NOTE: If you have not read parts 1 through 3, please read these before reading this part as this is a continuation of the story begun in the previous sections. Altiris and Intel vPro Use Cases

Security is only as tight as the weakest link in your environment. More often than not it's internally where the security holes are created, either inadvertently from carelessness or intentionally from a disgruntled or disillusioned employee. The hardware and software security can be top of the line, but if the human factor doesn't adhere to policy, it may not make any difference. This part follows the IT team for Mighty Modern Marketing as they try to track down a security hole where productivity is taken down through the very tools used to defend and manage the network.

Mighty Modern Marketing HQ - Boston, Massachusetts

Somehow the air inside the building congealed hotter than the heavy, humid swelter wallowing outside. Tevita, sweat running down the sides of his face, fanned himself with an empty binder. He stared at his screen, the image thereon frozen.

"I think one of the servers seized up," he said. Jessica Langley glanced at her Remote Desktop window. The previously blinking text icon in the script she edited no longer blinked, and as she watched the disconnected icon appeared, the remote screen graying-out. She closed it with a quick click of the white on red X.

She took a long drink of water. "If they don't fix the AC soon, I'm going home," she announced.

"They'll have it up soon. Besides, it's never been so quiet here. I only have one system running, and I think I'm approaching something like Zen. Either that or I'm about to pass out."

"Any more missing application tickets?"

Tevita groaned. "Oh yeah. Five so far today. It's like the uninstall faerie ran around randomly touching computers with her magic star-wand. I've taken care of it."

Jessica stood, feeling sodden. "Thanks. I'll check on Bobby to make sure he hasn't suffered from heat stroke."

The server room actually felt cooler despite the cacophony of running servers that reminded her of the sound and feel of a jet engine escalating towards takeoff. Somehow Bobby had created a wind tunnel with large fans, and she felt her hair whip away from her as she stepped directly in the wind's path. She shielded her eyes and walked to the developer's cube area. The pull of the moving air seemed to try and yank her off her feet by her dress-suit jacket. She folded her arms as she stepped into the relative stillness of the cube.

Bobby looked like a wilted plant. He looked up, and sighed. "What, IM down again?"

"Of course not," she responded with a smile. "You holding up in here?"

He shrugged. "I'll survive, though it reminds me of Phoenix, Arizona, except here it's like standing in front of a vat of boiling water. Phoenix is like standing in front of the open door to a blast furnace."

"The SQL Server locked again."

Bobby nodded. "I did a hard reset just a minute ago. I had to open the case and point a fan right at the CPUs. I think it'll stay up this time."

"Good."

Bobby shrugged again. He looked back at his screen, then back up at her. "You need something else?"

"Not really. You want to go to lunch with Tevita and I? The local Italian place has great AC."

"No, I'm good. My lunch cooked itself in this heat, so I ate already."

"Alright. See you later."

When she returned Tevita still sat in front of his computer, sweating profusely. He looked up as she passed by, a frown on his face.

"The facilities guy just passed by," he said as she sat down. "He says someone deliberately messed with the AC. He's fixed and says it'll be up and running any time now."

"Someone sabotaged the AC?" she inquired.

"Yep."

She sighed. "Just when I thought we were done with the underhanded antics."

Tevita nodded. "The AC guy put thick padlocks on all the control panel cases. Too bad we don't have any way to track who goes in and out of that room. A magnetic badge reader would work."

The next hour passed in receding misery as the AC kicked on and began liberating the employees in Might Modern Marketing's Headquarters from oppressive heat. Jessica checked the Altiris Notification Server Logs, ignoring the SQL errors for the times the SQL server seized up. Except for an occasional error where an event arrived for a package already deleted from the Notification Server, the logs looked clean.

"Mrs. Langley," Edgar's dry tones greeted.

Right on cue, she thought. Despite the heat things had been going too smoothly. She turned around and stood.

"Hello Edgar."

"I wanted to let you know that the budget we set aside for the mess with New Nifty Networks is on target, thanks to everyone's diligence," he said, eyes briefly moving down to the papers clasped in his hands. "We've even been able to devote some resources to Legal. It won't be long before we can put this whole ordeal behind us."

Tevita rolled over in his chair. "What, and I've done nothing?" The expression on his face and tone of his voice took away any sting of the words.

"Both of you have performed exceptionally," Edgar said, shuffling the papers in his hands. "Though it's not official, I believe you will both receive a merit increases for your performances."

"You're kidding!"

"I do not kid, Mr. Tatafu."

"So be honest, was it hard to allow that through?"

The barest hint of a smile touched the corners of Edgar's thin lips. "Yes, adding my approval felt much like pulling out stitches. Now don't you both have work to do?"

He shuffled away, his posture a little bent.

Tevita gave Jessica a thumbs up. "Ha! So some good is coming from this whole competition nightmare."

"Perhaps," she said noncommittally, having trouble suppressing a smile. "It's not over yet, not until this school-friend of Mr. Johnson's finally gives up. I'm hoping it happens soon so we can go back to normal."

"Normal?" countered Tevita. "When is IT work normal? It changes faster than the seasons."

