Microsoft Manageability

Microsoft System Center Configuration Manager SP2 Wireless Support Overview

daniel.w.brunton@intel.com — Tue, 17 Nov 2009 17:38:11 GMT

One of the new additions to Config Manager SP2 is native support of wireless access for managing clients with AMT. Microsoft has built in support for configuring enterprise level wireless profiles such as WPA2-Enterprise. These are wireless profiles that support RADIUS authentication using an authentication server to decide whether or not a given client is allowed to access the network. Config Manager SP2 does not support wireless profiles that use pre-shared keys (PSK). If you use security standards like WPA2-PSK/WPA2-Personal in your environment you will need to use the scripting framework tool to generate a script that can configure this option outside of Config Manager.

Mohan Veeramachaneni has put together several guides that explain how to configure the back-end RADIUS authentication components and access point configuration.

Cisco ACS

Configure Cisco ACS Server for Navigating Secure Networks with AMT/vPro

Microsoft NPS

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 1

Simple Configuration of Microsoft NPS as Radius for 802.1X - Part 2

Microsoft IAS

Step-by-step Guide for Navigating Secure Networks (802.1x) with Intel® AMT™ using Microsoft® SCCM SP1 & Microsoft® Radius (IAS)

Matt Royer has a blog entry that covers wireless profile management in Config Manager SP2. The process he outlines is still the same in the release version of SP2.

http://communities.intel.com/community/openportit/vproexpert/microsoft-vpro/blog/2009/06/05/a-closer-look-at-sccm-sp2-beta-oob-wireless-management-wireless-profile-management

Key things to remember about wireless management with Config Manager

Config Manager will not update a wireless profile that is currently in use.
Config Manager now uses DNS entries to resolve client names. You may run into a case where a client has switched between a wired or wireless connection and AMT is temporarily inaccessible due to delays in DNS update propagation. DNS caching on your Config Manager server can also cause this to occur. You can try running the “ipconfig /flushdns” command from a command prompt to clear the local DNS cache on your Config Manager server.
Launching a Serial-over-LAN session over a wireless connection while the client’s OS is using that same connection will cause the wireless network to be cut off to the OS.

Microsft System Center Configuration Manager SP2 Released! New vPro Use Cases included!

matthew.i.royer@intel.com — Thu, 22 Oct 2009 15:52:12 GMT

Microsoft has just released System Center Configuration Manager Service Pack 2. In addition to providing feature parity with SP1 and AMT firmware versions 3.2.1, 4.0 and 5.0, the following new features are supported:

Wireless management with up to 8 wireless profiles
End point access control: 802.1x support
Audit logging
Support for different power states
Power control options at the collection level
Data storage
Scheduling configuration for in-band provisioning

You can download it from the following location:http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=3318741a-c038-4ab1-852a-e9c13f8a8140#tm

--Matt Royer

Intel WS-MAN Translator Build 568 released... SCCM SP2 Ready!

matthew.i.royer@intel.com — Tue, 06 Oct 2009 15:15:29 GMT

The Intel WS-MAN Translator build 568 has just been released. The new features of this build included:

Validated with Microsoft System Center Configuration Manager 2007 Service Pack 2
Enhances legacy support for wireless profiles, 8021.x profiles, and 3rd party data storage
Enhanced Kerberos authentication and Kerberos ticket handling

There are known issues and feature gaps with the previous versions (builds less than 568) of the Intel WS-MAN and Microsoft SCCM SP2. It is recommended that customers upgraded to Intel WS-MAN Translator build 568 when upgrading to SCCM SP2. SCCM SP1 customers will also see stability and performance increases by upgrading to this WS-MAN Translator build.

--Matt Royer

A closer look at SCCM SP2: The more subtle changes with SCCM SP2

matthew.i.royer@intel.com — Sat, 19 Sep 2009 18:33:08 GMT

This information is based on Microsoft’s Release Candidate of System Center Configuration Manager Service Pack 2 and is subject to change.

There are several new features / changes that are coming with ConfigMgr SP2 related to AMT / vPro functionality. As noted in previous articles, some of the more obvious changes are:

OOB Wireless Management: Wireless Profile Management

Provide configuration of up to eight (8) wireless profiles per site that are available to AMT clients assigned to that site
Set the wireless information during AMT provisioning and configure all required profile settings (SSID, key management, encryption, etc.
Send wireless profile operations to the Intel translator on AMT systems with revisions earlier than 3.2.

