Intel vPro Expert Center Blog

Intel vPro Expert Center Blog

Intel vPro Expert Center Blog : October 2007

Previous Next
Click to view Ylian Saint-Hilaire's profile
1

It's time for one more release of the Intel AMT DTK v0.43. Here are the major changes in this release:

  • New Installer. Probably the most visible change is the new installer. The Intel AMT DTK is no longer a self-extract and I am looking for feedback on the installer and it's ease of use. I think users will appreciate that you can selectively install only portions on the DTK that make sense on a given computer (Console, Agent, Switchbox, Utilities).
  • New Japanese translation. All of the DTK tools got a new Japanese translation this week thanks for employees from Intel Japan. Intel AMT Defender got it's first translation into a new language, and many of the new features in Intel AMT Commander and Intel AMT Director are now translated to Japanese.
  • New Resource Translation Tool. I added the Intel Resource Translation tool in the DTK package. I am looking for people to translate portions of the DTK into other languages and this tool makes it very easy. Just run, load the dictionary, select a language and start translating. You can also select what tool or form you want to translate. When done, send me the dictionary file, my e-mail address is in the readme.txt file or about box and I will make it part of the next release. I also will be giving out prises, I will be figuring something out.
  • Console & mouse support. Intel AMT Guardport has a new "CMD" command allowing the administrator to shell to the command prompt and access all of the power of a text mode command prompt. As a bonus, I also added mouse support in the terminal, so you can enter EDIT and move the mouse and click to get into text mode menus.
  • New WMI-over-SOL. I started work on performing Windows Management Instrumentation (WMI) queries over Serial-over-LAN. It is early work, but it's looks like a powerful new way of managing and fixing computers remotly.

Download: Intel AMT DTK v0.43 Audio Blog (.mp3)

Ylian (Intel AMT Blog)

1 Comments Permalink Tags: intel, amt, commander, developer, dtk, outpost, switchbox, tool, tools, vpro
Click to view swood's profile
4

Greetings from the trenches! My name is Sandy Wood and I'm a network administrator for the Orange County District Attorney's office in Southern California.

What I do

My primary job is to manage and support our fleet of 950 or so Windows workstations and 30 Windows servers. This covers everything from updating software, performance monitoring, alert management as well as second level Help Desk support.

The tools I use the most in my day to day activities are Microsoft SMS Server 2003 and Microsoft System Center Operations Manager 2007. These tools are indispensable in our daily jobs to keep our systems running smoothly and up to date.

vPro What?

Earlier this year, while attending a Microsoft Management conference, I stopped by the Intel booth and learned about vPro technology. Boy, what an eye opener for a management geek! This could really be system management nirvana! Since we were in the beginning stages of planning for the replacement our entire PC fleet, I called my boss and told him he had to make sure that our next systems had vPro technology. This was going to revolutionize the way we managed our systems from deployment to software updating to day-to-day support.

Why Should You Care?

Well, fast forward to today and we're just beginning to receive our first new systems. Brand, spanking new HP systems with, yes, you guessed it, Vpro with AMT 3.0! Everyone watched while we opened and unpacked the first system box. After my big vPro sales pitch, management was keen to see all the great new bells and whistles that vPro and AMT were sure to bring us. Before I go into just how cool it all worked and how cool I looked doing it, I thought it would be instructive to blog the actual steps (and missteps) I took in planning and deploying AMT in a real world situation, warts and all.

This is why you should care - if you're getting ready to deploy AMT or are just interested in the technology, this may (I hope) offer a glimpse into what it will take to get AMT rolling in your world. Reading the manuals is good and I highly recommend it however, nothing beats a real step by step walk through with real situations to give you a feel for the product and its potential.

What's Next?

The next step for me will be the planning phase. Although most of us love to just get out there and run setup, planning before you deply AMT in your environment will truly pay off for you. AMT has a lot of pieces and features that you're going to want to sit down and do a bit of thinking about before running setup. Trust me; you'll be glad you did.

Well, I'm finishing up my planning and will be back here soon with another installment of Life in the Trenches as I run down just what I did to plan for AMT deployment in my environment.

Stay tuned and as always, your comments and questions are welcome!

4 Comments Permalink Tags: amt, client_management, manageability, vpro, vpro_expert_center, orange, county, district, attorney, josh_hilliker
Click to view josh.hilliker's profile
0

What's the difference between a Resource, a blog post, and a discussion?
Wiki resources, blogs, and discussions were born and raised on the Web, so you use them in Clearspace as you would there. The following table suggests ways to think about the content types.


