So what is in the Release 7.0 of SDK? First, we added the support for the feature named "Host Based Configuration" aka HBC. HBC allows you to now easily activate the Intel® AMT system from the local OS interface. You have a choice of configuring the AMT clients in two modes - Client Control Mode (I call it the easy mode) or Admin Control Mode (the old way supported in previous generation platforms). Configuring systems in client control mode removes many of the restrictions that were present before and you can now configure even if the machine if it connected on wired or wireless or no network connection. SDK 7.0 includes detailed documentation of HBC feature, requirements for configuration and any limitations. SDK also includes samples to demonstrate the feature.

Another big improvement in the SDK includes the restructuring of the use case flows. Instead of starting from CIM_ComputerSystem and traversing the associations to the desired object, we have updated the use case flows to include the direct path using keys/selectors to the desired objects. This approach will allow you to develop your application to access the desired objects in Intel AMT in an efficient way and is way more faster (trust me it is very fast this way). 

Next, I would like to talk about snippets. Snippet is a small set of code to demonstrate a single step. In the SDK, we have close to 300 snippets embedded in the Intel AMT Features use cases. Snippets are written in Powershell 2.0 and are dependent on the Intel vPro Module framework that is also available in the SDK. This new approach will provide a lot of clarity in understanding the use case flows and the code associated with the flows. We hope that you will find it useful in your development efforts.

Another major shift in this year's SDK includes the addition of source code for Intel vPro Enabled Gateway aka MPS. Previously, only the binary for the MPS module was included in the SDK. This time around, we have enhanced the MPS to add support for dynamic subscription to the notification events, option for consoles to query MPS for list of connected systems and keep alive mechanism to handle the disconnections of the connected AMT clients. All of these enhancements along with the features that were already present are now available in the SDK in the form of documentation, binary and source code.

Last but not least, we have also enhanced our redirection libraries. For IDE Redirection, we have officially added support for DVD media in addition to CD and Floppy. Both KVM and IDE redirectin libraries are updated to support Kerberos authentication, Digest authentication. Redirection library now supports the link preference when operating on a wireless interface.

There are many other improvements that were made in the SDK that I can list here :-). SDK is now your one stop source for information about Intel AMT and if you have any questions about it, feel free to reach us on the manageability community forum.

Part 1

Part 2

Quick Primer:

vPro Enabled Gateway is a piece of software intended to be residing in the corporate DMZ environment to allow connectivity to the clients that are out in the Internet. This connection will enable the IT help desk residing in the corporate intranet environment to provide support for road warriors.

Fast Call for Help feature in Intel AMT (4.0 and above) allows the end user to initiate the call for help through the OS tray icon provided by Intel or through Ctrl-Alt-F1 key right after BIOS POST. This connection is established between Intel AMT and vPro Enabled Gateway and has no dependency with OS being installed or operational.

Video contents:

Environment - Windows Server 2003 (DHCP, DNS configured).

Tools Used - VMWare Workstation, Manageability Developer Toolkit, Stunnel, 3proxy, Intel AMT SDK

The video will walk through the process of setting up vPro Enabled Gateway. Uses Manageability developer tool kit to create the necessary certificates and configuration of tools like Stunnel and 3proxy. Followed by the configuration of the tools, vPro Enabled Gateway is configured. This finishes the configuration portion of vPro Enabled Gateway.

Next step is to configure the Intel AMT client. Manageability Developer Toolkit is used again for AMT configuration. Training will walk you through the process of creating a profile that will be used to the configure the AMT client. TLS-PSK provisioning method is used to provision the AMT client.

After the AMT client is provisioned, the next step is to add information about the vPro Enabled Gateway, add a remote access policy, enable the appropriate interfaces and finally configure environment detection. Once the client and server is configured, the video will walk through the flow of connecting to the client over the remote access connection.

