Home > Intel Communities > Open Port IT Community > Intel® vPro™ Expert Center > Blog > Tags > deployment

Intel vPro Expert Center Blog

7 Posts tagged with the deployment tag
1

         

Integrating VNC on Windows PE 2.0

                            Author: Trevor Sullivan

                      Company:    OfficeMax Corporation

                        Versions: 1.0 – April 24, 2008 – original document

Synopsis

Integrating VNC on Windows PE allows a remote user, such as a support person, to remotely control a Windows pre-execution environment, and perform administrative tasks such as deploying an operating system image, or diagnosing hardware and software problems using 3rd party tools. This image can be remotely booted in a LAN environment using the IDE-R feature of Intel AMT.

Requirements

  1. Microsoft Windows AIK v1.1 (downloadable from Microsoft)
  2. A working Windows PE 2.x CD (can be built from WAIK)
  3. UltraVNC 1.02 (downloadable from Internet)
  4. ImageX (to mount WIM files) - included with WAIK

Setting up UltraVNC

Install UltraVNC 1.02 on a development system

 

You can optionally install UltraVNC 1.02 to an Altiris SVS virtual layer to avoid making permanent changes to your development system

 

After UltraVNC is installed:

1.  Execute VNC in user-mode

2.  Run the following command: winvnc –defaultsettings

3.  You should be presented with a configuration dialog

4.  Set a password for VNC and choose to disable the tray icon

5.  Confirm the settings dialog, and stop Winvnc by running: winvnc –kill

6.  Extract the following registry tree: HKLM\Software\ORL (vnc.reg)

7.  Add the password to the default key

a.  Open the registry file (vnc.reg)

b. Create a new section (key) for HKLM\Software\ORL\Default

c.  Copy the password value from ORL to the Default key

Gathering Source Files

Copy the following list of files from the UltraVNC installation directory on the source computer into a separate working folder:

 

  • Authadmin.dll
  • Authssp.dll
  • Ldapauth.dll
  • Logging.dll
  • Logmessages.dll
  • Mslogon.acl
  • Unzip32.dll
  • Vnchooks.dll
  • Vnchooks_settings.reg
  • Vncviewer.exe
  • Winvnc.exe
  • Workgrpdomnt4.dll
  • Zip32.dll
  • Vnc.reg (from previous section)
  • Vnc.vbs (see below)

 

Trevor developed a short script to get around a problem with winvnc hanging when I’d execute it. This executes winvnc.exe asynchronously so that it continues to run in the background, but startnet.cmd will be allowed to continue. The script source is included below:

 

ScriptPath = Left(Wscript.ScriptFullname, len(Wscript.ScriptFullName) - len(Wscript.ScriptName))

set sh = CreateObject("Wscript.Shell")

sh.Run "regedit /s " & ScriptPath & "vnc.reg", 1, true

sh.Run "wpeutil disablefirewall", 0, true

sh.Run ScriptPath & "winvnc.exe", 1, false

Modifying the PE Disc

  • Mount WIM file on filesystem using ImageX
  • Copy all source files to folder on root of WIM mount path
  • Modify startnet.cmd to execute VNC vbscript using cscript.exe
    • Use the fully qualified path to the script file (eg. “cscript X:\vnc\vnc.vbs”)

Notes

  • Winvnc does not work under service mode on Windows PE; Winvnc must be run under user context
  • The registry value “password” must exist under HKLM\Software\ORL\Default, otherwise winvnc will prompt for a password upon startup

 

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

1 Comments Permalink
0

Hello vPro community!

 

I rather quickly posted the Powershell code I got functioning yesterday just to make sure that I didn't forget to post it at some point, but if you're new to Powershell, you might not understand everything that's going on here. If I left your head spinning, then I apologize, but tonight, I'm wrapping back around to help describe to you the thought process behind the script I posted!

 

On top of that, once I put together some notes from earlier today, I will post later on about some of my newest findings! To give you a teaser, I found a method of setting AMT power profiles using Powershell code! I'll be sure to get this posted as soon as I can, but for now, I think it would be most beneficial to understand the basics of connecting to a vPro system.

 

I'm going to step through the script line-by-line and leave some comments about each of them. Comments will be denoted by lines beginning with a pound sign (#). This is because Powershell uses this character as a "comment" character.

