‘Import network filtering settings from the custom XML file'. Under the section ‘Location of the file to import from:' she clicked the Browse button. In the subsequent window she browsed to the share she'd copied the custom files Bobby had created and selected the Accounting one. She clicked Open which returned her to the Settings page.

 

 

At the bottom of the right-pane she clicked the Apply button. Next, she clicked on the ‘Run Now' button on the icon bar. Within the pop-up window that appeared she set the ‘Run name' field as ‘Accounting Lockdown SOS'. Under the ‘Connection credentials settings' section she clicked on the hyperlink labeled: Runtime Profile. From the list she selected the list of credentials containing her Domain credentials that had full rights to all AMT systems. When she'd committed the changes she then clicked the hyperlink under the Resources heading labeled ‘Select computers'. The Task Server resource selection window appeared.

 

 

In the left most pane she expanded the Computer Collections folder and the My Collections folder. Under this section she highlighted the collection labeled: All Accounting Computers. By double-clicking on this collection the picker added it to the right most pane, labeled Selected Items. She clicked OK to add the collection to the Task. On the main Run Task screen she hovered the mouse-pointer over the ‘Run Now' button. She wondered if both words were capitalized to emphasis the finality of the button! She believed the filter would work since she had faith in Bobby's skills, but if something went wrong...

 

 

For just a moment she paused, taking her hand off the mouse. Over reacting might save the day if these two interlopers really came with Mighty Modern Marketing's determent in mind, but if she'd jumped to the wrong conclusions she might just create a huge mess for no reason at all.

 

 

Another thought, one she'd had previously, surfaced in her mind. If Bobby hadn't verified the filter worked, and it somehow invoked a filter that did NOT give access to the systems via Notification Server, she might just decapitate every single one of the Accounting department's computers with a single click. She shuddered as she imagined Tevita and her running from computer to computer in a desperate effort to manually disengage the network filter using their credentials. There was a reason Bobby tested all the filters he created, and that same reason applied as to why she and Tevita each independently tested them again.

 

 

So far Bobby always got it right, at least from the Notification Server aspect. Sometimes the other filter items didn't work properly, but she'd still be able to quickly remove the filter from all the systems. She sat up straighter in her chair, her lips pressed into a firm line, and took hold of the mouse again. With only the briefest of hesitations she slicked the ‘Run Now' button.

 

 

She waited a minute, then refreshed the status display. So far so good. She quickly ran through the same procedure, but this time setting the Task to quarantine, this time for the system's own protection, the Executive systems. She paused before running it, then quickly picked up the phone and dialed Mr. Johnson's number.

 

 

"Mr. Johnson's office," a young voice greeted.

 

 

She paused. She didn't recognize the voice, but didn't attribute it to the two she'd seen. "Uh, yes, this is Jessica Langley down in the IT department. Is Mr. Johnson available?"

 

 

"No, ma'am. He's currently in a meeting. Can I take a message?"

 

 

"When did he get a secretary?"

 

 

She heard a chuckle. "I'm not a secretary, I'm his son, Roger. It's ‘Go to Work With Mom or Dad' day at school. I'd rather be here than school, so... here I am."

 

 

"Okay... Can you tell him this is urgent?"

 

 

"I would, except he left for the meeting and I don't know where."

 

 

She sighed. "Thanks Roger." As she hung up the phone she clicked the ‘Run Now' button.

 

 

Leaning back in her seat, she folded her arms, eyes on the Altiris Console. Having applied the filters she did feel a little better, but she still couldn't sit still. She stood and walked to the drinking fountain, trying to think what next she needed to do to ensure whatever their competitors planned didn't cripple the business. Her eyes roved over the immediate area. It seemed everyone moved calmly, with occasional conversations heard above the hum of computers. She fished in her pocket and removed her cell phone, staring at the display as it lighted up. If Tevita was hiding somewhere, calling him might give him away. But surely he'd have placed in phone on vibrate...? She hated not knowing where and what Tevita did, and what the interlopers meant to do.

 

 

She found herself facing the stairs. Part of her wanted to run up there and blow the whole thing wide open so that the sheer number of Might Modern Marketing's employees would stop whatever they planned. Of course if it ended up being an innocent visit... she threw that thought aside. They'd shown up looking like delivery guys, and the furtive glances from the "ninja" seemed to proclaim their guilt. She reached up and rubbed at her eyes, trying to decide what to do next.

 

 

They'd locked down the servers, taking down nonessential applications, and employed filters against critical systems. She squared her shoulders and entered the stairwell, hurrying up the two flights to the third floor. When she reached the door at the top she stopped, taking out her cell phone again. She dialed Tevita's number and pressed the send button. The phone rang several times before his voicemail started playing. She hung up the phone, fidgeting with it for a few moments before slipping it back into her pocket.

 

 

She tried to square her shoulders again, but somehow the thought of heading through the door started her stomach doing flips. She pressed a hand against her middle, trying to physical calm her nerves. It wasn't like these guys were armed... were they? So far the incidents had all been non-violent, but had desperation driven them to take extreme measures? Thinking about her job description, the security and protection for the intellectual property of Might Modern Marketing fell under her job description. These rubes from New Nifty Networks certainly qualified as a threat, but where should she draw the line?

 

 

She smiled wryly, decided she didn't like the spineless turn of her thoughts. True, there could be real danger on the floor, but most of the people up here she knew well and trusted. She opened the door and stepped through.

 

 

To the left sat the accounting team, most in closed-door offices to help with keeping sensitive data from wandering eyes. She saw one of them exit his office, a frown on his face. She walked towards him, intending to head through towards the executive staff area, when he looked up.

 

 

"Hi Jessica," he said, the tight expression on his face easing. "Can you help? I'm having internet problems right now."

 

 

"I know," she responded with what she hoped was a firm but friendly smile. "We have a security issue I'm dealing with and we've locked most systems. You should still be able to run the Accounting software... Balance Act. Have you had any problems with it?"

 

 

"No... I just... well... do you know when we'll get it back?"

 

 

"Hopefully soon. I'll send out a notice when it's back up."

