Intel vPro Expert Center Blog

Understanding vPro Chapter 6: It’s virtual world.

Sophia.Stalliviere — Tue, 12 Aug 2008 22:46:16 GMT

Ah...I love talking about virtualization. Virtualization feels like some non-reality spectrum. It is as if you can manipulate it to do anything with it. The topic just seems endless; technology is starting to run with the idea of that. With vPro, virtualization will be able to go farther. Remote manageability aids in the virtualization area. The thought of two different versions of a program being on the same client and the computer not being able to have them up is a thing of the past. They wouldn't even know that each other were there.

With the real world in mind, big companies with many different offices could stream private information to each other with vPro. This would prevent sensitive information from leaking out to the wrong hands. Hospitals would benefit from this because when their patients' files are in their data base they can just stream the whole data from their server to the client computer where the doctor is, again security would help aid against any tampering of sensitive documents.

Besides sending out vital and sensitive information, there are also necessary items that people would need that they could stream. School is a great area for that. They are implementing it in a few schools(St. Agnes Prep School Use emerge Compute Models With video). I know there are plenty of times where I have to carry three books and my back felt as if it was going to break. Also, I hated switching the books around depending on what day it was. I could have all my information on the laptop that I was carrying anyways would do me a lot more good.

With vPro, the universities will be able to have a few servers that will check on the laptops that are given out to the students. If there are any problems with the software (it wouldn't have to be just with the books, it could be with software that the university has rights to) that was being streamed the server computer can detect it and fix them remotely. As a college student, I would love to have all my information just through my computer. I wouldn't have to worry about trucking all my stuff everywhere and it's all centrally located in one area. For a company, it ensures that all information needed is gathered in one area that can be obtained by the employees and it can be relayed back and forth.

How many times have you gone to the ATM and it says that it's out of service? For the financial intuitions, how about all of those remote ATM that is difficult to go out and service the computer? With vPro the sever will be anywhere and it can service the client away from the machine, saving the financial institutes plenty because the service guy does not have to go out at all hours. They can check if there is anything wrong with it's software or hardware away from the computers within minutes.

vPro is able to extend the possibilities of virtualization. It has helped to be able communicate two (or more) computers together and talk to each other. knowing that we could go farther and farther with the technology of vPro and having Centrino2 coming out, it's only going to be even more endless. The excuse that the dog ate my homework will not work anymore. (I think I am going to try to find a virtual dog!)

Understanding vPro- Chapter 5: Enhanced Maintenance (I just want to wrap a big hug around AMT!!)

Understanding vPro: Chapter 4 vPro: What is with this trusted environment?

Understanding vPro: Chapter 3- Proactive Security- did Intel put a tiny guard dog in my computer???

“The Intern’s” Understanding vPro: Chapter 2-What is it used for/ why should I use it?

Network World article on vPro!

Terry Cutler — Wed, 07 May 2008 13:49:45 GMT

Have you seen the Network World article on Intel vPro technology?

Take a look at the article Wanted for dead or Alive PCs: Intel vPro technology. (Click on the name to link to the article)

The Intel vPro Technology Challenge Is Thrilling!

jlvb — Mon, 21 Apr 2008 19:30:17 GMT

At ManageFusion, we had the Intel vPro technology Challenge at the event - a competition where teams of two competed to find and fix a troubled PC. Each team had an opportunity to interact with Intel vPro technology based PCs from the Symantec Altiris Client Management Suite, and most had fun in the process! Check out the highlights from the Challenge.

What Acronym best describes Intel vPro Technology?

jlvb — Fri, 18 Apr 2008 01:38:17 GMT

Sometimes within Intel Marketing, we're told that our description of Intel Centrino with vPro technology or Intel Core 2 with vPro technology is a bit lengthy. Therefore, while at ManageFusion, we asked Intel customers as well as technical experts from Intel and Symantec to give us their best, most concise acronym that best describes Intel vPro Technology. Listen to their responses below.

