All,

Wanted to share a great post by Gael Holmes (Intel) who recently posted in the Intel® vPro™ Expert Center .   See the original post here: http://software.intel.com/en-us/blogs/2009/02/19/intel-amt-what-you-need-to-know-about-solide-r-and-smb/ also a copy provided below...

We recently made available to our Intel AMT Developers the first version of the SCS (Setup and Configuration Server) Lite tool. Eventually this tool will morph into a full blown setup and configuration server that supports all the infrastructure that SCS 5.0 now supports. This "Lite" version, however, is very "Lite" as the name implies. It does not require (or support) SQL database, AD, TLS.  It, instead supports one touch and remote provisioning using the SCS Service, the SCS Console, and the Activator tool. This tool currently provisions an Intel AMT Client in "Enterprise Mode" without TLS.

Many developers, or users, may have been provisioning their systems in what we call SMB (Small to Medium Business) mode manually and then they may decide to try out the new SCS Lite tool and realize suddenly they can no longer do a SOL/IDE-R (Serial Over LAN/IDE-Redirect) operation on the same AMT Client they did this on prior to provisioning with the SCS Lite Tool.

What is going on here is simple. When we provision our AMT systems manually (SMB mode) we enable SOL and IDER options in the MEBx BIOS extentions (otherwise there will be no SOL/IDE-R actions) and the Redirection port gets enabled automatically. This is not the case when provisioning in Enterprise mode (because it is a security issue to enable the port and leave it open.) Software vendors who provision their systems in Enterprise Mode (whether or not they have TLS) know that their software must open the port in order to have a successful SOL/IDER session and then they are expected to close the port when the session is over.

If someone is running a Manageability Application that was designed to work on AMT systems that were provisioned in SMB mode, but now they have been re-provisioned in Enterprise Mode, the Manageability APP may not open the port and so SOL/IDER will not work unless the redirection port is enabled.

This Screen Shot (From the Manageability DTK) shows what is enabled on an AMT Client after provisioning with the SCS Lite, or other Enterprise provisioning tool. Note that "Redirection Port" is Disabled. Simply click on the box next to "Disabled" and this will allow SOL/IDER sessions to occur.

This Screen Shot shows the SOL/IDER settings that occur automatically when the AMT Client is provisioned using SMB Mode - Note that the Redirection Port is automatically enabled and the AMT system is free to perform SOL/IDER sessions.

Note that whether the system is being provisioned in SMB mode or in Enterprise Mode we still must enable SOL and IDER in the MEBx Extensions. If we fail to enable them in the BIOS or in our Profile (for the SCS) then we cannot perform SOL/IDER at all - and this has nothing to do with the enabling or disabling of the Redirection Port.

Moving forward it will be necessary for all Manageability Apps to check the status of the Redirection Port and then open the port prior to initiating the SOL/IDER session (and then close the port when the session is complete.) By putting this flow into your code base, you are covered when communicating with the devices that are configured in either SMB or enterprise mode.

These are the API's of interest in this flow:

• SetEnabledInterfaces - Make sure SOL and IDE-R are set as enabled interfaces
• GetRedirectionListenerState - Gets the current redirection listener status
• SetRedirectionListenerState - Set the redirection listener state to enabled if not already enabled.

Over the next few posts I would like to describe 3 different scenarios as they apply to the adoption of vPro technology. I will be leveraging 3 categories as it describes to the IT shop (Maintain your baseline, Maximize your potential and Migrate completely to the new technology). These categories also relate directly to the % of vPro machines that are in your IT shop.

First, let’s start with maintaining your baseline. What are the challenges facing the IT shop and support provider of IT services as it relates to the client computers? Manageability and Security of that asset, along with ensuring lower costs for keeping them updated and the highest level of availability as it relates to the usage. However what is missing above is the Energy savings piece of the equation. To date our experience has been that integrating a power management & energy savings profile in your IT environment for vPro machines is an easy way to keep your baseline going and just add one new usage in your environment. I consider this to be maintaining your baseline, but making a small modification to realize benefits. Specifically this means the standard ability with turning Machines off that can reduce the power bills, however it is just a small change in the current IT policies/practices.

Now for the IT shop that is looking to Maximize your potential and have new level’s of service. The opportunity to implement more usages is always possible, for example if you are looking to move beyond the power use case to more of the remote repair to save $$’s in both Tech Time, downtime, productivity of the employees. I would note that the further you look to maximize your potential it will require additional planning, testing and of course effort to do so. I will deep dive deeper into the impact of each additional usage and what you can expect from a change perspective for your IT shop in the coming blogs.

Last case is the Migration path.. full migration of ZERO/Little vPro to all vPro ( here is where it gets fun ).. Must haves are: Good Strategy, Architecture awareness, Manageability/Security Landscape, & Top Pain points. If you have these at your disposal you are in good shape to have immediate value to your migration.

I look forward to deep diving into each of these over the coming weeks.

Josh H

Here are the key use cases supported by MS SCE (Microsoft System Center Essentials). Each of the use cases below will reference a certain page in the Manageability Pack located @ http://softwarecommunity.intel.com/isn/downloads/Manageability/Intel_AMT_MP_Guide.pdf. Therefore I highly recommend you download the PDF and then cross reference the list below.

System Discovery

Discovery allows the Management Pack to locate Intel® AMT systems. During the discovery process, the Management Pack retrieves asset information from the Intel® AMT subsystem. Discovery needs to be performed before you can perform any other Intel® AMT-related tasks.

For details on the different ways to perform discovery, see “Discovering Systems” on page 87.

Viewing Asset Information

You can view information about the Intel® AMT system’s hardware assets (CPU, memory, and more).

For details on viewing asset information, see “Retrieving Asset Identification Information” on page 97.Intel® AMT Management Pack for Ops Manager and Essentials • Installation and User’s Guide 6

Power Control Operations

Power control operations enable you to remotely control the power states of Intel® AMT-supported systems.

You can apply the following power control operations to Intel® AMT systems:

•power-up

•power-down

•power cycle

•reset

You can specify the way that a system should boot, depending on the specific system implementation.

For details on power control operations, see “Power Control Operations” on page 101.

SOL/IDE Redirection Operations

The SOL/IDE Redirection feature enables you to remotely perform the following redirection operations on Intel® AMT-supported systems:

•Serial Over LAN (SOL): Allows you to display the non-graphic boot screens of an Intel® AMT machine, thereby allowing you to modify BIOS entries or to change the way that the system boots.

•IDE Redirection (IDER): Allows you to boot the Intel® AMT machine from a boot image located elsewhere on the network.

For details on redirection operations, see “Redirection Operations” on page 109.

System Defense

The System Defense feature allows you to define multiple system defense policies and apply them individually to a system.

For details on the System Defense feature, see “System Defense” on page 121.Chapter 1 • Introduction7

Event Handling

You can configure Intel® AMT systems to send PET (Platform Event Trap) events to multiple event collectors, and view these events in Ops Mgr/Essentials. For information on the PET protocol, refer to the ASF specification at http://www.dmtf.org/standards/asf/.

For details on registering for PET events, see “Registering and Unregistering for PET Events” on page 137.

For details on monitoring PET events, see “Monitoring Alerts (PET Events)” on page 157.

Looking ahead to the next post..

the plan is to showcase each use case in quick video's and post out.. stay tuned for more..

Josh H