Content in Intel Communities

When your laptop computer is lost or stolen...

webadmin@intel.com — Fri, 04 Sep 2009 23:36:59 GMT

1) It’s a major headache to replace the content;
2) It’s costly to replace the laptop;
3) It invites the misuse of the sensitive data files you have stored on it;
4) It opens the door to the potentially bigger problems of data loss and identity theft.

Unfortunately, it’s a growing reality for hundreds of thousands of consumers, as between 600,000 and 1.5 million laptops are stolen or lost each year in the U.S. alone. Clearly, it’s foolish for business and consumers to ignore this increasing threat and not have computer security software and anti-theft products, with the idea that it only happens to other people.

I recalled from this past spring that Intel and Ponemon Institute released a study about the cost to businesses of a lost or stolen laptop:

"A recent study commissioned by Intel and conducted by the Ponemon Institute shows that a lost or stolen laptop is worth far more than just the hardware. When everything is taken into account, such losses cost a company as much as $115,000 and an average of $49,000.

The study analyzed 138 cases of lost and stolen notebooks. The average cost of $49,246 was based on costs associated with much more than just hardware and software replacement: detection and escalation, forensics and investigation, data breach, lost intellectual property, lost productivity, and other legal or regulatory costs. The study notes that the highest cost components are data breach and intellectual property loss..."

Wondering how much costs could be reduced if lost or stolen laptops had a security product like Phoenix Technologies' FailSafe™ [http://www.failsafe.com] - a theft-deterrence product that helps "protect, track, and manage lost or stolen laptops" using a BIOS embedded, tamper-resistant tracking agent.

MEI Driver Now Available via Microsoft Windows Update

webadmin@intel.com — Thu, 13 Jun 2013 23:23:11 GMT

Intel AMT, Anti-Theft Technology, and other solutions interfacing with the Management Engine in the chipset commonly use a kernel level driver. Formerly called the HECI (Hardware Embedded Controller Interface), the driver is known by and commonly called the MEI (Management Engine Interface).

If you are using an OEM provider base operating system install, you likely have the MEI driver already. However, it is more likely that you have reinstalled or re-imaged your system with a corporate image. If you are getting a missing driver install prompt for "PCI Simple Communications Controller", this indicates that the MEI driver is missing from the system.

Shown below is a screenshot of the Device Manager with an "Other Device" missing a device driver.

There are 2 main ways to get the driver installed. The best option is to avoid Microsoft Windows Update provided drivers and utilize the OEM provided drivers

Option 1 - For 2010 and newer platforms, a base MEI driver is provided via Microsoft Windows Update similar to the example shown below.

Note: There are specific caveats with this approach as listed below.

Three key caveats with option 1.

An incorrect driver version got released earlier in the year 2011. If your platform shows the MEI driver installed without expected functionality, check the driver version. If the MEI driver version is 1.x (such as the example below) or possibly 9.x, this is the incorrect driver. Remove from your platform and try the Windows Update again. (The incorrect driver was pulled from the Windows Update).
The second caveat is that only 2010 or newer platforms are supported for Microsoft Windows Update download and installation of the MEI driver. For older platforms or situations where Microsoft Windows Update is not accessible, see the second option below.
The third caveat is that only a basic version of the driver is provided. Solutions such as Intel® Anti-Theft Technology require the complete MEI driver from the OEM or Intel.

Option 2 - Most preferred. Download and install the MEI driver from the OEM website. The example below is from HP.com, and for those familiar with HP SSM, notice that this driver is SSM compliant.

For large scale or script installations, extract the files from the OEM provided package. In the software delivery script, use the command "setup.exe /s"

When the MEI driver is successfully installed and functional, it will look similar to the following Device Manager example

Dell Optiplex 755 BIOS Update (includes AMT update)

webadmin@intel.com — Fri, 13 Mar 2009 15:15:51 GMT

Dell just released a new BIOS update for the Dell Optiplex 755 system, version A13. This update includes an AMT firmware update to version 3.2.3 also that resolves a couple of security issues. I just performed the update on an Optiplex 755 that I had already provisioned, and it didn't break anything

If you're deploying the BIOS update via a ESM software package, such as Microsoft System Center Configuration Manager (SCCM) 2007, you can automate the staging of the BIOS update (without forcing a reboot) using the following command line:

O755-A13.exe -noreboot -nopause

Get it while it's hot!