 

 

"Okay. Thanks..."

 

 

She nodded and continued on her way. She heard him behind her start talking to another of the accountants, and he sounded a little annoyed, but she thought that better than any wrath had the critical application Balance Act gone down. She smiled, hoping someone would try to strip the data from the application and try to send it out, only to find that they couldn't make a connection to anything. She hoped they stewed over it, trying to figure out why the computer wouldn't connect to anywhere despite showing a network connection.

 

 

She tried to look casual as she raced towards the executive area. What would she find? By the look of people on the floor, no one had any inkling that two unwanted people prowled the hallways. As she turned the corner, her eyes followed the line of doors, most of them open. The sound of conversations floated out of a few, all sounding normal and unhurried. She noticed that Mr. Johnson's door remained closed. She walked on her tiptoes for a few steps, trying to look down into the cubes opposite the CEO's office. The first two stood empty, while the next two held their normal occupants, none looking more harried than normal.

 

 

She reached his door and glanced through the side window set to the left of the door. She noticed a young man sitting at the computer. He slouched back in the office chair, right hand moving around the mouse, his hair spiky and bleached blond. She assumed this was Roger, and moved on. She fished her phone out of her pocket and dialed Tevita gain. For the second time he didn't answer and she reached his voicemail. This time she left a short, terse message asking him to call her, and hung up.

 

 

She looked either way down the hall, her stomach slowly turning over. So far everything looked fine, except that Mr. Johnson wasn't at his office and Tevita wouldn't answer his phone. Many possibilities as to why held nothing malicious, and probably nothing amiss had happened. Somehow she couldn't convince her body of that, and found herself walking stiffly down the hall towards the set of conference rooms at the end. She couldn't unlock her knees, as if her joints had seized up. She wrung her hands in a gesture she'd long ago overcome, and forced her arms to swing normally at her side. Even that gesture felt forced, and she shook herself, trying to loosen up her tense muscles.

 

 

One of the conference room doors held shut, the other room's doors open and the lights out. Light streamed under the door and through the indoor window of the occupied conference room. She sidled up to it, trying to peer in without showing her face. She caught of glimpse of Tevita, standing against the wall. His normal smiley features pulled down in a frown, his arms folded tightly across his chest. She knew he only folded his arms like that when angry. Not just a little angry, but very angry. She quickly backtracked to approach the door from the other side.

 

 

The first person she saw held a sly smile on his face, his slick features seeming to hold confidence to overflowing. He spoke, his mouth quirking at the corner as if he had trouble keeping a secret. He pointed at a laptop plugged into one of the network cables snaking out of the middle of the large oval conference table. It looked like one of their field laptops meant for Sales Engineers or Consultants. She even saw the telltale barcode they stuck on all laptops before shipping them out, but also noted it was vPro capable. She glanced around, but in the dead-end hallway no one paid her any mind. She ducked down and put her ear against the door, trying to hear inside.

 

 

"...really think you're as spineless as that, old man." The voice reminded Jessica of a new car salesman who knew he could really sell cars.

 

 

Mr. Johnson's voice sounded as measured and confident as always. "You know that's not true, Jake."

 

 

"I do have to give you credit, Mr. Unflappable. You act like you aren't phased, but I've seen your employees run around like chickens with their heads cut off from time to time. I was hoping to reach an agreement today, to avoid future... incidents."

 

 

"We're not afraid of you," Tevita said hotly, the words loud enough to cause her to flinch.

 

 

She could just imagine Mr. Johnson holding up a placating hand to Tevita. "Why do we need an agreement? You've seen the projected numbers, I assume. You've done no real harm."

 

 

"Oh? You seem to forget I have access to your network, as this laptop proves. I know everything, including pending projects, budget allotment, fiscal year targets, and actual revenue both real and pending."

 

 

"You love the threat," Mr. Johnson said, a hint of mocking in his tone. "Did you think I'd be impressed that you'd have the gall to walk in here and make ludicrous demands?"

 

 

"You'll notice that security hasn't stopped me yet. If you need proof, let me show you..."

 

 

Jessica glanced through the window, her eyes trying to focus on the number printed below the barcode. If she knew which machine this was, she might be able to control it. She quickly pulled out her cell phone and punched in the number. She then quickly retreated, heading back quickly towards the stairs. She scampered down them, only to almost fall as the heel on her left shoe broke off. She skidded down the last few steps, barely catching the rail to stop a certain face plant. She quickly slipped both shoes off, hurrying down to the first floor.

 

 

She reached her cube, glad she'd left the Altiris Console up. She used the barcode in Asset Management to find the name of the system. She browsed in the console under View, Solutions, Real-Time Console Infrastructure, Tools, and clicked on the Manage node. She quickly typed in the name and clicked OK. A window appeared, giving her the RTSM interface. A grim smile slipped on her lips as the tree loaded, giving her all of the Real-Time System Manager functionality. In the left-hand pane she browsed down into Real-Time Consoles, Real-Time System Manager, Administrative Tasks, and selected Hardware management.

 

 

With her hand hovering over the mouse, her mind whirled through the possibilities. With vPro, she had a lot more power. Taking control of the system wouldn't do much since she could only access a non-graphical interface with Serial Over LAN. Anything else she might do would only alert them to what was occurring. She needed to do something fast. She selected to reboot the system, checking the option under Redirection options labeled, Perform boot from: and Display task progress and remotely control computer. She selected to provide a CD image, browsing to a utility for disk formatting. The utility had the ability to quickly write zeroes to the drive. This essentially cleared the hard drive of all data.

 

 

It was a good first step, and she initiated the reboot, redirection. She wished she could see the snide smile vanish as the computer abruptly turned off without any warning. She knew the laptops had reasonable boot times, but it seemed to take an eternity to load the utility. She half expected the laptop to be removed from the network, the SOL session dropping, but eventually the utility's interface appeared. She glanced at her watch. It took forty seconds, though she swore it had to be at least five fretful minutes.

