Blogs » Intel SW Partner Program http://software.intel.com/en-us/blogs Fri, 10 Feb 2012 03:07:00 +0000 en hourly 1 http://wordpress.org/?v=3.1.3 2011 Game Piracy Observations – Have Consoles Failed the Piracy Litmus Test? http://software.intel.com/en-us/blogs/2012/01/31/2011-game-piracy-observations-have-consoles-failed-the-piracy-litmus-test/ http://software.intel.com/en-us/blogs/2012/01/31/2011-game-piracy-observations-have-consoles-failed-the-piracy-litmus-test/#comments Tue, 31 Jan 2012 23:53:57 +0000 Matt Ployhar (Intel) http://software.intel.com/en-us/blogs/2012/01/31/2011-game-piracy-observations-have-consoles-failed-the-piracy-litmus-test/ So I’ll let you all draw your own conclusions; but I’ve been mulling over a few articles released earlier this month around the piracy statistics released via TorrentFreak. The first article I read was Tom’s article on Gamasutra titled “Report: Crysis 2 named most-pirated game of 2011”. That article led me to the link he posted that takes you to Ernesto’s article posted up on TorrentFreak titled “The Most Pirated Games of 2011”. They’re both great reads and for those interested in the topic of Piracy I recommend reading through them both; the posted comments are always good to scan as well. However; I think both articles lead me towards wanting to scrutinize these claims in FAR more depth.

Links to both articles here:
Gamasutra: http://www.gamasutra.com/view/news/39461/Report_Crysis_2_named_mostpirated_game_of_2011.php
TorrentFreak: http://torrentfreak.com/top-10-most-pirated-games-of-2011-111230/

Here’s a screen capture from the latter site that I’ll be discussing: (Attributes/Thanks to TorrentFreak & Ernesto)

So let’s dissect this & put things in more context. Besides the obvious exclusion of PS3 data – what stands out to you all? …………………………. Give up? Here are the things that stand out the most to me.

1) Does anyone see any Games here that lean on Free to Play/Freemium? (w/Micro-transactions)
2) Does anyone see any MMO, or Subscriptions based Games here?
3) Does it strike anyone else that these games all appear to originate in the Western Hemisphere?
4) Aren’t most of these games still leaning heavily on the Retail fire & forget release model?
5) Most of the games listed also stand out as those that are candidates for Secondary Sales.

Ok… yes…. Before I get flamed I do realize that a few of these are dabbling in things like Online Pass, & some platform specific exclusives, Co-Op modes that lean on a great multi-player experience etc., and so forth. However; I really believe that what we’re seeing occur in Piracy is largely (but not always) a function of these ‘Pirated’ games perhaps not taking, or leveraging more fully, the full tool-set of Business Model Options, Game Design Choices, & or Current Technology that can help reduce, or even in some cases eliminate Piracy outright. I honestly don’t get it. That said, not every game might be a good candidate for say the Freemium/Free-to-Play model, or warrants a subscription; however, it seems like the Western Hemisphere’s Game ISVs – could at least consider some form of a hybrid approach to implement at least (1) of these new trends or technologies to tackle Piracy issues. The alternative is to continue to blame the PC for being a bad platform to publish your game on. However; I don’t hear this kind of story coming out of Eastern Hemisphere Games Companies such as: Nexon, TenCent, Shanda, Netease, etc. So again… I’m at a loss as to why. Also; is the PC really that bad to publish on after all? I believe the PC as a platform to bring your games to is far superior as long as one's willing to tap into some of those relatively newer game design choices, business, and distribution models; but it's going to require some changes in our thinking and playing some catch up to other parts of the world. (Note: Worth adding that localizing your content on day 1 release as globally as possible is also extremely important - especially if you want to reduce Piracy)

