Tim Duncan and Andy Schiestle this week released a new Remote Encryption Management video, showing you how to unclock remote clients. It also gives you more instruction about using the REM SDK itself.

We are helping to promote a new Intel Press book: Harnessing the UEFI Shell Moving the platform Beyond Dos. Read authors' descriptions of the features and capabilities of the shell for the UEFI. "UEFI is not an operating system per se, but is instead intended to be a set of defined interfaces between the system firmware (BIOS), Option ROMs, and operating systems."

Our Community Manager at Large program has started with our selection of Javier Andres Caceres Alvis who works as a Software Engineer for Aranda Software in Bucaramanga, Colombia. He will be attending our content meetings once per month and has already provided some excellent ideas for our community. An extremely astute developer who understands what our community is all about, Javier thinks we need to make "more noise" about Manageability in general and Intel® AMT™ in particular. Stay tuned to find out which of Javier's plans will be put into practice.

We recently featured a poll concerning language preference. The question was "How comfortable are you with the English Language?" Half of the responders said they were not English speakers but understand English well, 42% of respondents said they were native English speakers. Only eight percent stated that they were not English speakers and that English was difficult for them to understand. This is good news for the most part but eight percent stilll have challenges. Please write to me at kathy.a.farrel@intel.com with ideas on how to reach these folks. The Intel Software Network is working to address different languages and will add more over time.

Hey - did you know we're on Twitter? Follow ISNManage to get the latest on Manageability and our Community.

I will continue to morph our site as I receive more input and discover new areas to interest you!

Keep your cards and letters coming! :-) Tell me what you're thinking about - really. What else can we do to help you with your work?

Kathy

Did you know that WSMan will soon replace the legacy SOAP interface in the Intel® AMT SDK? This means that new features are no longer offered along with SOAP APIs and soon, the older legacy SOAP interface will be completely replaced by the WSMan interface. So it is important that our developers start embracing WSMAN sooner than later. We are hoping that this updated document will help ease the learning curve. With that said, please let us know if this document helps and what else do you, as a developer need, in order to get going with WS Man?

The article describes how to develop flexible WS Management-based solutions for Intel® Active Management Technology using the .NET development environment. The basic ingredients and building blocks of a WSMan-based solution are also presented along with some coding samples. These samples were written using Windows 2008.

In a nutshell, here are the main topics that the article contains:

Basic Ingredients of a WSMan Solution:

• What is a WSMan Client?
• What is a WSMan Server?
• What is a CIM Binding method?

Preparing the Sample Environment:

• How to configure WinRM
• Registering the generic CIM binding library
• Setting up the Intel® AMT Hardware
• Setting up the WSMan ingredients in a .NET project
• Running the PowerControl Sample

Establishing a Session:

• Basic WSMan Get Operation
• WSMan Get Operation with Selectors
• WSMan Enumerate Operation
• WSMan Invoke Operation

Learn More about WS-Management

For further information regarding WS-Management, the following resources provide a good starting point:

• Web Services for Management contains the actual specification for WS-Management protocol.
• WS-Management - CIM Binding contains the actual CIM-Binding specification for the WS-Management protocol
• MSDN: Search for "WinRM" to get information regarding Windows Remote Management

The latest Intel® AMT SDK release contains the following resources regarding WS-Management.

• Intel® Active Management Technology WS-Management Flows
• WS-Management Classes\index.html

Out Of Band KVM is no triviality. Imagine your PC user calls you with a connectivity problem: You can ask her questions about the system... or you can use Intel KVM to control her system, seeing her screen and controlling her mouse -- discovering that the network driver isn't installed is a breeze, and fixing it is as simple as inserting the installation disc in your own machine and executing it through IDER (previous Intel AMT features are, of course, available concomitantly).

Intel KVM will show you the entire remote desktop in any case, even in a BSoD, or with a missing hard-disk or CPU.  As much as this is exciting, this sounds scary: what if users want some privacy?
Well, all and any KVM connection starts with a secure graphic output containing a secure password, and this password is required in order to make the connection. This means that there is no Intel KVM session unless the computer user is now in front of the screen and willing to give control. The remote session is indicated to the user, and he has also full control to halt the session at once at the press of a mouse. Reviewed by an internal privacy review board, the technology is planned to be friendly to IT Managers and users alike.

This new feature will be available in some of the 2010 platforms, and is an incredibly useful addition to the other manageability (and remote desktop or KVM) solutions IT shops already have in their toolbox.
In a recent demonstration I performed for local IT Managers, the reception was overwhelming! Instead of performing this full demo on the web, I'll let you with this teaser.

We'll be soon posting on this blogs new information about this technology (with videos!). Stay tuned, it is going to be an exciting topic!

First, what’s new since I became your community manager?