Demonstration of Intel vPro technology with Symantec Backup Exec System Recovery

jlvb — Fri, 11 Apr 2008 17:40:19 GMT

While at ManageFusion, we had a chance to talk with Lee Bender, Senior Technical Strategist for the Intel Alliance at Symantec Corporation.

Lee showed off how the Symantec Backup Exec System Recovery (BESR) takes advantage of Intel vPro technology. Intel vPro technology extends the reach of BESR, and helps prevent an IT administrator from visiting an end-user's desktop or notebook by enabling remote diagnosis and repair of a downed PC with an unavailable Operating System.

Watch Lee's demonstration of Intel vPro technology with Symantec BESR below:

Day 2 at ManageFusion

Frank Engelman — Thu, 10 Apr 2008 22:12:52 GMT

The Norton Backup Exec looks very promising as a receovey tool now that it uses WinPE...Maybe we can take a recovery point and convert to VMware or MS VM image- possibly use this as temporary system for users while their system is being worked on?

The Altiris CMS version 7 (beta) integrates many of the Norton suite features- of interest to me was the choice of PCanywhere, RDP OR VNC as a remote control

Symantec announced at the event that they purchased AppsStream and plan to intogetrate it into Altiris NS.

The next gen Ghost product includes many new features including Ghconfig, which can be used to rename a system.. this may be useful for easily renaming waterfalled (hand me down) systems...

Day 1 at ManageFusion

Frank Engelman — Thu, 10 Apr 2008 22:04:11 GMT

There were two sessions at ManageFusion 2008 in saving energy on clients in the corporate environment. Almost all hands when up when the question was asked "How many of you have a corporate initiative for green IT?"

HP is pursuing a "top down" power management tool from Verdiem Surveyor for the corporate environment as well as a "bottoms up" tool (HP Power Manager" for installation on clients that lets employees see the actual $ impact of their energy savings using a simple slider bar. I will post the HP link for the client tool on my BLOG when it becomes available

Gartner says PCs consume 40% of the power, servers are 22% even though most enterprises think it's the servers

"It's really neat that HP and others are offering tools to shut down systems to save power, but I want my users to be able to use their system as soon as they come to work without waiting for patches..." and the answer from the presenter was "...what you need is Intel AMT... it can wake systems for patching and put them back to sleep..." The audience had not heard of this...

The hard drive password issue that many companies are facing doing wakeup&patch can be solved by Danbury and a good ISV console

The Altiris Backup Exec Recovery solution using WinPE looks very promising

Intel Vice-President Gregory Bryant in Symantec ManageFusion keynote

jlvb — Thu, 10 Apr 2008 00:35:54 GMT

On April 8th, Intel Vice-President Gregory Bryant was part of the opening ManageFusion keynote led by Symantec's Steve Morton.

In the first part of the keynote, Steve talked about his travels to Intel to learn more about Intel vPro technology. Then Gregory talked about about how customers are realizing value today with Intel vPro technology through better remote management, better power management and better security policies - essentially allowing IT administrators to "levitate." View the first part of the keynote below:

Then, Gregory (along with Steve) introduced Ted Wilkinson, an IT Vice-President at Bank of NY-Mellon. He talked about his infrastructure of 47,000 PCs after the integration of Bank of NY with Mellon Bank, and how Intel vPro technology helps his new infrastructure with enhanced remote power control and remote remediation - which eliminates costs within his new infrastructure.

Also, Gregory discussed future Intel vPro technology directions - including:

The dynamic virtual client - which blends the manageability of thin clients with the ability to take advantage of the performance of thick clients
The ability to manage laptops and desktops that are outside of the corporate firewall starting with Intel vPro technology that come out mid 2008
The integration of hard drive encryption with Intel vPro technology starting in Q3'08 that is easy to manage

View the second part of the keynote with Gregory below:

Steps to purchase a GoDaddy Certificate for the purpose of vPro Remote Configuration

wryork — Mon, 03 Mar 2008 18:45:59 GMT

The following information contains the detailed steps used to order a Remote Configuration Client Certificate from GoDaddy. There are many methods that can be used, but this was tested and validated that the certificate worked for both SMS and SCCM SP1 to provide Remote Configuration Provisioning to vPro clients.