Last but not least we have to ask ourselves the following question. When looking at the links or the posted pic we see that PC is leading piracy rates, then it’s the Wii, then it’s the Xbox 360. Interestingly enough though, how much of this is due to the active install base of players on those respective platforms? It’s interesting to note that the higher the Install base, the higher the Piracy rates. Mere coincidence? I doubt it. Bear in mind, the volume of GPU capable PC Gamers over say the Xbox 360 platform is at least 4:1. (~250mu to ~60mu). The Wii has to be somewhere in the neighborhood of at least ~85-90mu or ~3:1 PC to Wii Gamers. Which is an extremely conservative estimate by the way for PC Gaming but I digress. So I’ll leave you with this thought. What would the Piracy rates be on the 360, Wii, or even the PS3 *if* the Active User Install base were at least comparable to that of the PC global install base? Sadly… I think what you’d see is comparable rates of Piracy; regardless of what platform a Publisher chooses. The net is this – and in my opinion it appears that: One: Consoles have failed to truly curb Piracy, and Two: As a result we’ve ended up with an experiment in Consoles that have unfortunately held back gaming and left us with sub-par gaming experiences.

Perhaps it’s time to break those shackles?!

]]> http://software.intel.com/en-us/blogs/2012/01/31/2011-game-piracy-observations-have-consoles-failed-the-piracy-litmus-test/feed/ 0 How to run the SCS Discovery Tool http://software.intel.com/en-us/blogs/2012/01/24/how-to-run-the-scs-discovery-tool/ http://software.intel.com/en-us/blogs/2012/01/24/how-to-run-the-scs-discovery-tool/#comments Tue, 24 Jan 2012 18:44:06 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2012/01/24/how-to-run-the-scs-discovery-tool/

Do you have a system that you believe is Intel(R) AMT capable and you are trying to run  samples but are getting an errors?  Here are some tips on how to make sure your systems *is* Intel AMT capable and is also capable of running the samples in the SDK

1.  Download and run the SCS Discovery Tool in a CMD window:

  • >SCSDiscovery.exe /Output file test.xml SystemDiscovery /NoRegistry
  • test.xml will be a debug file - look for another file named with the FQDN of your computer. Here is a snippet of the xml file and some of the key fields to look for:

2. Open the xml file from running the Discovery tool an look for the following lines:

  • <AMTversion>7.1.4</AMTversion>
  • <MEIVersion>7.0.0.1144</MEIVersion>
  • <FWVersion>7.1.4.1068</FWVersion>
  • <IsAMTConfigured>true</IsAMTConfigured>

For root-causing issues, it is good to know what AMT version/ FW Version we are working with and if AMT has been configured. (And that the correct FW version is installed.)

3. Since most questions appear due to SOL/IDER and KVM, let's take a look at the following entries:

  • <IsAMTKVMSupported>true</IsAMTKVMSupported>
  • <IsAMTIDEREnabled>true</IsAMTIDEREnabled> (IDER must be enabled )
  • <IsAMTKVMEnabled>false</IsAMTKVMEnabled>
  • <IsKVMEnabledInBIOS>true</IsKVMEnabledInBIOS>
  • <IsKVMSupportedInBIOS>false</IsKVMSupportedInBIOS> (Not a reliable indicator!!)

<IsAMTKVMSupported> True if the KVM redirection interface is supported in the Intel AMT Firmware.

<IsAMTIDEREnabled> IDE-Redirection must be enabled in the bios in order to use the KVM feature using the Redirection ports.

<IsAMTKVMEnabled> True if the Keyboard Video Mouse (KVM) redirection interface is enabled in Intel AMT  (This refers to the listener and if you have enabled Intel AMT but have not yet configured your KVM connections, this will show up as false.)

<IsKVMEnabledInBIOS> True if KVM redirection is enabled in the MEBx of the Intel  AMT device

<IsKVMSupportedInBIOS> True if the BIOS of the platform supports KVM redirection.  This entry is not always reported correctly - as you can see on my system it indicates false.  But my system is KVM capable.

It is important to note that the Discovery tool may indicate that your system can do KVM even if you do not have the right graphics card - that's why you check for that first. See this blog for more KVM troubleshooting.