She opened her mouth to respond when her telephone rang. The caller ID noted Johnson. She quickly picked up the handset.

"Mighty Modern Marketing, this is Jessica," she greeted as cheerily as she could.

"Jessica, this is Mr. Johnson," greeted the CEO. "Can you please come up to my office immediately? We have a sensitive matter to discuss."

"Of course. I'll be up right away."

"Please have Tevita join us as well. See you in a minute."

"Will do. Thanks. Bye."

When she looked up Tevita had his day planner in one hand, the other locking his computers.

"Ready for lunch?" he inquired.

"Change of plans," she said, rising. "Mr. Johnson wants to see us in his office immediately."

Tevita stared at her for a moment, then tossed in planner onto his chair, a wry smile twisting his mouth. "Wonderful. Somehow even though everything he says sounds enthusiastic and wonderful, we end up with a pile of work."

"Job security," she responded.

The CEO's office, remarkably, looked very much like the other offices in the entire building. She glanced through the window on the door, then knocked politely. Mr. Johnson, looking as refreshed and lively as ever, waved her in. The building continued to cool, but still hovered near eighty degrees. Though she felt sweaty and rumpled, Mr. Johnson appeared completely unaffected by the heat, his hair perfectly combed and his clothing pressed and clean. He smiled warmly as they sat down in the two chairs set before his desk.

A man sat next to him, and though she knew she should know who he was, she couldn't place his face in her memory.

"Thank you for coming up so quickly," he said, rising to shake their hands. "This is Dan Williams, Chief Security Officer."

She said hello, shaking Dan's hand. Funny how she knew the name so well from countless emails and conference calls. She felt she knew him despite only seeing him on rare occasions, all from electronic or audio correspondence. Somehow she'd never put that voice with this face.

"Jessica, Tevita," he said in way of greeting in that familiar voice. "We need to meet more often, especially with how much I depend on both of you."

"Definitely," Tevita responded as he sat down.

Jessica had trouble controlling a laugh that threatened to escape. "Mr. Williams, you don't look like I imagined."

Dan smiled, amusement dancing in his eyes. "What did you think I looked like?"

She blushed. "Well... you sound like Chuck Norris. But you're more like..."

Mr. Johnson started. "Chuck...?" He burst into laughter. Tevita's booming laughter joined in as Dan's smile grew wry. Jessica wondered if someone could faint from embarrassment, and imagined she looked as red as a tomato.

"Sorry, I like yoga, but not much of a martial arts guy," Dan said, trying not to laugh.

"Alright," Johnson said with a deep calming breath. "Without further preamble, I'll let Dan discuss the situation."

Dan nodded. "As you are well aware of our situation with our friends over at New Nifty Networks, what I'm about to show you shouldn't come as much of a surprise. We have a plant."

"A plant?" Tevita inquired. "Like a house plant?"

Jessica covertly elbowed him in the ribs as he chuckled.

Dan continued, undaunted. "Someone here is feeding information to our competitor. We're tracking this using email, etc, but the trail is long and convoluted. We think this spy, for lack of a better term, is also sabotaging our business here. While we're pretty sure he or she disabled the air conditioning, we don't have enough data to even begin to narrow down who it could be. There are other things happening that I believe you'll be able to help us with.

"You see, we believe he's somehow obtain access to your management tools. We've had increased cases where vital software has been mysteriously uninstalled from systems."

Jessica exchanged a look with Tevita. "We have had a large amount of emergency software deployment tickets," she said.

"The tickets always say the shortcut is missing," Tevita added.

"Exactly," Dan continued. "Depending on the user, this can severely hamper our productivity. Since some of the computers are locked behind office doors I'm assuming they're using management software to accomplish this. Is Altiris capable of this?"

"Yes," Jessica answered. "However you need rights to do anything."

"And that will be to our advantage. Please look through any auditing or logging done by Altiris and see if you can figure out how this individual is uninstalling applications, what credentials he or she is using. Any evidence or data you capture please forward to me."

"We will," Tevita responded.

Back at her desk, Jessica pulled up the Altiris Console. Events would allow her to see if any Software Delivery or similar jobs had been schedule to run on the affected systems. They had uninstall-programs setup for most of their managed applications. She browsed in the Altiris Console under View, Solutions, Software Delivery, Tasks, Windows, Software Delivery Tasks. The first task she choose uninstalled their accounting software, one application the spy or whatever he or she was liked to target. She did a quick scan to ensure no new tasks showed up.

She clicked on the Status tab. Once the tab loaded she used the dropdown labeled, "Display computers on which this task ran:" to set it to "All". Once the grid loaded she clicked on the top of the "Attempt Time" column to sort by date, and looked at the last week's runs. Only three showed up, and all of them had been scheduled by either her or Tevita.

"Any luck?" Tevita asked, his head rising above his cube's wall.

"Nothing yet. I guess it's possible they created a task and then deleted it after each execution."

"Yeah, but there's an ItemDeleted table that we can look at to see if that's occurred."