One of the new features in the Centrino 2 platform is the support for Microsoft Network Access Protection (NAP). As part of the Endpoint access control (EAC) umbrella, Intel AMT now supports 802.1x, Cisco NAC, and now Microsoft NAP. The endpoint access control feature in Intel AMT allows for controlling the network access to client based on its identity and compliance with the corporate policy.

So what can you expect in the Intel AMT SDK for supporting Microsot NAP? Windows Vista, XP with SP2 natively support NAP and for Intel AMT support, we are providing the System health Agent (SHA) that will collect Intel AMT's attributes and pass it to the NAP client.  On the server side, you will need Window Server 2008 for NAP enforcement. For Intel AMT attributes, we are providing a sample System Health Validator (SHV) that can be installed to create policies and enforcement.

Intel SCS supports provisioning of Intel AMT systems for NAP.

Let me give you a preface to this feature. All these days, one of the requirements for managing the vPro platforms with Intel AMT was to have the devices inside the corporate intranet. Management consoles would also be residing in the intranet. For any manageability related operations, the management console would initiate the connection and Intel AMT devices respond to the request.

This same model applies for both desktop and mobile platforms. For the mobile platforms that roam outside the corporate network, or for the employees that are working from remote locations (e.g home office), management console does not have the information to manage them. The devices once outside the corporate intranet, can be residing behind a firewall, NAT etc and cannot be reached by the management console. So in summary, once the device is outside the intranet, you cannot manage the device anymore. For any assistance, you would need the owner of the device to come into the nearest corporate location.

To address this situation, Fast Call for Help feature was introduced in Centrino 2 platform with Intel AMT 4.0 version. You will see the name of this feature as "Client Initiated Remote Access" in the documentation. As the name suggests, this feature requires the Intel AMT client device to initiate the call for help. An overview of the feature can be found here.

Once configured, when the Intel AMT client is outside the corporate network, it will initiate a secured connection to a vPro enabled gateway residing in the De-Militariazed zone (DMZ) of the corporate network. vPro enable Gateway will notify the management console of the connection with Intel AMT device in need of help. Using this secured connection, now the management console can perform all the management tasks (asset inventory, SOL, IDE-R etc..) just like on the devices in the intranet.

There are three ways to initiate the fast call for help:

1. User Initiated - User can initiate the connection using the privacy icon in the OS or through BIOS
2. Remote Scheduled Maintenance - Device can configured to check in with the vPro enabled gateway on a periodic basis for maintenance operations.
3. Remote Alerts - Anytime a platform event occurs, Intel AMT device will establish the secured connection and send the alert via this connection.

Check out the post by Lance Atencio about introduction of AMT SDK 4.0 that has all the ingredients to get yourself familiarize with this feature. In my opinion, this feature is intended for all those road warriors taking their systems with them and when in need of a help, your IT will be able to serve you.

Lets take a look at how we can achieve this on a Lenovo T61 laptop. The following steps worked for me.

• Power on the system and during the boot up, holding onto F1 key will let you into BIOS.
• Once you are in the BIOS, browse to Config->Intel AMT
• Change the Intel AMT settings to "disabled", save the settings and exit
• After the BIOS settings are saved, the system will automatically reboot
• On the power up, you will see a message about finishing the unconfiguration of AMT, do you want to continue (Yes/NO) -- Select Yes
• This will unconfigure all of AMT/ME settings and all the passwords are reset
• You will need to enter BIOS again, browse to Config->Intel AMT, change Intel AMT setting to "Enabled"
• After the BIOS settings are saved, next time when the system is powering up, you will need to hit "ctrl-P" to configure ME/AMT again.
• This time you will be using the default ME password ("admin")
• You know the drill from here :-)

If there are any further questions, feel free to post your questions on the manageability forum.

Many of the ISVs are now developing their applications based on WS-Management protocol. You may ask, there are so many of Intel AMT enabled machines that are below AMT 3.0 out it the market, how will these new management applications manage them? All of the vPro machines with firmware version below AMT 3.0 can only communicate using the legacy SOAP based protocol.