  Resource
Blog
Discussion
Purposes Collaborate with others on a single document; capture information that should be available for a while; create a report, agenda, or meeting notes. See What can I do with documents?
 Express a point of view; call something timely to others' attention; make a proposal to get feedback from others; ponder an idea. See What can I do with blogs?
 Ask a question of the community; ask for suggestions; make a short observation or assertion to get feedback; report a problem. See What can I do with discussions?
Format
Most of the content is in the document itself, with some added in comments by readers and authors. Most of the content is usually in the initial post, with other content added through comments by readers.
Most of the content tends to be in responses to the initial question.
Style More formal, often in the third person.
Informal, usually in the first person. Informal, usually in the first person.
Authoring
Editor — rich or plain text with preview. Same as for blog and discussion posts. Editor — rich or plain text with preview. Same as for documents and discussion posts. Editor — rich or plain text with preview. Same as for documents and blog posts.

I am reposting from the user guide & I believe this helps clear up how we use the 3 different areas of the vPro Expert Center.

Thank You

Josh

0 Comments Permalink Tags: vpro_expert_center, josh_hilliker
Click to view Terry Cutler's profile
0

Take a look at the latest resource article posted at http://communities.intel.com/docs/DOC-1210

Use the file to generate custom setup.bin files for AMT 2.1, AMT 2.5, and AMT 3.0 systems.

0 Comments Permalink Tags: amt, scs, dtk
Click to view josh.hilliker's profile
6

Short Version with Audio


FULL VERSION

If you would like to have more information on how we created the ISO image that copied the hal.dll file please let me know and I will post that information.

Or if you would like to see a certain feature shown how to use on the Intel System Defense Utility please let me know.

6 Comments Permalink Tags: vpro_expert_center, jerry_wheeler, intel_vpro, vpro, isdu, management_console, vpro_humor
Click to view joelsmith's profile
1

Sometimes the methods for dealing with hostile or infected systems on the network are drastic, resulting in lost productivity, time, and energy. In one example the IT staff would physically shut down the user's main network port, sealing off all production systems, test systems, etc, until the hostile machine could be dealt with. Phone calls results, requiring the user to deal personally with the affected system. Now take Intel AMT's System Defense. Remotely quarantine a hostile system and use Altiris to remediate it. System Defense, it puts the power in the hands of the administrator remotely.

Introduction

System Defense (formerly known as Circuit Breaker) allows network filtering at the level of AMT. Systems that have been compromised and are a threat to the network can be remotely quarantined, with certain ports and IP addresses available for remediation. For example the entire network can be filtered out except to the NS, and only those ports required for the Notification Server to remediate the client (install anti-virus, patches, remove harmful software, etc).

Note that testing is vital when using a mechanism that can potentially cut off a system from the network. The ease of remediating compromised systems remotely while quarantining from the main network will remain as long as the filters are properly configured. If not, the system may require a desk-side visit to bring back on the network.

System Defense

System Defense shows as Circuit Breaker in some versions of the Altiris Manageability Toolkit for Intel® vPro Technology. This feature allows a network filter to be placed at the hardware level via AMT. AMT will hijack the operating system's hold on the network connection and apply a secure filter based on a configuration file provided by the administrator.

See the following diagram for a representation of how System Defense (Network filtering) works:

http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/38-10692-1108/SysDefDiagram.jpg

This filter becomes a complete block that disallows any network communication in OR out, save those sources that are configured. Note that the parameters for allowing network communication are those of Sending IP Address and Port. This means that not only to systems have to be explicitly defined to be allowed through, but the ports they are using as well.

Use Cases

The following use cases will find real value with System Defense network filtering:

  • Virus attack from an infected vPro client - This cuts off the ability of that virus to send packets out on the network
  • Vulnerable vPro clients without anti-virus - Close off the ability of a virus from getting through to the vulnerable system
  • Vulnerable vPro clients without critical patches or updates - Quarantine systems, but allow NS to remediate to bring the system up to corporate security standards
  • Unauthorized Network use - plug a system that is found participating in unauthorized network use, whether it be unauthorized content, gross use of bandwidth for non-approved purposes, etc...
  • For fun - Drive a fellow administrator crazy by applying and removing filters randomly from his computer (Just kidding, don't try this at home, or at work for that matter)

Task Server Integration

As of Real Time Console Infrastructure release 6.3 the Task Server now has a Task type of Network Filter. This exclusively uses Intel AMT System Defense to apply a comprehensive filter that only allows strict communication to and from the NIC. Because of Task Server's sequencing engine and collection targeting, jobs using this can be setup to do a large number of things, including patching, critical application install such as anti-virus, and other critical computer maintenance items required by the organization.

Task Server Jobs

As a primer for details in this article, see the following article series on Altiris Juice: http://juice.altiris.com/article/2088/utilizing-intel-vpro-amt-technology-with-task-server-introduction.

