Brad Anderson & Gregory Bryant took a few moments to talk to a few folks about vPro & SCCM SP1.

Here's a few comments to share out:

GB - 800Million transitors in the chip. Transistors are focused on solving IT problems now.. (good news to IT folks).

Brad - key message is that users are moving to SCCM & the request is out to join up & give feedback to MS on the new console. (that's SCCM SP1).

GB - ROI's are positive, definitely a focus on changing the biz process is important.

Brad - Config Mgr is making life easier.

NOTE: Tom Quillin did a stellar job of hosting the session.. Kudos Tom.

Now onto a few audience questions.. if your not here @ MMS, your missing out..

Sharing with the community a recent thread I just picked up.

http://abunchofgreens.blogspot.com/2008/04/first-eco-certified-computer-lenovos.html

Eco is the first ThinkCentre computer made with recycled, post-consumer plastics and is EPEAT Gold and Energy Star ® 4.0 rated. The system comes with Intel vPro technology, Core 2 Duo E6550 / E8200 / E8400 Processor, 2GB DDR2 RAM, 160GB HDD, Dual Layer DVD Burner, Intel Graphics Media Accelerator X3100, and Windows Vista Business

A user asked us why we didn't have information about buying vPro PCs on the Expert Center. Well, here it is! I am compiling a list of the different manufacturers and their vPro landing pages. It will continue to grow as I find more information.

Find it here: Where can I buy vPro PCs?

You'll find more detailed information about specific model numbers in this document: Order an activation-ready PC

As always, let me know if you need additional information. I'm growing these documents, so check back!

Top 5 questions from the vPEc booth
#1. How do you get started
http://communities.intel.com/openport/blogs/proexpert/2008/02/09/high-level-guide-to-installing-sccm-sp1-beta or
http://communities.intel.com/docs/DOC-1499

#2. What about legacy support
http://communities.intel.com/openport/blogs/proexpert/2008/04/16/sccm-sp1-38-wsman-translator-how-vpro-firmware-versions-less-than-321-are-supported

#3. What are the top features that I capture about
Top features are in band client agent provisioning and integration of power control in collection based operation and task sequence support.

#4. Why does SCCM matter for vpro?
Sccm is microsoft's first managiblity software that provides native support for vpro capibility. You are able to have a single software provide you on on complete software solution for you vpro client fleet.

#5. What is the difference between Wake On LAN
http://softwarecommunity.intel.com/articles/eng/1151.htm#2 (abstract from the site)

Q1: Does the Intel® Active Management Technology (Intel® AMT) feature of Intel vPro technology support Wake On LAN* (WOL), Pre-boot eXecution Environment (PXE), and Alert Standard Format* (ASF)?

A1: Yes. A PC with Intel® vPro™ Technology can be managed using legacy tools that utilize WOL, PXE, and ASF when Intel® AMT is turned off , so existing tools that use these protocols can be used. However, Intel® AMT provides higher levels of security & functionality. Intel® AMT provides mutual authentication between client and console along with encrypted communication to guard against unauthorized access to networks and PCs, along with the ability to read hardware and software asset information even from PCs that are turned off or down.

Q2: How is Intel® Active Management Technology (Intel® AMT) feature of Intel® vPro™ technology different from ASF and Wake-On-LAN?

A2: Intel® AMT provides more security and functionality than ASF or Wake-On-LAN. Unlike legacy technologies, the Intel® System Defense feature within Intel ® AMT proactively helps prevent the spread of viruses by blocking transmissions from infected PCs. Intel® AMT also provides authentication and encrypted communication of management traffic so the Intel® AMT features can only be activated by authorized management consoles. Its out-of-band management capabilities include not only the ability to reboot PCs and send alerts, but also allow remote control, remote BIOS updates, and access to event logs and asset information regardless of system state or operating system presence. Alerting is policy based rather than based on preset criteria, allowing additional flexibility in IT processes. And Intel® AMT is designed to ensure management traffic can pass through network routers allowing remote management of a greater portion of your installed base.

