Microsoft Manageability

Intel WS-MAN Translator Build 568 released... SCCM SP2 Ready!

matthew.i.royer@intel.com — Tue, 06 Oct 2009 15:15:29 GMT

The Intel WS-MAN Translator build 568 has just been released. The new features of this build included:

Validated with Microsoft System Center Configuration Manager 2007 Service Pack 2
Enhances legacy support for wireless profiles, 8021.x profiles, and 3rd party data storage
Enhanced Kerberos authentication and Kerberos ticket handling

There are known issues and feature gaps with the previous versions (builds less than 568) of the Intel WS-MAN and Microsoft SCCM SP2. It is recommended that customers upgraded to Intel WS-MAN Translator build 568 when upgrading to SCCM SP2. SCCM SP1 customers will also see stability and performance increases by upgrading to this WS-MAN Translator build.

--Matt Royer

Updated version of the SCS to SCCM Migration Utility Available

matthew.i.royer@intel.com — Wed, 23 Sep 2009 18:37:11 GMT

An updated version of the SCS to SCCM migration utility has just been released. For those customers that were previously activated on the SMS Add-on and the Intel SCS, this utility will help ease your migration to SCCM SP1 or the upcoming SCCM SP2. This new version has been tested and validated to support up to SCS 5.x and SCCM SP2.

The SCS to SCCM migration utility is used to prepare Intel® Active Management Technology (Intel® AMT) systems, that were configured using the Intel® Setup and Configuration Service (Intel® SCS) and managed by any management console, to be configured and managed by Microsoft* System Center Configuration Manager (SCCM).

The migration utility is an executable (SCS_2_SCCM_Migration_Utility.exe) that performs the following:

Creates a Comma Separated Values (CSV) file containing information on all Intel AMT systems configured by the Intel SCS that are to be migrated. This CSV file includes the data about these systems that is needed by SCCM and is imported to SCCM before the actual migration.
Performs a series of tasks (including partial unconfiguration) that bring the Intel AMT systems to a state that will enable the SCCM to configure them.
Removes the records of the migrated Intel AMT system from the SCS database.

Once the Intel AMT systems are unconfigured they will send out “Hello” messages to SCCM, which will then configure the systems.

The SCS to SCCM migration Utility can be downloaded from the following location: http://software.intel.com/en-us/articles/intel-amt-setup-and-configuration-service-scs-to-microsoft-system-center-configuration-manager-sccm-system-migration/

--Matt Royer

SCCM Agent initiated provisioning of AMT / vPro clients with firmware 2.x

matthew.i.royer@intel.com — Wed, 19 Aug 2009 23:28:40 GMT

Microsoft System Center Configuration Manager can provision an AMT / vPro client in two different capacities: Bare metal and Agent Initiated. Bare metal provisioning begins with the AMT client sending a “hello packet” to the SCCM Out of Band Service Point; if the AMT client is approved and authorized to be provisioned, SCCM will initiated the provisioning process. Agent Initiated provisioning begins with the SCCM Client Agent pulling down the “Automatic Provisioning” policy from the SCCM Policy Server; if the SCCM Client Agent receives the policy, the Agent will negotiated a One Time password (OTP) with the AMT ME firmware and send the provisioning request along with the OTP to the Out of Band Service point to begin the provisioning process.

Bare Metal / Hello Packet Initiated Provisioning
For Bare Metal provisioning to work properly on AMT / vPro Clients with firmware 2.x, there are a couple of prerequisites that must be met.

SCCM Server

SCCM SP1 with Rollup Hotfix KB960804 or higher (full list of required hotfixes found here: http://communities.intel.com/docs/DOC-1897Required Software Bundles and HotFixes (KB’s) for System Center Configuration Manager SP1
Intel WS-MAN Translator installed and configured (Download available from here: http://software.intel.com/en-us/articles/intel-ws-management-translator/ )
SCCM configured for Out of Band Management (SCCM Quick Start Guide: http://communities.intel.com/docs/DOC-1754)

AMT Client

AMT Firmware version that support PKI provisioning with SCCM. For AMT 2.x Desktops and Laptops, you will want to ensure that you have a minimum of AMT Firmware 2.2.20 (Desktop) and 2.2.20 (Laptop). Note: For AMT Desktops with firmware 3.x, you will want to ensure that you have firmware 3.2.2 or above to meet the minimal requirements. AMT Laptops with firmware 4.x and Desktops with firmware 5.x have the minimum requirements meet from the initial firmware release.

