topic Re: Mixed AMT Environment Clarification needed in Intel vPro® Platform

Mixed AMT Environment Clarification needed

idata — Fri, 21 Oct 2011 08:11:39 GMT

I need some clarifcation how to proceed in a mixed AMT environment.

Our environment consists of round about 500 Intel AMT Version 5 computers. We have an internal (non Microsoft PKI) in place and installed a Microsoft Sub CA for provisioning the Intel AMT computers. We use SCCM 2007 SP2 with OOBM configured. The certificate hash of the Central CA is placed on each client via a USB stick. We use the SCCM "Auto Provisioning" feature configured on a collection.

So far, so good...

The next computer generation are Intel AMT Version 7 based. I read the documentation about host based configuration which is quite interesting. The following questions arose.

1) Is it correct that I cannot use the host based configuration feature to configure Intel AMT Version 5 computers? I assume I cannot use it.

2) Can I use the same provisioning approach for Intel AMT Version 5 also for Intel AMT 7 systems.?

3) Is the root hash still required on Intel AMT 7 systems in case there are "Host Based Configured"?

4) Do I have to maintain two different "solutions" in the future or is there a "single" approach for both AMT versions?

I appreciate any help and thoughts. Thanks in advance

Joachim

Re: Mixed AMT Environment Clarification needed

Bruno_Domignues — Fri, 21 Oct 2011 17:58:29 GMT

Hi,

Answering your questions inline...

1) Is it correct that I cannot use the host based configuration feature to configure Intel AMT Version 5 computers? I assume I cannot use it.

Bruno>> yes, you are right. HBC only for 6.2 and beyond.

2) Can I use the same provisioning approach for Intel AMT Version 5 also for Intel AMT 7 systems.?

Bruno>> for sure!

3) Is the root hash still required on Intel AMT 7 systems in case there are "Host Based Configured"?

Bruno>> No is not required, but I would recommend you use the same approach for version 5 for several reasons: 1.HBC is not native in SCCM; 2. SCCM takes care of manage TLS certificates and AD objects, using HBC you should create a routine to do it for you... in a mixed environment I believe that a consistent and standardized approach is better. 3. HBC configuration requires User consent for some operations.

4) Do I have to maintain two different "solutions" in the future or is there a "single" approach for both AMT versions?

Bruno>> You can use the this approach for any vPro version.

Best Regards!

--Bruno Domingues

Re: Mixed AMT Environment Clarification needed

idata — Fri, 28 Oct 2011 08:14:27 GMT

Thanks Bruno

your answer was very helpful.

We will use a single approach to prepare the computers via USB stick to add the internal root certificate. Some configuration like KVM and consent stuff can also be configured via USB.

Thanks again

Re: Mixed AMT Environment Clarification needed

idata — Mon, 31 Oct 2011 08:32:22 GMT

Hi Bruno

maybe you find a second. I have two more questions.

1) To improve the overall information quality I tested the ACUConfig on Intel 5.x systems. The data delivered is quite impressive. I cannot use HBC on Intel 5.x systems but can I use the ACUConfig utility to discover Intel 5.x. What I mean is this officially supported?

2) In the official document "Host Based Provisioning using SCCM and SCS 7" there is a paragraph talking about preparing the discovery package. Files inside a folder "SCCM_Utilities" should be copied. I cannot find an folder with such a name. Any idea?

Thanks in advance

Joachim

Re: Mixed AMT Environment Clarification needed

Bruno_Domignues — Mon, 31 Oct 2011 21:19:17 GMT

Joachim,

Yes, answering both questions: ACUConfig.exe is officially supported and there is a standalone version to use for this purpose that is called "http://software.intel.com/en-us/articles/download-the-latest-version-of-intel-amt-setup-and-configuration-service-scs/ System Discovery Utility" where your have documentation as well.

Best Regards!

--Bruno Domingues

Re: Mixed AMT Environment Clarification needed

idata — Tue, 01 Nov 2011 08:21:44 GMT

>>Yes, answering both questions ?!?

Second question:

Does that mean the SCCM Utility mentioned in the documentation is the standalone "System Discovery Tool"?

Thanks

Re: Mixed AMT Environment Clarification needed

Bruno_Domignues — Tue, 01 Nov 2011 20:35:23 GMT

No, you have the option to use the standalone tool but if you have the SCS, you will find this tool in SCS_Discovery folder.

Best regards

--Bruno Domingues

Re: Mixed AMT Environment Clarification needed

idata — Thu, 03 Nov 2011 11:41:59 GMT

I have to stress that again. In the Intel document "Host Based Configuration with Intel SCS 7 and Microsoft System Center Configuration Manager" regarding HBC is written:

Create System Discovery Package

This section describes how to create the System Discovery Package in Configuration Manager.

3.1.1 Download Intel SCS 7 to get the System Discovery Files

First you must download the necessary System Discovery files .Click the link below to obtain Intel SCS 7 files to obtain the System Discovery Tools.

http://software.intel.com/en-us/articles/download-the-latest-version-of-intel-amt-setup-and-configuration-service-scs/ http://software.intel.com/en-us/articles/download-the-latest-version-of-intel-amt-setup-and-configuration-service-scs/

Intel® vPro™ Technology Use Case Reference Design

From the chart, please download the Intel SCS (source kit) version 7.0.13.31 to your Configuration Manager console system.

1. On the Configuration Manager console system, expand the Intel SCS 7 7.0.13.31.zip file to the local drive.

2. Expand the IntelAMTSCS folder.

3. Expand the ACU_Configurator folder. You will need the following files to execute the system discovery capability:

• ACUConfig.exe

• ACU.dll

• xerces-c_2_7.dll

• the Licenses folder (all)

4. Copy the ACU_Configurator folder (including all files listed above) over to your Configuration Manager Server or store it on your library network share.

5. Create a new file and name it discover.bat.

6. Open discover.bat in a text editor and enter the following command line as the contents of the file:

AcuConfig /output console /verbose systemdiscovery

7. Save the discover.bat file in the ACU_Configurator folder.

8. Go back to the IntelAMTSCS folder.

9. Expand the SCCM_Utilities.

10. Expand the SCCM_Configuration_Notification.

11.Copy all files from this directory to the IntelAMTSCS\ACU_Configurator folder.

I am focusing on the red highlighted lines. I can't find these files in the most current Intel SCS 7 Version.

Any idea why these files are not inluded as described in the document? I' m also pretty sure that these files are required regarding host based configuration e.g. a notify.vbs script is mentioned later in the document which is not part of the sources.

Thanks again

Joachim

Re: Mixed AMT Environment Clarification needed

Bruno_Domignues — Wed, 07 Dec 2011 00:43:01 GMT

Joachim,

There is available in this following /docs/DOC-6474 link an updated documentation to SCS 7.1.

Best Regards!

-Bruno Domingues