He walked into her cube and sat down on the spare chair. He used her secondary system to open SQL Enterprise Manager and launch a query window. He used the query:

SELECT ItemName FROM ItemDeleted

WHERE ItemName LIKE ‘%Accounting%'

AND ItemClassGuid = ‘D922981C-B8E7-40EE-B6BD-1E6CB354C9FE'

"This class-guid here represents Software Delivery Tasks," Tevita explained as he ran the query. "Nope, nothing. Let me try one more query, this one more generic..."

SELECT * FROM ItemDeleted

WHERE ItemClassGuid = ‘D922981C-B8E7-40EE-B6BD-1E6CB354C9FE'

ORDER BY DeletedDate

"Okay," he continued. "I don't think he used Software Delivery. I don't see any Tasks deleted recently enough to account for all the uninstalls reported."

Jessica nodded. "Hmm. If he didn't use this, then the only other two options I can think of are Deployment Server and Task Server."

Tevita smiled. "No chance with Deployment Server. I've changed the management credentials recently and blocked everyone else out. Since only you and I use it, I figured with all the security stuff going on I'd better be safe, not sorry."

She blinked. "I didn't know you'd locked... I guess DS is your baby."

"You know it. So, do you think Task Server could really be it? Wouldn't he need to know scripting?"

"Not necessarily. There's a ‘Deliver Software' task available that can run any Package-Program we have available in Software Delivery. Let me look through here... I don't see any Jobs or Task Server tasks that reference the uninstall program. The ItemDeleted would have deletions if he'd done that. But you used the standard Software Delivery Tasks, right? Can you do one for Task Server Tasks?"

Tevita scratched his chin. "I think so. In fact we don't delete things that often. Let's try this..."

SELECT * FROM ItemDeleted

ORDER BY DeletedDate

"Okay. A few deletions, but they all look straight-forward. Computers purged, a couple of Software Portal Requests... but nothing that looks like a Task Server task. Wait... what's this? Bobby deleted a task named WOfW? This was last week. If I didn't know better, I'd say he's been playing with Software Delivery and Worlds Of Warcraft."

Jessica grinned. "You think he wants to roll it out company-wide? I can see it now. ‘Productivity hits an all-time low, though the average level of Mighty Modern Marketing exceeds fifty'!"

Tevita laughed, pointing at her. "I didn't know you knew enough about gaming to make a joke like that!"

"Right. Like you don't bring it up every week. It was bound to rub off on me at least a little."

"This looks clean. That doesn't make sense. Perhaps Dan's wrong, and whoever's responsible for this isn't using Altiris."

Jessica shook her head. "He's right, I don't think this could be done at this rate any other way. Either they're using a different method, or they have intimate knowledge of Altiris."

Tevita leaned back, looking up at the ceiling. Jessica placed a fingertip on her lips, thinking furiously. If Software Delivery and Task Server wasn't used, and the evidence suggested such, what other method could you use to remove software? They planned on using PC Anywhere for remote control, but it wasn't up and running yet in the Altiris environment. Tevita used the simple Remote Control feature in Deployment Server, and she still used Carbon Copy. She'd disabled access to it in Altiris and used the stand-alone product that only existed on her system for security reasons. Could they have a rogue copy of Carbon Copy installed...?

"What about vPro?" Tevita inquired abruptly, interrupting her thoughts.

"Serial-Over-LAN doesn't work in Windows currently," she responded. "No other remote application abilities... it's really considered an out of band management interface."

"Yeah, but if you built a remote tool into an ISO, using IDER, couldn't you use that?"

"In theory, yes... In fact if you ran an IDE redirect with something like that you could do whatever you wanted to the system."

"Exactly."

Jessica smiled. "And we have an actual activity log."

In the Altiris Console she browed in View, Solutions, Real-Time Console Infrastructure, Tools, and clicked on "Activity Log". She scanned down the entries.

"Well, well," Tevita said, leaning forward. "Our friend has been busy."

The icon showing a redirection session appears like two plugs plugged together. The other pertinent columns appeared as "client": showing what computer by IP Address is being accessed, "user": what credentials were used to execute the action, Host: as in the hostname of the destination computer, Description: showing the path to the ISO, and lastly Technology showing what method was used. Multiple RTSM sessions showed a redirection to an ISO labeled: RemoteControl.iso. The path led to a UNC share.

Jessica pulled up the contents. "Jackpot."

Tevita shook his head. "Too easy. If they know how to create ISOs of that nature and use RTSM to deploy them, did they actually think there wouldn't be some sort of logging?"

"I don't know. RTSM is unique in that it isn't dependent on an agent at all, so there is no logging client-side. Still... perhaps whoever's doing this didn't create the ISOs and is just in charge of running it. And we aren't done yet. Note that the User is all listed as admin. This means he or she is using the AMT credentials available on all systems."

"Oh. Can't exactly blame the invisible AMT admin..."

"No, but we can change the password easily. Before I do that, I'll send Dan the information on the share. That share should have some sort of user footprint his team can get to."

She quickly sent the email with all the information. She explained that she would change the admin password so that this rogue user could no longer use this method. After sending it she browsed in the Altiris Console to View, Solutions, Out of Band Management, Configuration, Provisioning, Configuration Service Settings, and selected Provision Profiles. She double-clicked on the profile they used for all systems. Under the Administrator Credentials section to the right, she changed the password under the Manual radial option. She clicked OK to save the changes.