SCCM Client Agent Initiated Provisioning
In addition to the prerequisites needed for Bare Metal provisioning, SCCM Agent initiated provisioning requires a couple additional items.

AMT Client

AMT ME / HECI Driver installed (available from your OEM driver website)
Execution of RNGSeedCreator.exe (Download available from here: http://communities.intel.com/docs/DOC-3807). RNGSeedCreator.exe is an executable that is ran on an AMT / vPro client with firmware version 2.x that has never been configured or provisioned; this utility generates a random number for the firmware to support the OTP used during the SCCM Agent Initiated Provisioning process. For SCCM PKI provisioning to complete successfully, the random number generated by RNGSeedCreator.exe must be completed prior to initiating provisioning via the SCCM Client Agent.Note: AMT / vPro clients with firmware version 3.x and higher do not need to have the RNGSeedCreator.exe ran prior to SCCM Agent Initiated provisioning.

If your AMT clients do not meet the minimal firmware version for PKI based provisioning (Bare Metal or Agent Initiated), you can use the software distribution capabilities within SCCM to remotely upgrade the AMT firmware and drivers; check out the following Blog / Video which walks you through creating this software package. Similar to upgrading the AMT firmware with SCCM Software distribution, you can also use the same Software Distribution process to run the RNGSeedCreator.exe utility on your 2.2 (Desktop) and 2.6 clients. If you wish to combine the firmware upgrade and RNGSeedCreator.exe execution into a single SCCM advertisement, you can construct a single task sequence that runs both the Firmware upgrade and RNGSeedCreator.exe software packages. A guide on how to accomplish this has been included in the RNGSeedCreator download package.

Once the firmware has been upgraded to the minimal firmware version to support PKI provisioning and the RNGSeedCreator.exe has been run, SCCM Agent Initiated provision can complete successfully on 2.2 and 2.6 clients.

--Matt Royer

MSFT updates to help with SCCM SP1 Troubleshooting

matthew.i.royer@intel.com — Mon, 17 Aug 2009 15:37:19 GMT

Microsoft has recently updated the Configuration Manager Documentation Library for out of band management for SP2, including revisions to troubleshooting issues. Some of these revisions are also applicable to Configuration Manager 2007 SP1, but they can't publish them with their monthly updates because of the new SP2 content. Rather than waiting until SP2 is released, they have included the revisions here that affect existing customers using out of band management in Configuration Manager 2007 SP1.

http://blogs.technet.com/configmgrteam/archive/2009/08/13/updated-troubleshooting-information-for-out-of-band-management-sp1.aspx

--Matt Royer

Security Best Practices for Out of Band Management in Configuration Manager 2007 SP1

matthew.i.royer@intel.com — Fri, 07 Aug 2009 03:45:02 GMT

Microsoft has released a really great blog on the “Security Best Practices for Out of Band Management in Configuration Manager 2007 SP1”. The following topics are covered in great detailed and is a definite read. http://blogs.technet.com/configmgrteam/archive/2009/08/05/updated-security-best-practices-for-out-of-band-management-in-service-pack-1.aspx