Let the Journey begin.. On my way to MMS (las vegas). Hopefully to make it to the show floor in a few hours and start to scope out the Intel booth. I am looking forward to talking with IT shops that are using vPro & the folks that are about to take on their journey. If you are also interested to learn more make sure you stop by the booth.

As soon as I arrive I’ll shoot a quick video of the booth & post on the Expert Center.. .

Hi all,

Tim's Tool team continues to deliver new tools to the community almost weekly. You can check the latest on the Tool Wiki @ http://communities.intel.com/docs/DOC-1171. Also if you have a need for a new tool please let him know by responding to the wiki.

If you are trying to use a tool and not having success please let us know as well as your feedback helps shape the tools the team works on.

I also know that Tim is defining a higher level picture of the typical IT infrastructure and how each tool can be used to troubleshoot different connection points. Stay tuned for this..

A great question was raised whether the Kerberos authentication was most or least restrictive on rights and access. First a little background - Kerberos authentication in an Intel vPro world allows you to specify an NT user or group for authentication purposes, and to authorize them for Intel AMT realm access on the provisioning Intel vPro device.

What if a user is a member of two different groups, both of which are defined in the provisioning profile, with each group having different authorization to the Intel AMT realms? For example - GroupA can only remotely power a system, while GroupB can only place System Defense filters on a system. If User1 is a member of GroupA and GroupB - what resulting access does that user get?

The answer is "least restrictive" - in that the user has the combination of authorization from both GroupA and GroupB.

Interested to hear what the community has experienced. Keep the questions coming.

The ability to provide access to the Real-Time tab of Resource Manager will enable administrators to provide this valuable tool to IT specialists or Helpdesk workers. Furthermore the ability to configure access to certain functions within the console will allow administrators to grant or restrict what users can do with Real-Time System Manager. This includes WMI functionality as well as powerful AMT functionality.

Introduction

Your environment will likely have a unique set of requirements on who can access what in Real-Time System Manager. It can be as simple as two levels of workers, from an administrator to an IT Specialist, to a complex system of access rights in a multi-tiered environment tightly controlled. No matter the environment, this article provides the details to customize access to the Real-Time tab, including WMI and AMT access rights.

RTSM contains limited functionality to configure access via WMI. AMT, on the other hand, can be configured at a function-granular level. Whether you're simply trying to give users full access to RTSM, or to provide access to only certain functions, this document assists to achieve this.

NS Role Security

The first item that must be enabled is creating a role or modifying an existing role to have rights to Real-Time System Manager at the general level. Without assignment to such a role, a user cannot gain access to RTSM.

Overview

Briefly I'll explain how NS Role and Scope security work together in Notification Server. Roles give feature access rights. For example in Software Delivery Solution there's a role object labeled ‘Item Tasks - Software Delivery Wizard'. The two options allow use of the Simple or Advanced Software Delivery Wizard. Without this right, the user cannot launch the Software Delivery Wizard, regardless if they have scope rights to the Wizard and Status node in the console.

Scope security is much like the Windows File-System security model. In the Altiris Console the left-hand tree can be accessed like the file system, applying security to folders or to nodes, as opposed to folders and files. Inherence allows security to be inherited from the containing folder, on up the chain until the root node is reached.

Role Configuration

The following steps show how to create a user with RTSM permissions.

1. In the Altiris Console, browse to View > Configuration > Server Settings > Notification Server Settings > Security Roles.
2. Select an existing Role or Right-click on the Security Roles folder and choose to create a new Role.
3. Under Privileges, find the following categories and check the indicated option. After the screenshot the items are details with description of the option:
   
