Blog Posts From Intel vPro Expert Center Blog Tagged With intel

REGISTER NOW FOR TODAY'S EVENT! Deploying Windows* 8 and Touch in the Enterprise

webadmin@intel.com — Wed, 10 Apr 2013 15:20:32 GMT

Intel IT is fully engaged in the process of integrating Windows* 8 into the corporate environment now that the new OS is running on thousands of business Ultrabooks, other mobile devices, and desktop PCs at Intel. Checkout today's live webinar where Intel experts Tiffany Pany and David Scheer will share their team’s insights and experiences on integrating Windows* 8. Register now!

Managing Intel vPro Ultrabooks and Tablets in wireless network only

webadmin@intel.com — Sat, 12 Jan 2013 23:34:19 GMT

On April 3rd, 2010 Steve Jobs showed this renewed computer tablet concept (i.e. iPad, which was not the first tablet computer available in the market, but was one that had great success), triggering a new kind of personal computer system that complements traditional form factors (e.g. desktops and notebooks) used by knowledge workers in corporate environment or even replace the workers in some cases. In fact, a tablet design is an excellent form factor to consume information, but it lacks ergonomic qualities to produce content with a physical QWERT keyboard larger display screen.

The computer industry is investing in several form factors in order to reinvigorate personalcomputer systems with exciting designs: Ultrabook, convertibles designs, touch screens, tablets, tablets with slide QWERT keyboard, multiples dock station capabilities. And in this new World of mobility and thin design, looks that RJ45 interface has become antiquated. For business, wired interface still predominant in most organizations and lot investments were made in this media for security and manageability and how to manage seamless Intel vPro devices, independently of form factor and connectivity medium (i.e. wired or wireless)?

Some Ultrabooks, such as Lenovo ThinkPad X1, arrived without an embedded Ethernet port, only with a dongle RJ45 interface that can provide wired connectivity for Operating System, however it doesn’t work for OOB (i.e. Intel ME).

The absence of an integrated Ethernet interface in these devices limits some use cases for devices of this category. E.g. Host-based Configuration (aka. HBC) is the only remote Setup and Configuration method supported, user consent is required for healing scenarios such as KVM or IDE-R, but fortunately, these limitations in most cases fits well with mobile use models. Admin Control mode can be achieved only configuring locally in Small and Business Mode (SMB), which for enterprise environment can be undesirable due to the required manual labor for configuration.

System Defense, that is enabled by McAfee ePo Deep Command for example, will not be available in WLAN-only systems for security reasons – basically, HBC transfers IT admin authentication to users, that is the reason that in HBC, for each remote operation, user consent is needed. However, for System Defense, there is no reason for user consent to switch on, that is the reason that System Defense is turned off in HBC.

For a wireless-only device be managed OOB with Intel vPro technology, it’s required that Intel ME be in 8.1 version and Wireless driver 15.3 (for Windows 7) and 15.5 (for Windows 8) have been updated for a correct operation.

For further details on creating a profile for wireless environment, read my priorblog post about “Managing Intel® vPro™ Technology clients in a wireless environment” where I discuss some basic configurations and lessons learned in this kind of environment.

Some management consoles such as Microsoft System Center 2007 or 2012, use the concept of provisioning using PKI that set the machine in Admin Control Mode that is not supported for wireless-only devices. So for these cases, Intel Setup and Configuration Services 8.1 (aka. Intel SCS) can be used for provisioning and configuring, following these instructions.

In order to provide better service for “road warriors” you can provided a full set of capabilities, including Fast Call For Help (aka. FCFH). This allows users outside of a corporate firewall to have support from a help desk technician even OOB. Intel vPro configuration profile provides detailed possibilities for provisioning as showed an example of a complete wireless configuration option:

Active Directory Integration is required if corporate wireless network requires 802.1x authentication;
Access Control List (ACL) that is required in order to specify users/groups for permissions (i.e. authorization) in Intel ME;
Home Domains used to specify when machine is inside or outside corporate network based on suffix DNS received by DHCP - this definition is important to enable FCFH when machine is outside corporate perimeter;
Remote Access specify address for Intel vPro Gateway (former Management Presence Server) and requires server configuration in corporate DMZ - read further details in Intel AMT SDK;
Wifi connection defines configuration and profiles for OOB connection and with Intel PROSet there profiles can be populated by users when added into PROSet profile.

For further details on each of these sections, read Intel SCS 8.1 documentation available on the Intel website.

Following these instructions and guidelines, you will be able to integrate these new categories of managed form factor with actual management console and allow seamless management.

Comment below with any questions – I would be more than happy to provide further details.

Best Regards!

Protecting your Digital Identify Using IPT-PKI

webadmin@intel.com — Tue, 27 Nov 2012 14:24:37 GMT

Currently, the most common way people verify their digital identity is by using a password. Exceptions often times are found with online banking, where most use a second factor for authentication (e.g. OTP token or even a confirmation code sent to mobile phone), that is costly or inconvenient for user experience, but due to the weakness of password versus value at risk, this kind of approach is accepted and the costs justify the investment. However it is not reality for the vast majority of digital services. Passwords are used to sign in to your PC, webmail, social network, and lots of other places. There is a research conducted by Microsoft Research conducted with half million PC users showing that the average person typically has about 25 online accounts.Are you an average user? In fact, the data also shows that the number of unique passwords across those 25 accounts is only about 6, so around 4 passwords are reused across accounts. This is in addition to the tendency of websites to increase password complexities such as mixing lower case with upper case, special characters and numbers. Password reuse probably will increase among websites and cases like those described by Mat Honan (Wired writer) will become even more frequent.

Dealing with username and password leads to a set of interesting challenges. We all want the web to be easy and safe. However, having to remember a dozen of complex passwords generally isn’t easy, and is even harder for websites accessed less frequently. However, using the same easy-to-remember password across multiple sites isn’t safe. The ideal solution here involves somehow finding a way to make it both easy and safe to use all of your different digital identities.