See the Introduction for more information on jobs. There are two major types of a Network Filtering job:
  1. Apply a System Defense network filter, either the default filter allowing communication to the NS for remediation or a custom filter allowing access to necessary resources
  2. Remove a System Defense network filter to open back up general network communication

See the following screenshot for the option when this Task type is created:

http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/38-10692-1111/SystemDefenseTask.jpg
  • The first radial button allows the application of a filter, either a custom or the default, with the added option of enabling anti-spoofing filter
  • The second radial button simply applies a PING filter to the target systems
  • The third and final radial button removes any filters previous applied to the system

Job Targeting

Because of the significance of System Defense and what it does to client computers, I'm going to cover how Task Server Jobs target systems. With a Task Server job you can add individual systems or whole collections of computers. Collections are either manually or dynamically defined and can have few or many systems therein. Multiple systems and collections can be attached to the running of a job, either on demand or by a schedule.

Since System Defense is essentially quarantining vPro Systems, any Task or Job should be tested in a lab environment to ensure workability. If a custom filter is used, the potential to decapitate vPro systems from the network becomes a very real, very severe consequence of improper filters. Take the scenario of having a custom filter that does not allow proper communication back to the Notification Server or another critical resource (like Task Server) in the remediation process. Once the trigger is pulled and the System Defense network filter has been applied, those systems now have insufficient network access to remediate, which may mean that a remote Task to remove the filter is unavailable. IF the job contained half the computers in the environment, the impact is huge.

I say again: Test every filter within every job to ensure everything works properly!

Filter Configuration

Real-Time System Manager allows you to create your own filter configuration files to use with a System Defense Task. In some instances it may be required to open additional ports or destination IPs for full remediation to occur. If you use Package Servers to deliver software you may need to allow communication to these systems.

Edit Network Filters Utility

A utility is provided to create, edit, or otherwise revise any filter file to be used by a System Defense Task. This filter is provided via the Altiris Knowledgebase.

Installation The ENF Utility

See the following article for both the guide in using the utility and to download the utility directly:

https://kb.altiris.com/article.asp?article=34891&p=1

The attached file is a zip. The file included Altiris_ENF_6_2.exe will install the utility on the computer it is executed on. The prerequisites for this utility include:

  1. Windows 2000 Server or Windows 2003 Server
  2. .NET 1.1
  3. Notification Server 6.0 Sp3
  4. At least Real-Time Console Infrastructure 6.2

Using the ENF Utility

Once the installation has run, the Altiris Console can now be used to edit the filters. It's found in the Altiris Console under View > Solutions > Real Time Console Infrastructure > Configuration > and click on ‘Edit Network Filters'. The console provided a spreadsheet of the current filters for the default filter file, as shown:

http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/38-10692-1109/ENFUtil.jpg

When you click the Edit pencil icon, a subsequent window will appear. This wizard will walk through editing of the filters. This same wizard is used to add new filters to the list. This wizard is robust and allows minute tuning of what ports are allowed, both for sending and receiving from the NS and from the host AMT computer. The wizard appears as follows:

http://communities.intel.com/openport/servlet/JiveServlet/downloadImage/38-10692-1110/ENFUtilWiz.jpg

The default file is called CBFilters.xml and is found at \Program Files\Altiris\RTSM\UIData\. Other files can be created and used in the System Defense Filtering Tasks. It is configurable per Task or Job instance.

NOTE: If you plan on making changes to the default filter file, it is recommended to browsing to the file and making a copy of it. The copy will be a backup to use in case the default file becomes corrupt through editing or for related recovery options.

The best way to know how to open which ports to enable the access you require is to consult the documentation for the application or mechanism you are trying to work with. For example the Task Server uses ports 50120 through 50124, and these ports need to be opened between the Task Server to be used and the client computer.

Conclusion

As previously indicated, make sure you test every system defense task and job you plan to use out in your environment. It's one thing to test against one or two systems where you can manually resolve any unforeseen problems, but if a targeted collection contains many systems and the job or task as an unforeseen issue, this can cut off all these systems from the necessary access to restore network functionality. So test, test, test, and test again before deploying large jobs using System Defense network filtering.

When used properly, this tool enables administrators to remotely deal with vulnerable or infected systems remotely, and stop unauthorized network use. With System Defense enable your administrators to more quickly deal with threats, and remediate in much less time.

1 Comments Permalink Tags: task_server, amt, system_defense, altiris, symantec, intel, vpro
Click to view David Grawrock's profile
4

The passive TPM

Posted by David Grawrock Oct 25, 2007


One interesting point that many individuals do not realize is that the TPM is not an active device. Let me explain. For this purpose an active device is one that gets to make a "decision" on the platform and interrupt what else is going on. A passive device only responds to requests.

The TPM, on the PC, currently resides on the Low Pin Count (LPC) bus. The LPC bus, as it's name implies, has just a few pins and wires and is very limited on the amount of data that moves across the bus. In fact the LPC bus operates at the blazing (tongue in cheek here) speed of 33 MHz. One property of the LPC bus is that the devices that attach to the bus are supposed to, by specification, to be passive devices. That is each device on the LPC bus only responds to commands.

The TPM design also only contemplates a passive device. The entire command set is designed to respond to requests. There are no commands that work on interrupts or initiate an action. Each TPM command is a response to a specific request from either the platform itself or the users of the platform.