   1. Altiris System Privileges - Use Real-Time System Management - This is the ability to use the product at the most basic and general level.
   2. Altiris Console Privileges - View Resources Tab - For this example I'm providing the user the ability to see collections so he or she can launch Resource Manager and use the Real-Time tab.
   3. Altiris Console Privileges - View Tasks Tab - Access to the ‘Manage' node allowing launch of Resource Manager requires this privilege.
   4. Item Tasks - Real-Time System Manager - Manage - This is access to the main tree for RTSM. Most functions are covered by this option.
   5. Item Tasks - Real-Time System Manager - Password Reset - Because of the nature of this function, it has been separated out as a single security role object in Notification Server but belongs to the Real-Time tree.
   6. Item Tasks - Real-Time System Manager - Port Check - The Port Check feature is normally accessed as a separate contextual item in the right-click menu, or launch from an icon under the Real-Time tab.
   7. Item Tasks - Real-Time System Manager - Trace Route - This is treated in the same way as Port Check.
   8. Item Tasks - Real-Time System Manager - Hardware Management - This is one of the objects in the tree that provides basic hardware function, which is greatly extended if the system is Intel vPro capable and Provisioned.
4. Click the Membership tab.
5. Use the blue + icon to add users and/or groups to the Role. These can be digest users or local computer groups, or Domain users or groups.
6. Click Apply to save the Role.

Note: The users will not have access yet to the Altiris Console as the scope-level security has not been set for the new Role. Complete the below NS Scope Security section to give access to the Altiris Console

NS Scope Security

Altiris Console

For Altiris Console access, scope security must be configured before a Role can access or login to the console. The security window is the same for any node, be it a folder or otherwise. The two screenshots below show the security window and the permission selection screens:

Note: Depending on the object type, the available permissions may differ

To allow access to the ‘Manage' Real-Time Console Infrastructure Task, follow these steps:

1. In the Altiris Console, browse under View > Tasks > Incident Resolution > Tools.
2. Right-click on the node ‘Manage' and choose Properties.
3. Click on the Security tab.
4. Click the ‘Add' button.
5. Select from the list Role name of your role (+ie:+ Role RTSM Workers) and click the ‘Select' button.
6. Check the option for ‘Full Control' and click ‘Select'.
   Note: Full Control does not give the user the ability to delete or otherwise manipulate the Manage node. This node can only be accessed for the function alone.
7. Click ‘Apply' to save the security changes made.

To access Collections so the users of the role can view collections so they can use the RTSM right-click contextual menu options for a listed resource, follow these steps:

1. In the Altiris Console, browse to View > Resources > Collections.
2. Depending on what collections you want to give the user access to, browse to a containing folder or an individual collection.
3. Right-click on the folder or collection and choose Properties.
4. Click on the Security tab.
5. Click the ‘Add' button.
6. Select from the list Role name of your role (+ie:+ Role RTSM Workers) and click the ‘Select' button.
7. Check the following options:
   1. Altiris System Permissions - Read
   2. Altiris Resource Management Permissions - Read Resource Data
   3. Altiris Resource Management Permissions - Read Resource Association
8. Click Select, and then click Apply on the permissions window.

Now we have allowed the user access to certain parts of the Altiris Console so they can execute Real-Time System Manager on managed systems. To restrict access to certain parts of the RTSM console, see the previous Role section for what options are available to you.

AMT Permissions

RTSM takes advantage of powerful functionality available in Intel vPro, AMT technology. Once a user has access to RTSM, their user account, if permitted, is used to connect to the remote system by WMI. An AMT connection can either use Kerberos integration or an inputted digest user when prompted. The credentials must be specified in the destination system's AMT Profile, otherwise authentication will fail.

To configure who has rights to AMT, follow these steps:

1. In the Altiris Console, browse to View > Solutions > Out of Band Management > Configuration > Provisioning > Configuration Service Settings > Provision Profiles.
2. Double-click on an existing profile, or create a new one.
3. Click on the ACL tab.
4. Click Add to add either a digest user or to use Domain users and groups with Kerberos integration.
5. Once a user is inputted, the ‘Realms' section allows or disallows access to different AMT functions. The boxes that are of importance to RTSM are:
   1. Circuit Breaker - Now known as System Defense, or Network Filtering
   2. Hardware Asset - For power management capabilities
   3. Redirection - To allow IDE Redirection
   4. Remote Control - Allows Serial Over LAN (SOL) remote connection
   5. Event Manager - Allows viewing of AMT logs
   6. General Info - Allows viewing of AMT data on the system
6. The ‘Access Permission' dropdown should be used to select either Network Access or Any. The Local Access option gives that user rights to log into the Intel ME locally when the system boots and isn't needed for RTSM function, however if you wish to allow the user to have access to both, choose ‘Any'.
   