SUMMARY: You will be required to prove that you, or your company, own the rights to the domain for which you are applying for this certificate. In the following example, I first registered my lab domain before ordering my Remote Configuration Certificate. I also needed a Company representative to submit a letter of approval (Company Letterhead) to GoDaddy giving me authority to request this certificate. I also tested the certificate I received from GoDaddy did work with Remote Configuring AMT clients in SMS and SCCM SP1 environment.

Key items that are detailed in the steps below that were required to get my certificate:
○ Certificate type must be a Deluxe Assurance SSL certificate
○ Certificate request is for an Organization
○ OU = Intel(R) Client Setup Certificate
○ CN = ServerName.domain.com (this must be the FQDN of the Provisioning Server for Remote Configuration generating the CSR)
○ Organization = The legal name of your organization that can approve your certificate request
○ Required Documentation to be submitted (Driver's License, Bank Statement, and Approval Letter on Company Letterhead)

STEPS TO PURCHASE THE REMOTE CONFIGURATION CERTIFICATE
1. Go to GoDaddy Web site: www.godaddy.com
2. Select the SSL Certificate link: https://www.godaddy.com/gdshop/ssl/ssl.asp?ci=8979

3. From the SSL Certificate page, choose the Deluxe SSL certificate and click ADD
a. select Single (your choice of 1, 2, or 3 years) for a single Domain environment
b. Unlimited Subdomains - wild cards are support for version of AMT 2.6 / 3.2 and higher
4. In the next screen, you will be prompted to customize your order. No additional items are necessary on this screen, select Continue
5. At the Checkout Now screen, you should see the Deluxe Assurance SSL certificate (other options may vary if you selected additional items to purchase)

6. In the Billing information Window, make sure to include your valid company name. You will be required to have someone from your company submit an approval letter for this certificate request on company letterhead (more detailed steps to follow).
7. After you fill out your billing information, you will need to login to your account to configure the certificate you have just purchased.
8. After logging in to your account, select Manage SSL Certificates.
9. You will see you have an available credit in the Secure Certificates, Click Set up Certificate link and Click Activate Account
a. You may need to Login in to your account or Create a new Certificate account - this is different than your GoDaddy Account

10. Select the Deluxe High-Assurance SSL Certificate and Click Request Certificate

11. Select Corporate option in Step 1
Fill out Personal Information in Step 2, including your company name
Generate you CSR and paste text in the box provided in Step 3 (make sure to indicate the type of server used to produce CSR)
They provide a link in Step 3 on How to generate a CSR (follow these steps).

The CSR MUST include the following fields to be a valid vPro Remote Configuration Certificate and approved by GoDaddy:

OU = Intel(R) Client Setup Certificate
CN = ServerName.domain.com (this must be the FQDN of the Provisioning Server for Remote Configuration generating the CSR)
Organization = The legal name of your organization that can approve your certificate request

12. After you paste your CSR information and click Submit, your request will be routed to GoDaddy and they will follow up via email for next steps.
13. You will be asked to send them two forms of Identification (Driver License and Bank Statement)
14. Additionally, you will be asked to have someone within your company provide an approval letter on company letterhead stating that you have the authority to request the SSL certificate for this server and domain.
15. After GoDaddy has validated the required documentation, they will send you an email stating that your SSL certificate is available.
16. You can now download your SSL certificate and apply it to your IIS Web Server on your requesting Provisioning Server.

How do you go for the WIN with your IT peers? - Moving the Yard Stick in Tech Adoption

josh.hilliker — Thu, 14 Feb 2008 16:56:55 GMT

This week I was reflecting on my IT journey in the last few years and how I successfully adopted new technology. I thought that sharing this type of information may be helpful to those out there that are either about to start or in the middle of their integration of Intel® vPro™ Technology. First things first, here’s an illustration of the different camps within an IT shop (architecture, engineering, operations, finance, security) and then of course there is the leadership (mgmt) that provides air cover for such new adoptions / also a key stakeholder in the success.