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

Intel 4th Gen Core vPro Processors & Intel AMT Announcement

webadmin@intel.com — Tue, 04 Jun 2013 16:36:39 GMT

Intel® 4th Gen Core™ vPro™ Processor &

Intel® Active Management Technology (version 9.0)

Configuration Management Product Implications

Intel® vPro™ Technology

Product Advisory

Summary:

Customers using IT configuration management products with support for Intel® AMT may be affected by a change in version 9.0. Intel® 4th Gen Core™ vPro™ Processors ship with Intel® AMT version 9.0 in 2013.

1. What specifically is different about Intel’s 4th gen Intel® Core™ Processor platforms with Intel® AMT?

Intel’s Core™ Processor Platforms prior to 4th generation with Intel® AMT supported the EOI communication protocol. Starting with Intel® AMT 3.2, an industry standard protocol for out-of-band management was adopted. That protocol is WS-Management (WS-MAN). Intel supported both protocols from Intel® AMT 3.2 until 8.x. Plans to remove the older EOI protocol were stated in 2009 with Intel® AMT 9.x as the first generation that only supports the WS-MAN protocol.

2. How do I know if I am affected?

There are IT configuration management products that have not made the transition to WS-MAN for Intel® AMT. These products may require that the customer perform an upgrade to their configuration management product, to maintain compatibility with new platforms starting with Intel® 4th Gen Core™ vPro™ Processors. Please check with your ISV to see if an upgrade is required to maintain compatibility.

3. How will this change impact customers’ experience?

If a customer is using an IT configuration management product that is not affected, then there is no change to the customer experience. For customers using an IT configuration management product that requires an upgrade, there will be changes to the customers’ business processes.

4. In the meantime, what is the impact with current Intel® vPro™ customers?

Existing Intel® vPro™ Platforms with Intel® AMT that have already been provisioned will continue to be managed with IT configuration management products. Customers with Intel® vPro™ Platforms that have not provisioned Intel® AMT should check with their ISV for specific list of supported Intel® AMT features and prior versions.

5. How will customers be supported?

Customers are encouraged to contact their ISV directly for support.

6. Who can I contact with questions or for more information?

Intel Customer Support: www.support.intel.com
For information about: Intel® vPro™ Platforms: www.intel.com/go/vpro

Wireless Profile Synchronization – Enable seamless AMT connectivity in newly discovered wireless networks.

webadmin@intel.com — Fri, 26 Aug 2011 13:11:48 GMT

In a previous article, I discussed Link Preference and how it enables better KVM user experience over wireless. In this article, I will discuss Profile Synchronization, another important capability that makes AMT over wireless a seamless experience.

What challenge are we trying to solve? Although we can configure in advance wireless networks in AMT, but what if the client roams in a new network; one that was never configured before? You can’t have access to AMT unless AMT is aware of that network. Profile synchronization solves that problem by pushing the OS’s currently used network's parameters to AMT.

OK, so how does it work?

First: Not all AMT wireless profiles are born equal!

AMT defines two types of profiles:

Admin profiles: Profiles known in advance and entered by IT administrator (during provisioning or manually using Web-UI for example)

User profiles: Networks discovered by the OS after the client has been deployed. AMT get User Profiles only though synchronization.

Up to 15 Admin Profiles and 8 User Profiles can be defined in AMT.

Other key differences

While Admin Profiles require TKIP or CCMP with WPA minimum encryption, User Profiles have more relaxed requirements and can be configured with WEP or no encryption.
User Profiles are not viewable from Web-UI, only Admin Profiles are viewable *

Wireless Profile Synchronization modes

Profile Synchronization supports three modes:

Normal (default)
Whenever the OS connects to a new wireless network the profile is pushed to AMT but requires user acknowledgment before synchronization.
Always reject
Synchronization of any new profiles are rejected and no user notification displayed.
Always accept
Synchronization accepted with no user notification (“Silent Synchronization”)

PROSet is currently the only Wireless Connection Manager that supports Profile Synchronization.

