Intel IT is fully engaged in the process of integrating Windows* 8 into the corporate environment now that the new OS is running on thousands of business Ultrabooks, other mobile devices, and desktop PCs at Intel. Checkout today's live webinar where Intel experts Tiffany Pany and David Scheer will share their team’s insights and experiences on integrating Windows* 8. Register now!

Download Now

  
To speed the time it takes clinicians to get to critical patient records, IT solutions provider Unisys is developing an application called MovilMed* that compiles data from multiple systems into one interface that’s easily accessible. Tablets featuring 3rd generation Intel® Core™ and Intel® Core™ vPro™ processors and Intel® Atom™ processors will give medical staff access to MovilMed no matter where they are. The Intel processor-based tablets also support Microsoft Windows* 8, giving IT a common platform.

“We’re developing the MovilMed solution around the Intel platform, which provides an environment that’s easy to manage and delivers the performance we need,” explained David Howard, director of IT automation for Unisys.

Read all about it in our new Unisys business success story. You can find more like this one on the Intel.com Business Success Stories for IT Managers page or the Business Success Stories for IT Managers channel on iTunes. And to keep up to date on the latest stories, follow ReferenceRoom on Twitter.

*Other names and brands may be claimed as the property of others.

Client Hyper-V* with Intel® Active Management Technology (Intel® AMT):

Client Hyper-V* virtualizes your Windows 8* installation. It allows you to add one or more child virtual machines, running other Operating Systems, as windows inside the Windows 8 desktop.

If you give Hyper-V* a try, you won’t have to worry about the effect of Hyper-V on your Intel vPro platform. Intel® Active Management Technology (Intel® AMT) functionality is still available with Hyper-V* enabled.

• Hyper-V* can be enabled or disabled on vPro systems at any time.
• Intel® Active Management Technology (Intel® AMT) can be enabled and provisioned with or without Hyper-V*.

Note: Intel® Active Management Technology (Intel® AMT) provides the capability for IT departments to manage client systems even when the PCs are powered down.

The advantage of Hyper-V*

There have been significant barriers to implementing other Client Virtualization solutions including:

• Deployment:

Other virtualization solutions, utilizing a hypervisor, may require a new installation which deletes whatever is already on the hard drive. The existing OS and data are lost. With Windows 8 there is no need to replace the operating system.

Hyper-V is relatively easy to deploy. In the Windows 8 features list, simply turn Hyper-V on and reboot. Windows 8 is now virtualized, although you wouldn’t notice it unless you were told. It doesn’t appear any different than Windows 8 without Hyper-V enabled. All of the user settings remain as before.

• Platform Compatibility

Other virtualization solutions may have a difficult time keeping up with the HW devices and platform models that are available. The hypervisors used by other solutions may only install on a fraction of the systems supported by Windows 8*.

While not all windows 8* compatible systems will run Hyper-V*, there is a broader range of hardware that is compatible with Hyper-V* than some of the other client virtualization solutions. See the list of Hyper-V requirements below.

• VM management

The Hyper-V* manager provides the capability to easy manage VMs. VMs can be managed locally or on a Windows 2012* server. On the local system you can create snapshots of your VMs. For example, you can create a base install and create a new snapshot. Then add a service pack to that snapshot and create another snapshot. Next you could add applications and create yet another snapshot.

You can also create different branches from the various snapshots. Based on the example above you could create a new snapshot of the base install and add another set of applications without installing the service pack. Using the Hyper-V manager you can switch to any snapshot and make it active.

Hyper-V* Requirements:

• 64 bit PCs with Second Level Address Translation running 64 bit versions of Windows 8 pro or enterprise
• 4 G of Memory
• HW virtualization such as Intel’s VT-x technology

Resources:

• About Virtual Machines and Guest Operating Systems

http://technet.microsoft.com/en-us/library/cc794868(v=ws.10).aspx

• Client Hyper-V

http://technet.microsoft.com/en-us/library/hh857623.aspx

http://social.technet.microsoft.com/wiki/contents/articles/7704.client-hyper-v-survival-guide.aspx

Hyper-V Enabling Process

Hyper-V* is enabled through Control Panel -> Programs and Features -> Turn Windows features on or off.