Request customized firmware before purchasing AMT-based computers
Use in-band provisioning instead of out of band provisioning
Manually revoke certificates and delete Active Directory accounts for AMT-based computers that are blocked by a Configuration Manager 2007 SP1 site
Control the request and installation of the provisioning certificate
Ensure that you request a new provisioning certificate before the existing certificate expires
If the provisioning certificate is revoked, delete it from the certificate store on the out of band service point site system server, and remove it from the out of band management component configuration properties
If you must revoke a provisioning certificate supplied by an internal CA, revoke the certificate in the Certification Authority console
Use a dedicated certificate template for provisioning AMT-based computers
Use out of band management instead of Wake On LAN
Use a dedicated OU to publish AMT-based computers
Use Group Policy to Restrict User Rights for the AMT Accounts
Use a dedicated collection for in-band provisioning
Restrict who has the Media Redirection right and the PT Administration right
Retrieve and store image files securely when booting from alternative media to use the IDE redirection function
Minimize the number of AMT Provisioning and Discovery Accounts

--Matt Royer

Intel vPro Wake On Advertisement and BIOS Upgrade

william.york@intel.com — Fri, 31 Jul 2009 18:40:45 GMT

Here is a demonstration I created on how to setup a SCCM advertisement to remotely and securely wake-up (boot) Intel vPro systems and push an automated BIOS upgrade. I wanted to show a useful and real-world Intel vPro Use Case that you can use today. If there are other Use Cases you would like to see, please post your comments and I will get more of these types of videos posted.

Thanks,

Bill

Interoperating between Microsoft SCCM and the Intel Manageability Tool Kit

matthew.i.royer@intel.com — Tue, 13 Jan 2009 03:17:31 GMT

If you want to have the Intel Manageability Tool Kit interoperate with a vPro client that has been provisioned by Microsoft System Center Configuration Manager SP1, there are two key things you need to do: Configure Manageability Commander to trust the Issuing Certificate Authority of AMT Web Certificates and to authenticate with a Kerberos user that has access to the vPro Client.

Before configuring Manageability Commander, you will need to obtain a copy of the Root Certificate Authority Certificate that the vPro Client AMT Web Server Certificate was issued from. This is the same Certificate Authority that was configured in “Microsoft System Center Configuration Manager Console” -> “Out of Band Component Configuration” -> "Site Database" -> "Site Management" -> "Site" -> "Site Settings" -> "Component Configuration" -> "Out of Band Management" -> "General Tab" -> "Certificate Template".

If you are issuing AMT Web Server Certificates from a subordinate certificate authority, you should still use the certificate from the Root Certificate Authority the SubCA is chained up to.

Export a copy of the Root CA

1) To export of a copy of the Root CA Certificate, you can open your local certificate store, select “Trusted Root Certificate” -> “Certificate” and search for the proper Root CA Certificate. If you do not have the Root CA certificate in your trusted root store, your CA Administrator can obtain a copy for you from the CA by selecting the “Properties” of the Certificate Authority and selecting “View Certificate”.

2) Once you have the certificate open, select the “Detail” tab and then select “Copy to File”.

3) When the “Certificate Export Wizard” appears, click “Next”.

4) Select “DER encoded binary X.509(.CER)” and click “Next”.

5) Select a location to export the certificate to and then click “Next”.

6) On the “Complete the Certificate Export Wizard”, click ‘Finish”.

Trusting your Root Certificate Authority in Manageability Commander

Now that you have a copy of the Root CA certificate, you are able to configure Manageability Commander so that it can manage a vPro client provisioned by SCCM.

1) If you have not already done so, you can download a copy of the Manageability Tool Kit from the following location: http://software.intel.com/en-us/articles/download-the-latest-version-of-manageability-developer-tool-kit/. Follow the onscreen instructions on how to install it.

2) Once Manageability Tool Kit is install and Manageability Commander is open, select “File” -> “Certificate Manager”.

3) In the “Certificate Manager” window, ensure you delete all other existing certificates by highlighting them and clicking the “Delete” button. After which, select “Import”.

4) Browse for the Root Certificate Authority Certificate you exported (which is the Root CA Certificate that is chained up from your AMT Web Server certificates) and click “Open”.

5) Back in the “Certificate Manager” window, click the “Refresh Displayed Certificates” button. You should now see your CA in the “Trusted Root Certificates” list. Click “Close” to exit the Certificate Manager window.