To address the gap between the management of pre-AMT 3.0 machines using the new ISV management applications based on WS-Management, Intel has come up with the WS-Management translator tool. For instructions on how to use the translator tool, refer to the readme file in the installation package.  Using Intel WS-Management translator tool, management consoles can issue WS-Man commands to the translator, the translator will perform the equivalent operation using the legacy SOAP interface.

Along with the installable package, source code is also made available for the ISVs. The source code will allow for tighter integration of the ISV management application with the translator. What does that do for me? With the management application that was developed based on WS-Management protocol,  and integrating Intel WS-Management Translator, now you have the ability to manage all generation of Intel AMT systems seamlessly. Check out this primer describing Intel AMT and WS-Management.

In summary, if you are an ISV developing the management application using WS-Man, and want to manage all generation of Intel AMT devices, Intel WS-Management translator is a very useful tool for you. For any questions on this tool or other Intel AMT related questions, submit your questions in the manageability community.

Inside the operating system (OS), when you want to connect over wireless interface, you will search for SSID or create a profile with the SSID name, configure it with the authentication details and any other credentials required. Using these wireless settings (also known as wireless profile), the OS will start connecting over the wireless interface. In order for AMT to be available via the wireless interface, you need to configure it with the wireless profile(s).

When dealing with large number of systems, adding the wireless profiles in a programmatic way is recommended. The needed API's are listed in the Network Interface Guide in SDK. For a small collection of systems, easiest way to add the wireless profiles is through the web UI supported by Intel AMT. One thing to note here is that addition of the wireless profile can only be done over the wired interface.

Things you need to collect for the wireless profile:

• SSID
• Name for the profile
• Network Authentication (Intel AMT would require either WPA-PSK or RSN-PSK)
• Encryption (TKIP with WPA-PSK or CCMP with RSN-PSK)
• Pass Phrase or Security Key or xProfile

Connect to the webUI on wired interface http://Intel-AMT-IP-Address:16992. After logging in with the credentials, click on wireless settings. Click on New under profiles, and enter the wireless profile parameters.  It is always a good idea to disable the radio, add the profile and enable the radio.

After the addition of the profile and enabling the radio, you can verify the IP address for the wireless interface on the System Status page in webUI. It will take couple of minutes for the wireless IP address to show up. Rebooting the system can expedite the wireless association.

Has this been helpful to you? Do you need to know any more information? Need help with your programmatic solutions? For answers to all your questions related to manageability applications development, visit the forums section and submit your questions.

Recently I was dealing with a forum question and had interesting conversations with the the developer. I made a comment about coding habits when dealing with Intel AMT. With this blog, I am trying to reach out to other developers. I want to hear some of your experiences, what are the tricks you did to get around the problems and so on.

Some of the the things I have observed on the manageability forum are listed below:

• Before issuing a remote control power state command, make sure to check the current power state
• If your SOAP request is not accepted by AMT, try it couple times before giving up. This will probably work provided your SOAP request is well formed and all the authentication requirements are satisfied and the infrastructure configured properly.

So take this opportunity to discuss your experiences with Intel AMT and what you had to do in your software application to encompass those issues. As you know, all of your experiences can guide the new developer and make their life easier. :-)

Ok, now after downloading the WinRM, what do I do? Like any other tool, you have to first configure it :-). The samples provided in AMT SDK only work with digest authentication and un-encrypted channel. So to run the samples in SDK, we need to configure WinRM. Here is how its done:

From a command prompt you can display the current WinRM client

C:\ >winrm get winrm/config/client

Client

    NetworkDelayms = 5000

    URLPrefix = wsman

    AllowUnencrypted = false

    Auth

        Basic = false

        Digest = false

        Kerberos = true

        Negotiate = true

        Certificate = true

    DefaultPorts

        HTTP = 80

        HTTPS = 443

    TrustedHosts = localhost,console,192.168.0.101

Set the AllowUnencypted property to “true”