 

 

She quickly selected the option to wipe the drive, quickly pressing through the double-warning that all data would be lost as quickly as she could. With luck the two dimwits wouldn't realize what was happening until it was too late.

 

 

Now what had he said about security? Bobby said he'd called them, so why hadn't anyone responded? She pushed to her feet as she locked her computer, hurrying towards the front desk area. When she reached the front desk she found it unoccupied. A visitor stood at the front of the desk, looking around with a frown and lines creasing his forehead.

 

 

"It's about time," the man said, visibly trying to smooth his expression. "I have an interview and need a temp badge."

 

 

Jessica shook her head. "Sorry, I'm not with security," she said hurriedly as she picked up the phone.

 

 

"If you're an employee, you can escort me," he said with the words forceful. She paused, looking him over quickly. He carried a thin folder under his left arm, with his arms held closely to his sides, his legs shoulder-length apart. His dark eyes watched her far too intently, hardly a blink to disrupt his scrutiny. Despite his oversized short, she could see the honed muscles tensed underneath.

 

 

She swallowed the lump that formed in her throat. If she hadn't failed Drama in high school she wouldn't be as worried as she tried to smooth her expression.

 

 

"It's against policy," she said, grateful the words came out firmly. "Without a badge... I'm sure security will return shortly."

 

 

The man's lips thinned. "You don't understand..."

 

 

She dialed the phone as if she wasn't two millimeters away from bolting back into the secured section of the building. The wide desk might give her enough lead time to get through before this suspicious man grabbed her. If he chased her, would she try to force the door closed behind her, or simply start screaming? Her face felt cold, but she still found the whole situation absurdly funny.

 

 

Bobby answered his phone. "What, IM broken again?"

 

 

"Hi, this is Jess. I came up to talk to the front desk folk, but nobody's here. Can you page them?"

 

 

The man standing in front of the desk scowled. "Look, I can't wait any longer..."

 

 

"Really? I called and told them the situation."

 

 

"I know. I need to take care of the power problem to the servers we discussed earlier, and need someone from facilities here, now. Can you try again?"

 

 

"Power...? Oh. I see. I'll get right on it."

 

 

"Thanks."

 

 

She hung up the phone. She contemplated calling the police, but she wondered if the two stooges upstairs had actually broken any laws. If they hadn't, what would the police think? She knew something had to be illegal, but did police get involved in this kind of thing? She continued to watch the man carefully. He stood stiff, visibly trying to keep his face smooth.

 

 

"Sorry," she said. "I can't help you, but someone should be here soon."

 

 

"That might be too late," the man said, throwing his free hand up into the air, almost dropping the folder with the other. "I'm supposed to do sneaky about this, but it's been too long. I'm Detective Cassidy from the Boston Police Department and believe some criminal activity is being conducted in this facility."

 

 

He reached back into his pocket and produced a wallet. He flipped it open, revealing a gleaming badge.

 

 

She stared at him, mouth open for a moment. "You're with the police?" she managed to say.

 

 

"Yes, now get me into that building unless you want to be held culpable as well!"

 

 

"Culpable? No, by all means! Please, come in."

 

 

She walked over to the main door, pulling her badge up to the magnetic reader. Her heart hammered in her chest, relief flowing through her limbs until she felt almost weak. She held the door open for the detective. He walked in, eyeing her suspiciously.

 

 

"I'm Jessica Langley," she offered. "I'm on the IT staff."

 

 

"Jessica... I'm surprised you'd offer your name so freely," he said, eyes moving over the collection of cubes.

 

 

"Why? Whatever you've heard, you'll see the truth soon enough."

 

 

"The truth, eh?" he said with a hint of a dry smile. "Okay. Lead on."

 

 

They quickly headed up the stairs, through the marketing section, past the executive offices, to finally reach the one closed door in the conference area.

 

 

"That guy there, Jake Wells I believe is his name, is the CEO of New Nifty Networks."

 

 

Cassidy peered in.

 

 

"Fix it!" Jake demanded with his face an unhealthy shade of red. The "ninja", still sporting his delivery guy outfit, fussed with the computer.

 

 

"It's dead..." he said. "Somehow I can't boot to the hard drive."

 

 

Mr. Johnson sighed. "Are we done here? I have a business to run."

 

 

"No!" Jake exclaimed. "I don't know how you did it, but this isn't the only laptop of yours I have, of course. I can access everything, even your accounting software..."

 

 

Cassidy stepped back, fingering his chin. "Well. This is certainly odd. But a few unanswered facts are now coming into focus."

 

 

Jessica gestured towards the door. "So you came here thinking we're doing something illegal?"

 

 

"No, according to the evidence presented to us, you were doing illegal stuff. This all but confirms the counter-theory that Jake Wells, a well-known business criminal, was in fact setting you guys up. Alright, don't tell him I came here as I need to get the right evidence in place before arresting him..."

 

 

"What if he gets violent?" Jessica asked as Detective Cassidy began hurrying away.

 

 

"Violent? Not likely, but if so, I'll have an officer waiting outside the building. Now if you'll excuse me..."

 

 

The man practically ran away, hurrying down the stairs. Jessica watched him disappear, and then heard the door behind her open. She turned around to face Jake Wells.

 

 

"Hello," Jake said with his broad smile just a little strained.

 

 

"Uh, hi," she responded, stepping to the side. She half-expected him to see right through her wary expression, but he simply walked on past, his cohort the ninja following behind, carrying the now defective laptop behind him.

 

 

Later Tevita, Jessica, Bobby, Edgar, and Daniel the CSO sat in Mr. Johnson's office. The CEO smiled, a look of relief cracking his normally stoic demeanor.

 

 

"Perfect," he said, standing up to offer his hand to Jessica. She blushed furiously as she rose and accepted the hand shake.

 

 

"Was nothing," she mumbled.

 

 

"Nonsense. You not only stole his thunder, that which he enjoys the most, but you unmasked his entire operation to the police. His sly and underhanded method to use the police to clear out our own security in his plans was ingenious, I must admit, but it certainly backfired. Bobby. Thank you for digging through the servers to find which stolen laptops made the illicit connections to our network to fudge our accounting procedures. Tevita. Well done identifying and cutting off access for those computers and those accounts on them. By removing that potential threat we've finished securing ourselves against any current threat, and with Jake Wells back under the watchful eye of the police, we will likely have a good respite."