 

]]> http://software.intel.com/en-us/blogs/2012/01/24/how-to-run-the-scs-discovery-tool/feed/ 0 How to Configure your System to Run the IntelvPro PowerShell Module http://software.intel.com/en-us/blogs/2012/01/20/how-to-configure-your-system-to-run-the-intelvpro-powershell-module/ http://software.intel.com/en-us/blogs/2012/01/20/how-to-configure-your-system-to-run-the-intelvpro-powershell-module/#comments Fri, 20 Jan 2012 22:22:55 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2012/01/20/how-to-configure-your-system-to-run-the-intelvpro-powershell-module/ If you are trying to run the vPro PowerShell scripts on your management console but are running into errors, it is possible that either the vPro PowerShell Module has not been installed and/or it is not configured correctly.   The following steps demonstrate how to configure your system in order to use this powerful interface.

Step 1: First make sure the PowerShell Module is installed on your system.  If not go to the following folder in the Intel AMT SDK and install the version that is right for your system (32 vs 64 bit.)

>SDK folder: ..\Windows\Common\WS-Management\Scripting Framework:

 

 

 

 

 

__________________________________________________________________________

For running PowerShell Scripts in the Powershell Command Window Environment

Step 2: Go to the Window's Start window  and search for "PowerShell"

Run the x86 window as administrator:

 

 

 

 

 

 

A PowerShell command window will appear.

First check to see what is the current policy.  If it is already set, you do not need to change it.

 

 

Note:  Setting the Execution Policy to Remote Signed usually works, but if you have certain configurations in your network you might want to use "Unrestricted" execution policy instead of "RemoteSigned."

Step 3: If needed, configure the Execution policy

Enter the following command in order to set the execution Policy:

 


 

 

 

Step 4: Import the IntelvPro Module:

 

 

Your system is now configure to run the vPro PowerShell scripts from within the command window environment.

_________________________________________________________________________________________

Running with PowerShell ISE:

If you will be running Intel vPro PowerShell scripts from within the PowerShell ISE, the configuration is as follows:

Step 1: Bring up PowerShell ISE as Administrator and open the TLS.ps1 file to be edited.  You may have to use the "open" option under the File menu - it may not let you drag it into the window.

 

 

 

 

 

 

Step 2: Once the PowerShell ISE is open,  configure this PowerShell environment for "unrestricted" execution policy  (or RemoteSigned - whichever works for your environment.)  See the middle window in the screenshot.  You need to enter the configuration commands in the bottom window.

 

 

 

 

 

 

 

 

Note that the TLS.ps1 script below imports the IntelvPro module so there is no need to enter the import command in the command window for this particular script.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 
Now your system is ready to run the Intel vPro Module Scripts in the PowerShell ISE Environment.

]]> http://software.intel.com/en-us/blogs/2012/01/20/how-to-configure-your-system-to-run-the-intelvpro-powershell-module/feed/ 0 How to create AMT Certificates using the AMT SDK and OpenSSL http://software.intel.com/en-us/blogs/2012/01/18/how-to-create-amt-certificates-using-the-amt-sdk-and-openssl/ http://software.intel.com/en-us/blogs/2012/01/18/how-to-create-amt-certificates-using-the-amt-sdk-and-openssl/#comments Thu, 19 Jan 2012 00:26:52 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2012/01/18/how-to-create-amt-certificates-using-the-amt-sdk-and-openssl/ Acknowledgements: Special thanks to Ajith Illendula and Sudeepti Balepur for sending this guide to me in order to share with our vPro Developers Community.


Objectives:

1.  Create certificates for Intel AMT TLS encryption using the Intel AMT SDK and OpenSSL
2.  Using the  TLS.ps1 script,  configure non TLS configured Intel AMT systems to use  TLS communication

Before you get started with the following steps, you may need to make sure your system is configure to run the Intel vPro Module PowerShell Scripts - see the following blog for instructions:

STEP 1: Modify the configuration server to not delete the private key and public key:

Open the file: <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\ConfigScripts\provend.bat


 

 

 

 

 

 

 

Comment out or delete the two lines:

 

 

STEP 2:

If your AMT Client is not part of the Domain, you will need to do the following:

  • Go to the <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecConfig folder

 

 

 

 

 

 

 

 

 

 

 

 

  • Edit the Uss.cfg file and look for the commonName_value.