End Point Access Control: 802.1x support

Provision 802.1x settings on AMT wireless clients during AMT provisioning
Send 802.1x settings operations to the Intel translator on AMT systems with revisions earlier than 3.2.1

Data Store (3PDS)

Write string data into 3PDS on AMT through OOB management console

Access Monitor: Audit Log

Enable or Disable Audit Log (no critical event settings)
View Audit Log through OOB Console

Remote Power Management

Power State Configuration

However, Microsoft has also made some more subtle changes between SCCM SP1 and SP2 to improve the end user experience that you may have not notice.

In-band Provisioning attempt schedule: With SCCM SP1, in-band provisioning was hard coded to initiate once every 24 hours. SCCM SP2 now supports the ability to set the provisioning attempt schedule to a configurable value within the Out of Band Management Properties - Provisioning Schedule Tab.
Handling wired and wireless contented clients with in-band provisioning: To provision an AMT / vPro client with SCCM 2007, first stage provisioning must be completed on the wired interface. With SCCM 2007 SP2, the wired interface information will be sent along with the AMT One Time Password (OTP) during agent initiated in-band provisioning. Second stage provisioning can then occur over either wireless or wired interface (which one is resolved by DNS).
Out of Band Provisioning disabled by default: The ability to use Out of Band provisioning (provisioning through AMT hello packet initiation) is configurable and defaulted to disabled with SCCM 2007 SP2. If you are using Out of Band provisioning, you will need to enable it after upgrading from SCCM SP1 to SCCM SP2. This is configured on the Out of Band Management Properties - General Tab.
Opening the Out of Band Console ensures an updated Kerberos token: With SCCM SP1, occasionally you would run into a scenario where the Out of Band Management Console would attempt to connect with an expired or involved Kerberos token; this would prevent OOB Console from properly authenticating with the AMT / vPro Client. This was common if you tried to connect to an AMT / vPro client immediately after an AMT client reprovision. The Out of Band Management Console with SCCM SP2 now refreshes the Kerberos token to ensure a proper connection.
AMT / vPro client provisioning prevented if Configuration Manager Client is blocked or not approved: If an SCCM client is block or not approved within with the site server, SCCM will not allow you provision an AMT / vPro client.
AMT PKI Certificates are revoked during an Update Management Controller: If you have wired or wireless 802.1x authentications being used, SCCM will revoke these certificates and new certificate will be requested & issued. As a clarifying note, the AMT TLS certificate used to secure the manageability traffic will not be revoked during this process.
Power control available for collection execution: SCCM SP2 now allows the execution of an AMT power control on an entire collection just by right clicking on the collection and selecting Out of Band Management -> Power Control. Previously with SCCM SP1, you were required to multi-select all the clients in that collection to perform the same function.
Serial over LAN (SOL) requires manual initiation with the Out of Band Management Console: With SCCM SP1, when you opened the Out of Band Management Console, the SOL session was automatically started. In SCCM SP2, you are now required to open and close the Serial over LAN connection via a new button or with the new Tools menu option.
IDE-Redirect Log renamed: What was previous known as the System Audit Log in SCCM SP1 within the Out of Band Management Console has been renamed to IDE-Redirect Log. This was done to allow the AMT Audit Log to assuming that name.
Working with AMT Data Storage: Within SCCM SP2, you are now able to interact with the AMT / vPro 3rd Party Data Store through the new button added in Out of Band Management Console labeled Data Storage. Note that the data storage is limited to ASCII characters and length of 4096 bytes.

--Matt Royer

SCCM Agent initiated provisioning of AMT / vPro clients with firmware 2.x

matthew.i.royer@intel.com — Wed, 19 Aug 2009 23:28:40 GMT

Microsoft System Center Configuration Manager can provision an AMT / vPro client in two different capacities: Bare metal and Agent Initiated. Bare metal provisioning begins with the AMT client sending a “hello packet” to the SCCM Out of Band Service Point; if the AMT client is approved and authorized to be provisioned, SCCM will initiated the provisioning process. Agent Initiated provisioning begins with the SCCM Client Agent pulling down the “Automatic Provisioning” policy from the SCCM Policy Server; if the SCCM Client Agent receives the policy, the Agent will negotiated a One Time password (OTP) with the AMT ME firmware and send the provisioning request along with the OTP to the Out of Band Service point to begin the provisioning process.

Bare Metal / Hello Packet Initiated Provisioning
For Bare Metal provisioning to work properly on AMT / vPro Clients with firmware 2.x, there are a couple of prerequisites that must be met.