The reason why this distinction is important is that with the TPM being a passive device, using the TPM requires software to request the TPM to perform an operation. The TPM has no mechanism to act independently on it's own.

Now you know why the TPM is a passive device.

PS sorry for not posting for a few days but life can get busy at times.

4 Comments Permalink Tags: tpm, security, vpro
Click to view Terry Cutler's profile
0

This is the third and final part of this series (at least for now). The previous two posts include Basics and Common Intel SCS errors

BEFORE GOING ANY FURTHER - PLEASE READ AND ENSURE THE FOLLOWING
At this point, you have ensured the infrastructure is setup correctly and have attempted to troubleshoot the common Intel SCS errors as listed in the SCSconsole log file. Intel vPro systems are being recognized and listed in the SCSconsole. However, strange or unexpected behavior continues to occur - whether during provisioning, maintenance, or other activities. If Intel SCS has been included in a system management console or a provisioning script provider with whom you are working - AND - further debug analysis is needed, the following points may help. The debug log output may be one of the datapoints requested to replicate and remediate issues.

Before we go on - please note that these steps require modifications to the Microsoft Windows Registry on the system labeled as "ProvisionServer". That system will be running the AMTconfig service. Enabling the debug logging features will require root drive access and space to capture and store the log outputs. The logs will be stored at the root of C:

Ready to create an Intel SCS debug log?
SCS debug logging is off by default. If enabling for troubleshooting purposes, be sure to disable when done troubleshooting. The following steps will require a new registry key and string value to be added. Once these changes have been made - restart the AMTconfig service. At most, two log files will appear on the root of c: drive. The first is scs_win_server.log the second is scs_server.log. The second commonly appears only after errors have occurred.

Create the following registry key on the service's machine:

HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\AMTConfServer\Log with string value "LogLevel"="V"

Click on the following image to view the entire image

SCSdebuglogv2.gif

Logging levels can be set to 'V' for verbose, 'W' for warnings and errors, 'E' for only errors.

Once the debug log capture is complete, remove the LogLevel entry from the registry and restart the AMTconfig service.

This concludes the three part Intel SCS troubleshooting. If the community is experiencing additional events or has additional questions - please comment\reply.

0 Comments Permalink Tags: scs, vpro, troubleshoot
Click to view Terry Cutler's profile
0

This is the second in a three part blog post. The first article covers the Basics and the final article discusses creating an SCS debug log

Handling common Intel® SCS errors
With the SCS event log set to verbose mode, not only will successful provisioning events show but also warnings and errors if you are having difficulty in provisioning or configuring an Intel® vPro™ client. When a successful provisioning process occurs, you will see a sequence of Intel AMT properties being set followed by the statement "Commit Changes". Once this occurs, the target system is configured and ready to send\receive AMT webservice calls.

However, if this does not occur, refer to the following list of common errors with guidelines on how to interpret and resolve.

  • Error 102 - Intel AMT device is already provisioned - This indicates that the IntelAMT database has the target system identified as provisioned. If the target system was manually unprovisioned via the local MEBx, than manually delete\remove the entry from the provisioning console. From a provisioning security perspective, this error may also indicate an attempt to replay a provisioning sequence. The ProvisionServer with Intel® SCS running will reject additional requests if the system is already listed as Provisioned.

  • Error 103 - Request is already in the queue - This is really a status or awareness indicator. Provisioning and maintenance requests are queued within the IntelAMT database and processed by Intel® SCS servers. In larger implementations, multiple Intel® SCS servers can be configured to process requests within a single IntelAMT database queue. The queue includes immediate and delayed requests. Thus if a request is already delayed, this error will be generated. Similarly, if the request is being processed or handled by the poller, a competing request will generate this message.

  • Error 137 - Another process currently working on AMT - The target AMT device has a preceding request that has not completed. For example, if a partial un-provision request has not completed and a reprovision request is sent, this will generate the error. Reasons for the previously queued request not completing might including connectivity, difference of provisioning state, and so forth. If the error is persistent for a target AMT device\system and connectivity to the target system is available - try executing a management function if the system is in a configured state. (e.g. Remote inventory, remote power on\off, etc). If unsuccessful, the target system may be in an unsupported state. A manual process of partial unprovision may be required. Removing the assigned profile at the provisioning console should occur also.

  • Error 139 - Failed to update Kerberos Password with Kerberos Integration is disabled on server - Intel® SCS has the ability to integrate with Microsoft Active Directory for Kerberos based authentication. Check to ensure schema extensions have been applied and proper authentication to the Kerberos server (e.g. Microsoft Active Directory) is in place.

  • Error 407 - Batch exit code 0xfffff - This is a -1 return caused between a provisioning script and the SCS instance. Incomplete Intel® AMT profile, missing provisioning/configuration data, or other console configurations will likely cause this error. Check with the provider of the provisioning script - whether system management vendor or other. If the error is persistent afterwards, refer to the SCS debug log creation in the next article and contact support of the script provider.

