We had the Intel vPro technology Challenge at MMS 2008 - a competition where teams of two competed to fix a troubled PC using Microsoft System Center Configuration Manager 2007 with PCs with Intel vPro technology. Check out how much fun this Challenge was at MMS 2008 this year:

When Intel released Intel vPro technology into the marketplace in 2006, the press asked us what the "v" in Intel vPro technology meant. Now that the technology has been in the marketplace for almost two years, we thought that the best answer to the question, "What does the "v" in Intel vPro technology mean to you?" would come from Intel customers, as well as from some of the technical experts from Intel and our partners who deal with our customers on an almost daily basis. See their answers below.

Coming Up: We are going to have Matt Royer join us again on the show. Josh, Russ, & Jeff Torello will be getting the latest information on WS-MAN translator integration and SMS/SCS to SCCM Migration. Hope you are able to join us!
When: April 21st @ 3:30 PM
Call-in Number: (347) 326-9831

Check out these blog posts from Matt Royer to get an insight on what our show will be about:
SCCM SP1 & WS-MAN Translator: How vPro firmware versions less than 3.2.1 are supported
Overview of SMS/Intel SCS migration to SCCM SP1


http://www.blogtalkradio.com/openport
Here's the scoop, yet again, for those who haven't heard...
Hosted by Josh Hilliker, Russ Pam, & Jeff Torello this bi-weekly informal show will be covering a variety of topics and is a perfect avenue to get your questions answered. Listen in live, give your two cents, or just download the show after it has aired. Make sure not to miss out on this awesome opportunity to learn and engage with the vPro experts. Can’t join us live? Have no fear, blogtalkradio let’s you listen to the show whenever you have the time. Visit the Open Port Radio site (link is above) to hear previous shows and even catch a glimpse of what’s to come!

Note: This information is based off Microsoft System Center Configuration Manager 2007 SP1 RC and is subject to changes between now and RTM

So as you read through the Microsoft documentation for SCCM SP1, you will most likely notice that Microsoft SCCM SP1 states they have native support for vPro clients with firmware versions 3.2.1 or higher. If Microsoft only natively supports vPro clients 3.2.1 or higher, you may be asking how vPro clients that are running firmware versions 2.x, 3.0, and 3.1 are supported.

Not to worry; through the use of the Intel WS-MAN translator, SCCM SP1 will be able to provide provisioning and manageability support for earlier versions of vPro firmware. As part of SCCM SP1 Release Candidate, Microsoft has introduced integration support for the WS-MAN Translator (It was not available as part of the initial SCCM SP1 Beta release).

In a future blog, we will provide a little more detail on the Install, Configuration, and SCCM Enablement of the WS-MAN translator; however, let us take this opportunity to talk little more about SCCM SP1 interaction with the WS-MAN Translator.

So why doesn't SCCM support earlier vPro firmware versions? The core reason is that SCCM only know how to communicate to vPro Clients in WS-MAN (Web Service Management). Prior to AMT firmware version 3.0, vPro Client only knew how to communicate in a protocol called EOI (External Operations Interface). So just like one person speaking English to another person that only understands French, when SCCM SP1 tries to communicate with a vPro client with a firmware version of 2.x, the vPro client does not understand what the management console wants it to do. So, simular to a person translating for our French and English speaking persons, the WS-Translator translates WS-MAN calls to EOI and from EOI to WS-MAN.

Ok, so vPro clients with AMT version 3.0 know how to speak WS-MAN. Why do you need the translator for firmware version 3.0 and 3.1? Well without getting into the excessively technical details, there were some changes required in the AMT 3.x firmware to make SCCM SP1 work properly with vPro client running firmware 3.x; these changes were introduced in vPro firmware version 3.2.1. To allow for vPro firmware 3.0 and 3.1 to be supported, we were able to mask those changes that SCCM SP1 required in the WS-MAN Translator.