SCCM Server

SCCM SP1 with Rollup Hotfix KB960804 or higher (full list of required hotfixes found here: http://communities.intel.com/docs/DOC-1897Required Software Bundles and HotFixes (KB’s) for System Center Configuration Manager SP1
Intel WS-MAN Translator installed and configured (Download available from here: http://software.intel.com/en-us/articles/intel-ws-management-translator/ )
SCCM configured for Out of Band Management (SCCM Quick Start Guide: http://communities.intel.com/docs/DOC-1754)

AMT Client

AMT Firmware version that support PKI provisioning with SCCM. For AMT 2.x Desktops and Laptops, you will want to ensure that you have a minimum of AMT Firmware 2.2.20 (Desktop) and 2.2.20 (Laptop). Note: For AMT Desktops with firmware 3.x, you will want to ensure that you have firmware 3.2.2 or above to meet the minimal requirements. AMT Laptops with firmware 4.x and Desktops with firmware 5.x have the minimum requirements meet from the initial firmware release.

SCCM Client Agent Initiated Provisioning
In addition to the prerequisites needed for Bare Metal provisioning, SCCM Agent initiated provisioning requires a couple additional items.

AMT Client

AMT ME / HECI Driver installed (available from your OEM driver website)
Execution of RNGSeedCreator.exe (Download available from here: http://communities.intel.com/docs/DOC-3807). RNGSeedCreator.exe is an executable that is ran on an AMT / vPro client with firmware version 2.x that has never been configured or provisioned; this utility generates a random number for the firmware to support the OTP used during the SCCM Agent Initiated Provisioning process. For SCCM PKI provisioning to complete successfully, the random number generated by RNGSeedCreator.exe must be completed prior to initiating provisioning via the SCCM Client Agent.Note: AMT / vPro clients with firmware version 3.x and higher do not need to have the RNGSeedCreator.exe ran prior to SCCM Agent Initiated provisioning.

If your AMT clients do not meet the minimal firmware version for PKI based provisioning (Bare Metal or Agent Initiated), you can use the software distribution capabilities within SCCM to remotely upgrade the AMT firmware and drivers; check out the following Blog / Video which walks you through creating this software package. Similar to upgrading the AMT firmware with SCCM Software distribution, you can also use the same Software Distribution process to run the RNGSeedCreator.exe utility on your 2.2 (Desktop) and 2.6 clients. If you wish to combine the firmware upgrade and RNGSeedCreator.exe execution into a single SCCM advertisement, you can construct a single task sequence that runs both the Firmware upgrade and RNGSeedCreator.exe software packages. A guide on how to accomplish this has been included in the RNGSeedCreator download package.

Once the firmware has been upgraded to the minimal firmware version to support PKI provisioning and the RNGSeedCreator.exe has been run, SCCM Agent Initiated provision can complete successfully on 2.2 and 2.6 clients.

--Matt Royer

MSFT updates to help with SCCM SP1 Troubleshooting

matthew.i.royer@intel.com — Mon, 17 Aug 2009 15:37:19 GMT

Microsoft has recently updated the Configuration Manager Documentation Library for out of band management for SP2, including revisions to troubleshooting issues. Some of these revisions are also applicable to Configuration Manager 2007 SP1, but they can't publish them with their monthly updates because of the new SP2 content. Rather than waiting until SP2 is released, they have included the revisions here that affect existing customers using out of band management in Configuration Manager 2007 SP1.

http://blogs.technet.com/configmgrteam/archive/2009/08/13/updated-troubleshooting-information-for-out-of-band-management-sp1.aspx

--Matt Royer

Security Best Practices for Out of Band Management in Configuration Manager 2007 SP1

matthew.i.royer@intel.com — Fri, 07 Aug 2009 03:45:02 GMT

Microsoft has released a really great blog on the “Security Best Practices for Out of Band Management in Configuration Manager 2007 SP1”. The following topics are covered in great detailed and is a definite read. http://blogs.technet.com/configmgrteam/archive/2009/08/05/updated-security-best-practices-for-out-of-band-management-in-service-pack-1.aspx