C:\>winrm set winrm/config/client @{AllowUnencrypted="true"}

Client

    NetworkDelayms = 5000

    URLPrefix = wsman

    AllowUnencrypted = true

    Auth

        Basic = false

        Digest = false

        Kerberos = true

        Negotiate = true

        Certificate = true

    DefaultPorts

        HTTP = 80

        HTTPS = 443

    TrustedHosts = localhost,console,192.168.0.101

Add the host names or IP addresses of the AMT devices you plan on using to the to the TrustedHosts list. This is a comma separated list that supports wild cards.

C:\>winrm set winrm/config/client @{TrustedHosts="*.mydomain.com,myAmt1,192.168.0.101,localhost"}

Client

    NetworkDelayms = 5000

    URLPrefix = wsman

    AllowUnencrypted = true

    Auth

        Basic = false

        Digest = false

        Kerberos = true

        Negotiate = true

        Certificate = true

    DefaultPorts

        HTTP = 80

        HTTPS = 443

    TrustedHosts = *.mydomain.com,myAmt1,192.168.0.101,localhost

Ensure the Digest Auth flag is set to true as follows:

C:\>winrm set winrm/config/client/Auth @{Digest="true"}

Auth

    Basic = false

    Digest = true

    Kerberos = true

    Negotiate = true

    Certificate = true

Phew, that was some configuration. Ok now we are all set and ready to use the samples.

Late July 2007, we have released SCS 3.1 in support for features in AMT 2.5, 2.6, and 3.0. All of the features are not covered by that time and now we have a newer and better version of SCS with more features support. This version of SCS will be posted on our Manageability Developer's Community website.

So what is new in this release? Check out the new features that are supported in this release:

• Support for Intel AMT Release 2.6
• Complete support for environment detection and Host VPN routing
• Support for wireless connections using the host wireless profiles without providing wireless profiles to Intel AMT devices
• Support for Microsoft* IAS RADIUS server using EAP-MSCHAPv2
• Support for Cisco ACS EAP-FAST/TLS
• Support for PXE boot with 802.1x authentication
• Support for Intel AMT authentication to 802.1x if the Host fails to authenticate
• The application now checks the expiration date of the remote configuration client certificate.
• A number of open issues have been resolved (see the Release Notes) and Documentation Updates

You can download the latest version of SCS 3.2 here.

My name is Ajith Illendula and this is my first blog post. I am one of the manageability engineer working for Intel. My role is to support the developer community writing the manageability applications for Intel AMT systems.

If you are currently using Intel AMT SDK 3.0 to develop applications for Intel CentrinoPro Processor Technology or Intel vPro Processor Technology, there is an update available for the SDK which can be downloaded here. You can find more detailed information about the SDK here.

Who needs this update? If you are seeing poor performance during SOL boot, seems like the system is unresponsive during SOL session, then you want this update.

This updated SDK release contains fixes to the following issue:

-Title: Performing SOL boot can seem to hang the Intel® AMT machine
-Symptoms: Performing SOL boot can cause the Intel® AMT machine's boot flow to work so slowly that it might seem that the Intel® AMT machine is not responsive. This behavior does not happen on all Intel® AMT machines, but is BIOS dependant.
-Cause: When opening an SOL session, the Redirection Library does not set all serial control bits needed by some BIOSs.
-Resolution: Use the Redirection Library included in this SDK release instead of previous versions.

All of the documentation errors as indicated by the errata document posted earlier are corrected in this release. For more detailed information about open issues, please refer to the readme file in the SDK distribution.

How do you install this SDK? Simply copy the complete SDK directory structure to a folder of your choice. Alternatively you can chose to copy single components directory. A word of caution for this approach - SDK is designed to be copied as a single unit, many samples rely on common include files and code that is part of the SDK and not replicated in each sample separately.