Adding a Client to Manageability Commander

Once the Root CA certificate has been trusted, you can now add the client (that is provisioned by SCCM) you want to manage via Manageability Commander.

1) To add the vPro client, select “File” -> “Add” -> “Add Intel® AMT Computer”.

2) When the “Add Intel® AMT Computer” window appears, enter in the full qualified domain name (FQDN) of the client you want to manage. If you want Manageability Commander to use Kerberos authentication of the local user logged, leave the Username and Password blank. If you want to specify a different Kerberos user then the local logged on user, enter in the desired Kerberos user as domain\user and the appropriate password. Click “OK” to close the “Add Intel® AMT Computer” window.

3) Once you have added the vPro client, you should see it in the list of clients to manage. Right click on the client, and select “Connect”.

4) Once connected, you can invoke any of the vPro / AMT use cases that the Manageability Commander Tool supports on the client provisioned and also managed by SCCM.

Debugging Connection

If you are having connection issue, you can perform some general troubleshoot by viewing the debug information.

1) To view the debug information, select “Help” -> “Show Debug Information...”

2) Once the “Manageability stack” window opens, you can see additional detail of any issues encountered.

--Matt Royer

SCCM SP1 hotfix KB957469 released - AMT 4 / 5 Power Control

matthew.i.royer@intel.com — Thu, 06 Nov 2008 22:10:05 GMT

Microsoft has just released a hotfix to address AMT 4 / AMT 5 power control within System Center Configuration Manager 2007 Service Pack 1.

System Center Configuration Manager 2007 (KB957469):

Description: The Out of Band Power control function does not work for clients that have the Intel AMT 4 or Intel AMT 5 chipset in System Center Configuration Manager 2007 Service Pack 1
http://support.microsoft.com/kb/957469

Please reference the following WIKI for a comprehensive list of required software bundles and hotfixes for SCCM SP1 and vPro/AMT Out of Band Management: http://communities.intel.com/openport/docs/DOC-1897

--Matt Royer

Microsoft SCCM 2007 SP1 Intel vPro Training Videos Now Available

jeremy.s.nicholes@intel.com — Fri, 24 Oct 2008 21:13:01 GMT

Microsoft SCCM 2007 SP1 Intel vPro Training Videos

We’re pleased to announce the availability of Microsoft SCCM 2007 SP1 Intel vPro Training videos. During a recent training event in Redmond, Washington, we had the cameras rolling for this detailed and robust training experience and it is now available for you to experience and utilize.

Below is an overview and link for each training section.

		Introduction Technical overview of Microsoft System Center Configuration Manager 2007 SP1 support of Intel vPro technology with specific focus on supported use cases, provisioning process and infrastructure prerequisites for Intel vPro Out of Band Management.

		Lab Module One Configuration steps of Active Directory and PKI infrastructure to support Intel vPro Out of Band Management within Microsoft System Center Configuration Manager 2007 SP1.

		Lab Module Two Steps for Microsoft System Center Configuration Manager 2007 SP1 OOB Service Point installation, OOB Component Configuration and Network Discovery for Management Controllers.

		Lab Module Three Steps for creating a collection for housing Intel vPro clients and configuring that collection for automatic provisioning of the Out of Band Management Controllers.

		Lab Module Four Installation overview for the Microsoft System Center Configuration Manager 2007 SP1 client agent and initiation of Intel vPro client provisioning.

		Lab Module Five Technical overview of the Out of Band Management Console, Intel vPro Management Engine Interface and Intel AMT power control via Advertisements.

		Lab Module Six Configuration steps of the Intel WS-MAN Translator to support legacy Intel vPro clients (Intel AMT firmware versions less than 3.2.1).

		Lab Module Seven Provisioning legacy Intel vPro clients (Intel AMT firmware versions less than 3.2.1) through the Intel WS-MAN Translator using PSK provisioning.

		Lab Module Eight Overview of the Intel vPro migration process from the Intel SCS / Microsoft SMS 2003 Add-on to Microsoft System Center Configuration Manager 2007 SP1.