After Hyper-V is enabled a reboot is required. Once the system has rebooted, launch the Hyper-V Manager and select the system name in the left pane. Next, select new -> Virtual Machine under options in the right pane. The New Virtual Machine Wizard will launch.

New Virtual Machine Wizard

Skip the “Before You Begin” screen.

Specify Name and Location:

Assign Memory:

Configure Network: for the first VM the only choice will be “not connected”. The network will be added later.

Connect Virtual Hard Drive:

Installation Options:

Completing the New Virtual Machine Wizard:

Select Finish and follow the OS install instructions. The new Virtual Machine is now visible in the Hyper-V Manager. Select the VM and start it by selecting “connect”.

Once the OS is installed disconnect the ISO image from the CD/DVD drive. Click on settings of the VM and then select the DVD drive under the IDE Controller. Select “none” under media. Note: do not delete the CD/DVD drive.

Virtual Switch Manager

From the Hyper-V Manager select the Virtual Switch Manager. Create a new “External” virtual network switch for your wired LAN, and if needed create another for your wireless LAN.

Wired network settings:

Wireless network settings:

Running the VM

After launching the Virtual Machine you can see Windows 7 running in a separate window on the Windows 8 desktop.

Below you can see that Windows 7 and Windows 8 both have internet access.

VM Snapshots

Hyper-V provides the capability to take snapshots of your VM. You can create a snapshot of your base OS install and then use that to create separate snapshots that have different applications or configurations. You can instantly switch to any snapshot you want by selecting it and applying it to the VM. Snapshots can even be taken when the VM is running.

A while back I ran into an issue configuring an AMT system in TLS mode. I wanted to walk you through the issue and one potential solution in the event you are seeing similar issues with TLS.

I did a quick overview of my environment and everything appeared to be set up correctly. I was able to provision using a non-TLS profile in SCS, but when I switched to a TLS profile I kept getting this error on the vPro client while running ACUConfig.exe:

“Exit with code 75.

Details: Failed to complete remote configuration of this Intel(R) AMT device. Failed to get the certificate from the CA. (Certificate ID: 3310051103).  (0xc0002825). The certificate chain could not be built. Please make sure that the root certificate is installed properly. (0xc0003e93). Intel(R) AMT Operation failed. (Request Certificate). (0xc00007d5). The RCS failed to process the request.”

I checked out the SCS server and made sure the root Cert was installed correctly and everything looked normal. Then accessing the MMC cert snap-in on the SCS server, I created a test request to the CA for the AMT TLS cert and it issued it to me:

And as you can see, the OS had no issues with the certificate, but I was still seeing the errors on the vPro client while running ACUConfig.exe.

Taking a closer look at the acuconfig error message, it seemed like the SCS was having trouble building the certificate chain. So I decided to take a look at the CRL. After some digging around a bit, I decided to copy the CRL from the Cert Authority. To do this I just ran this command from a PowerShell prompt on the Certificate Authority:

Then I copied the crl.crl file over to the SCS server and installed it:

After I finally got the CRL installed on the SCS server, I restarted the SCS service and attempted the provision again. Sure enough, I was able to complete the process and the Cert Authority issued the TLS certificate for the AMT device.

There are quite a few different methods of publishing / referencing the CRL in your environment, for more information see this technet page: http://technet.microsoft.com/en-us/library/cc737760(v=ws.10).aspx

Instead of relying on the SCS error messages, you could also use a utility like certutil to check the validity of the CRL. Here is a blog post on TechNet on Basic CRL Checking with certutil: http://blogs.technet.com/b/pki/archive/2006/11/30/basic-crl-checking-with-certutil.aspx

Bill York also has some information related to expired CRLs and SCCM: http://communities.intel.com/thread/20138

If you suspect you are having issues with the CRL in your environment, this manual workaround will get you back up and running, but for a long term fix you should bring it up with your PKI team.

