This information is based on Microsoft’s beta release of System Center Configuration Manager Service Pack 2 and is subject to change.
Within the SCCM SP2 beta, Microsoft has included support for AMT Audit Log. Audit Log was introduced in AMT version 4 and provides a mechanism to captures the occurrence of significant AMT events and who performed those actions.
Before you begin, you must configure SCCM SP2 on which AMT Audit Log events it turns on. This can be done by selecting Out of Band Management properties under "Site Database" -> "Site Management" -> <Site Code> -> "Site Settings" -> "Component Configuration" -> “Audit Setting” Tab.
Unlike other AMT feature enablement with SCCM, Audit log is not enabled during Provisioning or through the Update Management Controller process; it must be performed as a post provisioning step. To enable the AMT Audit log, you must right click on the AMT client and select “Out of Band Management” -> “Enable Auditing and Apply Audit Log Settings”. You can also disable and clear the audit log from this menu as well.
Once enabled on the AMT Client, you can access the AMT Audit Log through the Out of Band Management Console available through right clicking on the AMT client and select “Out of Band Management” -> “Out of Band Management Console”.
--Matt Royer
This information is based on Microsoft’s beta release of System Center Configuration Manager Service Pack 2 and is subject to change.
As noted in one of the previous posts, SCCM SP2 has extended support for AMT / vPro Wireless Out Of Band use cases. If we open Out of Band Management Component Configuration under "Site Database" -> "Site Management" -> <Site Code> -> "Site Settings" you will notice that there is a new tab for “802.1X & Wireless”.
When you click the new icon, you will be given the opportunity to create your AMT wireless profile.
There are a couple of interesting things to point out. First, SCCM SP2 supports AMT wireless security types of WPA-Enterprise and WPA2-Enterprise; WPA-Personal and WPA2-Personal are not supported
Second, the encryption method can be either TKIP or AES.
Third, you will notice that 802.1x authentication is required for the wireless connection supporting the Client Authentication methods of EAP-TLS, EAP-TTLS/MSCHAPv2, or PEAPV0/EAP-MSCHAPv2.
The 802.1x trusted root certificate can be loaded from either a file or pulled directly from your CA infrastructure.
The Radius Client Certificate (depending on the Authentication method chosen) will allow to you choose a desired certificate template from one of your Microsoft Enterprise Certificate Authorities.
Once the wireless settings have been configured in the Out of Band Management Component Configuration, the certificate request will be generated for the AMT client and the wireless settings will be pushed to the AMT client during the initial provisioning or when a “Update Management Controller” is performed on the client.
--Matt Royer
Intel® Client Manageability Add-on for Microsoft* SMS 2003 version 5.0.1 released
Posted by Matt Royer Jan 12, 2009
Interoperating between Microsoft SCCM and the Intel Manageability Tool Kit
Posted by Matt Royer Jan 12, 2009If you want to have the Intel Manageability Tool Kit interoperate with a vPro client that has been provisioned by Microsoft System Center Configuration Manager SP1, there are two key things you need to do: Configure Manageability Commander to trust the Issuing Certificate Authority of AMT Web Certificates and to authenticate with a Kerberos user that has access to the vPro Client.
Before configuring Manageability Commander, you will need to obtain a copy of the Root Certificate Authority Certificate that the vPro Client AMT Web Server Certificate was issued from. This is the same Certificate Authority that was configured in “Microsoft System Center Configuration Manager Console” -> “Out of Band Component Configuration” -> "Site Database" -> "Site Management" -> "Site" -> "Site Settings" -> "Component Configuration" -> "Out of Band Management" -> "General Tab" -> "Certificate Template".
If you are issuing AMT Web Server Certificates from a subordinate certificate authority, you should still use the certificate from the Root Certificate Authority the SubCA is chained up to.
Export a copy of the Root CA
1) To export of a copy of the Root CA Certificate, you can open your local certificate store, select “Trusted Root Certificate” -> “Certificate” and search for the proper Root CA Certificate. If you do not have the Root CA certificate in your trusted root store, your CA Administrator can obtain a copy for you from the CA by selecting the “Properties” of the Certificate Authority and selecting “View Certificate”.
2) Once you have the certificate open, select the “Detail” tab and then select “Copy to File”.
3) When the “Certificate Export Wizard” appears, click “Next”.
4) Select “DER encoded binary X.509(.CER)” and click “Next”.
5) Select a location to export the certificate to and then click “Next”.
6) On the “Complete the Certificate Export Wizard”, click ‘Finish”.