For each of these camps there is a different perspective and frames of reference, therefore let me dive into each one.

ARCHITECTURE: for the architect community, the requirement is to understand their 3-5 year roadmap and how a new client technology fits in - does it violate any major design rules, does it embrace the technology strategy?. Specifically the focus is around conceptual and reference architecture with focus on high level themes i.e. Compliance, Provisioning, Remediation, Automation, Virtualization. The vantage point here is looking at the big picture and being able to define it in relationship to the rest of the architecture. This includes the BDAT model as well (business, data, applications and technology), focus is around the business process changes, data architecture changes with respect to where data is being stored, retained, transmitted, etc.. Applications are all about the application architecture requirements and potentially any changes to the high level picture.

ENGINEERING: for engineering it’s all about the connection points, ports, protocol’s, access rights. What I find very compelling in this realm is that the dialogue is around AS IS and TO BE solution architecture with heavy reference to the BDAT model output. How does it specifically fit in w/ the rest of the pieces, what is the traffic pattern, what is the fault tolerance, how does it reuse the pieces of infrastructure already in place, how does each level of the support stack manage their respective pieces without breaking the separation of duties requirements, scaling out ramifications.

OPERATIONS: for operations it all about what is the process change, realization of the value and how does it all work. As you dig in more in this area it is about the 1-x process steps required, there is a heavier view on automation of remedial tasks, there is focus on ownership of problems, reliability of the solution, SLA’s, OLA’s (operational level agreements). The dialogue for operations is about the minutes it takes to operate a given function, the time to execute, back out, re provision, etc.. This is where the business process understanding and changes are the most critical as they are truly tested in live production scenarios

FINANCE: for finance, it’s a few things that I think are important to know, it’s not all about the ROI & TCO, however that is about 90% of it. The other 10% is primarily focused on how this solution would enable company objectives, goals and vision. They are also the keepers of the value (from Headcount, costs, impact, including how to verbalize) when it’s all said and done, as they play the role in delivering a projected vs. actual account of the events, therefore their keen involvement and insight is important. An Enlisted finance manager can make a world of difference.

SECURITY: I initially did not draw in security & then went back to add this into the picture above. Why you ask? Well, years back security was an afterthought, however Ever since the Code Red/Nimda/SQL Slammer days – they’ve had a pretty strong foothold in decisions within IT – especially in evaluating new technologies… They have to ensure that the ‘last mile’ is covered in the enterprise, 1 box can wreak havoc on the network, etc. What this means is that it’s all about CIA (Confidentiality, Availability & Integrity), therefore diving into the technology & understanding the RISK is the key part here (specifically the Risk Assessment).

LEADERSHIP/MANAGEMENT: the focus here is around not just being an “approver” but to also being a champion for the new technology. The goal is to have them very aware & equally as passionate as the adopter of the technology. If you can drive this passion from the top the air cover is significant in removing roadblocks that may arise.

So is one more important than the other? No, they are all critical for full adoption, however I will highlight that the message crafted towards the leadership team is critical.
Does a small/medium IT shops have these same challenges? I think so, they are just differing in size of the work required . for example in a small business the IT director may be participating in arch-eng-ops type of roles and rolling out the technology, where as in large enterprises these may be broken out over different people and groups.

So.. how do you go for the WIN?
My past has taught me that if I can understand the differing roles, what is needed to satisfy their requirements, the process is smoother (not perfect). I have also realized that sometimes even in IT you have to put on a marketing’ish type of role to help push the adoption along, whether it’s brown bag lunch meetings to show off the technology or just asking the Sr. Exec to join you in the data center for a hands on demo. In every case of new technology I’ve enlisted a team of passionate peers that see the vision and then together we tackle the key area’s as a team, while also diffusing that passion to others.

I’d like to share some examples of each area if there is interest in the community, specifically focused around Intel® vPro™ Technology. please comment back and then I will attach examples for each..

Also. What have I missed? What key questions do you think need to get answered for a “WIN”.