  • Error 602 - Exception in clock sync worker - Clock synchronization is important in Kerberos environments, since the authentication process has a time stamp dependency. This error is benign in non-Kerberos authentication environments. It refers to a SOAP call failure - thus further environment and infrastructure investigation may be needed for future environmental considerations.

  • Error 913 - No rows found in get UuidMap - For provisioning to occur, the UUID and the FQDN of the target vPro system are mapped together. The provisioning script utilized may attempt to utilize WMI, reverse DNS, previously stored asset data or client agents to obtain this data. Check with the provisioning script provider.

  • Cannot contact back AMT with IP:xxx.xxx.xxx.xxx Exception - The recorded IP address from the hello packet sequence is not responding to requests. If the target system sends a new hello packet with an updated IP address, Intel SCS will update the queue entry. This error commonly occurs when the system has been connected, an IP address and DNS resolution have occurred, hello packet was sent, and then the system was disconnected from the network prior to the ProvisionServer response. A common scenario is pre-staging a system before sending to the intended location.

If the suggestions above are not helping, and a deeper investigation of Intel® SCS is needed - a debug log can be created. Please refer to part 3

0 Comments Permalink Tags: scs, vpro, troubleshoot
Click to view Terry Cutler's profile
0

This blog is divided into 3 sections - understanding the basics, addressing common Intel SCS errors, and how to generate an Intel SCS debug log.

If only solutions were perfect, errors resolved automatically, and tuning was never required nor needed. Then again, that's what many of us get paid to do and handle. The intent here is to focus on common Intel® vPro™ configuration and provisioning errors with Intel Setup and Configuration Services (SCS). More importantly, the article intent is to provide some insight on the correction needed or tasks to handle common errors.

The Basics
Deploying Intel® vPro™ enabled solutions presents many working parts. In a lab environment - these "always" work well. In a production environment, determining the cause of an error could be difficult. Generally speaking, to isolate the scenario take into consideration the management console, the vPro configuration services (e.g. Intel® SCS), the OEM firmware and drivers, and the infrastructure. The lab environment comes in handy to isolate components and aspects, especially when so many variables are present.

In stepping through each item, consider the following basic points:

  • OEM hardware and drivers - Check the update page for the latest BIOS and Firmware on the platform. The BIOS update will often include the Intel® AMT firmware. The drivers to be checked are mentioned Management Engine Interface (MEI), Local Management Service (LMS), Serial over LAN (SoL), and User Notification Service (UNS). NOTE: UNS applies to AMT 3.0 and higher versions.

  • Intel® SCS version - Don't know what version if running? Check the AMTconfig service properties or version listed in the SCSconsole. More on SCS and AMT versions here. Version 3.2 is the latest. If running version 1.x, an update to version 3.x is recommended. Check first with preferred system management vendor on supported setups, upgrade paths, and so forth.

  • Infrastructure - Ensure a ProvisionServer DNS record exists for the target DNS domain, and that this pointer record resolves to the server running AMTconfig (e.g. Intel SCS). Ensure proper resolution of the DNS entry for the FQDN of ProvisionServer (e.g. ProvisionServer.company.com)

  • Verbose Logging for SCS events - Within the SCSconsole, access the Change the Log Level to "Verbose" mode. This will log all informational, warning, and error messages and events in the SCS log. This is good to see when a hello packet is received, when the ProvisionServer attempts to provision the target system, and so forth. When changing this setting, you may also want to decrease the log retention level to a few days or shorter timeframe than the default value. Depending on the number of systems managed or attempting to provision, setting the log level to "verbose" may rapidly grow the size of the IntelAMT database.

Image of SCSconsole and setting logging to verbose mode
Verbose logging.gif



Image of SCSconsole viewing log events in verbose mode
SCSlog.gif

0 Comments Permalink Tags: scs, troubleshoot, vpro
Click to view Kelsey_Witherow's profile
0

Check out this very informative video from Intel Pro, Fred Guzman, showcasing how to setup your environment to support Remote Configuration.

Video thumbnail. Click to play

0 Comments Permalink Tags: remot_configuration, vpro, vpro_expert_center
Click to view josh.hilliker's profile
4

Over the last year I have worked with our internal IT shop to implement vPro & CentrinoPro into the environment. While that was fun & rewarding, I thought now would be a good time to implement a smaller instance w/ a mix of clients & try out the new Intel System Defense Utility that I put a link on the tool page..

I've currently procured a centrinoPro, vPro(AMT2.x) & working on obtaining a vPro(AMT3.0) box to showcase all use cases & functionality, especially the Remote Configuration feature. What is good to note is that Matt Royer already helped me demonstrate Remote Configuration in San Francisco IDF & it was very nice to watch the out of the box to having the console automatically provision & show the vPro machine. However now the immediate challenge is for me to set this up w/ ISDU & see what use cases I can utilize.

if your on this path as well, let me know. I like to hear how you are using AMT (active management technology).