As I already explained in this post in InformationWeek, on how to effectively managing identity in the cloud, I introduced Intel Identity Protection Technology and described about strategies adopted by online banking to increase security and how One Time Password (aka. OTP) as second factor authentication can be used to increase security. However, all these approaches, even those more sophisticated, are based on symmetric key and thereby not resistant against an active man-in-the-middle attack (e.g. phishing).

One alternative is public/private key pairs, i.e. based on Public Key Infrastructure (aka. PKI) – these are the most commonly used methods for protecting network traffic on the Internet today. PKI is based on an asymmetric key – the private key and the public key are different, so the public key should become public in a way proving that it belongs to user and not someone else. Also, the private key must be stored securely where only the user has access. With this method, the website sends a sign-in request to be signed by user’s private key and sent back to website that uses the user’s public key to confirm the user has a private key. So long as the private key is not compromised, this system is resistant against phishing and keylogging attacks. However this method is not widely used on the Internet today due to the high costs associated with having dedicated hardware to protect the private key such as Smart Cards and other associated logistics.

Intel IPT-PKI architecture

Intel Identity Protection Technology (aka. Intel IPT) with PKI uses the Intel Management Engine (aka. Intel ME) and 3rd generation Intel Core vPro processor based systems to provide a hardware-based security solution similar to that of other hardware security modules like Smart Cards. Unlike most hardware security modules, Intel IPT-PKI is designed to be managed as software but hardware resistant against tampering.

The hardware based security is achieved by using the Intel ME to perform all cryptographic operations. This way, the keys are never exposed to software running on the computer’s central processing unit (CPU). Furthermore, all certificates are tied to the platform on which they are created.

As you can see in this diagram, so long as the ME is part of chipset and tied with PC, the user’s PC becomes part of authentication process. Intel IPT-PKI as showed exposes his capabilities as a Cryptographic Service Provides (CSP) via Microsoft CryptoAPI software layer. IPT-PKI can be used to:

Generate a persistent RSA key pair in hardware;
Generate PKI certificates, that can be used to identify user possession and password knowledge;
Perform operation with RSA private key;
And protect key usage with PIN

Intel IPT-PKI can be used to enhance user identity on several applications such as SSL web site authentication, S/MIME with Microsoft Exchange Server/Outlook client or VPN authentication.

In order to avoid operating system attacks keylogging user’s PIN and replaying automatically this PIN in a MiTB attack, a second IPT building block, Intel IPT Protected Transaction Display (aka. IPT PDT) can be used to create a secure channel between user’s interfaces. (I.e. keyboard, mouse and video, in order that operation system is not able to hook, as I explained in this Brazilian bank case in a previous post.)

If you are looking on how to start using IPT-PKI and IPT-PDT, there is an excellent Use Case Reference Design that explains majority of scenarios and how to configure. The only requirement from client side is a Intel vPro machine with 3^rd Core generation and Windows operating system homologated for this particular machine.

Best Regards!

Mobility Paradox: What BYOD means for IT

webadmin@intel.com — Mon, 01 Oct 2012 14:10:21 GMT

Networks constitute the new morphology of our society and the diffusion of this logic transforms operations and results in productive processes, experience, power and culture. Therefore, network organization has existed for a long time; the new information technology paradigm provided the material base for expansion that penetrated into whole social structure. Now we’ve come upon the mobility craze, the fastest changing field in technology, and the introduction of these new form factors into our society are reshaping the way that we interact with each other through social networks. They’re influencing the way that we work and produce information.

What we are seeing nowadays is the wave of Bring Your Own Device (aka. BYOD), where corporations are allowing employees buy devices and bring to enterprise, letting them use it to access their e-mails, calendars, contacts and even line-of-business applications. This new chapter in IT brings new opportunity for increased productivity, while putting valuable information in employee’s hands. BYOD takes advantage of the fast paced evolution of consumer devices such as smartphones, tablets, and the applications that run these devices and empower users with highly collaborative capability. However, these benefits come also with challengers for IT departments:

Security: Probably the biggest challenge for most organizations. Dealing with multiples devices, operating systems, and users accessing multiples devices at same time requires in-depth strategy, securing and integrating multiples layers into overall enterprise-class policy. The first touch point is the user, so starting with a small tech-savvy group can be a good start point, as demonstrated by BP case published 6 years ago by ZDNet.

Now IT organizations also can count on Intel® Anti-theft Technology (aka. Intel® AT) technology embedded into Intel tablets, laptops and Ultrabooks to lockdown lost or stolen device in order to “brick” and destroy information stored in these devices and make the device itself a useless piece. Also, to protect user’s identity these devices have Intel® Identity Protection Technology (aka IPT), that provides the foundation for a comprehensive, tamper proof and tied with hardware asset that match user and device to provide a consistent authentication mechanism and credential protection.

All these technologies have the potential to set an alliance between personal and professional roles into same device. As I already wrote about use of IPT for consumer using an online banking, this same technology can be applied for enterprise application in order to strengthen overall user identity. Pragmatism is the safest strategy for enterprise, IT organizations can’t ignore that their users are using their devices for personal matters, accessing personal e-mail and multiples cloud services, probably using the same password used by corporate systems. So, if IT ignores this simple human expected behavior and continues to think that IT security is based on firewall perimeter, and an employee losing his or her personal device won’t offer any threat to corporate will undoubtingly find themselves with a security breach.

Define a strategy to support an effective BYOD policy. This is actually not only an opportunity to boost employee productive but also, if well conducted, a way to protect against the security breaches that existed in today’s world.. However, it is not an easy task and there isn’t one solution fits all. That is the reason that some well-established consulting companies are focusing their efforts in this area, as announced by IBM Global Service and explained in this white-paper.