Next she browsed back up to Provisioning, and into Intel AMT Systems, selecting the node Intel AMT Systems. When the frame loaded, she clicked on the icon on the icon bar that looked like a system with refresh green arrows surrounding it, labeled: Re-provision. She hadn't selected any systems so she selected the only live option, "All systems". She clicked OK to execute.

"That should do it," she said aloud.

"A re-provision?" Tevita asked.

"It's a simple way to send down the changes in a profile to the systems. It'll take some time to cycle through all the systems, but soon all systems will have the new AMT admin password set."

Tevita leaned back. "So we're done?"

"For now, unless you have any ideas for further tracking this guy...?"

The rest of the day proceeded smoothly, with only one more reinstall helpdesk ticket coming in. By the next day no new tickets had developed, and things had settled down to normal. Dan said he had enough to identify the perpetrator, but said no more on the subject.

He did say one thing very firmly. "All the security we can muster is worthless if those with the right privileges are not careful with their credentials."

Further, he requested they review their procedures concerning the AMT admin password. Was it written down anywhere? Did they ever say it out-loud? Though neither knew how the password got originally stolen, the increased care with which they handled passwords became a driving program within the company. Security was everyone's job.

At the end of the week, as Jessica headed away from Boston on the Redline Commuter Train, she hoped they'd seen the end of the targeted attacks, but in her mind she already looked through her current policies and processes to see where she could increase security.

End Part IV

Altiris provided not only an audit trail to track potential rogue usage of RTSM, but it also provided a very quick and efficient way to change security within AMT when somehow the credentials are compromised. Is this the end of the threats against Mighty Modern Marketing? Only time will tell.

If you have not read Part 1 in this article series, please refer to it as this is a continuation of the story begun there:

http://juice.altiris.com/article/4367/altiris-and-intel-vpro-use-cases-part-1-the-setup

Antivirus is a must for any IT infrastructure. Without it productivity is quickly reduced as viruses run rampant in the environment. Keeping Antivirus installed and up to date is vital to ensure continuity of business services. In Part 2 the IT team for Mighty Modern Marketing is put up to the challenge of protecting their network from viral attacks. Using Symantec End Point Protection, Altiris and the Intel vPro technology, they work to ensure that the viral attack and subsequent virus attempts fall ineffective.

Mighty Modern Marketing HQ - Boston, Massachusetts

The commuter rail stretched out across the Charles River, but Jessica Langley didn't notice. Her eyes remained fixed upon the screen of her smartphone, scrolling through the emails that continued to pour in. The subject lines all contained the same word. Her shoulders hunched, feeling like a tremendous weight settled on them. She closed her eyes briefly, rubbing at them with her left hand, the PDA held forlornly in the right.

When she opened her eyes the word jumped up at her.

Virus.

This wasn't the first time this had happened at Mighty Modern Marketing. Viruses routinely showed up as email links or attachments, and it didn't matter how often she or Tevita sent out stern emails reminding people to leave email attachments and links alone unless they were expecting them. People continued to click that link to see the latest movie trailer, or to run the fun and exciting application their aunt or long-lost friend mysteriously sent them from out of the blue.

This time was worse. She'd painted a large red X on her by pushing the Intel vPro technology, and now it seemed everyone stared at her when anything ill befell the network.

She jumped to her feet the moment the train stopped, snatching up her purse and bolting for the nearest door. As she ran down the platform towards the exit of North Station, others gave her curious looks. She smiled briefly. Normally people ran towards the train to avoid missing it. She often saw them frantically running in high-heels or other dress shoes towards a departing train when the work day was over. Who wanted to run into work?

As she staggered into the main lobby at work, glad for the cool air that greeted her, she vowed to start exercising. She hurried through the building.

"I'm glad you're here early," Tevita said in his deep voice as she fell into her chair. "We're in trouble."

"I noticed," she said in-between deep breaths. "What's the situation?"

"I'm not sure, but somehow a virus was planted on a new system as it came online. It appears deliberate."

"But... we have Symantec End Point Protection (SEP). It should keep everything out..."

Tevita smiled, though his eyes shifted to his own monitor, his shoulders shrugging uncomfortably. "Yes... about that. You see, the base image hasn't been updated yet to include that..."

Jessica stared at him.

He waved a hand at her. "I know, no need to look at me like that. That's what I've been doing; recreating the image so it's there from the get-go."

She tried not to groan. "So how widespread is it?"

He laughed, though no humor made it into his tones. "All over the place. They used a vulnerability in one of Bobby's applets to spread it. Of course the first thing it did was disable the antivirus. If SEP had been installed it has protection against... Anyway, those systems without SEP are all hit."

Tevita's eyes glanced up, and widened. Jessica whirled to see Bobby walking up, his hands shoved in his jean pockets. He stared at the floor, his mouth moving as if he counted his steps.

"Bobby?" she inquired.

He looked up, looking like a boy lost out in the desert.