The Remote Encryption Management SDK was released at the start of the Intel Developer Forum. Remote Encryption Management allows computers with Intel® vPro™ Processor Technology and encrypted hard drives to be managed out-of-band.

To learn more about Remote Encryption Management and download the SDK, click the following:

• Remote Encryption Management Software Development Kit Download page
• Andy Schiestl’s Blog
• Tim Duncan’s Video Demo (filmed at IDF)

“Developing WS-Management Solutions for Intel® Active Management Technology” was written by Intel’s Randy Templeton and released just this week. This article describes how to develop flexible WS Management-based solutions for Intel® Active Management Technology using the .NET development environment. Basic ingredients and building blocks of a WSMan-based solution are presented along with coding samples.

As part of my spin up I’m naturally spending a lot of time with Intel engineers and other members of our community who are experts on manageability technology including Intel® Active Management Technology (AMT) and Intel® vPro™ Processor. And while I will continue to learn more I first came to the conclusion that I make some changes on the site. The first of these are:

• On the Manageability home page I removed the flash banner and replaced it with some to-the-point links and set them off with a blue box. This area is what I call the “sweet spot” of the page as I believe it should contain items you immediately look for when you arrive in our community, or when you return and want to start where you left off. If you would like to see additional links here let me know and I’ll add them.
• I added the book section and highlighted the newest offering: Active Management Technology Demystified: Unleashing the power of Intel® vPro™ Technology, authored by Intel employees Arvind Kumar, Purushottam Goel and Ylian Saint-Hilare. If you know of additional books and publications send the info to me and I’ll see where it fits and post it.
• I created a tag cloud at the bottom of the Home page, the links of which take you to pages covering the subjects that are listed.

Our goal is make this an ever-changing, user-friendly site that reflects us. We want you to find what you need as quickly as possible and quickly see what’s new in order to accomplish your work. As we continue to modify the site we will retain what works and improve where we can. More changes are coming and the evolution will be gradual and continuing.

Many of the changes will be a result of your contributions so it is imperative that you share your questions, answers, opinions and ideas.

I hold a content meeting each week to find out what’s going on and brainstorm ideas for articles and features. Each month we will invite a Community Member or two, outside of Intel, to attend this meeting to represent the Manageability Community at large. Let me know if you are interested and we’ll arrange for you to attend by phone.

We want to hear from you so join our conversation!

Kathy

I thought it might be useful to post the steps that are needed in order to set up the network and certs. In my environment, I run the SCS Service with a specific SCS User (SCSUser) and so the provisioning certificate had to be installed in that user's personal store (not in the Administrator's store.) Also note that this certificate is the root certificate that matches one of the Certificate Hashes that is already in the Intel AMT Client's Manageability Engine. Also, I am not using Active Directory in my environment.

Before Remote Configuration begins, the network should be configured as follows:

• The Intel SCS must have a server (provisioning) certificate, used only for setup and configuration, with the appropriate OID or OU that traces to a CA which has a root certificate hash stored in the Intel AMT device. The OID in the Extended Key Usage field must be [amt]2.16.840.1.113741.1.2.3, or the OU value in the Subject field must be "Intel® Client Setup Certificate".
  • Contact one of the vendors whose root certificate hashes are built into the Intel AMT firmware. A list of the hashes should be provided by the platform vendor. Go to the vendor's web site and purchase an "SSL certificate" For example, the following link to Verisign's site http://www.verisign.com/ssl/buy-ssl-certificates/index.html shows how to purchase an appropriate certificate. Use the OID or the OU values above (or both) when defining the certificate
  • This provisioning certificate must be installed in the SCS User's personal store.
  • It's OK if the provisioning certificate has a different domain associated with it than your management/provisioning console/AMT Client has.
• The Intel AMT device must be configured to receive its IP address from a DHCP server.
• Your DHCP server's Scope Options must be configured to support option 15 and to return the domain suffix that is in the provisioning certificate. Note that Remote Provisioning will not work without this requirement for Option 15.
• The Intel AMT device must be pre-programmed with at least one active root certificate hash. The device comes with a set of hashes from various vendors.
• The Intel AMT Setup and Configuration Server (SCS) must be registered with a DNS server accessible to the Intel AMT device with the name "ProvisionServer" (or the name defined by the PC manufacturer) and be in either the same domain as the device or in a domain with the same suffix. (Add an alias for "ProvisionServer"= <domain name of the Intel AMT Client>.)

Once your network is correctly configured and your provisioning certificate is installed, you should be able to follow the instructions provided in the SCS 6.0 Lightweight installation guide. The following components are required for remote provisioning:

• SCS Service must be installed
• SCS Console - you will need to set up a profile to be applied to your AMT Client system.
• The Activator is then run on the AMT Client - follow the GUIs - make sure you choose the "PKI" option for provisioning. (you can set up a remote desktop on your Provisioning console in order to execute the Activator remotely on the AMT Client.)