Best Regards!

McAfee ePolicy Orchestrator integration with Intel® Anti-Theft

webadmin@intel.com — Thu, 20 Sep 2012 12:00:07 GMT

Good news for IT administrators struggling to find an effective way to manage lost or stolen laptops. Now, McAfee ePolicy Orchestrator (aka McAfee ePO), an enterprise-class console for security management software, soon will be able to go further and securely disable stolen or lost laptops in order to protect the most valuable company asset: information.

This capability comes as joint effort of Intel, McAfee and Softex, that was announced last week during IDF in San Francisco, when Softex announced that has joined the McAfee Security Innovation Alliance (SIA) partner program in order to develop this capability and integrates as plug-in to McAfee ePO that will be called Softex SecureDisable.

There are several reasons to it be a good news:

It’s a long time desired capability, since corporations started replacing regular desktops by laptops.
Intel® Anti-Theft technology is an integral component of business-class laptops Intel® vPro™.
It is already integrated with McAfee ePO and provide an integration component for Microsoft System Center 2007.
McAfee ePO Deep Command already brings a key feature for “road warriors” called Fast Call for Help (aka FCFH). This allows remote users, even with damaged OS, to connect to corporate network and let a help desk technician provide support using KVM, now with AT feature, steroids the solutions for these workers and improve efficiency for IT department, not only to provide a fast back to work but also protecting organization information and assets.

Softex is planning to provide this capability as cloud computing offering, hosted in their facilities or hosted on-premise in enterprise boundaries.It will allow great flexibility on how to deploy and manage this capability across the board.

Now, as never before, “road warrior” workers are able to experience service and security protection as if they were working inside corporate boundaries.

Best Regards!

Innovative thinking - utilize manageability capabilities in a new way

webadmin@intel.com — Thu, 13 Sep 2012 14:08:46 GMT

I'm sitting in an airplane seat, 38,000 feet high heading to Portland International airport. I'm due to attend an Intel Technical Leadership conference to deliver a session on our most recent project with vPro AMT managing hardware based encryption.

In between channel surfing on this nice VOD touchscreen on the back of the seat in front of me, I thought of sharing this concept with you.

Many of the companies I know, that are using Intel(R) AMT, are mostly using it for power control, PC alarm clock, or waking up their vPro clients for patching and installations. These use cases are great introductions to AMT, but I would encourage IT admins running vPro to not stop there.

Let me share the story of Self Encrypting Drive management, as an example. We explained the solution in details in this white paper, but in this post, I’ll use this to illustrate my point.

A while back, I was approached by the client security service manager in Intel IT, who asked me to come up with a solution to manage self-encrypting drives. At the time, we were already deploying these types of drives at Intel IT, but without utilizing their encryption capabilities. In fact, since we did not have a management solution, we were forced to add another software-based encryption application on top of the hardware-based encryption, a redundant and more costly approach. Since Opal compliant solutions are not yet widely available, we needed to be creative.

First, we needed to find a way to secure the encryption key on the drive. We decided to use the ATA password, interfaced through the BIOS for this. Secondly, we had to automate the process of sending this password into the BIOS, and create a randomly created master password for each encrypted device. Then we had to provide remote management capabilities to our Service Desk, to support cases when the user forgets the password, and also to ensure we have zero data loss across the enterprise.

We gathered some smart engineers from IT and the AMT engineering teams, and came up with our solution.

Using manageability web services as the heart of the solution, we can interact with the client PC's Manageability Engine using the SOL protocol and automatically configure the BIOS with the passwords. A simple password management application installed locally on the client PC provides the end user with a GUI while a centralized secured database stores all master passwords for the encrypted devices. All communication channels are SSL encrypted, as well.

During our work on this project, we gained additional benefits that we didn't even think of before we started. Specifically, we created tools that enable our IT Operations folks to better control and maintain our vPro fleet, and we also improved our data and reporting capabilities for the clients’ hardware inventory and encryption status. This is, of course, in addition to the obvious gain of providing a hardware-based encryption solution, make this new solution very compelling for Intel and Intel IT.

This was a unique project because it didn’t just implement one of the obvious and most common AMT usages. In fact, using SOL for most of the activity might be considered antiquated by some, but we decided to use SOL as it allowed us to support all generations of vPro clients and not just the newer KVM models.

AMT is a powerful technology. It can be used for many reasons and through many methods. When you look at enabling AMT in your organization, don't just look to implement the obvious, try to think of other possibilities it could provide you as well. If you are already using AMT, I encourage you to consider how else you can benefit from it. As in many other IT domains, the key to getting the added value is to think out-of-the box.

Intel SCS works for me!

webadmin@intel.com — Wed, 08 Aug 2012 14:00:48 GMT

Let me introduce myself. My name is Omer Livne and I’ve worked for Intel since 2003, in various organizations (from Purchasing to Finance and now IT). During the last 2.5 years I’ve been responsible for vPro activation for Intel IT.

Intel® vPro™ technology is a set of security and manageability capabilities built into the Intel Core vPro processor family, Intel chipsets, and network adapters. Intel® AMT is one of vPro core capabilities that provides remote management capabilities of the PC fleet, regardless of the Operating System state or PC power state. In order to use AMT, the IT organization must configure the Management Engine (Intel® ME) and to create a trust between the computer and its IT organization.

Intel has a very complex IT environment. Most of our fleet is mobile, many are primary wireless and their IP's keep changing by the minute. We're working around the globe, with over 100K vPro clients.

We've been using different tools while waiting for a comprehensive management solution to help us with configuring and managing our complex environment.

When Intel Setup and Configuration Software 7 (SCS 7) was released about a year ago, those of us in IT were really excited. It provided us with a stable and reliable solution to configure and manage our clients and it could be integrated into our existing IT procedures (i.e - client build, scripts for PC technicians, etc.).