"It got through my firewall!" he exclaimed, extracting his hands so he could ball his fingers into fists. "It shouldn't have been able to do that. I can't even use IM."

Tevita gestured to an empty chair. "Have a seat."

Bobby slumped into the chair. "Whoever sent us this thing knew what they were doing," he said with a scowl. "The cursed thing used UNC to move about the network. Only someone with intimate knowledge of our network could do that. It has to be New Nifty Networks!"

"Do you really think...?" Tevita began.

"Bobby," Jessica said quickly. "Have you fixed the vulnerability?"

"How can I?" he lamented. "It jumped from computer to computer, and with mine infected I quickly turned it off. I need your to help me get that virus off so I can patch the applet."

Tevita smiled. "You actually walked over here."

Bobby looked up, his frown deepening. "Yeah? So?"

"It's unprecedented... You usually stay in your cave, even during power outages. Does it make you nervous to enter the world of real people?"

A flush bloomed on Bobby's sunken cheeks. "Not everyone's as social as you."

"You should stop by more often so..."

"So you can ridicule me?" he retorted.

"Guys," Jessica said, rolling her eyes. "Focus here. Bobby, do you have one of the new vPro systems?"

"Yes, of course," he responded, "I always get the latest hardware from procurement."

"Hey, why don't I see any of it?" Tevita blurted.

Jessica ignored him. "Good," she responded to Bobby as she turned back to her computer. She launched the Altiris Console. "If you have one, it should already be provisioned. Let's check the All Provisioned Computers collection... is this yours?"

"No, my computer is named Superman."

Tevita laughed, and Bobby managed to turn an even more alarming shade of red. Jessica kept her expression passive despite the twitch in her lips from a potential laugh. The computer name Superman showed in the list, and she double-clicked on it. She clicked on the Real-Time tab, entered her credentials, and loaded the Hardware Management page under the Real-Time System Manager, Administrative Tasks folders.

"I have a boot ISO of Symantec's Antivirus scan," Jessica explained as the hardware management page loaded. "I'll just turn on your machine but use IDE Redirect (IDER) to load the antivirus disk. We'll wipe the virus, and turn the system off."

"That's great," Bobby said as he shrugged his bony shoulders," except the minute you bring it back up the virus will propagate again."

Jessica smiled. "Not if I invoke a Network Filter."

"What's that?" Tevita asked, as if on cue.

"Tevita, we've covered this. It's the Intel System Defense. You know, block all traffic except to certain ports and IP Addresses. If you want to read up on it I'll email you the URL. (http://69.93.2.147/article/2645/hold-mf-utilizing-intel-vpro-amt-technology-task-server-part-5-system-defense-tasks)."

"System Defense!" Bobby exclaimed. "I read up on that technology. I created a script that provides a text interface where you can specify which ports you want to allow. I call the API's provided by Intel's SDK. It's great stuff."

"RTSM and Task Server already have it configured to only use communication to them," Jessica said, trying not to smile.

"Oh." Bobby cleared his throat as he pushed himself up onto his feet. "That sounds good. Do you need me to stick around...?"

She gave him a grin. "Just for a minute while I do this."

Bobby sat back down, but leaned forward, staring at her monitor. Tevita slid over, looking on with interest. She said a quick silent prayer that it would all work like she theorized it would.

She choose the ‘Power on' radial option, and under the Redirection options checked the ‘Perform boot from' checkbox. She also checked the ‘Display task progress and remotely control computer' option. Under the device drop down she left it at CD image, and then click ‘browse' and located the Symantec ISO. She lastly clicked ‘Run Task Now'.

A new window popped up, showing the computer boot. It loaded the CD and a textual menu showed up giving her scan options. She initiated the scan.

"Looks like it's working," Tevita said.

Bobby nodded. "I had my doubts since I've been unable to ever get Wake-On-LAN to work across my router..."

"Wake-On-LAN packets don't get by any of our switches are routers," the Tongan responded. "I believe you're the one who recommended the network security scheme we use."

"I know, but Altiris did have an Altiris Agent mechanism to try and deal with it, but I couldn't get it to work in my environment. This vPro stuff sure made that easy. I didn't have to touch the router."

"That's the point," Jessica said with just a hint of exasperation in her voice. "Were both of you sleeping when I gave my presentation on vPro last month?"

Tevita smiled, tugging at his collar. "Have I ever mentioned I don't like PowerPoint?"

"Only twice daily. But I showed demos... oh who am I kidding? That's the last time I supply lunch before a presentation."

The two men exchanged glances with sheepish grins, and then focused back on the screen. She looked back to the scan. It finished quickly, showing the virus as detected and quarantined. She closed the remote window and clicked on the Network Filtering node under Administrative Tasks in the Real-Time Console. She checked the ‘Override default solution settings' checkbox and changed the radial selection to ‘Filter network traffic other than to and from the Notification Server'. She clicked Apply. When the page finished refreshing it contained the message, "Machine was successfully moved into quarantine".

"Alright Bobby. I'll use the Power Control to boot your machine up so you can Patch your applet and install SEP. You head back and get it done ASAP. Once it's patched I'm going to mass-remediate all the vPro systems doing the same actions we just did except on a mass scale with Task Server."