Please let us know if you have questions or comments regarding this material.

This resource along with other resources on the Intel vPro Expert Center can assist you in answering questions when deploying Intel vPro clients in conjunction with Microsoft System Center Configuration Manager 2007 SP1.

Intel WS-MAN Translator 1.1 (build 552) released

matthew.i.royer@intel.com — Thu, 16 Oct 2008 22:17:02 GMT

An updated version (release 1.1 - build 552) of the Intel WS-MAN Translator has just been released. Updated features include:

Provides support for running on 64-bit systems
Provides additional translation services for legacy systems such as wireless profiles, and 802.1x.
You can upgrade from existing builds by using this VB Script or it can be installed on its own.

To download the latest version, please visit: http://software.intel.com/en-us/articles/intel-ws-management-translator

Upgrading from Intel WS-MAN Translator 1.0 to Intel WS-MAN Translator 1.1 (Build 552)

To upgrade a previous version of the Intel WS-Man Translator to a newer version, download the Update Translator VBScript and run it in the same folder that the latest Translator MSI is located. This will upgrade your WS-MAN Translator version and keep your previous configuration setting.

Fresh install of the Intel WS-MAN Translator

Generate a Certificate Request on SCCM Server for Intel WS-MAN Translator

On the SCCM Server, go to Start > All Programs > Administrative Tools > Internet Information Services (IIS)
Expand Web Sites and Right Click on Default Web Site and select Properties
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1723/GenerateCert1.JPG!*
In the Default Web Site Properties windows Select the Directory Security Tab. In the Secure Communications section, click the Server Certificate button
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1724/GenerateCert2.JPG!
This will launch the Web Server Certificate Wizard. Click Next
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1725/GenerateCert3.JPG!*
In the IIS Certificate Wizard Window, select Create a new certificate . Click Next
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1726/GenerateCert4.JPG!*
Select Send the request immediately to an online certification authority. Click Next
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1727/GenerateCert5.JPG!
Enter a Name for the certificate: WS-MAN Translator Server Certificate. Click Next
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1728/GenerateCert6.JPG!
Enter Organization Information (Organization and Organizational Unit) and Click Next
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1729/GenerateCert7.JPG!*
Enter the Common name: This is the FQDN of your server you are installing the Intel WS-MAN Translator on and should be the same as the FQDN of your SCCM Server. Click Next
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1730/GenerateCert8.JPG!
Enter in your Geographical Information. Click Next
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1731/GenerateCert9.JPG!
Enter 443 for the SSL Port for this web site. Click Next
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1732/GenerateCert10.JPG!
In the Choose a Certification Authority Window, select your issuing Certificate Authority. Click Next
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1733/GenerateCert11.JPG!*
Confirm your request and click Next
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1734/GenerateCert12.JPG!
Once Wizard is complete, click Finished
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1735/GenerateCert13.JPG!*

Set Delegation for the SCCM Server

On your Domain Infrastructure Image, Click Start > All Programs > Administrator Tools > Active Directory Users and Computers > vprodemo.com > Computers. Right Click on SCCM Server and select Properties.
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/38-11434-1782/Computer.JPG!
Check the box Trust Computer for Delegation and click OK
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/38-11434-1781/delegation.JPG!*
Note: If you do not allow this, you will need to setup the WS-MAN Translator (during configuration steps) run time account with a user that has permission to the AMT client. At that point the credentials configured in the run time account are used to manage the client for Kerberos authentication.

Installing the Intel WS-MAN Translator

On the SCCM Server, run the Intel WS-MAN Translator Setup
In the Intel WS-Management Translator setup window, click Next
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1736/Install1.JPG!*
In the Intel WS-Management Translator setup window, click Next
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1737/Install2.JPG!*
During the installation, keep all of the Default settings until installation wizard is complete and install has finished.
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1738/Install3.JPG!
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1740/Install5.JPG!