We designed a stable environment which was based on SCS for all AMT activities, and other client management consoles for all OS related client activities. Since it worked so well for us, we even decided to share our experience in a white paper.

Now, even though SCS 7 was a huge step forward, it was not quite the optimal solution for all our needs. We still needed to find a way to collect the data from our clients, analyze it and act upon it. Some of the maintenance activities were challenging, and required some creative thinking in using of external utilities. That's where SCS 8.1 came in and solved a lot of these challenges. By the way, you can get your own free version of Intel SCS 8.1 here.

We immediately took advantage of its database and diagnostics capabilities, and started to get valuable information from our clients. It provides quick snapshots of the health status of our environment with just a few mouse clicks.

One of the great benefits of SCS 8.1 is that it's flexible and can be easily adjusted to any environment. You can define variety of configuration profiles, with or without WLAN support, with or without 802.1x support, with or without CIRA (or FCFH - Fast Call For Help) support, or even just one profile that fits all.

It can be used in a global environment like ours as a single instance or with multiple servers across the globe. It even has built-in capabilities for configuration and maintenance, as well as hostname mismatch resolution.

But the coolest thing about it is the fact that it really simplifies management of our vPro fleet.

I can't wait until we complete our full deployment of SCS 8.1 in Intel IT within the coming weeks. We are looking forward to using the even better management and analysis tools on our vPro fleet. If you ever used vPro, thinking of using it or simply wondering about it, I’ll be happy to hear and assist. Let me know what’s on your mind.

Randomizing the time for Set-AMTAlarmClock

webadmin@intel.com — Tue, 07 Aug 2012 14:03:46 GMT

*****************************************

All Intel-provided code snippets in or attached to this blog are provided under the Intel Software Community License unless otherwise specified.

Any user submitted code or materials posted on this blog is supplied under license from the submitter, and should be used or downloaded in accordance with any license terms specified. Intel is not responsible for user submitted code nor warrants that it will work correctly. If no license is provided, you should contact the submitter.

*****************************************

I was showing off setting an Intel vPro Alarmclock to a colleague. He thought it was easy…because it is!

PS C:\Users\cdpiper> Set-AMTAlarmClock 192.168.1.101 -Credential $itprocredential -AlarmTime 2012-08-21T11:22:33

This tells the platform to power itself on at 11:22:33 on August 21, 2012.

“BUT…” he starts to say. Great – there is always more!

“But what?” I reply.

“But what happens if I want to power on the machine at a slightly different time?”

Easy! So I quickly wrote a small cmdlet to input the Set-AMTAlarmClock string and a random minute range.

Feel free to use this:

[CmdletBinding()]

Param (

[Parameter(Mandatory=$true,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, position=1, HelpMessage="Alarm Time in YYYY-MM-DDTHH:MM:SS format")][ValidatePattern("[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]")] [string] $AlarmTime,

[Parameter(Mandatory=$true,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, position=2, HelpMessage="Random minute range to add")][Int] $RandomMinuteRange

)

PROCESS {

$RandObj = New-Object System.Random

$TimeObj = [System.DateTime]::Parse($AlarmTime)

$TimeObj = $TimeObj.AddMinutes($RandObj.next(-$RandomMinuteRange,($RandomMinuteRange+1)))

write-Output $TimeObj.ToString("yyyy-MM-ddThh:mm:ss")

}

Here is an example of using this with a random 180 minute (three hour) range before or after the specified alarm time:

“Awesome” I think to myself as I show him.

“Looks good for running on a single client. BUT…” he starts to say. Great – what else!?!

“…but what about if I want to set a randomized time to lots and lots of systems at once?”

Again, this is where the power of Microsoft’s PowerShell really shines. We discuss the different options. You could write another script that randomizes the $date and calls set-AMTAlarmClock for each $item in a list. You could query each system to get the time and then add or subtract x minutes. You could modify the Set-AMTAlarmClock cmdlet to take a random minute range as an input parameter.

He opted for the last option since the AMT cmdlets already can take in a list of clients. I agreed to blog about it – so here we go!

I modified the original Set-AMTAlarmClock cmdlet located in the C:\Program Files\Intel Corporation\PowerShell\Modules\IntelvPro directory to include the logic from above. Of course to run this cmdlet after modification your execution policy must not be set to All-Signed.

Here is the modified cmdlet:

[CmdletBinding()]

Param (

[Parameter(Mandatory=$true,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$true, position=0, HelpMessage="Hostname, FQDN, or IP Address")] [String[]] $ComputerName,

[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, HelpMessage="Valid Ports are 16992 (non-TLS) or 16993 (TLS)")][ValidateSet("16992", "16993")] [String] $Port,

[Parameter(Mandatory=$true,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, position=1, HelpMessage="Alarm Time in YYYY-MM-DDTHH:MM:SS format")][ValidatePattern("[0-9][0-9][0-9][0-9]-[0

-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]")] [string] $AlarmTime,

[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, HelpMessage="Periodic Interval in DD-HH:MM:SS format")][ValidatePattern("[0-9][0-9]-[0-9][0-9]:[0-9][0-9]:[0

-9][0-9]")] [string] $Interval,

[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, HelpMessage="Use TLS (Port 16993)")] [switch] $TLS,

[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, HelpMessage="Digest of Kerberos User")] [string] $Username,

[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, HelpMessage="Digest of Kerberos Password")] [string] $Password,

[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, position=2, HelpMessage="PS Credential")] [System.Management.Automation.PSCredential] $Credential,

[Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, HelpMessage="Random minute range to add")][Int] $RandomMinuteRange

)

PROCESS {

$Results = @()

$RandObj = New-Object System.Random

#create a connection object

$Connection = New-Object Intel.Management.Wsman.WsmanConnection

if ($credential.username.Length -gt 0)

{

$Connection.SetCredentials($credential.Username, $credential.Password)