 

 

"You're welcome," several said at the same time.

 

 

He smiled again. "Take the rest of the day off. Expect a bonus soon for all your troubles, but most of all, I'm letting half of you take next week off, and the other half the following week, and you won't have to use your accrued vacation days."

 

 

Jessica smiled. Vacation. She hadn't been able to think about it for months now with the ongoing threat, and the idea almost put her to sleep on the spot. She yawned, then offered a nod of thanks.

 

 

She didn't really believe things would suddenly become easy as sliding across a newly iced hockey rink, but surely things couldn't be as bad as they'd been?

 

 

As she traveled home on the early metro commuter train, a thought struck her hard. She'd said to Tevita that things should be easier. Knowing fate, and her own unlucky streak, she'd just opened herself up to an even harder, scarier situation; one that would probably arise on the first day of her vacation. She considered throwing her mobile phone out the window, but as she raised her arm she stopped. That would be drastic; besides, fate wasn't really against her, was it? And if it was, wouldn't the arsenal provided by Intel's vPro, Altiris Manageability Platform, and tighter security policies stop it?

 

 

She didn't throw the phone out the window, but she did turn it off, vowing to turn it back on only when Sunday arrived before she was to return.

 

 

 

The End of Part 6

 

 

 

This concludes this story arc. I hope you enjoyed reading as much as I enjoyed writing this. I hope also that some of the value of vPro has been properly communicated through this story, highlighting some of the features that could be used in a security situation.

 

 

0 Comments Permalink
10
This is officially closed on both Survey Monkey and this site.

 

Just go to Survey Monkey and take the survey that is shown below.

 

I have been saying so much on what I love about vPro and the cool features that it presents to the public, so now I want to know your perspective. Since you are going to be so nice to put your point of view up here, I am going to give something back to the best answers: a 16GB USB key!! So post what you like best about vPro and I will send you a 16GB USB key All I need to know is:

 

 

 

 

 

 

 

 

What I think is cool about vPro:

 

 

 

 

 

 

 

 

 

 

 

Company Name:

 

 

 

 

 

 

 

 

 

 

 

Number of vPro/Centrino Pro systems:

 

 

10 Comments Permalink
0

In prior posts I shared out the CIRA (Client Initiated Remote Access) technology. Since the release is coming closer it's time to start talking about what this means for the IT shop and what the exact touch points are. here is a quick flow that shows the touch points, whic highlights this new MPS (Management Presence Server), which sits in your DMZ and acts like a proxy between the client and the management console. this is that final mile of connecting your notebooks when they are out of your corporate enterprise. I listed out the limitations in my last post that I reference below.

 

(note: Thanks to Kyle in Brand Promise Validation for this great flow..)

 

 

 

 

Here are the prior posts on CIRA

Client Initaitied Remote Access - vPro in 2008 - IDF

 

Here is the Centrino2 one stop shop wiki

Centrino 2 vPro - One Stop Shop Wiki

 

 

I'm working on posting a video to showcase CIRA and also will be looking to post who supports this capability in their console.

0 Comments Permalink
0

We had the Intel vPro technology Challenge at MMS 2008 - a competition where teams of two competed to fix a troubled PC using Microsoft System Center Configuration Manager 2007 with PCs with Intel vPro technology. Check out how much fun this Challenge was at MMS 2008 this year:

 

 



]]>

 

To see more videos from MMS 2008, go to: http://www.intel.com/go/mms/

0 Comments Permalink
0

One topic of curiousity at MMS 08 was around the new benefits of Intel Centrino 2 with vPro technology. In the video below, D.C. Tardy, System Architect at EDS, and Kiron Lahiri, Lead Systems Engineer for Client Systems at Sisters of Mercy Health System, talk about the benefits that they are looking forward to with the upcoming Intel Centrino 2 with vPro technology.

 


]]>

 

 

0 Comments Permalink
0

 

The primary key of identity for an AMT computer is its Fully Qualified Domain Name (FQDN). One of the essential parts of the setup and configuration process (Provisioning) is when Altiris attempts to map a valid FQDN inside the IntelAMT database. This article covers how to handle FQDN issues, including ways to correct invalid entries, the best method to avoid the issues, and how it all works. If you're using Altiris Out of Band Management for provisioning, this is a must read!

 

 

 

Introduction

The two key identity items for vPro are the UUID (Universally unique Identification) and the FQDN. The UUID is contained within the hello packet sent by AMT, but the FQDN is not held within AMT without Provisioning. This means it is up to Altiris to acquire the system's FQDN. While this may sound simple, the problems arise when the system is in its setup process, whether prepping or being imaged, having software and scripts rolled out to provision and join the system to the domain, including when its final identity on the Domain and network are established and it received a new IP Address.

 

 

Preferred Provisioning method

For specifics I'll refer to the Best Practices document, but for the general steps to be followed specifically for the FQDN I'll provide the steps below.

 

 

 

 

LINK: http://juice.altiris.com/article/2810/best-practices-configuring-intel-vpro-capable-system-within-symantecaltiris-vpro-toolki

 

 

 

 

 

  1. Image the system with the Operating System, including any post-imaging work to get the system configured. This includes rolling out software or scripts.

  2. Join the system to the Domain after it has its rightful identity. The computer name should be set. When the computer is joined to the domain, this will provide the valid operable FQDN.

  3. Install the Altiris Agent on the system. This provides the information for the FQDN in the Inv_AeX_AC_Location table.
    +NOTE: If the Altiris Agent was part of the image, make sure the system sends Basic Inventory again after the system has been joined to the network to ensure we have the valid FQDN within the Altiris database.+

  4. Ensure the Out of Band Discovery package is enabled and configured via the collection to go to all machines.
    +NOTE: This step is essential because OOB Discovery will pick up the FQDN from the Basic Inventory and map it in the IntelAMT database. This screenshot shows where the data is located:+
    +!OOBCapACLocation.JPG!+

  5. Now if the hello message was sent before the above steps were completed, normally it will recover as long as the process completes before 24 hours have passed. 24 hours is the period of time the hello packets will be sent from the client. AMT will continue to send hello packets throughout the period UNTIL it is fully provisioned. This helps reestablish connection if the IP Address changes in the middle of the Provisioning process and the Server can't connect back up to the remote AMT system.

