Version 3.3 of the Intel Client Manageability Add-on has been released to bring more vPro manageability features to SMS. The following new features have been added:

• Scheduled power command operations on collections. (Note that scheduled power commands are not executed on subcollections.)

• Graceful shutdown (attempting to shut down a platform via its operating system) for Power Down operations on collections

• Changes in the way the Add-on interprets and applies IP site boundaries within SMS, including an optional registry switch. If the switch is set, if the platform's subnet does not appear in the SMS properties for the platform, the platform will be considered as being in the site boundaries. Note: There is no change in the way the Add-on interprets and applies Active Directory site boundaries.

Intel Client Manageability Add-on version 3.3 can be downloaded from the following location: http://downloadcenter.intel.com/Filter_Results.aspx?strOSs=All&strTypes=All&ProductID=2609&lang=eng&OSFullName=All%20Operating%20Systems :

--Matt Royer

Some enterprises may find that they want to take advantage of both Microsoft System Center Configuration Manager 2007 (SP1) and System Center Operation Manager 2007 in their environment. Each independently have the ability to provision and manage vPro clients (natively from SCCM and through the Intel SCOM MP for SCOM), but is there a way so that both can manage the same vPro clients? YES, there is!

The way it works is that SCCM owns the provisioning (setting up certification, ACL, base configuration) and then both SCCM and SCOM w/ Intel SCOM MP can invoke vPro Use Cases. To get SCCM and SCOM w/ Intel AMT Management Pack to work together with vPro, here are the high level steps:

1. If you have not already installed Microsoft SCCM SP1, Microsoft SCOM 2007, and the Intel SCOM MP, following the standard install documentation.

2. Create a domain account that the Intel SCOM MP Service will run under. Once created, ensure you set the Log-in Account for the Intel SCOM MP Service to run under that account.

3. Within SCCM under the Component Configuration -> AMT Settings -> AMT User Account Setting, add the domain account you created to run the Intel SCOM MP service under. Ensure you give that account sufficient access to perform the desired vPro function.

4. Within SCOM Intel Management Pack, navigate to the "Intel AMT Management Pack Settings". Under Security Settings, set Kerberos to be used and check the "TLS Enable" check box. Under the CA Certificate, ensure to specify the file location of an export of the Root CA cert (This should be the same CA that SCCM is using to issue AMT client certificates). Once complete, make sure you restart the Intel SCOM MP Service.

5. Now that base configuration is done, provision your vPro Client normally through SCCM. If you have already provisioned the vPro Client, ensure you "update management controller" so that new ACL is pushed to the vPro Clients. Once provisioned, you should be able to invoke vPro Use Case through SCCM Collection Based power control or the Out of Band Console without issue.

6. Within SCOM, configure the IP range that includes all vPro Clients to be monitored by the Intel SCOM Management Pack. After the vPro Clients are discovered, you should be able to invoke vPro Usage from within SCOM as well.

--Matt Royer

By default, the Intel WS-MAN Translator has logging turned off. To turn logging on, browse to "C:\Program Files\Intel Corporation\Intel WS-Management Translator\" directory and open "wstrans.exe.config" file with a text editor. Within the wstrans.exe.config file, browse to the the system.diagnostics section. You can change the values of the switches from "off" to "verbose".

<system.diagnostics>

<switches>

<add name="Intel.Wstrans" value="verbose" />
<add name="Intel.Wstrans.Eoi" value="verbose" />
<add name="Intel.Wstrans.WsMan" value="verbose" />

</switches>

</system.diagnostics>

After you make the changes, you will be required to restart the Intel WS-MAN translator service for the changes to take effect. After which, the Intel WS-MAN Translator will report actions and errors in the "C:\Program Files\Intel Corporation\Intel WS-Management Translator\wstrans.log".

The wstrans.log has been formatted to allow easy readablity via Microsoft SMS Trace utility which is included in the Microsoft System Center Configuration Manager 2007 Toolkit.

Matt Royer

The Intel WS-MAN translator is a crucial component for providing vPro legacy (less than firmware 3.2.1) support within Microsoft SCCM SP1. The beta of the WS-MAN Translator has been released and can be downloaded from the following location:[http://softwarecommunity.intel.com/articles/eng/3840.htm]

The installation and configuration of the WS-MAN Translator is a fairly straight forward process and can be broken up in three key steps: Configuring ISS Certificate, WS-MAN Install & Configuration, and Enabling support for Intel WS-MAN translator within SCCM.

High Level Installation steps & reference documentation:

• Configuring ISS Certificate

• WS-MAN Translator Install & Configuration

• Enabling support for Intel WS-MAN translator within SCCM SP1

For additional information on the WS-MAN Translator, please visit the FAQ

Note: The Intel WS-MAN Translator is current in Beta status and not considered a released product at this time.

Matt Royer

As noted in a previous blog, SCCM SP1 only natively supports vPro firmware version 3.2.1 and higher. For legacy (less than 3.2.1) vPro clients to be supported, SCCM SP1 depends on the WS-MAN Translator.