}

elseif ($username.length -gt 0)

{

if ($password.length -gt 0)

{

$Connection.SetCredentials($username, $password)

}

else

{

$cred = Get-Credential $username

$Connection.SetCredentials($cred.Username, $cred.Password)

}

if ($Port.Length -lt 1) {

if ($TLS.IsPresent) {

$Port = 16993;

}

else {

$Port = 16992;

}

Foreach ($comp in $ComputerName)

{

$Connection.SetHost($comp, $port)

if($Port -ne "16992")

{

$GMTError = $false

}

else

{

$http = [System.Net.WebRequest]::Create("http://"+$Comp+":"+$port+"/logon.htm")

$httpResponse = $http.GetResponse()

if($httpResponse.StatusCode -eq [System.Net.HttpStatusCode]::OK)

{

$amtTime = [System.DateTime]::Parse($httpResponse.GetResponseHeader("Date"))

$systemTime = [System.DateTime]::Now

if($amtTime.Hour -ne $systemTime.Hour)

{

# AMT Time was not set to UTC

$GMTError = $true

}

$httpResponse.Close()

}

$Obj = new-object psobject

$Obj | Add-Member -MemberType noteproperty -Name ComputerName -value $Comp

$Obj | Add-Member -MemberType noteproperty -Name Port -value $port

$AlarmClockService_EPR = $Connection.NewReference("http://intel.com/wbem/wscim/1/amt-schema/1/AMT_AlarmClockService")

$AlarmClockService_EPR.AddSelector("SystemName","ManagedSystem")

try

{

$AlarmClockService = $AlarmClockService_EPR.Get()

}

catch

{

$Obj | Add-Member -MemberType noteproperty -Name "Status" -value "Failed"

$Obj | Add-Member -MemberType noteproperty -Name "NextAlarmTime" -value "[Error]"

$Obj | Add-Member -MemberType noteproperty -Name "PeriodicInterval" -value "[Error]"

$Results += $Obj

continue

}

if($AlarmTime -ne "")

{

if ($AlarmTime.EndsWith(":00") -eq $false)

{

$replace = $AlarmTime.SubString($AlarmTime.Length-3, 3)

$NewAlarmTime = $AlarmTime.TrimEnd($replace);

$NewAlarmTime+= ":00"

$AlarmTime = $NewAlarmTime

}

$SetAlarmTime = $Connection.NewInstance("Datetime")

try

{

$TimeObj = [System.DateTime]::Parse($AlarmTime)

$TimeObj = $TimeObj.AddMinutes($RandObj.next(-$RandomMinuteRange,($RandomMinuteRange+1)))

}

catch

{

$Obj | Add-Member -MemberType noteproperty -Name "NextAlarmTime" -value "[Parse Error]"

$Results += $Obj

continue

}

if($GMTError)

{

# Local Time

$SetAlarmTime.Text = $TimeObj.ToString("s")+"Z"

}

else

{

# Universal Time

$SetAlarmTime.Text = $TimeObj.ToUniversalTime().ToString("s")+"Z"

}

$Obj | Add-Member -MemberType noteproperty -Name "NextAlarmTime" -value $TimeObj.ToString("F")

$AlarmClockService.SetProperty("NextAMTAlarmTime",$SetAlarmTime)

}

if($Interval -ne "")

{

if($Interval.Contains("-"))

{

$temp = $Interval.Split("-")

$Day = $temp[0]

$TimeInterval = $temp[1]

}

else

{

$Day = "0"

$TimeInterval = $Interval

}

$temp = $TimeInterval.Split(":")

$hours = $temp[0]

$minutes = $temp[1]

$seconds = $temp[2]

$intervalstring = "P0Y0M" + $Day + "DT" + $hours + "H" + $minutes + "M"

$SetIntervalTime = $Connection.NewInstance("Interval")

try

{

$TimeObj = [System.DateTime]::Parse($AlarmTime)

}

catch

{

$Obj | Add-Member -MemberType noteproperty -Name "PeriodicInterval" -value "[Error]"

$Results += $Obj

continue

}

$SetIntervalTime.Text = $intervalstring

$Obj | Add-Member -MemberType noteproperty -Name "PeriodicInterval" -value $intervalstring

$AlarmClockService.SetProperty("AMTAlarmClockInterval",$SetIntervalTime)

}

try

{

$RetVal = $AlarmClockService_EPR.Put($AlarmClockService)

$Obj | Add-Member -MemberType noteproperty -Name "Status" -value "Successful"

}

catch

{

$Obj | Add-Member -MemberType noteproperty -Name "Status" -value "Failed"

}

$Results += $Obj

}

Write-Output $Results

}

The differences?

Added Line 11: [Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$false, HelpMessage="Random minute range to add")][Int] $RandomMinuteRange

Added Line 104: $TimeObj = $TimeObj.AddMinutes($RandObj.next(-$RandomMinuteRange,i($RandomMinuteRange+1)))

That’s all!

Hope he doesn’t ask for more!

Intel® 3rd Generation Core Processors and Windows 8: Better Together

webadmin@intel.com — Tue, 19 Jun 2012 15:47:18 GMT

Intel produced the latest “tick” (or die shrink) on our “tick-tock” release schedule with the Intel® 3^rd Generation Core Processors. Code named “Ivy Bridge,” this next generation brought us to a 22nm manufacturing process. Newer processors perform as well or better than previous models, with lower power requirements and better cooling. In addition to the thermal and performance improvements, our Intel 3^rd Generation Core Processors brings an updated version of integrated Intel HD Graphics that is compatible with DirectX 11, improving intensive 3D experience and allowing the user to view 1080p HD video smoothly.

As for Ultrabooks, there are actually more than 110 Ultrabooks based on dual-core version of 3^rd Intel Core Generation processor. Most of these designs are intended for the more traditional laptop form-factor; however with Windows 8 expected to launch this year, we should see more innovative designs as well. There will be more than 30 models with touchscreen functionalities, including 10 convertible designs that can be used as laptop or tablet.