 

 

 

Following =$ENV::PROVISIONING_HOSTNAME.$ENV Delete: “.$ENV::PROVISIONING_DOMAIN ”,

  • Next look for [alt_names]

DNS.1 =$ENV::PROVISIONING_HOSTNAME.$ENV::PROVISIONING_DOMAIN,

Delete: “.$ENV::PROVISIONING_DOMAIN

 

 

 

STEP 3: If the Certificate details such as Organization Name, Country Name, etc. need to be modified to suit local needs, then the following files will have to updated:

  • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecConfig\Auditor.cfg
  • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecConfig\rootCA.cfg
  • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecConfig\subCA.cf

 

 

 

 

 

 

 

 

 

 

 

 

  • countryName_default             = IL
  • countryName_value                = US
  • organizationName                     = Organization Name (eg, company)
  • organizationName_value       = Your Company Name
  • commonName                             = Common Name (eg, YOUR name)
  • commonName_value                = Intel® Active Management Technology root CA demo

 

STEP 4:  Your certificate needs to reflect the correct Provisioning Hostname. Edit Certgen.bat.

To create the Certificate for a specific AMT Client, set the Provisioning Hostname to reflect the AMT Hostname for your AMT System.

<SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\certgen.bat

IF "%PROVISIONING_HOSTNAME%"=="" SET PROVISIONING_HOSTNAME= <no quotes, the host name given to AMT>

 

 

 

 

 

STEP 5: Create the certificates by running the following (in this order)

For all the questions, respond with “Y"; no command window is necessary, just double click

  1. <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\checkca.bat
  2. <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\certgen.bat

All three certificates will be created.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

STEP 6: Copy the hash from the following files for the Root CA, AMT Private Key and the AMT Certificate into the appropriate sections in the TLS.ps1 script (Create a file on your computer by cutting and pasting from this blog.)

Bring up PowerShell ISE as Administrator  and open the TLS.ps1 script.

  • The hashes are in the following files:
    • Trusted Root CA - cacert.cer
    • AMT Private Key - newkey.pem
    • AMT Certificate - newcert.pem

Trusted root CA:

  • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\rootCA\cacert.cer

AMT Private Key:

  • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\newkey.pem

AMT Certificate:

  • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\newcert.pem

Look for the following sections in the TLS.ps1 script and copy the blobs from the above files into the blob sections of the TLS.ps1 file as follows:

cacert.cer:

 

 

 

 

 

 

 

 

newkey.pem

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

newcert.pem:

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

STEP 7:

Run the TLS.ps1 script, it should install the RootCA and the AMT Private key, AMT Certificate on the AMT Client.

Make sure to update the Adress - this is the ip address of the AMT Client.  Also ensure you can connect to the Webui - if there is something wrong with the network connection, the TLS.ps1 script will not run.

 

 

 

 

If the TLS.ps1 file executes without error, your AMT client will now be operating using TLS communication.

You should now be able to connect to the WebUI using https and port 16993:

 

STEP 8: When connecting via TLS, you will now get a certificate warning

In order for the WebUI to open (without the certificate warning), make sure the following certificates are installed in the respective machine from which the WebUI is being accessed:

  • RootCA:
    • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\rootCA\cacert.cer
  • and SubCA:
    • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\subCA\subcacert.der

 

STEP 9:  Creating additional Certificates

  1. Modify the host name as defined in Step 4.
  2. After the new host name is modified, run the certgen.bat file from step 5.
  3. Follow steps 6 and 7 to configure the new AMT client for TLS encryption.

 

_________________________________________________________________________________________________

The TLS.PS1 file is as follows (cut and paste it and put it into a script file that can be run on your system.)

Note: This file is a conglomeration of some of the ps scripts that exist in the Intel AMT SDK. The same licensing for this snippet is applicable. To view the legal notice for the Intel AMT SDK go to the download link (it appears when you go to download the SDK.)

