Home > Intel Communities > Open Port IT Community > Intel® vPro™ Expert Center > Microsoft Manageability > Blog > Authors > Dan Brunton
Up to Blog Posts in Microsoft Manageability

Microsoft Manageability

6 Posts authored by: Dan Brunton
Dan Brunton
0

One of the new additions to Config Manager SP2 is native support of wireless access for managing clients with AMT.  Microsoft has built in support for configuring enterprise level wireless profiles such as WPA2-Enterprise.  These are wireless profiles that support RADIUS authentication using an authentication server to decide whether or not a given client is allowed to access the network.  Config Manager SP2 does not support wireless profiles that use pre-shared keys (PSK).  If you use security standards like WPA2-PSK/WPA2-Personal in your environment you will need to use the scripting framework tool to generate a script that can configure this option outside of Config Manager.

Mohan Veeramachaneni has put together several guides that explain how to configure the back-end RADIUS authentication components and access point configuration.

Cisco ACS

Configure Cisco ACS Server for Navigating Secure Networks with AMT/vPro

Microsoft NPS

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 1

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 2

Microsoft IAS

Step-by-step Guide for Navigating Secure Networks (802.1x) with Intel® AMT™ using Microsoft® SCCM SP1 & Microsoft® Radius (IAS)

Matt Royer has a blog entry that covers wireless profile management in Config Manager SP2.  The process he outlines is still the same in the release version of SP2.

http://communities.intel.com/community/openportit/vproexpert/microsoft-vpro/blog/2009/06/05/a-closer-look-at-sccm-sp2-beta-oob-wireless-management-wireless-profile-management

Key things to remember about wireless management with Config Manager

  • Config Manager will not update a wireless profile that is currently in use.
  • Config Manager now uses DNS entries to resolve client names.  You may run into a case where a client has switched between a wired or wireless connection and AMT is temporarily inaccessible due to delays in DNS update propagation.  DNS caching on your Config Manager server can also cause this to occur.  You can try running the “ipconfig /flushdns” command from a command prompt to clear the local DNS cache on your Config Manager server.
  • Launching a Serial-over-LAN session over a wireless connection while the client’s OS is using that same connection will cause the wireless network to be cut off to the OS.
0 Comments Permalink Tags: dan_brunton, sccm, configuration_manager, configuration, sccm_sp2, vpro, configmgr, microsoft
Dan Brunton
1

SCCM Log Parser Script

Posted by Dan Brunton Jun 25, 2009

Reading through the wealth of information in SCCM logs can be a challenge, especially if you are provisioning a lot of systems at one time.  I've put together a VBScript example to help make the job of debugging provisioning problems easier.  This script will parse through the log file you specify and create a new log file containing entries relevant to the string you are searching for.  The most common usage for this would be to look through the amtopmgr.log for all entries related to a specific computer name.  This script will first go through the log and find all the thread values associated with the computer name, then, it will take any log entry with any of those thread values and place it in a new file and launch it in the SMS Trace (Trace32) application.  The idea is that having all these entries, not just the lines with the computer name, will paint a more complete picture of what has gone on during the provisioning process and cut back on the time spent looking for relevant log entries by hand.  Here's some information on how to run the script.

Required parameters:

/l: - The SCCM log file you want to parse, typically amtopmgr.log

/s: - The search string, often a computer name, you want to parse the logs for

Optional parameters:

/o: - The name of the parsed log file this script will produce.

      If no name is specified, the file will be named:

      <specified computer name>.log

Example: cscript sccmlogparse.vbs /l:amtopmgr.log /s:vProPC /o:parsedlog.log

You can download the script here:

http://communities.intel.com/docs/DOC-3400

1 Comments Permalink Tags: amt, dan_brunton, script, sccm
Dan Brunton
0

Whenever you make a change to your Out-of-Band configuration settings in SCCM you need to push that change out to your Intel® AMT clients.  Normally you have to go through each of your collections that has AMT systems in it and tell SCCM to manually update the management controller configuration.  It is possible to automate this process using a script that makes WMI calls to the SCCM server, requesting it update the management controllers in your clients.  This can be scheduled as an advertisement to be run automatically.  This package contains documentation that outlines the required security, creation of the update task and an example VBscript.  You can download the package here:

 

http://communities.intel.com/docs/DOC-3399

0 Comments Permalink Tags: dan_brunton, amt, script, sccm
Dan Brunton
3

The SCCM Out-of-Band (OOB) Management Console is a stand-alone executable that is typically launched from within the SCCM console application itself. There may be cases where different groups in an IT department will want to make use of the OOB access to clients, but should not have access to the other features of SCCM in order to maintain proper separation of duties and best known security practices. It is possible to use existing technologies to launch the OOB Management Console outside of the SCCM console application itself. This package contains documentation that explains the required SCCM security configuration and includes and example VBScript.  You can download the package here:

 

http://communities.intel.com/docs/DOC-3398

3 Comments Permalink Tags: dan_brunton, script, sccm, amt
Dan Brunton
1

In order for Microsoft Systems Center Configuration Manager to provision a vPro system, via bare-metal provisioning, it needs to know its UUID (Also referred to as a GUID), MAC address, short name and FQDN.  This information can be collected into a CSV file and imported into SCCM manually, or automatically by leveraging a script and WMI.  This package will outline the security configuration and point you to resources you can use to create a script to automate this process.  You can get a copy here:

 

Update 6/25/2009:  An updated version of the script is available at the link below.

 

http://communities.intel.com/docs/DOC-3067

1 Comments Permalink Tags: amt, sccm, configmgr
Dan Brunton
1

Steve Rachui at Microsoft has put together a great PKI validation script.  The script itself validates PKI in two ways.  First, it can be used to verify third-party remote configuration certificates from the vendors supported by AMT.  Second, the script can verify that your PKI environment is properly configured to support AMT provisioning.  The script itself needs to be run from a server to work correctly.  Check out Steve’s blog to get all the details.

http://blogs.msdn.com/steverac/archive/2009/05/18/tool-to-verify-amt-certificates.aspx

1 Comments Permalink Tags: sccm, pki

Popular Blog Posts

Incoming Links