Intel vPro Platform Solution Manager:

A plug-in designed to target  Intel vPro Technology usages

• Receive the latest and greatest Intel vPro functionality as soon as its launched!
• Improve time to market for platform feature availability for end customers
• Provides a solution for the Help Desk to utilize Intel vPro Technology
• Increase your ROI by providing more use cases to your IT Department and Help Desk
• No cost

Allow your IT Department to focus on innovation and not the traditional every day tasks!

Download NOW! http://www.intel.com/vprosolutions

When creating an Intel AMT Configuration profile with Transport Layer Security (TLS), a target Microsoft Certificate Authority (CA) and certificate template must be specified.  When using TLS with Intel AMT, a Server Authentication certificate must be defined and applied into the firmware of each system.   The easiest choice is the WebServer certificate template.   In some environments, this template might be disabled or removed due to security policies.

The following steps summarize the required steps.

First - if a valid Server Authentication certificate template has not be published, a screen similar to the following will occur.   The certificate template field is blank with no available options

Within the Microsoft Enterprise CA, duplicate the WebServer certificate template.  When prompted, select the default option for "Windows 2003 Server, Enterprise Edition"

Provide the details for the certificate template.   Shown below the certificate template name is "Intel AMT TLS Cert".

On the security tab, provide access to the template for the logon account of RCSserver.   In this example, RCSserver is running under the Network Service Account of a system with hostname SCS8, thus the select "SCS8$".   Grant the "Read" and "Enroll" permissions

Next, issue the certificate template.   Right click on Certificate Templates under the target Microsoft CA (Note: Required only for Microsoft Enterprise CA to issue certificate templates to the Microsoft Active Directory.   Microsoft Standalone CA implementations do not include this option.)

With the certificate template issued...

... in the Intel SCS console, select "Refresh CAs &Templates".   Via the pull down list, select the target certificate template.

Two final reminders - ensure the logon account for RCSserver (the server component of the Intel SCS installation) has rights to "Issue and Manage Certificates" along with "Request Certificates" as required for the Web Enrollment process.

And ensure the Policy Module setting allows for automatically issuing certificates

The above information is provided in the Intel SCS User Guide.   This article provides a summary and reminder

Hi

Some new vPro platforms heading our way in 2013 may not have LAN port on-board, therefore only WLAN will be available. This configuration implies of course that Intel AMT will connect via WLAN only.

In general, LAN-less platforms are becoming common in the emerging Ultrabook segment, as Ultrabook requirements put limitations on traditional LAN solutions both in power consumption and in physical size. While the LAN solutions are evolving to handle those new requirements (still LAN is the most reliable and fast communication method in wide use) there are vPro Ultrabooks with WLAN only, and more platforms are anticipated.

Most capabilities of vPro platform are available on the WLAN only systems, including security use cases and the majority of automation use cases. I would like to take this opportunity to remind the AMT IT manager of the key differences between LAN and WLAN in terms of AMT usage:

• Provisioning:
  • Host-based Configuration (HBC) is the only remote Setup and Configuration method supported in WLAN**
  • HBC over WLAN enables the AMT in Client Control Mode, for which user consent is required for healing scenarios (e.g. KVM or IDE-R). Indeed user presence for some of these use cases fits well with the mobile Ultrabook use models, but this is still a limitation to consider.
  • Notice that provisioning the AMT for Admin Control Mode is still available through local provisioning
• The vPro based capability "System Defense", enabled by ecosystem solutions like McAfee ePO Deep Command, will not function on WLAN-only systems.

** Note: Usage of a docking station that makes AMT available through Intel LAN is not considered as WLAN only as long as system is docked.