I hope this helps!

Note that Intel AMT Management Consoles that are based on the legacy SOAP APIs will not be affected by this issue.

The affected API is:

CIM_BootConfigSetting. ChangeBootOrder(REF Source, REF Job)

Prior to FW 5.1 the API is defined as lower-case "s" (e.g. 3.x,4.x,5.0.x)

CIM_BootConfigSetting. ChangeBootOrder(REF source, REF Job)

In 5.1  FW  the API definition changed to  (upper-case "S")

CIM_BootConfigSetting. ChangeBootOrder(REF Source, REF Job)

In 5.2.10 and above  the FW supports either Lower-case "S" or uppercase "s"

CIM_BootConfigSetting. ChangeBootOrder(REF Source, REF Job)

CIM_BootConfigSetting. ChangeBootOrder(REF source, REF Job)

For those ISVs who have already upgraded their Intel AMT clients to 5.1, you may be experiencing issues where your WSMan Management Console Application worked with the AMT 5.0 Firmware but not with the AMT 5.1 Firmware. This DASH compliance issue might be the reason why.

By the way, Dell has already posted AMT version 5.2 on their website HERE for the Optiplex 920.

To sum up in a sentence, Remote Encryption Management supports the ability to unlock an encrypted hard drive through vPro. This refers to both software encrypted solution (where the OS and a pre-boot authentication are involved), or FDE encrypted hard drives where the encryption is handled at the hard drive level. This helps to solve a previous conflict if someone wanted to use both encrypted hard drives and vPro to wake up and patch a system when a user wasn’t present. Previously the systems had to be left unlocked overnight, or a user had to be physically present to unlock the hard drive. Now, the credentials to unlock the systems can be passed to the system to unlock it from remotely, and allow the patching process to continue. This also enables some other use cases remotely out of band, such as securely erasing the hard drive once the machine is no longer in use to ensure that sensitive data is removed.

The SDK contains both an example console that shows how the functionality could be integrated into an existing encryption solution, and an ISO file that can be remotely booted using the IDE-R functionality to unlock the systems. It also includes the source for both of these components, to make the integration task into an existing solution easier. If the existing encryption solution already has a pre-boot authentication environment, the key component of the ISO (the ATAoverLAN bridge) can be integrated into the pre-boot authentication environment. Integration into a pre-boot authentication environment is actually a better performing solution, since the ISO image does not need to be loaded over the network before the hard drive can be unlocked.

One of the things that is interesting about this project is that since its software based, it can work with the existing vPro platforms that were released last year. This functionality is supported on full vPro systems (not Standard Manageability systems) in the current generation of AMT 4 and AMT 5 systems, as well as the next vPro generation that releases next year.

Even if someone doesn’t have an existing encryption solution to integrate this functionality into, the SDK still might be of interest. I mentioned the ISO previously, it's a Linux based iso image that's used through IDE-R. In addition to the ISO image itself, the source for that ISO file is provided. This iso is very compact (it’s approximately 2.5 MB), and could potentially be used for other out of band functionality.

Note that this conversation is still pretty high level and I’ve papered over some details that would be involved. If anything I’ve talked about sounds interesting, I’d recommend downloading the Remote Encryption Management SDK here: http://software.intel.com/en-us/articles/download-the-latest-version-of-Remote-Encryption-ManagementSDK/ and look at the more detailed content.

There’s also a demo video of the functionality being used here: http://software.intel.com/en-us/videos/amt-remote-encryption-management-demo/

We have talked about this IT game in previous posts (here and here), but much of the renewed interest on the game comes from its newest feature: Crisis!
"...the management suddenly slashes your department’s budget. Your mission is to make the business case for upgrades..."
Nothing like a game that accompanies and simulates reality :)

you play the IT manager of a small company with global ambitions. Part of your job is ensuring that everybody’s desktop PCs, laptops and servers keep running smoothly, and the skills your characters acquire during gameplay include knowledge on virtualization, manageability and security. In case you didn't sign for the game yet, go to IT Manager 3: Unseen Forces and start having fun while you learn.

Here is the game trailer:
IT Manager 3: Unseen Forces on Intel's YouTube channel

One answer arrived via Facebook this morning from the vPro Expert Center... Intel IT, as a member of Microsoft's Technical Adopter Program (TAP), found that Windows 7 running on PCs with Intel® vPro™ technology delivers the best productivity for our employees & the best managed solution for IT. After 3 months of trial with over 300 users, 97% of our test users would recommend the new OS to peers and Intel IT sees the potential to save $11M over the next three years. So I now have one personal observation - and another business one.