Request customized firmware before purchasing AMT-based computers
Use in-band provisioning instead of out of band provisioning
Manually revoke certificates and delete Active Directory accounts for AMT-based computers that are blocked by a Configuration Manager 2007 SP1 site
Control the request and installation of the provisioning certificate
Ensure that you request a new provisioning certificate before the existing certificate expires
If the provisioning certificate is revoked, delete it from the certificate store on the out of band service point site system server, and remove it from the out of band management component configuration properties
If you must revoke a provisioning certificate supplied by an internal CA, revoke the certificate in the Certification Authority console
Use a dedicated certificate template for provisioning AMT-based computers
Use out of band management instead of Wake On LAN
Use a dedicated OU to publish AMT-based computers
Use Group Policy to Restrict User Rights for the AMT Accounts
Use a dedicated collection for in-band provisioning
Restrict who has the Media Redirection right and the PT Administration right
Retrieve and store image files securely when booting from alternative media to use the IDE redirection function
Minimize the number of AMT Provisioning and Discovery Accounts

--Matt Royer

Intel vPro Wake On Advertisement and BIOS Upgrade

william.york@intel.com — Fri, 31 Jul 2009 18:40:45 GMT

Here is a demonstration I created on how to setup a SCCM advertisement to remotely and securely wake-up (boot) Intel vPro systems and push an automated BIOS upgrade. I wanted to show a useful and real-world Intel vPro Use Case that you can use today. If there are other Use Cases you would like to see, please post your comments and I will get more of these types of videos posted.

Thanks,

Bill

SCCM Log Parser Script

daniel.w.brunton@intel.com — Thu, 25 Jun 2009 16:06:54 GMT

Reading through the wealth of information in SCCM logs can be a challenge, especially if you are provisioning a lot of systems at one time. I've put together a VBScript example to help make the job of debugging provisioning problems easier. This script will parse through the log file you specify and create a new log file containing entries relevant to the string you are searching for. The most common usage for this would be to look through the amtopmgr.log for all entries related to a specific computer name. This script will first go through the log and find all the thread values associated with the computer name, then, it will take any log entry with any of those thread values and place it in a new file and launch it in the SMS Trace (Trace32) application. The idea is that having all these entries, not just the lines with the computer name, will paint a more complete picture of what has gone on during the provisioning process and cut back on the time spent looking for relevant log entries by hand. Here's some information on how to run the script.

Required parameters:

/l: - The SCCM log file you want to parse, typically amtopmgr.log

/s: - The search string, often a computer name, you want to parse the logs for

Optional parameters:

/o: - The name of the parsed log file this script will produce.

If no name is specified, the file will be named:

<specified computer name>.log

Example: cscript sccmlogparse.vbs /l:amtopmgr.log /s:vProPC /o:parsedlog.log

You can download the script here:

http://communities.intel.com/docs/DOC-3400

Automatically Updating the Management Controller Configuration in SCCM Using a Script

daniel.w.brunton@intel.com — Thu, 25 Jun 2009 15:46:39 GMT

Whenever you make a change to your Out-of-Band configuration settings in SCCM you need to push that change out to your Intel® AMT clients. Normally you have to go through each of your collections that has AMT systems in it and tell SCCM to manually update the management controller configuration. It is possible to automate this process using a script that makes WMI calls to the SCCM server, requesting it update the management controllers in your clients. This can be scheduled as an advertisement to be run automatically. This package contains documentation that outlines the required security, creation of the update task and an example VBscript. You can download the package here:

http://communities.intel.com/docs/DOC-3399

Launching the SCCM OOB Management Console with VBScript

daniel.w.brunton@intel.com — Thu, 25 Jun 2009 15:37:56 GMT

The SCCM Out-of-Band (OOB) Management Console is a stand-alone executable that is typically launched from within the SCCM console application itself. There may be cases where different groups in an IT department will want to make use of the OOB access to clients, but should not have access to the other features of SCCM in order to maintain proper separation of duties and best known security practices. It is possible to use existing technologies to launch the OOB Management Console outside of the SCCM console application itself. This package contains documentation that explains the required SCCM security configuration and includes and example VBScript. You can download the package here:

http://communities.intel.com/docs/DOC-3398

Automated SCCM Bare-Metal Provisioning

daniel.w.brunton@intel.com — Thu, 25 Jun 2009 14:10:04 GMT

In order for Microsoft Systems Center Configuration Manager to provision a vPro system, via bare-metal provisioning, it needs to know its UUID (Also referred to as a GUID), MAC address, short name and FQDN. This information can be collected into a CSV file and imported into SCCM manually, or automatically by leveraging a script and WMI. This package will outline the security configuration and point you to resources you can use to create a script to automate this process. You can get a copy here:

Update 6/25/2009: An updated version of the script is available at the link below.

http://communities.intel.com/docs/DOC-3067

A closer look at SCCM SP2 Beta: Audit Log

matthew.i.royer@intel.com — Fri, 05 Jun 2009 23:33:01 GMT

This information is based on Microsoft’s beta release of System Center Configuration Manager Service Pack 2 and is subject to change.