The other thing that the WS-MAN translator enables is support for PSK vPro Client provisioning. Natively, Microsoft SCCM SP1 only supports PKI (also commonly referred to as Remote Configuration) for provisioning. vPro firmware version 3.0 supported PKI provisioning from the initial release; however, vPro firmware version 2.x did not received PKI provisioning support until versions 2.2 & 2.6. Although we recommend that you upgrade your vPro firmware to the latest version supported by the OEM, there may be some cases were upgrading 2.2 or 2.6 is not a viable option. So to support clients that are running 2.0, 2.1 and 2.5 firmware, the WS-MAN translator offers a means of supporting PSK provisioning. The key item to keep in mind about PSK support within the WS-MAN translator is that it only supports one PID/PPS pair; the same PID/PPS will be used for all your vPro Clients using PSK for provisioning.

If desired, you can use PSK provision through the WS-MAN translator for all vPro firmware versions; however, since SCCM SP1 only uses the WS-MAN Translator for firmware versions less then 3.2.1 you are required to use PKI provisioning for any vPro Client firmware version 3.2.1 or higher. It is for this reason (and the fact that you can take advantage of vPro Remote Configuration) that we recommend you upgrade your vPro Clients to 2.2, 2.6, and 3.2.1 were supported by the OEM.

If you have no vPro Clients in your environment that are less then firmware version 3.2.1, there is no need to use the WS-MAN translator; SCCM SP1 will natively provision and manage vPro clients without the need for the WS-MAN Translator.

As previously noted, stay tuned for more information on vPro Expert Center about the WS-MAN translator in the next couple weeks.

Matt Royer

The Intel® Active Management Technology's (Intel® AMT) Setup and Configuration Service (Intel ®SCS or SCS) provides developer or ISV with the tools to set up and configure Intel AMT devices. The Setup and Configuration Service (SCS) allows for most aspects of setup and configuration to be completed through a remote management console. The service package consists of a configuration engine and installer in binary form, plus a reference graphical user interface that the ISV may integrate into their Manageability Product.

So where is the Intel® SCS in Microsoft System Center Configuration Manager (SCCM) SP1? The short answer is MS SCCM SP1 does not use the Intel SCS. The longer answer is that Microsoft, as part of their architectural design of SCCM SP1, has chosen to develop their own mechanism for performing the initial provisioning and configuration of the Intel® vPro Clients. This is different from the requirement the Intel Client Manageability Add-on for SMS 2003 had on the Intel SCS for enterprise provisioning and configuration.

Each ISV, as part of their enablement of vPro Management Technology within their product, can choose to leverage the Intel® SCS or use it as a reference design to develop their own implementation. Microsoft, with SCCM SP1, is not the only ISV that chose to develop their own capability for provisioning and configuring vPro Client; did you know that LANDesk also does not use the Intel SCS for vPro Client provisioning and configuration?

Matt Royer

Note: This information is based off Microsoft System Center Configuration Manager 2007 SP1 Beta and is subject to changes between now and RTM.

Once the vPro client has been provisioned by SCCM SP1, you can now start performing vPro Client Manageability through either Collection based power operation or through the “Out of Band Console”.

To invoke vPro power management feature from within a collection, you can right click on a single client (or multi-select several clients) and select “Out of Band Management” -> “Power Control”. After which, a “Power Control” Screen will appears for the client(s); from there you can select whether to power on, power off, or restart the vPro Clients.

Here is a video that visually goes through the process:

To perform more vPro client manageability options, right click on the client in the collection to manage and select “Out of Band Management” -> “Launch Out of Band Console”. It may take several seconds for the “Launch Out of Band Console” to fully load; make sure that System status in the bottom left section of the “Out of Band Console” reads as “System: Connected”. Once the “Out of Band Management” is loaded, you will see 7 menu options:

• System Status: Displays the following for the connected computer:
  • The power state
  • IP address
  • Computer name
  • System ID
  • System date
  • System time
• System Inventory: Displays the hardware inventory information for the connected computer.
• Power Control: Initiates one of the following power control actions:
  • Power on the computer
  • Power off the computer
  • Restart the comput
  • If you power on or restart the computer, select one of the supported boot options that is retrieved from the computer. These can typically include the following:
    • Normal boot
    • Boot from local CD/DVD drive
    • Boot from local hard drive
    • Boot from alternative media (and specify the image file in Alternative media path)
    • Boot from the network
    • Boot to BIOS
• System Event Log: Displays activity for the management controller on the selected computer. You can also clear and set log levels from this screen.
• System Audit Log: Displays IDE redirection and PXE boot information.
• Serial Connection: Starts a terminal emulation session so that you can run commands and character-based applications. After invoking an IDER or BIOS redirections, you will want to come to this screen to interaction with the SOL session.
• Configuration: Allows you to perform either a full or partial unprovision of the vPro Client
  • Full Unprovision: “Delete both configuration data and identification data from the management controller”
  • Partial Unprovision: “Delete configuration data and retain identification from the management controller”

Here is a video that visually goes through the process:

Matt Royer

Here are the high level steps to configure SCCM SP1 so that you can begin provisioning and managing vPro Clients out of band. This does not take in consideration any additional configuration settings you may want to enable based on your business needs. Please note that until the WS-MAN translator is released, you will only be able to Provision and Manager AMT 3.x or higher machines.

Configure AMT Certificate on Enterprise CA for SCCM SP1

1. Open of the Certification Authority Management Console for the Certificate Authority that will issue your AMT certificates.
2. Expand the menu so that the “Certificate Templates” drill down is available.
   Right Click on “Certificate Templates” and select “Manage”.
3. When the “Certificate Templates” windows appears, Select “Web Server” from the Template Display list.
4. Right Click on “Web Server” Template and select “Duplicate Template”.
5. When the “Properties of New Template” appears, ensure the “General” tab is select and enter in the “AMT Certificate” in the “Template Display Name” field and check “Publish certificate in Active Directory”.
6. Within the “Properties of New Template” windows, click on the “Security” tab.
7. Click “Add” and add the server name of the SCCM SP1 Site Server.
8. Ensure you give the SCCM SP1 Site computer name read, Enroll, & Autoenroll permissions and then click “OK”.
9. Close the “Properties of New Template” window
10. Right Click on “Certificate Templates” and select “New”, then “Certificate Template to Issue”
11. When the “Enable Certificate Templates” window appears, select “AMT Template” and click “OK”.

Adding “OOB Service Point” Role

1. Open up “Configuration Manager Console”Expand “Site Database”-> “Site Manager” -> Site server Name -> “Site Settings” -> “Site Systems”. Right click on the SCCM Server and select “New Roles”.
2. When the “New Site Role” wizard appears, click “Next”.
3. Check the “OOB Service Point” and click “Next”.
4. When presented with the “Transmission” options, leave default unless business needs dedicate otherwise and click “Next” to finish.

1. Open up “Configuration Manager Console”.
2. Expand “Site Database”-> “Site Manager” -> Site server Name -> “Site Settings” and click on “Component Configuration”.
3. Right click on “Out of Band Management” and select “Properties”.
4. Under the “Provisioning Settings”, click “Set” near the MEBx Account.
5. When the windows appears in the “General” tab, enter in the MEBx password that you want the MEBx password to be or what you have had your OEM preconfigured it with. SCCM SP1 will try the default (admin) password first (no configuration required) if necessary. Once completed, click “OK”.
6. Within the “General” tab, check the “Register provisioning server in DNS for zero touch provisioning”. This will register provisionserver on your DNS server.
7. Under “Certificates”, click the “Browse” next to “Provision Certificate”.
8. On the “Select Provisioning Certificate” window, click “Browse” and choose your Remote Provisioning Certificate and then OK. Then enter in the password associated to the certificate and click “OK”. Please check of the following blogs to get more detail on Remote Configuration and process to create the certificate Please check out Terry Culter’s blog on Remote Configuration - What is it? How does it work? When will it be available?
9. Back on the “General” tab, Click the “Select” next to “Certificate Template”.
10. Once the “AMT Certificate Configuration Dialog” window appears and fully loads, select “AMT Certificate” under the “AMT Device Certificate Template” and click “OK”.
11. Back on the “Out of Band Management Properties”, click the “AMT Settings” tab.
12. Click the “New Icon” next to “AMT User Accounts”. When the “AMT User Account Setting” appears, click “Browse”, choose your desired groups or users, and click “OK”. Once the group has been selected, identify which permissions to authorize for that group or user. Click “OK” when completed
13. On the “AMT Settings” tab, ensure that “Enable Web interface”, Enable Serial over LAN and IDE redirection for AMT devices”, and “Allow ping responses”. You may choose which options you want based on your business needs.
14. Back on the “Out of Band Management Properties”, click the “Provisioning” tab.
15. Click the “New Icon” next to “Provision Accounts”. When the “Windows User Account” appears, enter in a user name and password. This will allow you to specify user accounts that have been configured in the firmware for AMT-based computers, and can provision these computers. Once satisfied, check “OK”.
16. Click “Apply” and “OK” to save the changes for the “Out of Band Management”.