 

Preferred Provisioning Settings

Not all settings within Out of Band are FQDN friendly. The following items affect how Out of Band Management approaches provisioning.

 

  1. Resource Synchronization - Make certain this is enabled! A Disabled Resource Synch policy will halt Provisioning, greatly increasing the change for FQDN problems when it is finally enabled.

  2. Use DNS IP resolution to find FQDN when assigning profiles - This option, under the Resource Synchronization policy, is typically unreliable. While this option allows for bare-metal provisioning or Agentless provisioning, it also is at the mercy of the DNS and DHCP environment. It is highly recommended NOT to use this option unless you fully trust your DHCP and DNS environment. Factors to consider are:

    1. IP Lease times - The lease times afforded systems may be short, increasing the possibility that when OOB fetches the FQDN via IP the lease will have expired and the wrong FQDN will be mapped.

    2. PXE or other auxiliary boots - Often these types of systems will obtain a different IP address from DHCP as their identity is not the same as when the system is booted to the OS.
      !ResourceSynchronizationOOB2.JPG!

  3. Intel AMT 2.0+ to Profile - This option allows a default Profile to be setup for Provisioning. Make sure you've created a default profile and set it in the Resource Synchronization policy. Without a profile Provisioning will not occur.

  4. Intel AMT requires authorization before provisioning - Under the General node within Provisioning, this option stops provisioning from occurring. The profile will not go down to the system until the system is selected, using the right-click to choose ‘authorize'. This can aggravate FQDN problems by delaying full provisioning.

 

FQDN Fixes

Invalid FQDN in IntelAMT

The first issue stems from a variety of causes. The issue is that in the IntelAMT database, shown under the Intel AMT Systems node under Provisioning for Out of Band Management, the FQDN is invalid. The causes vary, but here are a few we've seen:

 

  1. Reverse DNS IP Lookup is enabled - Unless your DHCP and DNS environment are rock solid, often IP Address leases expire, and other systems pick up the IPs that the AMT systems originally sent the Hello message with. When this occurs, the wrong FQDN is mapped.

  2. IP Leases short - Often the IP Lease length can create a problem acquiring the correct FQDN. This can especially have problems with TLS as the FQDN is part of authentication using certificates.

  3. FQDN is incomplete - When a system is in setup mode, sometimes the mapped FQDN is not part of a domain, resulting in the Host Name only being set as the FQDN.

 

 

 

IMPORTANT! When the FQDN is invalid in the IntelAMT database, Resource Synchronization can have troubles matching resources with their correct counterparts in the Altiris database. Because of this, duplicates can emerge. If the checkbox in Resource Synchronization labeled: ‘Remove duplicate Intel AMT resources from Notification Server database' is checked, managed resources can get deleted from the Altiris database!

 

 

 

FQDN has Changed

Another not-uncommon occurrence is when a system changes identity. This can occur in a variety of ways, including:

 

  • The system has been reimaged

  • The computer name has been changed

  • The computer has been migrated to a new Domain

  • The system has switched subnets, resulting in a new FQDN

 

 

 

Regardless of the method, changing the FQDN on the system does not change it in the Intel ME or AMT firmware, and also does not change it within the Intel SCS component database (IntelAMT). When these are not synched up, it can cause problems when you need to manage the system via AMT when the computer is booted to the operating system. This particularly has problems when TLS is enabled and the provisioned certificate no longer matches the FQDN in Windows.

 

 

 

Issues Resolution

Since the Altiris Agent sends Basic Inventory daily by default, the Altiris database usually has a valid FQDN on record in the Inv_AeX_AC_location database table. We can run a query that will capture the correct FQDN from the Altiris database and insert it into the IntelAMT database, correcting any duplicate or invalid FQDN entries. This is the first step. The second step is to update the FQDN within AMT on the local systems. The following processes walk you through the resolution:

 

 

Update IntelAMT from Altiris

  1. Open up SQL Query Analyzer or Microsoft SQL Server Management Studio.

  2. Open a Query window within the database instance that contains both the Altiris database and the IntelAMT database.

  3. Run the following query, though for testing purposes you can omit the line ‘COMMIT TRANSACTION until you can verify the operation completed as expected. Once validated, run COMMIT TRANSACTION to complete the process:
    BEGIN TRANSACTION
    UPDATE intelamt.dbo.csti_amts SET fqdn = b.fqdn FROM (SELECT il.[Fully Qualified domain name] AS 'fqdn',
    REPLACE(oob.uuid, '-', '') AS 'uuid' FROM
    altiris.dbo.Inv_AeX_AC_Location il JOIN altiris.dbo.Inv_OOB_Capability oob ON
    oob._ResourceGuid = il._Resourceguid) b WHERE intelamt.dbo.csti_amts.uuid = b.uuid
    COMMIT TRANSACTION

  4. Done! The FQDNs now match between Altiris and IntelAMT.

 

Update FQDN on local AMT

  1. It is recommended to follow these steps in batches so as to not overwhelm the Intel SCS component. Perhaps run this against 100 systems at any one time, or run it against those systems you know have been updated. While it doesn't hurt to run this against systems that didn't have the FQDN changed from the above process, it is unnecessary if you are able to target those systems with invalid FQDNs.
    +Note: This process assumes that the system can be reached via the SCS using the new FQDN supplied by Altiris. For TLS there may be complications we have not foreseen.+

  2. In the Altiris Console browse under View > Solutions > Out of Band Management > Configuration > Intel AMT Systems > and select the Intel AMT Systems node.