Cheers. Off to Provisioning....

UPDATE
I updated the BIOS via USB on the CentrinoPro & vPRO machines to ensure latest bios. I will work to get the post up this week on how to create a dos bootable USB stick & the preferences on size of the stick.

I then downloaded the Intel System Defense Utility, then I hard lined the CentrinoPro machine for now as I have not changed my Access Point settings for WPA at this point
(remember i'm doing this in SMB mode).

I then started the scan & was able to see both machines. If you click on link below you will find that I was able to detect both machines. I started first with inventory to show what I could validate from the Machines. Good to note is that both machines are Plugged into the network & the power (desktop - of course, notebook - yes). I wasn't satisified with the results so I went to each of the machines Web UI to ensure I could connect.


Initial Scan to obtain machines on the subnet, while this took longer than I expected it did find all the machines.
FindScreen.bmp

After finding you double click on each PC & it connects you to the Firmware.
Connected.bmp

Then I pulled an asset mgmt screen on both the notebook & desktop to show that I can pull inventory, take in account each machine is powered down at this point.
AssetMgmtDesktop.bmp
AssetMgmtNotebook.bmp

Now to be sure you can establish communication I went to the Web UI on both, which in the ISDU tool it is simple to click the link & hit the admin login.
WebUIDesktop.bmp
WebUILaptop2.bmp

While this is good, it's time to now showcase the rest of the use cases, including System Defense with a few good filters. I was out hunting for a good virus & found the backdoor.darkmoon. One of the ports is listens on is 6868 & 7777.. I was able to use System Defense as seen below to block these ports by doing the following:
#1. Open up Intel System Defense Utility
#2. Connect to the impacted machine
#3. Select the "System Defense" tab
#4. Select "Block LImited Services"
#5. Uncheck all items & then in blocked ports in put "6868,7777"
#6. Hit Apply Settings, then Apply Changes

DONE - I've now protected my machine quickly against the potential exploit. It doesn't fix it for cleaning, however it does protect the virus from communicating & receiving future instruction.

Now I can remote control it, turn it on, update the DAT files.

4 Comments Permalink Tags: vpro, vpro_expert_center, centrino_pro, tools, isdu, josh_hilliker, manageability
Click to view Ylian Saint-Hilaire's profile
2

Hi everyone. I just released the Intel AMT DTK v0.41 with a few new things ahead of my departure to Taiwan for the Intel Developer Forum . In this new version, I have 3 major new things to report:

  • Intel AMT Defender. I added a new tool called Intel AMT Defender. It's like a community supported version of the Intel System Defense Utility (ISDU) but does it's all new source code. It's a nice new UI, the most impressive thing about it is the new System Defense user interface that is live and very cool.
  • Added Endpoint Access Control (EAC) support. I don't know much about this feature and certainly did not test it, but looking at the Intel AMT API, I added support for it in Commander. If you make it work, let me know.
  • Added WSMAN browser in Intel AMT Outpost. This is very useful to see that WSMAN objects are available on the local Intel AMT interface. As a reminder, what is available locally and remotely is very different.

Intel AMT DTK v0.41 Audio Blog (.mp3)


http://softwareblogs.intel.com/wordpress/wp-content/uploads/2007/10/screen52.jpg

Ylian (Intel AMT Blog)

2 Comments Permalink Tags: intel, amt, dtk, commander, defender, outpost, wsman, eac
Click to view Terry Cutler's profile
0

The conference goes through end of the week - yet the excitement around Intel vPro will continue for days\months to come. Below is a quick summary of items shown. Have questions or want more information? Add a comment or post a question.

  • Keynote demonstration - showing how the Intel vPro client can be remediated (or isolated) to only the management console on specific ports. Using the Altiris TaskServer - a 1:many job was defined to place a system in remediation, restart a process on the client, and remove the system from remediation. This did require a customization to the network filter settings (e.g. System Defense). The value of isolating a system on the computers NIC was very compelling and led to many conversations.

  • At the demo booth - some of the most frequent questions (and associated answers) include:
    1. When will Intel vPro and Centrino Pro be available? (Product available today from all major OEMs - including Dell's recent product announcement for Latitude 630c)
    2. How long has Intel vPro been available? (Product has been available for a year now)
    3. Are customers adopting Intel vPro? (Yes)
    4. How do channel partners and service providers get training or more information to assist their customers? (Utilize sites such Intel vPro Expert, Altiris Juice, and so forth today. Formalized training material and events are being created. Stay tuned)
    5. Does Intel vPro utilize Wake-on-LAN? (The remote power features are communicated via TCP\IP for reliability\consistency. WoL utilizes UDP and a "magic packet" to contact systems - yet may not act as reliably. In addition, Intel vPro remote power features allow for power off. With integration into Altiris - the ability to record present power state, perform list of defined tasks, and to return the system to the previously recorded power state.)
    6. Will Intel vPro appear in other platforms beyond PC-based laptops and desktops? (No publicly stated plans. Raise the question\interest with your preferred OEM)
    7. What break-out sessions and materials were available at the event? ("Realizing the value of Intel vPro" - focus on how to integrate Intel vPro into a production environment. A hands-on lab also occurred to step through common operational usage models.)