From iCSO SW Engineering – Intel® vPro™ Packet Decoder – The First of Many

tcduncan — Mon, 28 Jan 2008 17:11:15 GMT

Last month's post of the open source packet decoder is just the first of a strong list of tools planned by the team that brings you the Technology Test Utility. The iCSO software engineering team is charted with making utilities and applications available to the public that accelerate and simplify the adoption and activation of Intel vPro technology.

We will be maintaining these tools and look forward to your feedback, suggestions, and participation in making these tools the best they can be for you and the marketplace. Our commitment is to post new versions of each tool at least every other month and of course post earlier if issues are found that render the tool less than useful.

The next tool we will be posting is a Pre-Installation Utility intended to speed the first user experience and automate as much as possible the initial setup of the Intel® AMT(tm) Setup and Configuration (aka SCS) environment in enterprise mode. Coupled with post setup wizards it will enable users to provision devices with minimal effort and time.

We look forward to hearing your feedback on our efforts.

Intel's iCSO Software Engineering Team

Intel AMT Status Message - How do I turn it off?

josh.hilliker — Wed, 14 Nov 2007 17:46:00 GMT

If you see this pop up on your PRO machines and you would like to turn it off..

Check out what Gael already wrote on this on the Manageability Developers site

Life in the Trenches: Planning A Real World Deployment of AMT

swood — Wed, 07 Nov 2007 19:10:00 GMT

As a network administrator for a small local government agency, I have been tasked to deploy Intel's Active Management Technology (AMT) into our network environment. Having sold our IT management on the benefits of vPro technology and how it can revolutionize our system management capabilities, I am ready to move forward and get AMT installed . In addition, today I learned that we will begin receiving brand spanking new HP systems in January that will have the latest greatest vPro technology aboard. I've got a few months to become an AMT expert and be ready for the new systems. Life is good!

Where To Start

The first thing I did after learning about vPro and AMT was to visit the Intel vPro Expert Center web site. There I found a great variety of resources to help me with my deployment. This is a good site to get help and guidance. The only problem I have with the site is that there's no link to download the AMT docs or software. You'll want to get your hands on the Intel Active Management Technology Setup and Configuration Service (SCS) - Installation and User Manual. You can get this document as well as the software from http://softwarecommunity.intel.com/articles/eng/1025.htm. Since SCS is the foundation and support structure of everything that goes on in the AMT and vPro world, this was the most logical place to start.

In addition, since I plan on integrating SCS with my existing SMS 2003 infrastructure, I also downloaded the Intel Active Management Technology Add-on for Microsoft SMS 2003 - Installation and User's Guide. Getting this was a bit of a challenge so stay with me on this one. I had to navigate to another good link you'll want to keep and refer to, The Intel Management Developer Community. From here I searched for "SMS 2003" and found the link to the SMS 2003 Add-on document. For non-developers like me, this site can appear to be not exactly what we do everyday, but hang in there, this site has a lot of info too. Now I had the documents I needed. They created the basis on which I would start to plan and deploy AMT into my network.

Read, read, read

The first thing I did after printing the documents was to read them over several times so I could get the gist of just how all the pieces played together. Then I read them again. After the first pass, it all looked pretty daunting and difficult, but after reading many of the sections over, it all started to come together and make sense. Read. Read. Read.

Time to lay things out

Ok, now I had a pretty good idea of what everything did and why, it was time to make sure I had everything I needed to make the pieces work together. I began to try and lay out what I needed to have to make AMT work.

Servers - I need to decide where to install SCS. I had a recently rebuilt Windows 2003 R2 server available that also had SQL 2005 on it. Plenty of disk space and horsepower. This was good. We were using this server to host our Help Desk application and it didn't appear to be over taxed in any way. The hardware and base OS part was taken care of. The server happened to be in our central office which was also a benefit. Our office is put together in a spoke and wheel configuration with all outer offices connecting to the central office over fast network connections. This would be good when we start to provision systems from outer office locations.