Download Intel® AMT SDK

########################################
# Create a Wsman Connection Object #
########################################
$wsmanConnectionObject = new-object 'Intel.Management.Wsman.WsmanConnection'
$wsmanConnectionObject.Username = "admin"
$wsmanConnectionObject.Password = "P@ssw0rd"
$wsmanConnectionObject.Address = "http://10.14.164.24:16992/wsman"

# Add the Trusted Root CA
$certificateBlob = "MIIDBzCCAe+gAwIBAgIJAJehJZlKRi2YMA0GCSqGSIb3DQEBBQUAMDIxFTATBgNV
BAMTDERlbW8gUm9vdCBDQTELMAkGA1UEBhMCSUwxDDAKBgNVBAsTA0ZUTDAeFw0x
MDExMjIwODI1MDhaFw0yMDExMTkwODI1MDhaMDIxFTATBgNVBAMTDERlbW8gUm9v
dCBDQTELMAkGA1UEBhMCSUwxDDAKBgNVBAsTA0ZUTDCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAL4S0DXjcngUXGlqX0oezRHDpUJV0bsp9uQNMPc+LhQe
pb0aR7Mgyec4zoI5wMhlHsyjbGEo/AzkoQQiZ5d7YVreh7cqfowXkqvCud/+NnCb
0Dy7bPSCfrSygAaMQ2Dgu1GZZIgd9oPYU1o/P/SK+xS1+PTa2G6CrJ++yjywcPWM
avOCe7hDYXo9TlscbJizsvBfglzweJsHjZLZMW5YK62+PS1CzMUY9uQimz3dVUgz
tItqfefDkMVwJQcAMsTOwg8nj9xZ10LKBRs9+xW2d0exJcAqkwM5df3FoVO9GUjF
a4qsqGjt3Yj/17H8G0Qtn/nGyrleQyx82mdzvGSCAPcCAwEAAaMgMB4wDwYDVR0T
AQH/BAUwAwEB/zALBgNVHQ8EBAMCAbYwDQYJKoZIhvcNAQEFBQADggEBABD/TQ+w
tcejnCCSLI9HRJq1YdtVqreXD0Q3gmsrltrabi09oJkqtILVZwX0C/I3laOObcgy
n2nv3AT4HjEoGY+ezoUNNZwWyoCIMz11FqkLinUKqfGWjBJbagk9tw2bpibIydFJ
M1a0Wnn/51mgbSHkNc5q80kHui/8SUkHh9XZ28FbqgLA5k4hSuFLO+K81ATVgqgO
657yZ0e/wl4l3Qs4Ssn3T7rdq7KumLQKFFfKlSdbNULW5dvNVRK0yMNcYpbFRa/x
ghBmBFpIPze/TCUhir8ysL19MBvX5fjmnjGZHfvl3KPNz0YrBvGCtNNX5J3CJFbH
CaJLIH3FAIfVFMs="
$publicKeyManagementServiceRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_PublicKeyManagementService WHERE Name='Intel(r) AMT Public Key Management Service'")
$inputObject = $publicKeyManagementServiceRef.CreateMethodInput("AddTrustedRootCertificate")
$inputObject.AddProperty("CertificateBlob", $certificateBlob)
$outputObject = $publicKeyManagementServiceRef.InvokeMethod($inputObject)
$returnValue = $outputObject.GetProperty("ReturnValue")
if($returnValue -like "0")
{
# The $publicKeyCertificateRef is an EPR to the new AMT_PublicKeyCertificate object.
$publicKeyCertificateRef = $outputObject.GetProperty("CreatedCertificate").Ref
}