  3. Select one or more systems you need to update the local AMT FQDN on.

  4. Right-click and choose the ‘Re-provision...' option.
    !Re-provision.JPG!

  5. Check the Action status node under Provisioning > Logs > Action Status for messages concerning the Re-provision attempts. You can also check the Log node for errors.

  6. Done! The systems, when reprovisioned, should have the correct FQDN planted by the IntelAMT database entry that was updated from the Altiris database.

 

Conclusion

Use this article to resolve your FQDN issues to ensure ATM functionality is available when it is needed. The above process has been verified, though all environmental potential issues have not been explored. It is advised to test the process in your environment before implementing on a wide scale.

0 Comments Permalink
0

 

The Task Server contains AMT function tasks that give you the ability to integrate AMT functionality into Task Server Jobs. This allows you to use AMT in conjunction with Software Delivery, Scripting, and any other Task Server supported function. Understanding how to troubleshoot the AMT side of a Task Server job will help resolve issues so that AMT can be utilized. This includes the following technologies:

 

 

  • System Defense - Network Filtering

  • Reliable Power Management

  • IDE redirect for boot redirection

 

Introduction

This is the concluding article for the series: Troubleshooting the Altiris Manageability Toolkit for vPro Technology. The first four articles covered the setup and configuration of AMT systems, while parts 5 and 6 covered RTCI and RTSM respectively. This final article discusses troubleshooting the AMT integration into Task Server when issues arise.

 

 

 

 

As an introduction, the actual SOAP or API calls made to the AMT system is invoked through Real-Time Console Infrastructure, the same as when they are invoked through the Real-Time tab for RTSM. Though the calls are from the same place, how those calls are made differ. The following subjects will be covered:

 

 

  • Determining Cause of Failure

  • AMT Detection Issues

  • Authentication Issues

 

Determining Cause of Failure

Often you'll known the general symptom that tells you a job or task in Task Server didn't execute as expected. For example a power management task may have shown as run but the AMT system never woke up. A failure is not shown except deep within a series of status windows.

 

 

 

 

To determine the returned error, use the following steps. Task Server's actual failure code is buried deep in a series of status windows, as shown in the screenshot after the steps.

 

 

  1. Under the Task or Job that failed, double-click on the general status row for the specific execution attempt.

  2. If within a job, double-click on the line that represents the task or AMT function that failed.

  3. Note the numbers of successes versus failures. Click the ‘View Report' link.

  4. Now you'll get a grid with the status of the Task, including the status and return code, if present.

 

 

 

AMT Detection Issues

When Task Server reaches a Task that involves AMT, it makes direct calls to AMT in those systems targeted in the task or job. Detecting AMT and subsequently executing the scheduled function requires success at both junctures. The following sections discuss potential issues and solutions in this process.

 

 

Power State Unknown

One common problem we see is when a power management task fails due to the failure message: Generic error, FromState detected as unknown:14. This will cause the power action to fail. The causes vary, but the following list contains the most common:

 

  • System unreachable - The target system is not available on the network

  • AMT failed to be detected - See the subsequent section ‘AMT not detected'

  • Authentication failed - See the subsequent section ‘Authentication Troubleshooting'

  • AMT is unavailable - If a system is not provisioned, or AMT is not functioning on that system

 

 

 

Use the following process to determine what the issue is:

 

 

  1. If RTSM is available, try connecting to the target system using RTSM, specifying the same credential profile.

  2. If that fails, try manually putting in credentials until you find one that works.

  3. If Step 1 succeeds, try creating a different connection profile with only AMT functions provided.

  4. If no RTSM is available, still try the profile with only AMT functions to see if it works.

  5. Try other AMT functions, such as Collect Intel AMT Inventory to see if they succeed.

  6. If other functions succeed, try using another method to reboot the system to reset the power state stored in the Intel ME. One way to accomplish this is using the Task Server Power Management Agent to send down a standard reboot command to the PC.

  7. If no other AMT functions are successful, AMT might not be properly setup on this system. Ask the question: Has this system gone through the provisioning process?

  8. If unknown, use the Out of Band Discovery Task to see if AMT is available and to identify what state it is in. See the steps provided under the ‘AMT Not Detected' section following.

  9. If all else fails (generally this is on a system-by-system basis, rarely do a collection of systems encounter this level of this issue) try reprovisioning the system by fully unprovisioning and going through the provisioning process again.

 

AMT Not Detected

Normally a non-vPro system will receive the return code that AMT was not detected. This is accurate, but when it happens to valid managed vPro systems, the issue must be troubleshot to determine why the applying Task Server cannot detect AMT on the system. Out of Band Discovery is a great way to determine what state the system is in. Use the following steps to take stock of the systems:

 

  1. In the Altiris Console, browse to View > Solutions > Out of Band Management > Configuration > Out of Band Discovery > and select the ‘Out of Band Discovery' policy.

  2. Enable the policy if it is not yet enabled. If it is enabled, set a schedule to run the discovery again so you have updated information on your systems.

  3. On the AMT system in question, go to the Altiris Agent and bring up the Agent UI by double-clicking on the system tray icon or by launching C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe.

  4. Highlight the ‘Out of Band Discovery Package.

  5. Click the ‘Out of Band Discovery' link under Application Tasks.
    !OOBDiscoveryRun.jpg!

  6. Once completed, now check back at the server and double-click the system within a collection to bring up Resource Manager.

  7. Click on the Inventory tab and browse to Out of Band Management, and select the data class OOB Capability. This will give you the details of AMT.

 

 

 

If AMT is disabled, it needs to be enabled in the BIOS. A BIOS update from the vendor may provide you a remote way to enable AMT, by using Software Delivery for example. If it is all enabled, next check the provisioning status. Provision as necessary.

 

 

 

Authentication Issues

As with RTSM, Task Server uses the same basic authentication method when executing against a computer. Task Server also includes another option to add additional credentials to the execution to be used when contacting the protocol, which is AMT in this case.

 

 

Authentication Methods

Since RTCI controls the authentication, much of the same method is used whether the execution of an AMT command is issues from the Real-Time console or from Task Server, however there are some differences.