 

If you're experienced with .NET, then you'll probably either already know about, or want to get familiar with, the tool known as the .NET Reflector. This utility allows you to "reflect" over a .NET library, and discover the objects, methods, and properties that are available to you to use in your Powershell scripts. It's not always a simple task to figure out how to use .NET objects, especially if there is either poor documentation, or none at all, but this tool definitely makes it easier.

 

----------------------------------

 

# The following 6 lines are simply variables that we are setting

# to make troubleshooting and customizing our script easier.

# We will be instantiating (creating) an object of the data type

# "AmtSystem" that requires these values as params to its

# constructor method.

 

# This is the domain\userID we want to authenticate as

$amtusername = "vprodemo\DomainUser"

 

# This is the password for the user account to authenticate
$amtpassword = "P@SSW0Rd"

 

# This is the FQDN of the vPro client system we want to connect to
$amthostname = "vproclient.vprodemo.com"

 

# This is the TCP port that we want to connect to the vPro client on

# TCP 16993 is used for TLS communications to AMT clients

$amtport = 16993

 

# This parameter determines whether or not your password is

# saved in the AmtSystem object (I think)
$amtrecallpassword = $false

 

# I haven't verified this, but I believe that this parameter determines

# whether or not WS-MAN is used exclusively on vPro clients

# that support it. Otherwise, it will attempt to use EOI (SOAP).
$amtwebservicesonly = $false

 

# Next, this variable stores the path to the "Manageability Stack.dll"

# which is included with the Intel AMT Developer Toolkit (DTK).

# Be sure to download the latest version from the Intel website.

# This DLL is a .NET library, written in C#, that provides an API

# to interact with Intel vPro clients.

$manageabilitystack = "C:\Program Files\Intel\Manageability Developer Tool Kit\0.6.08325.2\Manageability Stack.dll"

 

# This line uses the built-in Assembly class (part of .NET reflection)

# to load the .NET DLL containing the AMT API. The Out-Null Powershell

# cmdlet is used to suppress any console output of the LoadFile() method.

[System.Reflection.Assembly]::LoadFile("$ManageabilityStack") | Out-Null

 

# The Write-Host cmdlet is built into Powershell and simply writes

# some text to the console. We are using inline variables to dynamically

# display the information about the client we're connecting to.

Write-Host "Connecting to $amthostname on port $amtport"

 

# This is the line that's actually getting the object that we will use to

# reference our target Intel AMT client. We are creating a global variable

# name "amtdevice" and setting its value to a "New-Object" of datatype

# ManageabilityStack.AmtSystem (you can use .NET Reflector to find this)

# and then passing the parameters that we defined before to its constructor.

# If the below line wraps in your browser, please be sure to put it all on one line in your script.

$global:amtdevice = New-Object ManageabilityStack.AmtSystem -ArgumentList $amthostname,$amtport,$amtusername,$amtpassword,$amtrecallpassword,$amtwebservicesonly

 

# Footnote: With respect to variable scope in Powershell, the reason I am

# defining this as a global variable explicitly, is because if you copy and paste

# this code into a script, and then run that script from within an interactive

# Powershell session, the $amtdevice will now be defined as global to the session

# and will not be deleted when the script exits. This allows you to run the script to

# retrieve the device object, but then continue to work with it interactively once

# the connection is established!

 

# Tell the AmtSystem object that we want to use TLS

$amtdevice.UseTls = $true

# Enable WS-MAN support (if available) on the connection
$amtdevice.WsManSupport = $true

 

# Once we've set up all of our configuration options about the connection,

# this next line actually establishes the connection.

$amtdevice.Connect()

 

# The "State" property of the AmtSystem object is "Connecting" until the

# connection either succeeds or fails. We want to monitor the status until

# this occurs.

while ($amtdevice.State -eq "Connecting") { Start-Sleep 1 }

 

# Finally, once the connection either succeeds or fails, we write out the

# State property to the console so that we know what the outcome was.

Write-Host "AMT device is in state $($amtdevice.State.ToString())"

 

-----------------------------------

 

So, there you have it. That is the code, with my comments inline. If you have any questions or feedback on my articles, please feel free to comment on this blog article. I will try my best to answer them, although please understand that I am still working on comprehending this great API! If this is useful to any of you, I would like to know that, and if not, then please recommend something that you would like to hear about!

 

As promised, I will eventually write another follow-up article on how you can set Management Engine (ME) power profiles on a provisioned AMT client remotely, using Powershell! Until next time ...

 

Happy Powershell Scripting!!

