Greetings from the trenches! My name is Sandy Wood and I'm a network administrator for the Orange County District Attorney's office in Southern California.

What I do

My primary job is to manage and support our fleet of 950 or so Windows workstations and 30 Windows servers. This covers everything from updating software, performance monitoring, alert management as well as second level Help Desk support.

The tools I use the most in my day to day activities are Microsoft SMS Server 2003 and Microsoft System Center Operations Manager 2007. These tools are indispensable in our daily jobs to keep our systems running smoothly and up to date.

vPro What?

Earlier this year, while attending a Microsoft Management conference, I stopped by the Intel booth and learned about vPro technology. Boy, what an eye opener for a management geek! This could really be system management nirvana! Since we were in the beginning stages of planning for the replacement our entire PC fleet, I called my boss and told him he had to make sure that our next systems had vPro technology. This was going to revolutionize the way we managed our systems from deployment to software updating to day-to-day support.

Why Should You Care?

Well, fast forward to today and we're just beginning to receive our first new systems. Brand, spanking new HP systems with, yes, you guessed it, Vpro with AMT 3.0! Everyone watched while we opened and unpacked the first system box. After my big vPro sales pitch, management was keen to see all the great new bells and whistles that vPro and AMT were sure to bring us. Before I go into just how cool it all worked and how cool I looked doing it, I thought it would be instructive to blog the actual steps (and missteps) I took in planning and deploying AMT in a real world situation, warts and all.

This is why you should care - if you're getting ready to deploy AMT or are just interested in the technology, this may (I hope) offer a glimpse into what it will take to get AMT rolling in your world. Reading the manuals is good and I highly recommend it however, nothing beats a real step by step walk through with real situations to give you a feel for the product and its potential.

What's Next?

The next step for me will be the planning phase. Although most of us love to just get out there and run setup, planning before you deply AMT in your environment will truly pay off for you. AMT has a lot of pieces and features that you're going to want to sit down and do a bit of thinking about before running setup. Trust me; you'll be glad you did.

Well, I'm finishing up my planning and will be back here soon with another installment of Life in the Trenches as I run down just what I did to plan for AMT deployment in my environment.

Stay tuned and as always, your comments and questions are welcome!

Over the last year I have worked with our internal IT shop to implement vPro & CentrinoPro into the environment. While that was fun & rewarding, I thought now would be a good time to implement a smaller instance w/ a mix of clients & try out the new Intel System Defense Utility that I put a link on the tool page..

I've currently procured a centrinoPro, vPro(AMT2.x) & working on obtaining a vPro(AMT3.0) box to showcase all use cases & functionality, especially the Remote Configuration feature. What is good to note is that Matt Royer already helped me demonstrate Remote Configuration in San Francisco IDF & it was very nice to watch the out of the box to having the console automatically provision & show the vPro machine. However now the immediate challenge is for me to set this up w/ ISDU & see what use cases I can utilize.

if your on this path as well, let me know. I like to hear how you are using AMT (active management technology).

Cheers. Off to Provisioning....

UPDATE

I updated the BIOS via USB on the CentrinoPro & vPRO machines to ensure latest bios. I will work to get the post up this week on how to create a dos bootable USB stick & the preferences on size of the stick.

I then downloaded the Intel System Defense Utility, then I hard lined the CentrinoPro machine for now as I have not changed my Access Point settings for WPA at this point

(remember i'm doing this in SMB mode).

I then started the scan & was able to see both machines. If you click on link below you will find that I was able to detect both machines. I started first with inventory to show what I could validate from the Machines. Good to note is that both machines are Plugged into the network & the power (desktop - of course, notebook - yes). I wasn't satisified with the results so I went to each of the machines Web UI to ensure I could connect.

Initial Scan to obtain machines on the subnet, while this took longer than I expected it did find all the machines.

After finding you double click on each PC & it connects you to the Firmware.

Then I pulled an asset mgmt screen on both the notebook & desktop to show that I can pull inventory, take in account each machine is powered down at this point.

Now to be sure you can establish communication I went to the Web UI on both, which in the ISDU tool it is simple to click the link & hit the admin login.

While this is good, it's time to now showcase the rest of the use cases, including System Defense with a few good filters. I was out hunting for a good virus & found the backdoor.darkmoon. One of the ports is listens on is 6868 & 7777.. I was able to use System Defense as seen below to block these ports by doing the following:

#1. Open up Intel System Defense Utility

#2. Connect to the impacted machine

#3. Select the "System Defense" tab

#4. Select "Block LImited Services"

#5. Uncheck all items & then in blocked ports in put "6868,7777"

#6. Hit Apply Settings, then Apply Changes

DONE - I've now protected my machine quickly against the potential exploit. It doesn't fix it for cleaning, however it does protect the virus from communicating & receiving future instruction.

Now I can remote control it, turn it on, update the DAT files.

If your in Dresden on October 9-11th, I would recommend to check out this workshop.. From the attendees, you can see Microsoft, Altiris, & LANDesk will be there. Plus from the Intel side you have Mike Seawright, he's one of our key activation folks that has been out deploying AMT.

Here's the abstract: This is an in-depth workshop on how to implement Intel Active Management (AMT).

This workshop is especially designed for IT engineers, system architects, pre-sales or post-sales support staff, who are involved in improving business processes or implementing new technologies, either in-house or at customer locations.

or you can email Frank Rommel @ frank.rommel@intel.com.