7. Click OK to save the changes.

To apply the updated or new profile to an AMT system Provisioning must occurred. If the system was already provisioned with this same profile previously, a reprovision will update the profile.

This will not limit access to see the functions available in the Real-Time tab for AMT, but will throw a not authorized message if an applicable function is attempted with a user who does not have the rights to execute it.

Conclusion

The Real-Time tab, a one-to-one solution for system access, data gathering, or troubleshooting, provides a powerful tool to IT administrators and IT professionals alike. Providing this ability to users you do not want to have full access to Altiris is essential for any secure environment. With the additional ability to configure granular AMT rights for vPro capable and configured systems, an administrator has the ability to get very specific on what users or groups of what rights.

While at ManageFusion, we had Symantec Director of Strategic Alliances Kevin Unbedacht discuss how Intel vPro Technology enhances the Symantec Altiris Client Management Suite. The videos below include demonstrations around power management with secure power-on, remote diagnosis and repair of troubled PCs, isolation and repair of infected PCs, and discovery of PC assets.

• Hardware-assisted Power Management with Secure Power-On

• Hardware-assisted Diagnosis and Repair of PCs Remotely (by getting into PC's BIOS settings):

• Hardware-assisted Diagnosis and Repair of PCs Remotely (by remote booting PC to fix-it image on the network):

• Hardware-assisted Isolation and Recovery of Infected PCs:

• Hardware-assisted Discovery of PC Assets

Click here to learn more about the combination of Symantec products with Intel vPro technology: http://www.earlyroi.com/

We just finished our live radio show on blogtalkradio with Matt Royer. Listen to it below, or visit www.blogtalkradio.com/openport to download previous shows.

Topic: We are going to have Matt Royer join us again on the show. Josh, Russ, & Jeff Torello will be getting the latest information on WS-MAN translator integration and SMS/SCS to SCCM Migration.

Just click play!

At ManageFusion, we had the Intel vPro technology Challenge at the event - a competition where teams of two competed to find and fix a troubled PC. Each team had an opportunity to interact with Intel vPro technology based PCs from the Symantec Altiris Client Management Suite, and most had fun in the process! Check out the highlights from the Challenge.

Jeff talked about this in the last show on vPro Radio (http://blogtalkradio.com/openport) about his latest Intel vPro training modules. We finally have those posted and here is the link to get started..

http://download.intel.com/business/vpro/ActivationClass/main.html

I believe he posted six out of nine, with the final three still in progress. If you have any questions please let Jeff know.

I am glad you inform everyone that the Intel AMT DTK is back online and once again, my apologies for the interruption. Version v0.52x was released, with just a few fixes over the previously posted v0.51x. It's mostly the same as before, not many new features, but if you have experiences problems in the past, try this version.

Probably the area where the DTK is improving most is with general stability and WSMAN. When using Intel AMT 3.0, Intel AMT Commander and Intel AMT Outpost will use WSMAN instead of SOAP. Since all the calls are different, many new bugs showed up. As we get the benefit of more testing and feedback, the code keeps improving. Users can force Commander to use SOAP by going to the "View" - "Advanced properties". The second tab has a check box to remove using WSMAN first. WSMAN will of course still be used if Commander determines that WSMAN is the only available option.

Next week I am once again heading to Israel to meet with this Intel AMT firmware development team. Last year I had a pretty shaky flight over, something I had blogged about. Hopefully this year will be better. At Intel, this is going to be the ultimate meeting of everyone related to AMT, so I will get to meet some of the other people that post on the forums, and many of the people that I get the most complicated answers from.

Ylian (Intel AMT Blog)