There has been an issue identified within SCCM SP1 (RTW version) Out of Band Console that does not route AMT management communication through the WS-MAN Translator for legacy systems. Microsoft is aware of the issue and will be releasing a SCCM SP1 HotFix (targeted for July’2008) to address the problem.

Provisioning and collection based (power control / WOL via AMT) are not impacted by this issues; vPro firmware version 3.2.1 and above are also not impacted.

Matt Royer

One of the great features of SCCM SP1 is the ability to provision vPro Clients through the SCCM SP1 client agent. This allows for vPro clients to be deployed in an unprovisioned state and then later provisioned via the client agent once the client agent has been deployed using in-band methodologies.

Prior to Client Agent provisioning to occurs, there are a couple of configuration steps you need to do within SCCM SP1. First, it is recommended that you create a new collection that will house your vPro clients that have been discovered and are in an unprovision state. It is viable to use the "All Systems" collection to set the policy for automatic provisioning via the clients agent; however, it is not advised.

To create a new collection...

1. Right Click on Collection, and select "New Collection"

2. When the "New Collection" window appears, enter in a Collection Name. Something like "Unprovisioned vPro Clients" is recommended. Fill in the comment field appropriately and click "Next"

3. When the "Membership Rules" appear, click on the "Query Rule Properties" (it is the Database icon)

4. In the "Query Properties", enter in a name something similar to "Unprovisioned vPro Client Query" and then click "Edit Query Statement..."

5. When the Query Properties appear, click "Show Query Language"

6. In the Query Statement textbox, type in the following: Select * from sms_r_system where AMTStatus=2
   This will pull all the clients that are vPro capable and in an unprovisioned state

7. Once completed, click "OK" and "OK" again on the Query Rule Properties. When returned to the "Membership Rules" screen, click "Next"

8. Add any desired advertisements and click "Next"

9. On the "Security" screen, add any appropriate users or groups and click "Next".

10. On the Confirmation screen, click "Close".

You should now see your new Collection in the collection list. The next step is to configure this collection so that vPro Clients in the collection are automatically provisioned.

1. Right Click on the "Unprovisioned vPro Clients" collection and select "Modify Collection Settings".

2. In the Settings windows, click on the "Out of Band" tab.

3. Check the checkbox "Enable Automatic out of band management controller provisioning" and click "OK"

It is also recommended that you add the "AMT Status", "AMT Version" and "Automatic AMT Provisioning" columns to the collection for easier troubleshooting.

To do so...

1. Select the "Unprovisioned vPro Client" collection and right click in the open white space

2. When the context menu appears, select "View" -> "Add/Remove Columns"

3. When the "Add/Remove Columns" screen appears, add "AMT Status", "AMT Version", and "Automatic AMT Provisioning" to the collection view. Click "OK" when finished.

This collection is now setup so that any vPro client in the collection will be automatically provisioned through the SP1 client agent. With the collection defined, you can use any of the client discover methods that SCCM SP1 provides (AD System Group, AD Security Group, AD System , AD User, Heartbeat, or Network) to discover the client. If you decide to use Network discovery, you can also check the checkbox on the "General" tab to "Enable Discovery of out of band controllers"; by doing so it will also check to see if the client is vPro capable. After you run the discover method and update the collection (either manually or via scheduled policies), you should now be able to see the client in the "All Systems" Collection.

Now that the clients have been discovered by SCCM, you will need to perform a "Discover Management Controller" to see if any of them are vPro capable. On the "All Systems" right click and select "Out of Band Management" -> "Discovery Management Controller". This will scan through your collection and validate which clients are ready to be provisioned.

After a few minutes, depending on the size of your collection, you can update your collection membership by right click on "Collections" and select "Update Collection Membership". If you now refresh your "Unprovisioned Vpro Clients" collection, you should see a list of unprovisioned vPro clients ready to be provisioned. The AMT Status of the client should be listed as "Not Provisioned".

Depending on your SCCM SP1 Client Pulling schedule, it may take a few hours for the client agent to pull down the new provisioning policy. You can, however, force the policy to be refreshed earlier by opening the Configuration Manager Properties within the client's Windows Control Panel and selecting the "Action" tab. Once in the Action Tab, select "Machine Policy Retrieval & Evaluation Cycle" and click "Initiate Action". For instructions on how to deploy the SCCM SP1 client agent, please

reference the SCCM SP1 Help and look for the “Overview of Configuration

Manager Client Deployment” article.

After the provisioning has occurred, the vPro Client will be removed from the newly created "Unprovisioned vPro Clients" collection and be listed as an "AMT Status" as provisioned.

Similar to provisioning via the Out Of Band Wizard, you can track the progress of the provisioning process through the SCCM Out Of Band reports or for more detail amtopmgr.log. There is also the oobmgmt.log on the client machine that will track the Agent based provisioning process.

Another clarifying note is that once the SCCM SP1 Agent is installed and acknowledged by SCCM, the Client Agent initiated provisioning is the only provisioning method supported; SCCM will ignore any vPro hello packets it receives from the client. Also, the vPro client must be in a unprovisioned state with for the Agent based provisioning to occur.

Here is a video that goes over the high level process