Configuring the Intel WS-MAN Translator

Click Start > All Programs > Intel WS-Management Translator > wtranscfg.exe to configure the Translator
In the WS-Translator Configuration Wizard Window, Set common setup accounts, Set TLS/forwarding options, & Set WinRM Options. Click Next
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/38-11641-1935/config1.JPG!*
In the Set initial setup password window, enter the password you configured within SCCM Out of Band Management Properties > Provisioning setting Section > MEBx Account. Click Next
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1719/ConfigTrans2.JPG!*
In the Set Common Pre-Shared Key window, should select a more random and secure PID and PPS for security reasons. Click Next.
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1720/ConfigTrans3.JPG!
In the Import Common Setup Certificate, Click Browse and select the Same Certificate you used in SCCM Out of Band Management Properties > Certificates Section > Provisioning Certificate. Click Next.
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1721/ConfigTrans4.JPG!
In the Select TLS/forwarding options windows, select (default Options): Listening Port: 443 & Forwarding Port: 16993. For the Server Certificate: select the WS-Man Translator certificate created in previous step.
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1722/ConfigTrans5.JPG!
Select Allow Basic Authoziation and Click Finished. Click OK to Restart the Translator Service.
!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/38-11641-1936/config2.JPG!

Configuring SCCM SP1 to use the Intel WS-MAN Translator

Within System Center Configuration Manager Out of Band Management Properties > Provisioning setting Section > AMT Settings. Check the option for Enable support for Intel WS-MAN Translator. Once selected, click Apply.
*!http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/1717/ConfigSCCM1.JPG!*

--Matt Royer

OOB Q&A from Microsoft Technet

josh.hilliker@intel.com — Wed, 08 Oct 2008 05:25:10 GMT

this weekend I received a link that had a pretty good Q&A from Microsoft about OOB (out of band management). I found it a good resource to answering typical questions that are brought up during a Pilot of the technology.

http://blogs.technet.com/wemd_ua_-_sms_writing_team/archive/2008/10/03/overflow-additional-quiz-questions-for-out-of-band-management-amt.aspx

Enjoy the Q&A. Thank you Sergio for forwarding it..

Great source for vPro and System Center Configuration Manager information: Microsoft’s SMS Writing team blog

matthew.i.royer@intel.com — Fri, 03 Oct 2008 16:36:11 GMT

For those that are not aware, our friends at Microsoft maintain a great blog on System Center Configuration Manager. The blog is used by the SMS Writing team to keep you informed about the content they are writing, the availability of new documents, updates to documents, and other news. The blog is also intended to collect feedback from you, their customers, about existing content and what you'd like to see in the future.

If you haven't already subscribed to the feed, I would highly recommend it. http://blogs.technet.com/wemd_ua_-_sms_writing_team/

This week they have a great article on "[Quiz Questions for Out of Band Management (AMT)|http://blogs.technet.com/wemd_ua_-_sms_writing_team/archive/2008/10/03/overflow-additional-quiz-questions-for-out-of-band-management-amt.aspx]"; take a couple minutes and check it out.

--Matt Royer

Using WMI to force the SCCM Agent to check for its AMT Auto Provisioning Policy

william.york@intel.com — Wed, 01 Oct 2008 05:16:53 GMT

While working on-site with a customer and a Microsoft SCCM Technical Consultant, I was shown a great capability in the OS to force the SCCM client agent to check its AMT auto-provisioning policy at will.

The Windows OS ships with a utility called Windows Management Instrumentation Tester that can be used to force the SCCM agent to check its AMT Auto-Provisioning Policy (standard WMI calls). The following steps show this manual method that you can perform with this utility, either locally or remotely, to force this check. By default the SCCM server's site control file sets the agent check to automatically run every 24 hours. However, in a lab or testing environments this 24 hour default cycle is not convenient. With these steps below, you can execute this check at will or even use while troubleshooting issues. To perform these steps, you must have administrative privileges on the target OS.

After the manual steps listed below, Matt Royer has provided a reference to a .vbs file that performs these steps to help automate the process. Feel free to use these steps and scripts for your environment. And if you find new and/or improved methods with these WMI calls, please post for others to learn from.