Active Directory - SCS / AMT relies on and utilizes Active Directory quite a bit. Our Active Directory is at Windows 2003 R2 level so I'm good to go. Also, as a Domain Admin, I have the ability to make any changes necessary to Active Directory.

Security - AMT supports Transport Layer Security (TLS) for secure communications between AMT devices and management console applications. TLS is optional for AMT, however we wanted to make all our communications as secure as possible so we're going for a full TLS implementation. This requires certificates and fortunately we have a Microsoft Certificate Authority server in our network that will make things easy to manage.

Database - SCS stores all its information in a database. We're going to use the existing SQL 2005 database on the server we're going to install SCS on.

AMT Device Location - Where were the new systems coming into and who was handling them? In the past when new systems came in, our Help Desk techs were very efficient in imaging them and deploying them right out the door. I need to make sure that everyone in our Help Desk group was tuned into what we were trying to do. We'll need to have a meeting to discuss what's going to happen after they plug in a system to the network for the first time.

Now that I've gotten my infrastructure laid out, it's time to start installing software. Yeah!

Next time I'll detail the steps I took in actually installing SCS into my network. As always, any comments and suggestions are warmly welcomed.

Life in the Trenches: A Real World Deployment of AMT

swood — Tue, 30 Oct 2007 15:17:00 GMT

Greetings from the trenches! My name is Sandy Wood and I'm a network administrator for the Orange County District Attorney's office in Southern California.

What I do

My primary job is to manage and support our fleet of 950 or so Windows workstations and 30 Windows servers. This covers everything from updating software, performance monitoring, alert management as well as second level Help Desk support.

The tools I use the most in my day to day activities are Microsoft SMS Server 2003 and Microsoft System Center Operations Manager 2007. These tools are indispensable in our daily jobs to keep our systems running smoothly and up to date.

vPro What?

Earlier this year, while attending a Microsoft Management conference, I stopped by the Intel booth and learned about vPro technology. Boy, what an eye opener for a management geek! This could really be system management nirvana! Since we were in the beginning stages of planning for the replacement our entire PC fleet, I called my boss and told him he had to make sure that our next systems had vPro technology. This was going to revolutionize the way we managed our systems from deployment to software updating to day-to-day support.

Why Should You Care?

Well, fast forward to today and we're just beginning to receive our first new systems. Brand, spanking new HP systems with, yes, you guessed it, Vpro with AMT 3.0! Everyone watched while we opened and unpacked the first system box. After my big vPro sales pitch, management was keen to see all the great new bells and whistles that vPro and AMT were sure to bring us. Before I go into just how cool it all worked and how cool I looked doing it, I thought it would be instructive to blog the actual steps (and missteps) I took in planning and deploying AMT in a real world situation, warts and all.

This is why you should care - if you're getting ready to deploy AMT or are just interested in the technology, this may (I hope) offer a glimpse into what it will take to get AMT rolling in your world. Reading the manuals is good and I highly recommend it however, nothing beats a real step by step walk through with real situations to give you a feel for the product and its potential.

What's Next?

The next step for me will be the planning phase. Although most of us love to just get out there and run setup, planning before you deply AMT in your environment will truly pay off for you. AMT has a lot of pieces and features that you're going to want to sit down and do a bit of thinking about before running setup. Trust me; you'll be glad you did.

Well, I'm finishing up my planning and will be back here soon with another installment of Life in the Trenches as I run down just what I did to plan for AMT deployment in my environment.

Stay tuned and as always, your comments and questions are welcome!

Technical Breakout sessions and labs at Altiris ManageFusion

Terry Cutler — Tue, 11 Sep 2007 15:15:00 GMT

Extending the value of Altiris Client Management Suite via Intel vPro Technology will be a focus at the upcoming Altiris ManageFusion event in Orlando. The dates are Oct 9-11. Registration and event information is available at http://www.managefusion.com/agenda/Orlando.aspx

For details on the technical sessions, please refer to the following article - http://juice.altiris.com/headsup/2479/managefusion-07-intel-vpro-sessions-and-events