To be classified as an Ultrabook (which is an Intel trademark), there are some requirements which can only be achieved through capable operating system integrations, such as Windows 8:

Thin Design: must be 18mm or less in thickness for systems with display less than 14inches and 21mm for larger screen
Responsive: A interesting capability that comes with this generation is device wake in flash – going from sleep state to full use in less than 7 seconds
Battery Life: The Ultrabook must offer at least 5hs of battery life with 8hs as recommended
Security Enabled: Anti-theft technology (i.e. AT) and Identity Protection Technology (i.e. IPT) are those security features embedded into Ultrabook platform
Faster I/O: must have USB 3.0 or Thunderbolt technology
Processor: Powered by 3^rd Intel Core Generation processor

To complement these technical specifications, Microsoft has redesigned the user interface in Windows 8. Known as Metro, this interface is specifically designed to bring an excellent experience for touchscreen devices, with beautiful tiles and a motion engine.

Tablets and smartphones are also utilized in the workplace and as personal devices. For knowledge workers, tablets are an excellent device to consume information with their sleek displays and user-friendly motion engine. On the other hand, Ultrabooks have a convertible design and a mature operating system such as Microsoft Windows. They allow the possibility of having a single device that provides an ergonomic solution, supports easy attachment to use multiple/bigger displays, and remains a thin, light and tablet-like form factor. Ultrabooks provide the most flexibility in the user’s life and are, in my opinion, the best solution – removing concerns with data synchronization, application compatibility and other issues that come with managing a second device.

A convertible Windows 8 PC with a 3^rd Generation Core processor (such as Lenovo IdeaPad Yoga presented at CES 2012) provides an experience that you cannot get with Windows 7 alone, and will be the best solution for my work environment.

Best Regards!

Configuring Intel vPro with Linux in User Control Mode

webadmin@intel.com — Thu, 19 Jan 2012 21:54:00 GMT

This is the second post about configuring Intel vPro with Linux, the first post was about Intel Setup and Configuration Service 7.2 that is a special version designed for Linux users, actually only supported on SUSE Linux Enterprise Desktop (SLED) 11 SP1, 64bits.

Now, I’ll describe how to configure a Linux machine using Intel SCS 7.2 for Host-based configuration. The very first step is to install the required drivers and services in order to allow the ACUConfig (i.e. a utility that is part of Intel SCS) to communicate with the Intel ME for locally provisioning the Linux machine.

Intel Management Engine Interface:

It’s a driver that must be installed that allows applications to access the Management Engine firmware via the host interface. Messages from the Intel MEI driver are sent to the systems log (i.e. /var/log/messages). Once the Intel MEI driver is running, an application can open a file to it, connect to an application on the firmware side, and send and receive messages to that application.

Click here to download the MEI driver. If you are using a SLED 11 SP1 64bits you only need extract the content of this package and install it using the RPM with root privileges:

linux:#rpm –i mei-7.1.20.25.x86_64.rpm

There isn’t a console output showing that installation succeeded.

Intel Local Manageability Service:

The Local Manageability Services (aka. LMS) allow applications, such as ACUconfig, to access the ME firmware via the Management Engine Interface. The LMs is dependent on the MEI driver, so the MEI driver should be installed prior to LMS installations. As the majority of Linux services, LMS runs as a daemon and messages from the service will be sent to syslog. Once the LMS is running, it listens for incoming connection requests on the following ports:

Port 16992 for SOAP and WS-Management requests.
Port 623 for WS-Management requests.

Click here to download the LMS Service. If you are using a SLED 11 SP1 64bits you only need extract the content of this package and install it using the RPM with root privileges:

linux:#rpm –i lms-7.1.20.25.x86_64.rpm

You should receive a message in the console about the status of installation and service.

Using ACUConfig

Now that your Linux is ready for host-based configuration, you can test and check the status of your vPro machine using ACUConfig using syntax like this:

linux-8xff:/home/bruno/Downloads/IntelAMTSCS/Executables # ./ACUConfig -Output console Status Starting log 2011-12-27 19:23:42

: Retrieving machine status...

Host information-

UUID- 0EC7E5D1-32B8-11E1-B45E-A484BF0CC0AD

Intel(R) AMT version- 7.1.3

The system is unconfigured.

The system TLS setup is using PKI.

The system supports host-based configuration.

AMT state- Pre-Provision(0)

***********

Exit with code 0 - The requested operation completed successfully.

Note in this output that the system is unconfigured and that supports host-based configuration.

Creating Profile

In order to configure Intel® vPro™ it is required that we supply information about how the machine behaves such as: WebUI, IDE-R, KVM, security authentication and authorizations, network connectivity, etc. The way that we accomplish it with Linux is the same with Windows machines: you should use Intel SCS 7.1 console to create the profile and export to .xml file.

This process is fully documented in Intel SCS 7.1 documentation folder.

Provisioning

The provisioning process is very similar with Windows ACUConfig version as you can in this video:

At this point, we are able to manage an Intel vPro machine in User Control Mode.

Best Regards!

Demystifying VeriSign certificates for Intel® vPro™ activation

webadmin@intel.com — Tue, 20 Dec 2011 17:44:00 GMT

There are several ways to configure an Intel® vPro™ machine and the most popular among corporate companies is the Zero Touch configuration method, which is based on PKI. You must issue a certificate for a provisioning server in order to establish a trusted relationship between the provisioning server and the ME. VeriSign is one company that can provide a certificate for this.

Since the launch of Intel® vPro™ in 2006, VeriSign has made some changes to their products. Rather than issuing certificates from G1 and G3 roots in their Secure Site (Standard SSL) and Secure Site Pro (Premium SSL) SKUs, these products now issue certificates of different roots. Unfortunately, Intel ME is firmware and updating the list of root certificate authorities is not as easy as it is in an operating system. Updating this list in the Intel ME will instead require a firmware upgrade.