 

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

0 Comments Permalink
2

Sometimes it’s just easier to adopt a technology that you’re able to use “out-of-the-box” and don’t have to spend excessive amounts of time trying to get it to a configured and operational state. Bypassing some of the advanced configurations may be sufficient, as long as you are able to “take-control” of the situation at a future date.

 

Repeatedly setting up demonstration, training, and lab environments for Intel vPro may present a challenge in adjusting the Intel AMT firmware settings. From an "in-band" perspective - it's relatively easy and known how to re-image a group of systems - thus resetting the operating system state, application configuration, and so forth. However, mass resetting or management of the Intel AMT firmware remotely may not be as straight forward.

Another environment or situation to consider is when more than one management console is used. Does it matter which console owns the Intel AMT firmware configuration? What if the console used to configure the system is no longer available? Can you regain control of the system configuration?

 

Are there command-line tools to provide some management of the Intel AMT firmware?

What if an OEM or a value-added reseller (VAR) provisioned the client in a staging area totally separate from the production environment?

 

These questions are raised to help address a number of questions raised by customers and partners.

 

In my lab, I've left my Intel vPro systems in a "standard provisioned" state - meaning that they are enterprise provisioned, yet are not using Kerberos, TLS, or other advanced security configuration options. I am able to change out management consoles, re-associate or rediscover the clients that are Intel AMT capable and provisioned, and continue doing tests on associated usage models. A ProvisionServer or provisioning service is not needed - as the Intel AMT firmware is already provisioned. Should I need to regain control of the configuration within my present "ProvisionServer" - a few commandline tools or agents are used to adjust the environment accordingly.

 

If you've read this far - I apparently have your attention. Let me provide a few reference points and guidelines on how this is possible:

 

  • An initial provision event MUST occur on the system - be it a Basic or Standard provisioning event which is manual or automated.

  • Once an Intel vPro\AMT system is provisioned - authenticated and authorized requests can be accepted from any source using the defined admin account credentials

  • Authentication\authorization of requests - at the basic level - is done via a Digest username\password

  • Commandline utilities such as Intel AMT Reflector Utility or UnprovisionEX (see http://communities.intel.com/openport/docs/DOC-1171) allow for remotely adjusting basic or standard provisioning settings – including remotely UnProvisioning the Intel AMT firmware. Some consoles – such as Altiris – also include a remote unprovision capability (see http://juice.altiris.com/node/4640).

 

Note: If you have a ProvisionServer already defined, make use of it to change configurations and settings. These tools and insights are provided for situations where the original ProvisionServer is no longer available and you want to adjust settings without physically touching the client.

  • If an environment is using TLS or Kerberos and the former management console is not longer available – the new console must be a member of the same Active Directory domain and have the root certificate used by TLS in it’s local certificate store.

  • Management consoles must support network discovery or agent based discovery of Intel vPro systems already in a provisioned state (Basic or Standard – see Understanding Provisioning Models - Basic, Standard, & Advanced). For an example of agent based remote discovery – see http://juice.altiris.com/node/4638

  • The consoles must be configured with the known digest username\password. This unfortunately excludes Microsoft SCCM – as it requires TLS and Kerberos. Other common consoles and interfaces have options to both discover and connect to clients using Digest authentication (i.e. Altiris, LANDesk, HP Openview, SupportSoft, Intel System Defense Utility, etc)

 

In support of the above ideas and conditions, the following scenarios could be supported without any

“ProvisionServer”:

 

  • An OEM or VAR provisions a set of systems before shipping them to a customer. Upon arrival, the IT administrator adjusts the management console configuration with the OEM or VAR provided credentials used, and continues with normal deployment activities. Once the systems are on the network, a network scan or agent based discovery of the Intel AMT capabilities updates the management console, and the IT administrator now has full use-case functionality of the out-of-band technology as supported by the host management console. (NOTE: No mention of ProvisionServer, Intel vPro provisioning process, etc)

  • In deploying the systems, the hostname of the operating system does not match the hostname of the Intel AMT firmware. Using the Intel AMT Reflector Utility, the administrator sends out a single command script to all clients. (This assumes the “server” component of the utility is running on a single system separate from the Intel vPro clients, and that the Intel vPro clients have the Intel AMT reflector client console executable and associated DLLs local). An example of the single command sent to all clients for synchronizing the host operating system and Intel AMT firmware name is:

 

Reflector –user admin –password P@ssw0rd –server vprodemodc.vprodemo.com –port 16992 –syncFQDN> > Note: This utility must be run locally on the Intel vPro\AMT client, as it will obtain the local FQDN before transmitting to the Intel vPro Reflector Server component. If you have an existing ProvisionServer in the environment – do NOT use this tool. Utilize the FQDN synchronization option of the ProvisionServer, such as the /f option with the Intel vPro Activator Utility for Intel SCS based environments.