The Full PROSet package (except GUI) must be installed. The ‘drivers only’ installation does not have the necessary API to support that feature.
Install PROSet with the following option to enable/disable synchronization:
1. MEPROFILESYNC=ACCEPT (silently accepts all profile sync)
2. MEPROFILESYNC=BLOCK (silently blocks all profile sync)
If desired, instead of setting the MEPROFILE though PROSet, the registry value can be edited directly:

define ENABLE_USER_ACCEPT 0x10 // accept all USER profiles, no popup

#define ENABLE_USER_BLOCKED 0x20 // reject all USER profiles, no popup

Other important points about Profile Synchronization:

Only currently connected network is pushed to AMT (discovered networks are ignored).
Both sides of synchronization (OS & AMT) must be enabled:
1. OS side (“push” ): PROSet synchronization is enabled as described above
2. AMT side (“accept”): Configured in the Provisioning Profile: “Enable Synchronization” box
LMS is required for Profile Synchronization.

PROSet communicates with AMT through LMS.

Profile Synchronization user acknowledgment:

What happens when User Profile password changed?

PROSet will NOT synchronize changes in the profile’s password. The proper procedure to change profile password is:

First disconnect and delete the network from PROSet
1. PROSet synchronization will remove the wireless profile from AMT.
Create a new profile with the new password.
Upon connecting to that network, PROSet synchronization will add the profile to AMT.

What happens when max of 8 User profiles reached?

When AMT has already maxed out at 8 User Profiles, a newly synchronized network will override the profile that has not been used for the longest time.

What happens during provisioning and re-provisioned?

Un-Provisioning deletes, as expected, all Admin Profiles as well as User Profiles.

Re-Provisioning however is less intuitive:
During re-provisioning, only Admin Profiles are deleted (and new ones installed based on what is configured in the provisioning profiles), User Profiles however, are NOT removed ** and although the provisioning process competes successfully it gives warning: “ClearWirelessSettings failed” and “Access Denied”. The warnings look scary but don’t be alarmed, it only means that user profiles could not be deleted but that’s not an issue.

Here is a screen sample of such warning message after re-provisioning completes:

* This can be confusing, particularly during debugging: you connect with Web-UI and don’t see any User Profiles; you may think they are simply not there, which may or may not be the case. Knowing this would save you some grief during debugging.

** User Profiles are saved in User Space that certain applications (Ex. Web-UI) and Re-Provisioning cannot access or remove.

Setup and Configuration Software 8.0 training

webadmin@intel.com — Mon, 23 Apr 2012 15:21:12 GMT

With the release of the Setup and Configuration Software version 8, we have introduced a lot of changes. First, there are a lot of technical changes to how SCS 8 works compared to the previous version. Second, this is the first release of the software that’s geared towards wide use. Previously, we targeted this software towards software development companies interested in including Intel® vPro™ Technology capabilities in their software products. So, in order to help organizations adopt and use SCS 8 I have put together some training videos to help you get up to speed with the SCS. They videos are available at http://www.intel.com/go/scs.

We have six videos that will give you an overview of the Intel® vPro™ Technology platform, the SCS and how they work together. In total, it’s about an hour’s worth of video total. Here’s a brief summary of each of the videos.

Intel® SCS 8 Training Introduction
- A brief overview of the training videos in this series.
Module 1: Introduction to Intel® vPro™ Technology
- This module gives you an overview of the capabilities of Intel® vPro™ Technology, Intel® Active Management Technology and the Intel® Setup and Configuration Software that we discussed in the other modules in this series.
Module 2: Intel® SCS Overview
- This module discusses the components of the Intel® Setup and Configuration Software, including the Configurator and the Remote Configuration Service.
Module 3: Intel® AMT Configuration
- This module discusses how to create AMT configuration profiles with the SCS tools and the methods to apply those configurations to clients with Intel® vPro™ Technology.
Module 4: Jobs & Maintenance
- This module discusses the types of maintenance jobs and when they need to be performed against your Intel® vPro™ Technology clients after they have been configured.
Module 5: Environmental Pre-requisites

This module discusses the various pre-requisites that ease the setup and configuration process of Intel® vPro™ Technology clients.

