Microsoft Manageability

Microsoft System Center Configuration Manager SP2 Wireless Support Overview

daniel.w.brunton@intel.com — Tue, 17 Nov 2009 17:38:11 GMT

One of the new additions to Config Manager SP2 is native support of wireless access for managing clients with AMT. Microsoft has built in support for configuring enterprise level wireless profiles such as WPA2-Enterprise. These are wireless profiles that support RADIUS authentication using an authentication server to decide whether or not a given client is allowed to access the network. Config Manager SP2 does not support wireless profiles that use pre-shared keys (PSK). If you use security standards like WPA2-PSK/WPA2-Personal in your environment you will need to use the scripting framework tool to generate a script that can configure this option outside of Config Manager.

Mohan Veeramachaneni has put together several guides that explain how to configure the back-end RADIUS authentication components and access point configuration.

Cisco ACS

Configure Cisco ACS Server for Navigating Secure Networks with AMT/vPro

Microsoft NPS

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 1

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 2

Microsoft IAS

Step-by-step Guide for Navigating Secure Networks (802.1x) with Intel® AMT™ using Microsoft® SCCM SP1 & Microsoft® Radius (IAS)

Matt Royer has a blog entry that covers wireless profile management in Config Manager SP2. The process he outlines is still the same in the release version of SP2.

http://communities.intel.com/community/openportit/vproexpert/microsoft-vpro/blog/2009/06/05/a-closer-look-at-sccm-sp2-beta-oob-wireless-management-wireless-profile-management

Key things to remember about wireless management with Config Manager

Config Manager will not update a wireless profile that is currently in use.
Config Manager now uses DNS entries to resolve client names. You may run into a case where a client has switched between a wired or wireless connection and AMT is temporarily inaccessible due to delays in DNS update propagation. DNS caching on your Config Manager server can also cause this to occur. You can try running the “ipconfig /flushdns” command from a command prompt to clear the local DNS cache on your Config Manager server.
Launching a Serial-over-LAN session over a wireless connection while the client’s OS is using that same connection will cause the wireless network to be cut off to the OS.

SCCM Log Parser Script

daniel.w.brunton@intel.com — Thu, 25 Jun 2009 16:06:54 GMT

Reading through the wealth of information in SCCM logs can be a challenge, especially if you are provisioning a lot of systems at one time. I've put together a VBScript example to help make the job of debugging provisioning problems easier. This script will parse through the log file you specify and create a new log file containing entries relevant to the string you are searching for. The most common usage for this would be to look through the amtopmgr.log for all entries related to a specific computer name. This script will first go through the log and find all the thread values associated with the computer name, then, it will take any log entry with any of those thread values and place it in a new file and launch it in the SMS Trace (Trace32) application. The idea is that having all these entries, not just the lines with the computer name, will paint a more complete picture of what has gone on during the provisioning process and cut back on the time spent looking for relevant log entries by hand. Here's some information on how to run the script.

Required parameters:

/l: - The SCCM log file you want to parse, typically amtopmgr.log

/s: - The search string, often a computer name, you want to parse the logs for

Optional parameters:

/o: - The name of the parsed log file this script will produce.

If no name is specified, the file will be named:

<specified computer name>.log

Example: cscript sccmlogparse.vbs /l:amtopmgr.log /s:vProPC /o:parsedlog.log

You can download the script here:

http://communities.intel.com/docs/DOC-3400

Automatically Updating the Management Controller Configuration in SCCM Using a Script

daniel.w.brunton@intel.com — Thu, 25 Jun 2009 15:46:39 GMT

Whenever you make a change to your Out-of-Band configuration settings in SCCM you need to push that change out to your Intel® AMT clients. Normally you have to go through each of your collections that has AMT systems in it and tell SCCM to manually update the management controller configuration. It is possible to automate this process using a script that makes WMI calls to the SCCM server, requesting it update the management controllers in your clients. This can be scheduled as an advertisement to be run automatically. This package contains documentation that outlines the required security, creation of the update task and an example VBscript. You can download the package here:

http://communities.intel.com/docs/DOC-3399

Launching the SCCM OOB Management Console with VBScript

daniel.w.brunton@intel.com — Thu, 25 Jun 2009 15:37:56 GMT

The SCCM Out-of-Band (OOB) Management Console is a stand-alone executable that is typically launched from within the SCCM console application itself. There may be cases where different groups in an IT department will want to make use of the OOB access to clients, but should not have access to the other features of SCCM in order to maintain proper separation of duties and best known security practices. It is possible to use existing technologies to launch the OOB Management Console outside of the SCCM console application itself. This package contains documentation that explains the required SCCM security configuration and includes and example VBScript. You can download the package here:

http://communities.intel.com/docs/DOC-3398