There were likely other questions - yet these questions occurred frequently.

With the event closing this Thursday - some early discussions already starting to build on the momentum.... "What should we show next time?". I'm thinking more real-world scenarios, enterprise reference architecture for implementation, and remote configuration - what do you think?

0 Comments Permalink Tags: vpro, event
Click to view josh.hilliker's profile
0

Fellow Pro's. Sometimes finding the right tool is a challenge, so.. I've started a "PRO Tool Wiki" on the site that will feature all known tools and new tools as they get released.

PRO TOOL WIKI
Purpose: Create a single page of key tools that help you integrate & utilize your vPro & CentrinoPro machines.

If you have ideas on tools that would be valueable please let me know, or add links to known good tools on the wiki.

Josh

0 Comments Permalink Tags: josh_hilliker, vpro, vpro_expert_center, tools, vpro_tools
Click to view Ylian Saint-Hilaire's profile
0

Just released version v0.40 of the Intel AMT DTK, with the addition of 802.1x and Endpoint Access Control (EAC) as I wrote about in my previous blog. This is probably not going to be a big impact on many people since this feature is exclusive to large enterprises, but it's very useful for testing Intel AMT in environments where the network has access control. As I noted previously, I don't have equipment to test 802.1x and EAC, so, I will rely on the community to give me feedback.

Another interesting feature in v0.40 is the additon of Intel AMT Guardport as a Microsoft Windows tray icon application and Windows Service. Guardpost is of course the C/C++ version of Intel AMT Outpost, perfect to deployments with smaller system footprint but also for adding to a WinPE based recovery OS.

Intel AMT DTK v0.40 Audio Blog (.mp3)

Ylian (Intel AMT Blog)

0 Comments Permalink Tags: intel, amt, dtk, commander, outpost, guardport, 802.1x, eac
Click to view Gareth Bevan's profile
1

Well, it probably won’t work if you stick it there, but the
truth is that there are a lot of certificates used in AMT, and knowing where to
put those certificates and their private keys can save a lot of hair pulling
down the line.

AMT Certs.jpg


AMT Certificates

Let’s start with the AMT system itself.

TLS Certificate

If the SCS profile calls for TLS to be enabled then a
private key and certificate are generated at the SCS and then installed on the
Amt device as part of the provisioning process. This certificate and key are
then used in future communications between the SCS and the AMT device and the
Management Console and the AMT device. I’m going to use the SMS Add-on as an
example of the management console because it uses gSOAP libraries which have
addition certificate storage requirements.

802.1x Certificate

If the SCS profile calls for and 802.1x certificate then a
private key and certificate are generated at the SCS and installed on the AMT
device as part of the provisioning process. This certificate and key are used
to allow the AMT device to connect to an 802.1x protected network without the
host operating system being available.

Mutual Authentication Root Certificate (MTLS Root)

The MTLS root certificate is used by the AMT device to
validate the mutual authentication certificate provided by the SCS or
management console after provisioning has completed. (Assuming of course that
the SCS profile used for provisioning configures MTLS). This certificate is
installed during the provisioning process. Note only the certificate is
installed – there is no private key installed for this certificate.

h1. Remote Configuration

The remaining two certificates on the AMT device are used
for Remote Configuration. This feature is available in AMT 2.2, 2.6 and 3.0.
(Note that does not include 2.5).

Remote Configuration Root Certificate (RCFG Root)

Actually this is not a whole certificate. It’s just the
certificate thumbnail, referred to as a hash. The certificate hashes can come
from a couple of places:

·{font:'Times New Roman'}
The AMT systems come with default certificate
hashes from VeriSign, GoDaddy and Comodo.


·{font:'Times New Roman'}
Your OEM can place a certificate hash of your
choosing on to the AMT devices you buy as part of their manufacturing process.
E.g. if you have your own PKI and wish to use your own root certificate.

{font:Symbol}·{font:'Times New Roman'}


You can
manually enter the certificate hash into the MEBx screen.


The advantages and disadvantages of each of these methods
are best left for another discussion.


This certificate is used to validate the remote
configuration certificate provided to the AMT device by the SCS service that is
trying to provision the AMT device. The details of this validation are somewhat
complicated and also best left to another discussion.


Remote Configuration Self Signed Certificate

Finally the remote
configuration processes requires the AMT device to generated its own self
signed (i.e. there is no certificate authority involved – and hence no trust
established) certificate to serve as a TLS/SSL certificate in place of the Pre
Shared Key (PSK) that was used to protect provision in earlier version of AMT.
Both the certificate and the key are generated locally on the AMT system.