Please share your feedback on these videos. If there is enough interest in topics not covered, or enough interest in deeper discussion of specific topics, I can look into creating additional videos.

Enabling Trusted Boot on Linux OS using Intel TXT

webadmin@intel.com — Tue, 12 Apr 2011 19:57:31 GMT

As previous discussed in my last post about what is Intel TXT (aka Trusted Execution Technology), showing how this technology can Measure Launch the OS/Hypervisor, now I would like to show you something practical, how to use it with Linux.

In this demonstration, I used an HP 8440p box, but it works with any Intel vPro with AMT 3.0 and superior, and Linux Fedora 14 (kernel 2.6.38).

Praparing the BIOS:

Enable Intel VT/VTd, TPM and TXT in BIOS;

Updating Linux:

Some tools and updates are required in order to configure and enable Trusted Boot in Linux and in this particular demo, I used the following commands:

# yum update yum hg openssl openssl-devel trousers trousers-devel rpmdevtools yum-utils ncurses-devel

# yum groupinstall 'Development Tools'

Configuration:

I created a 15:06 video long showing configurations steps:

At this point, if you completed successfuly these steps, you enabled the Trusted Boot with ANY Policy, that means that now you have it ready to define policies about TXT measurement and behavior. It'll be a subject of a future post.

Further references can be found here:

Intel Trsuted Execution Technology Software Development Guide

Best Regards!

Demystifying VeriSign certificates for Intel® vPro™ activation

webadmin@intel.com — Tue, 20 Dec 2011 17:44:00 GMT

There are several ways to configure an Intel® vPro™ machine and the most popular among corporate companies is the Zero Touch configuration method, which is based on PKI. You must issue a certificate for a provisioning server in order to establish a trusted relationship between the provisioning server and the ME. VeriSign is one company that can provide a certificate for this.

Since the launch of Intel® vPro™ in 2006, VeriSign has made some changes to their products. Rather than issuing certificates from G1 and G3 roots in their Secure Site (Standard SSL) and Secure Site Pro (Premium SSL) SKUs, these products now issue certificates of different roots. Unfortunately, Intel ME is firmware and updating the list of root certificate authorities is not as easy as it is in an operating system. Updating this list in the Intel ME will instead require a firmware upgrade.

If you have different Intel® vPro™ generations in your environment, you are most likely looking for a solution that uses the least common denominator like we have displayed in this table:

Firmware version	VeriSign Hash
2.x	G1 and G3
2.6.20	G1, G2 and G3
3.x	G1 and G3
3.2.10	G1, G2 and G3
4.x	G1 and G3
4.2.x	G1, G2 and G3
5.x	G1 and G3
5.1.10	G1, G2 and G3
2.6.40	G1, G2, G3 and G5
4.2.30	G1, G2, G3 and G5
5.2.30	G1, G2, G3 and G5
6.x	G1, G2 and G3
6.1	G1, G2, G3 and G5
7.x	G1, G2, G3 and G5

As you can see, the latest version of each firmware generation is accompanied with a complete list of trusted roots.