Manual Steps to issue WMI command:

Open a command prompt and type wbemtest

This is the Windows Management Instrumentation Tester

After the Windows Management Instrumentation Tester Utility Opens, click Connect

In the Namespace of the Connect Window, type the system name you want to force the check followed by \root\ccm

Example: **
Click Connect
You can also simply run the command on the local system by simply leaving out the host name
Example: \root\ccm

After you successfully connect to the target system, click the Execute Method Button

In the Get Object Path window, type sms_client in the Object Path field

Click OK

In the Execute Method Window, enter TriggerSchedule in the Method Field

Click the Edit In Parameters Button

In the Object editor for _PARAMETERS window, Double Click the sScheduleID in the Properties field

In the Property Editor Window, change the Value to Not NULL and add the following {00000000-0000-0000-0000-000000000120}

This value is the Object ID to initiate this OOB auto-provisioning check.
Click the Save Property button

In the Object editor for _Parameters window, click the Save Object button

In the Execute Method window, click the Execute Button

After you Execute the method, you should see a message that the Method was executed successfully

To confirm that your method was executed, look at the target systems c:\windows\system32\CCM\Logs\oobmgt.log

You should now see a new entry in the log GetProvisioningSetting indicating that the policy has been re-evaluated.

To perform these steps automatically through a .vbs script:

All you need to do is run the following command:

cscript sendsched.vbs {00000000-0000-0000-0000-000000000120} <target vpro machine name with sccm client>

sendsched.vbs is piece of code included in the SMS 2003 Toolkit: http://technet.microsoft.com/en-us/sms/bb676787.aspx

00000000-0000-0000-0000-0000 00000120 is the scheduled ID for auto-provisioning policy.

vPro Machines stuck in "Detected" State?

josh.hilliker@intel.com — Wed, 17 Sep 2008 17:00:25 GMT

If you are using SCCM SP1 with AMT 3.2.1 machines (ex: HP7800P) and you see the following error.. this post is for you.

Here is what MEinfo read back during this state of detection

If you do, no need to be frustrated, just need to run a couple of steps to get back on the road. You can utilize Matt Royer's blog at Intel AMT 3.2.1 Self-signed certificate issue and working around it for Microsoft System Configuration Manager SP1

For me I had to give it a go myself, so Nick & I did the following:

secured our SCCM environment
borrowed 2 new HP boxes in the box
downloaded the vbscript file, wsman translator.

After 3 trial runs at it, we captured the video today and here it is. Here are the top things I wish I knew prior to installing:

#1. OOB settings is under component configuration (Under site settings) in SCCM

#2. Having your cert (*.pfx) file downloaded and handy is important (and it's in the dictionary)

#3. Make sure you run the following: winrm set winrm/config/client/auth @{Basic="true"} on the console your running the box on

#4. Be patient - this was the single hardest thing during this process for me..

Here's the video.

My recommendation, if your stuck in this state on your machines, follow Matt's blog, check out my video and then ask if any questions..

SCCM SP1 hotfixes KB955355 & KB956337 released

matthew.i.royer@intel.com — Wed, 27 Aug 2008 18:46:13 GMT

Microsoft has just released two additional hotfixes that address issues with System Center Configuration Manager SP1 and vPro/AMT Out of Band Management. Please reference the following WIKI for a comprehensive list of required software bundles and hotfixes for SCCM SP1 and vPro/AMT Out of Band Management: http://communities.intel.com/openport/docs/DOC-1897

System Center Configuration Manager 2007 (KB955355):

Description: A distinguished name that contains more than 100 characters and that is discovered from Active Directory for an AMT host causes the SMS_EXECUTIVE service to crash in System Center Configuration Manager 2007
URL: http://support.microsoft.com/kb/955355

System Center Configuration Manager 2007 (KB956337):

Description: System Center Configuration Manager 2007 Service Pack 1 is unable to remove AMT user ACLs during the provisioning process for AMT 2.x computers
URL: http://support.microsoft.com/KB/956337

--Matt Royer