Bobby jumped to his feet. "Sounds good. IM me if you need anything..."

"Except IM won't make it through the Network Filter," she responded dryly.

"Ah... yes. Well... you know where I am."

"Quick question, how long will it take you?"

"Less than an hour."

As Bobby walked away Tevita smiled hugely, some of his natural humor finally flowing back into his features. "He's a real gem."

"You should cut him some slack," she scolded.

"Bobby? I'm holding back, really I am. It's just too much of a temptation. He's classic nerd. But he is a master at what he does, so I'll be sure to keep it friendly."

"I'm reassured," she said, rolling her eyes for the third time that day. She then gave him a sly smile.

"What?" he said, his smile drooping. "You have that look."

"Regardless of blame, even though you should have updated the image weeks ago to include Symantec Endpoint Protection so I blame you for this mess, I need you to create a CD out of the Antivirus boot ISO and load SEP on a flash drive so you can manually remediate those systems without vPro."

Tevita swallowed. "Hey, we've had a pretty busy workload..."

She softened her look. "I know, sorry. Anyway... when you get to each system, yank the network cable, use the ISO to clean the virus, then load SEP, and then put the cable back in. I'd even suggest making several copies so you can do a handful at a time. And here's a printout of all non-vPro systems."

Tevita took the printout and nodded. "I'm on it."

Jessica focused back on the Altiris Console after Tevita left clutching ten copies of the ISO and SEP installer. She browsed under Manage, Jobs, Tasks and Jobs, right-clicked on Jobs, and choose ‘New Folder'. She right-clicked on the new folder and choose ‘New > Task/Job'. In the resulting window she choose ‘Server Job' under the ‘Jobs' folder. The first element popped up a message from a VB script stating that an emergency procedure would fire in 60 seconds, and instructing the user to save all data. Her second task was a ‘Boot Redirection Task' that booted up a modified ISO that automatically ran the scan and took any appropriate actions against detected threats. The third task invoked the Network Filter, allowing only NS and Task Server communication capability with the system. For the fourth Task she located the SEP install Tevita had made with Altiris Software Delivery Solution and put it into a Task Server Deliver Software Task. Finally she created the fifth and sixth tasks that removed the filter and invoked a reboot to finish the process.

She saved the job and selected her own system to test it.

"Mrs. Langley," a familiar voice prompted. Normally she caught movement in the mirror mounted on her flat panel monitor when someone walked up to her, but she'd been so focused that this time she started almost violently in surprise, whirling around in her chair.

Edgar Watts stood behind her, his hands conspicuously empty of printouts. Her first impulse was to point to her screen and tell him she had a plan with vPro to take care of the virus in a timely manner.

She rose to her feet, trying to place a polite and not strained smile on her face. "Hello Mr. Watts."

"Since my computer is down, I've been using my laptop to research the impact of viruses to corporations, specifically impacts to finances."

He frowned, briefly rubbing a forefinger along his jaw. He didn't immediately continue, his vexed expression seeming to say he was seeing those numbers again and loathing what he saw.

"We're working on it," she said, trying not to sound defensive.

"I know," he responded. "I'm astounded at the amount of this company's hard-heard cash flow flowing down the drain."

"We'll have your and all vPro enabled systems up within the hour," she said, forcing that smile to remain on her face."

"One hour?" he responded, looking down at his watch as his brow drew low over his eyes, almost like a thundercloud.

She braced for some kind of outburst, feeling sour in the pit of her stomach. It seemed like her stomach wanted to remain clenched, and she couldn't relax the muscles in her shoulders. What more could she do? She often woke in the middle of the night, her sleep-clouded mind immediately whirling through all the issues she needed to address immediately. She needed to prove vPro, identify and eliminate any threat from their nefarious competitor, keep Edgar's expense-cutting knives away from her department, and still find enough time to enjoy time with her husband. Lying awake at night, trying to will herself to sleep, got old fast. Two days ago her husband had recommended quitting.

That seemed wrong. She'd never given up on anything in the past, and she didn't want to give up on this now, especially when all of Mighty Modern Marketing needed her at this critical time.

When Edgar looked back up from his watch he smiled, a rare sight that stilled her thoughts, her breath catching in her throat.

"All vPro capable systems, you say?" he asked.

"Yes sir," she responded after a moment of stunned silence.

"I came down to wish you luck, but perhaps you don't need that luck after all. Good day, Jessica."

He turned around and walked away, and she stood and stared at him. She almost chuckled, but she still felt too emotionally invested and she just might break down and tear up. She slowly sat back down, staring at the Altiris Console. With renewed vigor she tested her job, made a few tweaks to the command-line of the rollout job, and then brought up a Run Now window, selecting All Provisioned Systems. Her mouse hovered over the Run Now button.

"Come on Bobby," she whispered. The few minutes before the IM popped up declaring "Applet is patched" seemed like an eternity.

She clicked the Run Now button.

She got up and took a quick water break, grabbing a drink and throwing it down as if a shot in a drinking contest. She didn't want to return to her desk. What if it failed on most systems, especially the executive team's? What if she hadn't accounted for different hardware platforms in her job? What if?