 

Runtime Profile - The Runtime profile contains he following information:

 

 

  • All known good credentials used to connect via RTSM to a system

  • The Intel SCS AMT password sent to systems when provisioning occurs

  • Previously successfully used credentials from past RTSM sessions

  • Previously successfully used credentials from a Task that succeeded

 

User-defined Profiles - Profiles can be created that specifically provide credentials for the four types of technologies:

 

  • WMI digest or Domain account

  • AMT digest or Kerberos-authenticated user

  • ASF digest or Domain account

  • SNMP community strings

 

Task-specified Credentials - When a user setups up a job or task, the user can specify specific credentials to be used when executing AMT-related functions through the profile interface. This option is per job or task, and applies to all AMT functions invoked during the job or task. The Interface allows this as shown in the following screenshot:

 

 

 

 

Authentication Troubleshooting

The following method will help identify issues and offer ways to work-around and solutions. These have been compiled through experience when troubleshooting issues with failed authentication with Task Server.

 

  1. First, how do you determine if your task or job is failing due to authentication? Use the previous section under Introduction labeled ‘Determining Cause of Failure'.

  2. In the Altiris Console browse to View > Solutions > Real-Time Console Infrastructure > Configuration > select Manage Credentials Profiles, or in the Task click the ‘Run Now', and on the subsequent page click on the pencil icon next to the credential profile being used.

  3. Where does the green checkmark fall? This is the default profile that will be used when connecting via a Task Server task.

  4. Create a new profile by clicking the blue + on the icon bar in the right-hand pane.

  5. Under the Intel® AMT tab check the box ‘Enable this technology in the profile'.

  6. Supply the admin user credentials set when the managed vPro systems were provisioned.

  7. Under the WMI tab also check the box as above and provide a user that has admin privileges to the target system.

  8. Give the profile a name and then save it.

  9. Back at the main screen check the box under the ‘Default' column until the green check-mark uses your new Profile, or if you are in a job interface select the profile to be used for the run. Note that this does not require you to make it the default profile, allowing another profile to remain the default credentials.

  10. Run the task or job to see if the authentication failure has been resolved.

  11. If it is not, try rerunning with the Runtime Profile. This contains all known good authentication attempts to the system from either Task Server or RTSM.

  12. In one case we supplied only AMT credentials in the Profile which allowed it to authenticate to AMT while a multiple protocol authentication profile failed. If your Task or Job does not contain any of the other protocols, this is recommended.

 

Conclusion

This concludes the Troubleshooting article series for the Altiris Manageability Toolkit for Intel vPro Technology, version 6. While this doesn't cover all issues, it should resolve most of the common issues we've seen.

0 Comments Permalink
1

 

Formerly known as Web Admin for Windows, Real-Time System Manager provides a powerful set of functions for IT specialists. In part 5 of this article series we covered the main points for Real-Time Console Infrastructure troubleshooting. As a natural extension of RTCI, Real-Time System Manager troubleshooting is covered in this article as part 6. With an emphasis on credentials and connection methods, this article provides information to overcome the most common issues seen when using the Real-Time tab for direct, one-to-one computer interaction.

 

 

 

Introduction

Real-Time System Manager provides a powerful tool for directly connecting to a system agentlessly with functionality available through WMI and Intel AMT. This article covers the issues associated with general functions seen with both technologies but with emphasis on the AMT functions. The following sections cover areas of troubleshooting:

 

  • Connection Issues

  • Authentication Issues

  • IDE Redirect (IDER)

  • Network Filtering

 

Connection Issues

Under the current architecture the FQDN is the primary method for connecting and authenticating to AMT on remote systems. If the FQDN the Real-Time tab is using does not resolve in DNS, then AMT connectivity and thus functionality will not be available. FQDN connectivity issues are the number one issues we see with RTSM connections to AMT.

 

 

Invalid FQDN

To view what FQDN the Real-Time is using, use the ‘Hardware Management' node in the RTSM tree. The following screenshot shows what AMT is using:

 

 

 

 

 

 

In this example my system is in a workgroup and reported only the hostname as the FQDN, which DNS had no trouble resolving. If this fqdn is not reachable via DNS, we won't be able to connect to the AMT functionality.

 

 

NOTE: We use several methods, including IP address, for WMI. WMI functionality may show correctly when AMT is absent in this situation

 

 

 

 

 

Use these steps to see the FQDN is the issue:

 

 

  1. Open the Real-Time tab for the AMT system you are managing.

  2. Once the tree loads, open the Real-Time System manager folder, open Administrative Tasks, and click on ‘Hardware Management'.

  3. Once the page loads, if AMT is missing as an available technology, take note of the name displayed as in the screenshot above.

  4. Go to Start, Run, type in cmd, and click OK.

  5. Type in nslookup <name displayed>. In the above example it would read:

    1. Nslookup dellvpro

  6. Can DNS resolve this address? If no, we'll need to fix the issue in one of the following ways.

  7. FIX DNS and/or the Altiris record: If DNS can be fixed, this is the preferred method. The difficulty is finding out why the Altiris Agent reported the incorrect record. Once DNS is fixed, have the Altiris Agent run Basic Inventory. The table location we pull this out of for management in RTSM is Inv_AeX_AC_Location, column: Fully Qualified Domain Name.

  8. Use the ‘Manage' node available in RTSM (see the below screenshot): By putting in the IP address of the system, we'll use the IP to lookup the FQDN and not make any assumptions.
    !Manageshortcut.JPG!

  9. Update the Servers HOSTS or LMHOSTS files to contain the mapping to the invalid name. For example find the LMHOSTS file, edit it and add a line <IP ADDRESS> <FQDN>, as in this example:

    1. 10.10.10.1 Dellvpro

 

Real-Time unable to connect

If WMI and AMT functions are unavailable, you'll get a message when you click on the Real-Time tab indicating that the functionality isn't available. See the following screenshot:

 

 

 

Note: If you use another product such as Dell or HP's plug-ins to this tab, you'll simply not have the ‘Real-Time System Manager' node underneath Real-Time Consoles.