1. Open up “Configuration Manager Console”.
2. Expand “Site Database”-> “Site Manager”, right click on Site server Name and “Properties”.
3. On the “Wake On LAN” tab, check “Enable Wake on LAN for this site” and click “OK”. Checking this option will allow SCCM SP1 Wake on LAN to use AMT remote power up control.

1. Open up “Configuration Manager Console”
2. Expand “Site Database”-> “Site Manager”, right click on Site server Name -> “Discovery Methods” and double click on “Network Discovery”.
3. When the “Network Discovery Properties” appears, check “Enable network discovery” and “Enable discovery of baseboard management Controller”. Then click “OK”.
4. On the “Wake On LAN” tab, check “Enable Wake on LAN for this site” and click “OK”. Checking this option will allow SCCM SP1 Wake on LAN to use AMT remote power up control.

Matt Royer

Note: This information is based off Microsoft System Center Configuration Manager 2007 SP1 Beta and is subject to changes between now and RTM.

Microsoft has just release System Center Configuration Manager 2007 SP1 beta. As part of SCCM 2007 SP1, Microsoft has included native support for several of the core vPro Out of Band Management use cases.

Security-based management: Through the use of public key infrastructure (PKI), SCCM 2007 SP1 allows for remote provisioning and out of band management communication through Kerberos authentication and Transport Layer Security (TLS) Channels. Activities are also recorded and auditable to ensure traceability and compliance.
AMT Provisioning: SCCM SP1 provides native provisioning capabilities for vPro Base clients through both bare metal (agent-less) and Configuration Manager 2007 SP1 client (agent based).
Inventory Data: SCCM 2007 SP1, through the use of core vPro capability, provides enhanced support for hardware base inventory. Inventory data such as BIOS UUID, power states, memory, process, hard drive information, etc that can all be retrieved out of band and independent of power state.
Power Control: SCCM 2007 SP1 enables you to perform both in and out of band power controls for vPro Clients such as power on, power off, and restart capabilities for a single computer or a selection of vPro clients in the collection.
Out of Band Manager Console: Within SCCM 2007 SP1, you are able to interaction directly with each vPro client and invoke AMT use cases through the Out of Band Manager Console. This capability allows you leverage additional power control options including the use of Serial over LAN (SOL), IDE Redirect (IDER), and detail vPro Audit / Event logs. SOL allows you to perform terminal emulation to the vPro client and perform character-based commands and/or interact with the systems BIOS. IDER enables you to boot from a remote or local image to take advantage of alternate boot environment or diagnosing / repair tools.

1. Set-up an account. on MS Connect.
   MS Connect Website
   http://www.connect.microsoft.com/
2. After you've logged in, select "Available Connections" from the menu on the left side of the screen.
3. Select "System Center Configuration Manager 2007". You will be asked to fill out a questionnaire so they can get some background and demographic information.