She squared her shoulders, throwing off the ‘what if' game. She walked resolutely back to her desk and sat down, refreshing the job.

Ninety percent success rate brought a smile to her lips.

For the next few hours she used RTSM to connect to and patch those systems where the Task Server job failed for whatever reason. Most she could figure out the issue by using RTSM, aided by the article, http://69.93.2.147/article/4075/troubleshooting-altiris-manageability-toolkit-vpro-technology-part-5-real-time-console-, since RTCI was the component that executed most Task Server and RTSM commands against AMT.

Toward the end of the business day she leaned back. All vPro capable systems, a good 75% of the environment, was patched. Just as she shut down her computer Tevita showed up. His natural good humor managed to put a smile on his face. His long-sleeved dress shirt had the sleeves rolled up, his tie loose and top button of his collar undone. Sweat glistened on his forehead, remnants of computer dust bunnies streaked on his hands and forearms.

"Hi!" she said, unable to keep from smiling in amusement at him.

"Let me guess," he said, his smile twisting a little, "you've managed to patch all vPro systems."

"Yes," she responded, putting her purse back down on her desk. "How's the other systems coming?"

"I'm... uh... half done."

She nodded, picking up her phone. "Tevita, give me just a moment. Hi, Rob? I'm fine, though it looks like I'll be here a while. It's mostly under control, but we have a few more systems to fix. I know, I'm sorry. I'll see you later tonight, honey. Love you too, bye."

"What are you doing?" Tevita asked, frowning.

"We need to finish up, right?"

"Well... yes. But you don't really have to..."

"I'm thinking your wife wants to see you at least some time tonight. I'll take the third floor, you finish up the second, and the last one done has to bring donuts tomorrow."

Tevita looked relieved. "Deal. Thanks, Jessica."

Bobby walked up, a laptop case in his hands. "I'm heading out. Thanks for getting me back up so fast."

Jessica turned to him, her smile growing. "Bobby, we need your help," she said without preamble. "We have a few more systems to remediate..."

Bobby shook his head, his expression tightening. "No way, I have a Halo 3 party..."

"Bobby, you can't abandon us..."

Bobby looked down at the case in his hands. "Ah nuts! You don't know what this does to me. I'll lose my leader spot..."

"You'll make it up," Tevita said confidently. "If we get this done quickly imagine how impressed they'll be when you join late and still take the top spot."

Bobby's stricken look abated. "Yes. Yes, that would be impressive. Ok, I'll help."

Hours later Jessica left the building, running towards North Station to catch one of the late trains home, her shoulders feeling much lighter than when she'd rode in.

End Part II

Having minimized the damage of the first attack, the IT staff will continue to prepare in anticipation of more cyber attacks.

The big question after successfully provisioning a vPro/Symantec-Altiris environment comes in the simple form of "Now what"? The article series: Utilizing Intel® vPro AMT Technology with Task Server covers a lot of the functionality directly (LINK: http://juice.altiris.com/book-page/2201/utilizing-intel-vpro-amt-technology-with-task-server). This article series takes it a few steps further, with real-world examples and use cases for taking advantage of Intel® vPro technology through Symantec/Altiris Notification Server.

Introduction

There are two components for directly interfacing the AMT vPro technology. The first is Real-Time System Manager, the second Task Server. Both components utilize much of the same functionality, however RTSM provides a one to one interface, while Task Server allows a one to many task or job to execute against a group of vPro systems.

To understand how all the components work together, this Introduction walks through the basics of the components that will be used throughout the use cases. The list of solutions, or applications, that utilize Intel vPro technology is listed here along with a description:

• Real-Time Console Infrastructure - This component is generally invisible when working directly with vPro AMT Systems. The Configuration of how to connect to systems and what credentials will be used can be found in the configuration pages for this product. It supports both the Real-Time tab and the Task Server vPro AMT tasks available.

• Real-Time System Manager - The Real-Time tab functionality that directly interfaces with vPro AMT on a system per system basis provides a live tool for directly invoking vPro AMT functions as part of troubleshooting or maintaining a system directly. This is useful for troubleshooting problems with a specific system.

• Out of Band Management - Out of Band Management will only lightly be covered in this article series. For the most part this solution is part of the setup and configuration of Intel vPro AMT systems so that vPro AMT functionality can be used. There are some maintenance and profile items that can be used as part of ongoing use of vPro AMT.

• Task Server - Task Server is the engine used for a one to many task or job where specific vPro AMT functions, along with functions from a myriad of other Solutions, can be executed or scheduled to execute against a collection or list of systems. This is the integration framework that allows AMT to become part of a much larger Altiris functionality portfolio.

See the following diagram for a representation of how the two main functional engines work:

This series will focus on these two pieces (RTSM and Task Server) since they are the delivery mechanism for the vPro AMT functionality. Other Symantec Solutions can and will be used through the use cases.