If you have different Intel® vPro™ generations in your environment, you are most likely looking for a solution that uses the least common denominator like we have displayed in this table:

Firmware version	VeriSign Hash
2.x	G1 and G3
2.6.20	G1, G2 and G3
3.x	G1 and G3
3.2.10	G1, G2 and G3
4.x	G1 and G3
4.2.x	G1, G2 and G3
5.x	G1 and G3
5.1.10	G1, G2 and G3
2.6.40	G1, G2, G3 and G5
4.2.30	G1, G2, G3 and G5
5.2.30	G1, G2, G3 and G5
6.x	G1, G2 and G3
6.1	G1, G2, G3 and G5
7.x	G1, G2, G3 and G5

As you can see, the latest version of each firmware generation is accompanied with a complete list of trusted roots.

However, a problem occurs if you have multiple versions of vPro but are only able to use one certificate for provisioning server (and cannot issue a certificate from G1 or G3 anymore). Fortunately, in order to avoid interoperability issues with legacy browsers, VeriSign makes a cross-signed of VeriSign Class 3 PPCA-G5 with Class 3 PPCA (G1.3). This is called Secure Site Pro, creating a cross certificate as shown in this diagram:

Usually, OpenSSL libraries use a PEM file format when building the trust chain in order to validate the certificate. We can statically define the trusted certificates that we would like to use in this chain. Microsoft has some wrapper code available to build the PEM list of certificates and, in this particular case, Windows has 3 possible root certificates to be used. All three are equally valid and Windows built the trusted chain using the shortest chain, i.e. VeriSign "G5" Class 3 PCA Root or VeriSign "G1.5" Class 3 PCA Root, both of which are not present in some old ME firmware. When you install the certificate, without any modification you see the root certificate VeriSign "G5" Class 3 PCA Root as shown here:

In order to force Windows to build the trusted chain up to VeriSign Class 3 Primary CA - G1, we have to eliminate VeriSign "G5" Class 3 PCA Root and VeriSign "G1.5" Class 3 PCA Root from the Root folder (or at least disable Client Authentication and Server Authentication from the purpose list of these certificates).

Without these two certificates, the only valid chain will be with VeriSign Class 3 Primary CA - G1. That chain is present in every ME firmware version, since the first version, i.e. 2.0 through 7.1 - See below:

Now you don’t have to be concerned about these VeriSign certificate issues with your Intel vPro versions, just follow the instructions presented in this document and have yourself a happy vPro configuration.

MEI Driver Now Available via Microsoft Windows Update

webadmin@intel.com — Mon, 19 Dec 2011 21:36:27 GMT

Intel AMT, Anti-Theft Technology, and other solutions interfacing with the Management Engine in the chipset commonly use a kernel level driver. Formerly called the HECI (Hardware Embedded Controller Interface), the driver now by and commonly called the MEI (Management Engine Interface).

If you are using an OEM provider base operating system install, you likely have the MEI driver already. However, it is more likely that you have reinstalled or re-imaged your system with a corporate image. If you are getting a missing driver install prompt for "PCI Simple Communications Controller", this indicates that the MEI driver is missing from the system.

Shown below is a screenshot of the Device Manager with an "Other Device" missing a device driver.

There are 2 main ways to get the driver installed

Option 1 - For 2010 and newer platforms, a base MEI driver is provided via Microsoft Windows Update similar to the example shown below.

Two key caveats with option 1.

An incorrect driver version got released earlier this year. If your platform shows the MEI driver installed without expected functionality, check the driver version. If the MEI driver version is 1.x (such as the example below) or possibly 9.x, this is the incorrect driver. Remove from your platform and try the Windows Update again. (The incorrect driver was pulled from the Windows Update).
The second caveat is that only 2010 or newer platforms are supported for Microsoft Windows Update download and installation of the MEI driver. For older platforms or situations where Microsoft Windows Update is not accessible, see the second option below.

Option 2 - Download and install the MEI driver from the OEM website. The example below is from HP.com, and for those familiar with HP SSM, notice that this driver is SSM compliant.

For large scale or script installations, extract the files from the OEM provided package. In the software delivery script, use the command "setup.exe /s"

When the MEI driver is successfully installed and functional, it will look similar to the following Device Manager example

Intel IPT and Symantec VIP

webadmin@intel.com — Mon, 28 Nov 2011 13:00:09 GMT

In 2011, Intel introduced the 2nd Generation Intel Core platform with Intel Identity Protection Technology (IPT). Intel IPT provides an integrated hardware component to assist with two-factor authentication. More information on Intel IPT is available at http://ipt.intel.com.

An update to Symantec VIP access provides integration with Intel IPT. Websites secured with VeriSign and ready for the combination of IPT\VIP provide a new level of authentication for a larger number of users.

The concept of hardware tokens with a unique 6 digit code generated every 30 seconds is not necessarily new. However, it required a lot overhead in managing the physical tokens. For each physical token issued to a target user, it must be maintained. If the token is lost, it must be deactivated and a new token issued. Even worse, if the seed value used by the tokens is compromised all of the tokens must be reissued.

Intel IPT and VeriSign VIP takes a different approach. The physical token is replaced by a combination of embedded security hardware with an enabled software component.

The video demonstration provides a consumer example accessing PayPal.

Note: Double-click to launch in YouTube*.