What are you looking forward to with Windows 7 - and are you considering early or late adoption of the new OS?

Ylian

Watch the Youtube Video!

If your at IDF now, go into session room 2009 to get your promotional book! For everyone else, the book is at Amazon.com here, we also have a web site here.

Ylian

     http://mesh.homeip.net

It's very basic right now. The mesh networking code is core infrastructure for a lot of other usages in the future. Since it's important to get the basics right, I am spending a lot of time on making the software stable, secure, portable and small as possible. The peer-to-peer agent itself is written is raw C code and runs on both Linux and Windows, 32 and 64 bit, IPv4 and IPv6, all traffic is encrypted, etc.

So far, it's just a start, I expect to be coming out with many more usages after the basics are completed.

Ylian

In both the session and the lab, I will be talking about pushing the limits of what you can do with existing Intel AMT. I have done similar things in the past, but this year I will focus on two main ideas:

• Using IDE redirect over the Internet. Anyone how used Intel AMT know, IDE-R is probably the most powerful feature of Intel AMT. You can use it to do just about anything on the remote computer. In my lab, I will be using this powerful feature where it was not designed to work, high-latency and low bandwidth networks. This is going to be useful for people who want to use IDE-R to fix computers at remote places without having to wait hours for an IDE-R boot image to load.
• Using Intel AMT as a peer-to-peer client. This is probably the most gutsy proposal for how to use Intel AMT beyond it's original design yet. If you form a peer-to-peer network inside your own network, there are piles of interesting usages that because possible. If you have Intel AMT, you can make it act like a small peer-to-peer client when the computer is sleeping. So instead of disappearing off the network, it's still participating along with other nodes. I have actual code running and in the lab, we will get to play with it.

One last thing, I will be doing book signings. As you guys know, I am the co-author of the book "Active Platform Management Demystified" and will be promoting the book at IDF. So far, the reviews have been great and I will be very happy to hear from people how have read it.

See you next week!
Ylian

Those of us who have been moderating the forum are constantly thinking of ways we can improve our customer's experiences and so we have been thinking about Tags. We have noticed that if you click on a tag, every post, article, blog, etc that has that tag will appear. We thought that perhaps if we started tagging our forum questions with relevant "AMT" tags then our users would eventually find this useful in researching their questions prior to posting them (we know that the bulk of people on Social Networks can be a little shy and don't like to actually post questions.)

How do tags work? First of all I'm going to list our tags in this blog. The first thing you will notice is that they are one word and the first three letters are "AMT." For those of you who have tried to find AMT questions about Linux may have run into the situation that "Linux" appears many many times throughout the ISN site; AMTLINUX, however will only show up on posts that are relevant to Intel AMT.

So here they all are. I have tried to categorize them so that you wouldn't have to deal with one big blob of Tags. What I would like to see next is "Tag Clouds."

General help in getting started with Intel AMT:

• AMTSTARTHERE
• AMTTRAINING
• AMTDISABLE
• AMTANNOUCEMENT
• AMTALL

Questions about General topics including AMT versions, bios:

• AMTBIOS
• AMTDRIVERS
• AMTME
• AMTFW
• AMTLICENSE

Questions about Provisioning:

• AMTMODES
• AMTSCS
• AMTBAREMETAL
• AMTPROVISIONING

Questions regarding the Intel DTK and other Sample Code:

• AMTDTK
• AMTOUTPOST
• AMTHLAPI
• AMTSAMPLE
• AMTRDK
• AMTQST
• AMTSDK

Questions regarding Development Environment and Tools:

• AMTDELPHI
• AMTIMRSDKDLL
• AMTLINUX
• AMTECLIPSE
• AMTLINUXCLIENT
• AMTIDE
• AMTAXIS
• AMTIMSS

Questions regarding Intel AMT Messages and Alerts:

• AMTEVENTLOG
• AMTALERT
• AMTSMS
• AMTSENSOR

Questions regarding SOL/IDER and Boot Options:

• AMTF12
• AMTPXE
• AMTSOLIDER

Questions regarding Storage

• AMTSTORAGE

Questions regarding general connection issues:

• AMTCONNECTION
• AMTDISCOVERY
• AMTWEBUI
• AMTKERBEROS

Questions regarding Intel AMT protocols:

• AMTSOAP
• AMTWMI
• AMTWSDL
• AMTWSMAN

Questions regarding System Defense/Agent Presence:

• AMTFILTER
• AMTPOLICY

Questions regarding Client Initiated Remote Access:

• AMTCIRA
• AMTMPS

Questions regarding Data Center Manager:

• AMTDCM

Questions not handled in the Manageability Forum:

• AMTOFFTOPIC

In a previous blog post, I talked about the release of Landscape, which is a fairly new product for Canonical.

You can watch more of our open source videos on the multimedia page.