Real-Time Console Infrastructure

Consider this the core underlining infrastructure for the Symantec use of Intel vPro AMT. All solutions that make use of this component will install it if it is not already installed. The primary products are Out of Band Management and Real-Time System Manager. Other Notification Server Partner solutions, such as HPCM and Dell Openview, will need RTCI installed in order to make use of the vPro AMT functions. The console pages available for this solution center around the configuration of the vPro AMT functions.

The configuration page for RTCI is found in the Altiris Console. In the Altiris Console 6.5, browse under View > Solutions > Real Time Console Infrastructure. Under the Configuration folder, the following nodes are available:

1. Configuration - Includes settings for vPro AMT Connections, such as Transport Level Security, Redirection Security, and other settings such as the connection timeout value. It also includes a page to configure where SNMP vPro AMT alerts are sent, and allows a default configuration for the System Defense filter (default is to ‘Allow all network traffic').

2. Edit Network Filters - This page is only available if the ENF utility has been installed (see article http://juice.altiris.com/article/2645/hold-mf-utilizing-intel-vpro-amt-technology-task-server-part-5-system-defense-tasks for more information). If you do not have this node, install it so that you can configure what is allowed through the System Defense filter.

3. Manage Credentials Profiles - This node is vital for setting up connection profiles when using RTSM. It includes credentials for WMI and vPro AMT. Users who do not have rights to vPro AMT will need to use a profile that has a user configured with rights. This also includes the Run-Time profiles which is used by both Task Server and RTSM to use known good credentials when functioning against specific vPro AMT systems.

4. Manage Views - Views are

5. Purge Policy - This page is used to configure how often and how much residual data RTCI purges. For large environments this will help keep the database size down to improve performance.

The Reports, Resources, and Tasks section contain the typical items for Altiris Solutions. Tasks include all the vPro tasks available through Task Server. See the subsequent Task Server section for more details.

The Tools folder is also found under the Real-Time System Manager section (it ties into the same data so the duplication is only visual). For vPro AMT, the two applicable nodes are:

1. Activity Log - This logs all functions executed while in a Real-Time session. This is useful to look at what operations have been run, one which computers, by whom, and utilizing what technology (WMI versus vPro AMT).

2. Manage - This node allows an IP address to be entered in directly for a launch of the Real-Time tab. This is especially useful for systems that are not in the Altiris database. This also allows a host-name to be entered, but keep in mind that if there is a DNS issue this may fail.

Real-Time System Manager

To simplify things, we'll simply define this product as ‘The Real-Time tab within Resource Manager'. There are Partner Solutions for HP, Dell, and others that will add items to the left-hand tree, but the Real-Time System Manager node provides all functionality including all vPro AMT functionality available. See the following screenshot for details:

NOTE: Only the vPro AMT functions are shown above as my Symantec Client Firewall is enabled! Since vPro AMT is a trusted technology my Symantec firewall does not block vPro AMT traffic.

The console is a direct connection to the machine listed under ‘Managing Resource'. As such this is a one to one implementation and is useful when troubleshooting a specific vPro AMT system. In the Use Cases where the use defines the target as one machine, often RTSM will be utilized.

Out of Band Management

Since Out of Band is primarily a Provisioning Solution, only a few of its functions will be used in the use-cases provided in this article series. The functions that apply are:

• Maintenance - For security purposes, OOBM can be setup to run maintenance tasks against managed vPro AMT systems. The vPro AMT administrator password for a particular machine can be randomly changed. A re-provision, which reassigns the profile assign to it, will help keep vPro AMT systems up to date with profile settings and password information.

• Profiles - In the profile setup while configuring an vPro AMT system users can be defined for having certain vPro AMT rights. This allows administrators to limit what type of worker can execute what vPro AMT functions.

Task Server

Task Server is a sequencing engine, and RTCI provides vPro AMT targeted tasks that can be employed singly or jobs that can run a large variety of tasks or actions against a target collection of machines. In the preface to this article a link provided access to a series focusing on how vPro tasks can be utilized into Task Server, with articles covering additional Altiris/Symantec Solutions for further integration. Before walking through the Use Cases, it will help a great deal to understand how we're integrating the functionality and how Task Server functions in general.

The vPro AMT tasks themselves are provided by RTCI, including the engine that connects and executes functions against a vPro capable system. Task Server handles all the rest, including integrating other Solution functionality within Jobs.

Most automated processes to be executed against one or more vPro AMT systems will fall under Task Server. Task Server Jobs can be scheduled, or executed on demand. Notification Server Collections or individually picked vPro AMT systems can be targeted per Task or Job, allowing a large number of systems to execute at a time (Note: for large environments multiple Task Servers are recommended).

Conclusion

Before any of the Use Cases can be tested, all target AMT systems must be provisioned in one of the provisioning modes: Small Business (Low security), Enterprise Mode, Enterprise Mode with TLS. Once provisioned, Symantec, via RTSM and Task Server, can then work directly with the machines via vPro AMT.

I hope to cover common scenarios in this article series that can be of use to many environments. Most of the testing will be against a limited lab environment so results may vary and additional configuration may be required, all depending on the complexity and configuration of the environment. Since the hardware and software worlds introduce many levels of complexity and configuration, additional steps may be required to create workable jobs and functions. Having said that, hopefully these provide enough information to move forward.