Trusting your Root Certificate Authority in Manageability Commander
Now that you have a copy of the Root CA certificate, you are able to configure Manageability Commander so that it can manage a vPro client provisioned by SCCM.
1) If you have not already done so, you can download a copy of the Manageability Tool Kit from the following location: http://software.intel.com/en-us/articles/download-the-latest-version-of-manageability-developer-tool-kit/. Follow the onscreen instructions on how to install it.
2) Once Manageability Tool Kit is install and Manageability Commander is open, select “File” -> “Certificate Manager”.
3) In the “Certificate Manager” window, ensure you delete all other existing certificates by highlighting them and clicking the “Delete” button. After which, select “Import”. 
4) Browse for the Root Certificate Authority Certificate you exported (which is the Root CA Certificate that is chained up from your AMT Web Server certificates) and click “Open”. 
5) Back in the “Certificate Manager” window, click the “Refresh Displayed Certificates” button. You should now see your CA in the “Trusted Root Certificates” list. Click “Close” to exit the Certificate Manager window. 
Adding a Client to Manageability Commander
Once the Root CA certificate has been trusted, you can now add the client (that is provisioned by SCCM) you want to manage via Manageability Commander.
1) To add the vPro client, select “File” -> “Add” -> “Add Intel® AMT Computer”.
2) When the “Add Intel® AMT Computer” window appears, enter in the full qualified domain name (FQDN) of the client you want to manage. If you want Manageability Commander to use Kerberos authentication of the local user logged, leave the Username and Password blank. If you want to specify a different Kerberos user then the local logged on user, enter in the desired Kerberos user as domain\user and the appropriate password. Click “OK” to close the “Add Intel® AMT Computer” window.
3) Once you have added the vPro client, you should see it in the list of clients to manage. Right click on the client, and select “Connect”.
4) Once connected, you can invoke any of the vPro / AMT use cases that the Manageability Commander Tool supports on the client provisioned and also managed by SCCM.
Debugging Connection
If you are having connection issue, you can perform some general troubleshoot by viewing the debug information.
1) To view the debug information, select “Help” -> “Show Debug Information...”
2) Once the “Manageability stack” window opens, you can see additional detail of any issues encountered.
--Matt Royer
Already activated? Now start taking advantage of vPro functionality!
Posted by Michele Gartner Oct 28, 2008
Microsoft SCCM 2007 SP1 Intel vPro Training Videos Now Available
Posted by Jeremy Nicholes Oct 24, 2008Microsoft SCCM 2007 SP1 Intel vPro Training Videos
We’re pleased to announce the availability of Microsoft SCCM 2007 SP1 Intel vPro Training videos. During a recent training event in Redmond, Washington, we had the cameras rolling for this detailed and robust training experience and it is now available for you to experience and utilize.
Below is an overview and link for each training section.
|
Technical overview of Microsoft System Center Configuration Manager 2007 SP1 support of Intel vPro technology with specific focus on supported use cases, provisioning process and infrastructure prerequisites for Intel vPro Out of Band Management. | |
|
Configuration steps of Active Directory and PKI infrastructure to support Intel vPro Out of Band Management within Microsoft System Center Configuration Manager 2007 SP1. | |
|
Steps for Microsoft System Center Configuration Manager 2007 SP1 OOB Service Point installation, OOB Component Configuration and Network Discovery for Management Controllers. | |
|
Steps for creating a collection for housing Intel vPro clients and configuring that collection for automatic provisioning of the Out of Band Management Controllers. | |
|
Installation overview for the Microsoft System Center Configuration Manager 2007 SP1 client agent and initiation of Intel vPro client provisioning. | |
|
Technical overview of the Out of Band Management Console, Intel vPro Management Engine Interface and Intel AMT power control via Advertisements. | |
|
Configuration steps of the Intel WS-MAN Translator to support legacy Intel vPro clients (Intel AMT firmware versions less than 3.2.1). | |
|
Provisioning legacy Intel vPro clients (Intel AMT firmware versions less than 3.2.1) through the Intel WS-MAN Translator using PSK provisioning. | |
|
Overview of the Intel vPro migration process from the Intel SCS / Microsoft SMS 2003 Add-on to Microsoft System Center Configuration Manager 2007 SP1. | |
Please let us know if you have questions or comments regarding this material.
This resource along with other resources on the Intel vPro Expert Center can assist you in answering questions when deploying Intel vPro clients in conjunction with Microsoft System Center Configuration Manager 2007 SP1.