An enterprise example for VPN access is shown in the Tech 10 video at http://www.youtube.com/watch?v=W71udR3WH0w (see the second half of the video) along with http://www.youtube.com/watch?v=W6ljEvCSKSM

The VIP access desktop software is available at https://idprotect.verisign.com/learnmoredesktop.v. Those with an Intel 2nd Generation Core platform that supports Intel IPT can start using this technology with enabled VIP access websites. More information on OEM SKUs supporting IPT is available at http://ipt.intel.com/Protected-PCs.aspx with enabled websites listed at http://ipt.intel.com/protected-sites.aspx

Intel Setup and Configuration Service 7.2: Designed for Linux

webadmin@intel.com — Thu, 03 Nov 2011 14:21:26 GMT

This post is the first in a series about configuring Intel vPro with the Linux operating system. The motivation for this series is that Intel vPro has been adopted for embedded systems such as ATMs, Digital Signage, Kiosks, etc. and the knowledge to do it is almost tribal. In this post, I would like to introduce the Intel SCS 7.2 that was tailor made for Linux and the following posts I’ll demonstrate how do it with more details.

As I mentioned, Intel® Setup and Configuration Service 7.2 (aka SCS 7.2) is a special version designed for the Linux operating system on an Intel vPro machine. However, the capability presented in this version is not the same that is present in Intel SCS 7.1, which is designed for the Windows operating system. Intel SCS 7.2 brings only these two components:

Configurator (aka. ACUConfig): A command-line application that runs locally on the Intel AMT system. You can use this tool to configure the system using an XML file (i.e. Host Base Configuration) or Manual configuration through a USB key.

Configuration Profiles: XML files that contain configuration settings for the Intel AMT devices.

However, these components are more than enough to cover most usage cases:

- Desktops running Linux where you want user consent with remote operations such as KVM;

- Embedded Devices that are in a staging area to be completely prepared before deployment; the configuration can be performed by a USB key (i.e. manually);

At this stage, this version only works with Intel vPro with firmware version 7.1.2 (or later) and Intel SCS was tested only on SUSE Linux Enterprise Desktop (SLED) 11 Service Pack 1, however there are no reasons for it to not work with different Linux flavors.

Requirements:

In order to create the Configuration Profiles (i.e. XML files), you will need the ACU Wizard found in Intel SCS 7.1 under ACU_Wizard folder (it requires a Windows machine to execute it).

In order to bridge the communication between the Intel ME (aka. vPro firmware) and Linux OS, there are two components required: Intel® Management Engine Interface (Intel MEI) driver and Local Management Service (Intel LMS) driver. Intel® MEI driver allows application, such as ACUConfig, communicate with the firmware using host interface, and LMS driver allows applications to access the Intel® ME via local Intel® MEI.

If you are not using a Linux kernel version 3.0 or later, you should install these drivers that can be downloaded here.

In the next blog I’ll show you how configure an Intel® vPro machine running Linux in Admin Control mode using manual configuration (i.e. USB key).

For further information about how to enable Linux for Intel® vPro, read this document.

Best Regards!

BriForum Observations Chicago 2011

webadmin@intel.com — Wed, 27 Jul 2011 20:50:12 GMT

Just got back to my office from the BriForum (http://www.brianmadden.com/) show in Chicago. I was there working the Intel/Dell/Citrix booth as well as giving a classroom presentation. I wish I had more time to attend more of the classroom sessions but working the booth kept me rather busy. Here are my thoughts and observations from the show.

-No one size fits all.

-If it is not broke don’t fix it.

-The end user experience is important.

-IT shops will engage in desktop virtualization implementations for security, manageability and faster rollout of Apps, not so much just for cost savings.

-Interest in type 1 hypervisors is growing.

-VDI still being looked at first, before any other delivery model, but no widespread adoption yet.

-Desktop virtualization is far different than server virtualization.

During my presentation I had about 115 people in the room. I asked how many either had a POC in progress or were in production with vdi. 30-40% of the people raised their hand. Then I asked how many people had vdi in production with over 500 users. Approximately 6-8 people raised their hand. A lot of people are looking at vdi, but not many large implementations yet of vdi yet. At least, not of the people in my class that day. There was more discussion this year than last around other delivery models besides vdi. Organizations will likely have a mix of delivery models around desktop virtualization. In addition to vdi, os/app streaming, hosted/virtualized apps, local containers/vm’s are all part of the various delivery models that are available today. No one size fits all. No one delivery model is ubiquitous yet, and may never be.

Another comment I heard was, if you are happy with the way you currently manage your desktops, don’t change it just for the sake of change, or changing to some desktop virtualization model, thinking that it will save you money, it will not. Seems as though the word has gotten out that one needs to look at all the back end costs and software costs associated with implementing a desktop virtualization model, not just the end client costs. Some companies are moving to desktop virtualization models but for other reasons than just cost savings. Those reasons being more centralized management, security, and faster application rollouts.

It was interesting to see a small trend towards having the end point perform some of the application processing when possible, rather than having the back end servers perform all the cpu application cycles. Certainly all the type 1 hypervisor offerings perform all the application cycles locally but so now does Red Hat’s offering with the SPICE protocol. The SPICE protocol looks to the endpoint first and the server second to perform the applications. I think we will see more of this type of balanced approach in the future between the endpoints and servers. With intelligent clients we will be able to let the clients perform the application cpu cycles when conditions permit, and when they do not, the servers will do all the work and just send out the screens.

It was brought out many times that Desktop virtualization in not like server virtualization. There are many more things to consider like graphics, usb ports, user personalization, and sleep/hibernate modes that are not found on servers. So desktop virtualization, while not necessarily hard, can be very involved.

All in all, I thought it was a good thought provoking show. Brian Madden and his team did another excellent job. If you have never been to a BriForum show before, you owe it to yourself to go to next year’s show. See some videos of the show here. http://www.brianmadden.com/blogs/videos/archive/2011/07/22/brian-and-gabe-walk-the-floor-at-briforum-chicago-2011.aspx

Also some more info on desktop virtualization here. http://www.intel.com/assets/pdf/whitepaper/dv_understanding_desktop_virtualization.pdf