SCS Certificates

Once we get to the server side, certificates become more
interesting as we have to know which Windows certificate store to put the
certificate and private key.

The SCS requires four certificates.


SSL Certificate

The SCS service runs as a web service within IIS.
Connections to the service can be carried out by the SCS console or by an ISV
supplied UI. To secure this traffic the SCS service requires that these web
services be protected by TLS/SSL. The SSL certificate is the same type used to
secure other web servers like amazon.com or eBay.

This certificate is installed in the Windows certificate
store of the service account used to run IIS. If you use the IIS “Server
Certificate” this is a two step process. First the IIS server generates the
private key and a certificate request. The private key is stored in the IIS
service account key store, and the request is stored in a text file. The
certificate request is then sent to the CA who issues the certificate. The
wizard then installs the certificate and matches it up with the private key.

SCS Certs.jpg


TLS Root

The TLS root certificate is the root certificate from the
certificate chain that issued the TLS certificates to the AMT devices. This may
or may not be the same as your MTLS Root, depending on how you issue your
certs. This certificate is used to validate the TLS certificate provided by the
AMT device when the SCS connects to the device to perform some function after
initial provisioning. This could be re-provisioning or one of the maintenance
tasks that the SCS performs – like setting the AMT system time.

There is no private key associated with this certificate.
The certificate should be stored in the “Trusted Root Certification
Authorities” folder of the SCS service accounts certificate store.


Mutual TLS Authentication Certificate

This certificate is used by the SCS to authenticate itself
to the AMT devices. Both the certificate and the private key should be stored
in the SCS service accounts “Personal” certificate store. The root certificate
of the chain must be installed on the AMT device during provisioning to allow
this authentication mechanism to work correctly.

Remote Configuration Certificate

This is the most interesting of the three SCS service
certificates. This is because the certificate needs to be in two certificate
stores – but the private key only needs to be in one. The SCS service presents
this certificate to the AMT device to start remote provisioning. As this is a
mutually authenticated TLS session, the SCS service must have access to the
private key. So the certificate and private key should be installed in the SCS
service accounts certificate store.

To configure SCS for remote configuration, a utility called
“loadcert.exe” is run. This utility lists the certificates in the local
computer store and you select the one you want the SCS service to use for
remote configuration. The utility then make a registry entry containing the
thumbnail of the certificate. The SCS service looks at this registry entry and
then looks up the selected certificate in the SCS service account certificate
store. Because the loadcert.exe utility reads from the local computer store,
the remote configuration certificate needs to be installed in there. But,
because it is only read by the utility to extract the thumbnail, the private
key does not have to be installed in the local computer store.


SMS (Management Console) Certificates

Certificates for the SMS Add-on are complicated by the use
of the gSOAP libraries. GSOAP is a cross platform, open source web services
development toolkit. Because it is cross platform it does not (obviously) use
the windows certificate store. Instead it uses a file format called PEM (from
the Privacy Enhanced Mail system). PEM files store certificates and keys as
base-64 encoded strings. This makes them easy to manipulate (with things like
notepad) and portable between systems. The following discussion assumes a 3
level PKI hierarchy, with a root CA, policy CA and an issuing CA. If there is
sufficient interest I can talk about PKI hierarchies on a separate thread.

As the SMS is also a windows program, it also needs its
certificates in the windows store.

SMS Certs.jpg


h2. Mutual Authentication Certificate (MTLS)

If the AMT profile the SCS calls for mutual TLS, then the
management console needs to supply an MTLSS certificate. This certificate, and
its private key, needs to be installed in SMS Add-on Service account
certificate store. This allows the SMS Add-on service to access the key for
operations such as power management. Because
the windows certificate store can “walk certificate chains”, only the MTLS cert
needs to be installed. Windows will work out where to get the rest of the chain
from on its own.

This is not true for the PEM file. In order for the gSOAP
library to have access to the certificate chain, all the chain entries must be
placed in the file (in the right order).


TLS Root Certificate

When a connection to the AMT device is made, it presents its
TLS certificate. In order for the Management console to trust the certificate,
the root certificate the issued the AMT certificate must be installed in the
“Trusted Root Certification Authorities” folder in the SMS Add-on’s certificate
store. . Because the windows certificate
store can “walk certificate chains”, only the TLS root cert needs to be installed.

Again, this is not true for the PEM file. In order for the
gSOAP library to have access to the certificate chain, all the chain entries
must be placed in the file (in the right order).


1 Comments Permalink Tags: certificates, pki, amt, vpro, remote_config, pem, keys, private_key, public_key, scs, sms
Click to view Ylian Saint-Hilaire's profile
0


In my never ending quest to try to have full coverage of all Intel AMT features in the Intel AMT DTK, I got motivated by two colleges to add 802.1x and Endpoint Access Control (EAC