 

 

 

 

 

The number one reason this occurs is due to a firewall being engaged. Firewalls need to allow AMT traffic through. If a firewall is enabled, use the following details to resolve the AMT issue:

 

 

  1. Create an inclusion in the firewall properties.

  2. Allow the following ports, based off your environment:

    1. 16992 - For non-TLS encrypted traffic - if you are not using TLS this is the port that will be used for communication

    2. 16993 - For TLS-enabled, encrypted AMT traffic - If https is required for communication with AMT, this port will be used

    3. 16994 - For a note, AMT provisioning uses this port for sending out the ‘hello' packet during the configuration process - this will be used if you initiate a reprovision from RTSM

  3. Another options is to disable the firewall when you need to manage the system via RTSM.

  4. Unfortunately WMI has a known issue with the Windows firewall where the dynamic ports WMI uses after initiation will be blocked. It's a bug in WMI that has been addressed in Vista. Previous Operating Systems do not have a resolution at this time.

 

 

 

The other issue we've seen is where the system is simply unavailable for one reason or another. AMT is available if the system is off but still connected to the network, but WMI or if the system is unplugged from power or off the network RTSM obviously cannot function. Verify that the system is available if nothing resolves this issue.

 

 

 

Authentication Issues

Another common issue concerns authentication to the system via the Real-Time tab. First, let me discuss the methods RTSM uses to authenticate to a target system.

 

 

Authentication Methods

Runtime Profile - The Runtime profile contains he following information:

 

  • All known good credentials used to connect via RTSM to a system

  • The Intel SCS AMT password sent to systems when provisioning occurs

  • Previously successfully used credentials from past RTSM sessions

 

User-defined Profiles - Profiles can be created that specifically provide credentials for the four types of technologies:

 

  • WMI digest or Domain account

  • AMT digest or Kerberos-authenticated user

  • ASF digest or Domain account

  • SNMP community strings

 

Manually entered credentials - When RTSM tries to connect, if the default profile set in the RTCI configuration fails to authenticate, the left-hand tree will still load but each node will prompt the user for credentials. A user can put in an AMT account, Domain user, or digest user that has rights on the target system. When authentication succeeds, these credentials are then stored in the Runtime Profile for the target system.

 

 

Troubleshooting Authentication

The following method will help identify issues and offer ways to work-around and solutions. These have been compiled through experience when troubleshooting issues with failed authentication with RTSM.

 

  1. In the Altiris Console browse to View > Solutions > Real-Time Console Infrastructure > Configuration > select Manage Credentials Profiles.

  2. Where does the green checkmark fall? This is the default profile that will be used when connecting via the Real-Time tab.

  3. Create a new profile by clicking the blue + on the icon bar in the right-hand pane.

  4. Under the Intel® AMT tab check the box ‘Enable this technology in the profile'.

  5. Supply the admin user credentials set when the managed vPro systems were provisioned.

  6. Under the WMI tab also check the box as above and provide a user that has admin privileges to the target system.

  7. Give the profile a name and then save it.

  8. Back at the main screen check the box under the ‘Default' column until the green check-mark uses your new Profile.

  9. Test to see if this new profile is successful. Note that you'll need to launch IE fresh to use the new settings.

  10. If it is not, try entering credentials in manually when you hit the system under the Real-Time tab. See the screenshot below for the connection icon to switch between WMI and AMT authentication. If two show in this area, both technologies are available but not authenticated.
    !RTSMconnectiontype.jpg!

  11. In one case we supplied only AMT credentials in the Profile which allowed it to authenticate to AMT while a multiple protocol authentication profile failed.

  12. Check the collection you are launching Resource Explorer from. Sometimes the identity of the system is incorrect. For AMT you can launch RTSM from the Provisioned collections populated with the Resource Synchronization.

 

IDE Redirect (IDER)

IDE Redirect allows a system to be remotely booted to a file, drive, or virtual disc. There are a number of potential issues to be aware of when working with IDER in a vPro environment. The below items include well-known issues and their resolutions.

 

 

Redirection Invalid Parameter

When initiating an IDER (IDE Redirect) session to an external source such as an .iso file, the following error appears in the console:

 

 

 

 

Power management operation failed.

Redirection session start has failed. See logs for more details.

 

 

 

 

 

The Notification Server log shows the following error:

 

 

 

 

 

Log File Name: C:\Program Files\Altiris\Notification Server\Logs\a.log

Priority: 2

Date: 3/9/2007 2:51:05 PM

Tick Count: 10617218

Host Name: <>

Process: w3wp.exe (2436)

Thread ID: 5412

Module: AltirisNativeHelper.dll

Source: RTCI.Trace

Description: RedirectionProvider::StartIDER - RedirectionProvider::StartIDER - IMR_IDEROpenTCPSession: IMR_RES_INVALID_PARAMETER

 

 

 

 

 

This is caused by Intel's redirection library requiring a correct floppy device to initiate an IDER session (either floppy image or real removable device). Real-Time System Manager 6.2 can work around this. If you put floppy.img file into Program Files\Altiris\RTSM\UIData folder, then the issue will not occur.

 

 

 

IDER or SOL Disabled

In some instances Intel vPro systems are arriving from the OEM with IDER and SOL disabled in the BIOS. When disabled, neither of these functions work from any management engine, including RTSM. Correcting this oversight is not easy, especially if the OEMs do not offer a solution by a firmware or BIOS update. Use the following method to resolve the issue:

 

  1. Go to the Support site for the OEM for the systems.

  2. Browse to the drivers and downloads section for the exact model (note that sometimes the model will differ based on possessing or not possessing vPro technology).

  3. Check the firmware updates for a new BIOS.

  4. Check the documentation for any new BIOS versions that include vPro to see if they've corrected this.

  5. Contact your OEM if they have not and request a status!

  6. The only other recourse is to develop an update yourself or manually update the settings by visiting the system.

 

Conclusion

This should account for the most common issues we've seen, and allow you to successfully use RTSM with AMT technology, avoiding those issues.

1 Comments Permalink
1 2 3 Previous Next