Within the SCCM SP2 beta, Microsoft has included support for AMT Audit Log. Audit Log was introduced in AMT version 4 and provides a mechanism to captures the occurrence of significant AMT events and who performed those actions.

Before you begin, you must configure SCCM SP2 on which AMT Audit Log events it turns on. This can be done by selecting Out of Band Management properties under "Site Database" -> "Site Management" -> <Site Code> -> "Site Settings" -> "Component Configuration" -> “Audit Setting” Tab.

Unlike other AMT feature enablement with SCCM, Audit log is not enabled during Provisioning or through the Update Management Controller process; it must be performed as a post provisioning step. To enable the AMT Audit log, you must right click on the AMT client and select “Out of Band Management” -> “Enable Auditing and Apply Audit Log Settings”. You can also disable and clear the audit log from this menu as well.

Once enabled on the AMT Client, you can access the AMT Audit Log through the Out of Band Management Console available through right clicking on the AMT client and select “Out of Band Management” -> “Out of Band Management Console”.

--Matt Royer

A closer look at SCCM SP2 Beta: OOB Wireless Management / Wireless Profile Management

matthew.i.royer@intel.com — Fri, 05 Jun 2009 22:25:53 GMT

This information is based on Microsoft’s beta release of System Center Configuration Manager Service Pack 2 and is subject to change.

As noted in one of the previous posts, SCCM SP2 has extended support for AMT / vPro Wireless Out Of Band use cases. If we open Out of Band Management Component Configuration under "Site Database" -> "Site Management" -> <Site Code> -> "Site Settings" you will notice that there is a new tab for “802.1X & Wireless”.

When you click the new icon, you will be given the opportunity to create your AMT wireless profile.

There are a couple of interesting things to point out. First, SCCM SP2 supports AMT wireless security types of WPA-Enterprise and WPA2-Enterprise; WPA-Personal and WPA2-Personal are not supported

Second, the encryption method can be either TKIP or AES.

Third, you will notice that 802.1x authentication is required for the wireless connection supporting the Client Authentication methods of EAP-TLS, EAP-TTLS/MSCHAPv2, or PEAPV0/EAP-MSCHAPv2.

The 802.1x trusted root certificate can be loaded from either a file or pulled directly from your CA infrastructure.

The Radius Client Certificate (depending on the Authentication method chosen) will allow to you choose a desired certificate template from one of your Microsoft Enterprise Certificate Authorities.

Once the wireless settings have been configured in the Out of Band Management Component Configuration, the certificate request will be generated for the AMT client and the wireless settings will be pushed to the AMT client during the initial provisioning or when a “Update Management Controller” is performed on the client.

--Matt Royer

A glance at Microsoft SCCM SP2 Beta

matthew.i.royer@intel.com — Fri, 05 Jun 2009 18:27:03 GMT

Note: This information is based on Microsoft’s beta release of System Center Configuration Manager Service Pack 2 and is subject to change.

Besides extending ConfigMgr support for new Operating Systems (Windows 7, Windows Server 2008 R2, Windows Server 2008 SP2, Windows Vista Sp2) and Branch Cache (peer to peer content distribution), ConfigMgr SP2 significantly evolves their native support for AMT / vPro use cases and features. As noted in the SCCM SP2 release notes, extension of the Intel vPro Technology support expands into:

OOB Wireless Management / Wireless Profile Management

· Provide configuration of up to eight (8) wireless profiles per site that are available to AMT clients assigned to that site

· Set the wireless information during AMT provisioning and configure all required profile settings (SSID, key management, encryption, etc.)

· Send wireless profile operations to the Intel translator on AMT systems with revisions earlier than 3.2.1

End Point Access Control / 802.1x support

· Provision 802.1x settings on AMT wireless clients during AMT provisioning

· Send 802.1x settings operations to the Intel translator on AMT systems with revisions earlier than 3.2.1

Persistent Data Storage

· Non Volatile Memory or Third Party Data Store (3PDS)

· Write string data into 3PDS on AMT through OOB management console

Access Monitor: Audit Log

· Enable or Disable Audit Log (no critical event settings)

· View Audit Log through OOB Console

Remote Power Management: Power State Configuration

· Enable configuration of the power policy settings and include in provisioning settings when provisioning an AMT system

If you are interested in taking a closer look at the SCCM SP2 beta build, you can get access to the download by going to https://connect.microsoft.com and signing up for access.

--Matt Royer