However, a problem occurs if you have multiple versions of vPro but are only able to use one certificate for provisioning server (and cannot issue a certificate from G1 or G3 anymore). Fortunately, in order to avoid interoperability issues with legacy browsers, VeriSign makes a cross-signed of VeriSign Class 3 PPCA-G5 with Class 3 PPCA (G1.3). This is called Secure Site Pro, creating a cross certificate as shown in this diagram:

Usually, OpenSSL libraries use a PEM file format when building the trust chain in order to validate the certificate. We can statically define the trusted certificates that we would like to use in this chain. Microsoft has some wrapper code available to build the PEM list of certificates and, in this particular case, Windows has 3 possible root certificates to be used. All three are equally valid and Windows built the trusted chain using the shortest chain, i.e. VeriSign "G5" Class 3 PCA Root or VeriSign "G1.5" Class 3 PCA Root, both of which are not present in some old ME firmware. When you install the certificate, without any modification you see the root certificate VeriSign "G5" Class 3 PCA Root as shown here:

In order to force Windows to build the trusted chain up to VeriSign Class 3 Primary CA - G1, we have to eliminate VeriSign "G5" Class 3 PCA Root and VeriSign "G1.5" Class 3 PCA Root from the Root folder (or at least disable Client Authentication and Server Authentication from the purpose list of these certificates).

Without these two certificates, the only valid chain will be with VeriSign Class 3 Primary CA - G1. That chain is present in every ME firmware version, since the first version, i.e. 2.0 through 7.1 - See below:

Now you don’t have to be concerned about these VeriSign certificate issues with your Intel vPro versions, just follow the instructions presented in this document and have yourself a happy vPro configuration.

Resources and recording from Intro to Intel vPro Technology webinar

webadmin@intel.com — Wed, 19 Aug 2009 21:02:58 GMT

Hey everyone!

We hosted a great webinar this morning to provide the basics on Intel vPro technology. It was a very interactive session and we had Josh in the audience who piped up with some good comments AND some good humor. :-D We referred to quite a few helpful resources in the webinar, which I e-mailed to all of the registrants afterwards. If you missed my email, here are the links:

Webinar Recording

If you missed the live event, you can now watch the recording!

http://vproexpert.com/E24VZ/Training/Intro_to_Intel_vPro_Technology.wmv

Webinar Slides

Want to download the deck? It's attached to this blog post.

Intel® vPro™ Heartbeat Newsletter

A bi-weekly newsletter that announces training, user docs, downloads, and other news about Intel® vPro™ technology.

View the last issue here: http://eepurl.com/cVxx
Subscribe here: http://intel.us1.list-manage.com/subscribe?u=755b64b0b11a68448fce67d4b&id=0f3040214e

Intel® AMT Scan Tool

This tool identifies the vPro systems in your environment.

http://communities.intel.com/docs/DOC-2061

Information about Intel® Anti-Theft Technology

http://communities.intel.com/docs/DOC-3266

Webinar Archive

http://communities.intel.com/docs/DOC-3492

Demo Video

Intel vPro Platform Solution Manager

webadmin@intel.com — Thu, 27 Dec 2012 16:28:48 GMT

Hello again! My team has been working on a use case reference design called the Intel vPro Platform Solution Manager (quite a mouthful i know!). So what is it? Well, we were sitting around one day after an epic nerf gun war asking ourselves “how can we make management with Intel® vPro™ even easier to use?” (yes we actually say “circle-R” and “T-M” while we discuss this, but it’s mostly as a joke… unless you’re one of our legal or marketing folks; in that case we’re very serious). We’ve made great strides in simplifying the setup and configuration of vPro (if you’re not familiar with Host Based Configuration you must check it out!).

So, how can we make management of a platform easier? We write some software of course! The Platform Solution Manager (PSM) is a plugin-based framework that allows us to connect to a vPro based platform and exercise the various AMT features of that platform. For starters we can:

View and set Alarm Clock settings
View the AMT Event log
Perform IDE-Redirection
View Hardware Inventory
Connect via Remote KVM (on supported platforms)
Power Management
Serial-Over-LAN
And More!

PSM allows you to connect to multiple vPro platforms concurrently and quickly switch between them. If you don’t want to continually switch, you can “pop-out” any of the plugins above into a separate window!

“But what about all my existing management tools?” Well I’m glad you asked. You can launch PSM from your existing management tool (just pass the hostname and credentials, or only hostname if using Kerberos) to PSM and it will automatically connect for you!

If you’re using vPro, download PSM and give it a shot and let me know what you think! (Oh, and I was just kidding about the epic nerf gun battle)

Thanks

--Richard