  • Not feeling comfortable with the OEM\VAR preset values of Intel AMT admin firmware username and password, the IT administrator wants to remotely change these credentials. Instead of the default username of “admin”, the IT administrator wishes to use “PCSupport” with an associated strong password. This could be handled via the WebUI, supporting management consoles, or via commandline script. The following example uses the Intel AMT reflector utility from the management system to the Intel vPro client:

Reflector –user admin –pass P@ssw0rd –server –vProSystems1.vprodemo.com –port 16992 –setAdminCred –newUsername PCsupport –newPassword Pr0t3ct!0n

 

 

 

Finally, a situation occurs where the IT administrator wishes to transfer or take control of the provisioning process with a designated ProvisionServer. The preference is not to physically touch any of the systems to make this adjustment – thus the requirements of remote configuration must be met (i.e. support by the management console running ProvisionServer, remote configuration certificate obtained and installed, etc).

 

Using the Intel AMT Reflector or UnprovisionEX utility (see http://communities.intel.com/openport/docs/DOC-1171), the IT administrator executes a command to remotely unprovision the Intel AMT firmware and reset to a factory default state. (As noted in the linked article above, some management consoles may have this capability already built in). Once the target systems or group of systems have been unprovisioned, a provisioning event can be initiated via the Intel vPro Activator Utility, supporting management console agent, or related methods.

 

All of the above scenarios and situations have been proven out in a lab environment – mostly out of necessity as I desired to automate procedures a little (resetting an environment a few times a week or month becomes exhausting, thus my quest to find methods or simplification). Although my lab is only 10 systems, the concepts have been applied to large lab, testing, and training environments.

 

Do you have additional ideas or inputs on this topic?

 

A final thought – since a majority of the initial deployments of Intel vPro are pilot or limited test situations, the advanced security features are not the initial focus. The initial focus is on the usage and applicability of the technology within a target environment. Unfortunately, getting the initial setup or provision event to occur presents an upfront hurdle which many have overcome… yet would have preferred to sidestep. What if during the pre-staging of the equipment the firmware was put into a Basic or Standard provisioned state (again – no TLS, no Kerberos, no 802.1x - see Understanding Provisioning Models - Basic, Standard, & Advanced). Wouldn’t this help get to the desired state of using the technology – allowing time to gain a better understanding first? If at a later time the IT administrator wants to setup a ProvisionServer and own the configuration – then the process could be done remotely via command scripts, agents, and so forth.

 

Open to comments, criticisms, corrections, or alternative viewpoints out there…

2 Comments Permalink
0

Hi all, While Terry is out I wanted to highlight this new 4 Part series on deployment scenarios over on the Altiris Juice site. thank you Terry for posting.

 

http://juice.altiris.com/article/4801/deployment-scenarios-intel-vpro-part-1-deployment-scenarios-introduction

0 Comments Permalink
0

 

This SCS deployment and capacity planning white paper presents architectural and infrastructure guidance for deploying Intel setup and configuration service in various enterprise scenarios. The guidance is based on SCS 3.x extensive scalability testing done in Intel Enterprise Integration Lab.

 

 

You can download white paper and capacity model calculator from below links:

 

 

SCS 3 deployment white paper: http://communities.intel.com/servlet/JiveServlet/downloadBody/1636-102-1-1993/SCS3%20Deployment%20White%20Paper.pdf

 

 

SCS 3 capacity model calculator: http://communities.intel.com/servlet/JiveServlet/downloadBody/1637-102-1-1994/SCS3%20Capacity%20Model%20Calculator.xls

 

 

I am currently working on SCS 5 white paper. Any additional inputs will be comprehened in scs5 white paper. Appreciate all the inputs and comments that will help me in refining the content to make it more relevant for end user community.

 

 

thx

 

 

Anjaneya "Reddy" Chagam

 

 

0 Comments Permalink
0

Be sure to view this brand new resource created in the activation subzone. It details out nearly 40 links to documents, tools, and websites that aide in activation of Intel vPro Technology.

CHECK IT OUT:

Intel vPro Useful Links for Activation

0 Comments Permalink
0
0 Comments 0 References Permalink