# Add AMT private Key
$keyBlob = "MIIEogIBAAKCAQEA9NvDxsVLUAf4N7iZgCpjDdTCehQFgQKTtDKTWl8J000NOVvF
UiniEJUaQzZkRUIQRQcmr82mBe8NYLZeLR+c6FKE1BH9dFFWX7SSvNdWOyVBMGLK
z5gSbAWidluuzrbreTOnkaNu8jztdAoqCocL3SIIZgdJR5mmSm4lTlvkINgPPQ9r
SHGdhG4CI0BGAgdxMZ6lvsOqJBhEowEQXueqGwH4/wPfU0++sMrGhmYnsDMkSETk
23nI+vS9hIlCu0iagtAdBTJgeNd0TYi2kRBmBx7qVjbeFhVdBvtCveqTkz7hhu5M
BXT7f/xplgWCR1x4UKIpvimgs7Qu9qvSIxtVWQIDAQABAoIBAHlYB5eT4pTQvkPu
6bNITjpme9I/5dJfUo90mO2qN5ZNkwYf4pOrSerp2VABvoNMEAAFYTiyc1pxc3HA
Lr+x8PJ5InZuS+q+/E0Fkcqf9I3vEnVGIDfspwR9blu1Z9XtdJhl7t8P3UWSyCI/
f0IkVs7JtNvLNJeVH4G3QCmrBEz5jbI4+NikQSPFkueoDGhlMpTr1XpICU0Xre/z
Jc5Q5KVzuZp+J7B2857MKRm19d0zbzOZv9e1jqpXgNOZYRnU/SSSDGrLxbDjdgB3
hCb4HzQWp+F503SzsE7zYoDh2Xo/0MGB0gmHRhO7PGLwrpjRJR5TLg0rGgCLe31F
7gO+sBkCgYEA/wHiLgSe5BPxGoyIQTnFodoomLs1AMmhrjoay6XpozBffEPWQ9gY
ikZl9zRJVx1lQNmO0F3eK7f8d8iGALPSgaKDZlFgaOG7c+a2FzGThREC20GBmHes
6cIYkctnhAU63XH3xVIf/TRy3IJVni2pp+tXNMqGrvC5zSbNBsc+dacCgYEA9c/E
jfNmUEIidVFc+mPTDnY67kWtb+oR/GzE3YhGQKCyOkgxlB1JHNFusevCzX1/A+5F
LdAPn1fjU/IBK+boKVqDODeQEVAQvRp+p+XUs5bknYctM3g7q8usr68dqRmx5AGl
nEmKsL3R2KKFXKvef38QwFO2T0uY8Pq5C0FHPP8CgYBniGw8IsQf9bi9/rCTStFi
lSBGYjtyxmpOQmj+pa3mA43A9gnYIbRU76AWbbQZGmYxniLNlk7NkTV/rHo7bsbY
uxJ+SCvMaVmiBNmJMSejrvRp8H6dWHlrrtIq31p3z2fG4K6n/l/efZzkykXYotFu
y63sUQ29mR7WnBpB1kMVoQKBgD40sxAdPZIn+mJoEbiH1Jx/TRCJb4e3249e0z8g
wm6OfCwFow5RjvQNCA9ck3K/RIpxHO6oDZwMeMoAn01F5RC6CCUM4pePBH1mnBDP
N9Gu6PH4iHbTAX7LT0sybLYje4Iw7IEtlzx8/QLutgMqt2baeBnD1YohnnW1bWis
v2NvAoGACmpT0xDNQMgRz6lUIKkhjvm94apBMkiiRNw0+4FKd8j1IphZLoyrA7W3
MpIP4UlXRgtOkp33q9L23b/mwLTHHSvhkkSRgSYtM4lHyhpyzkzsSMynVEECdaOD
4eQg6GG2x7LKl2j1cFAo/61tUEtaKSstqkQ+vvDVoD6O8LFCC6E="
$publicKeyManagementServiceRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_PublicKeyManagementService WHERE Name='Intel(r) AMT Public Key Management Service'")
$inputObject = $publicKeyManagementServiceRef.CreateMethodInput("AddKey")
$inputObject.AddProperty("KeyBlob", $keyBlob)
$outputObject = $publicKeyManagementServiceRef.InvokeMethod($inputObject)
$returnValue = $outputObject.GetProperty("ReturnValue")
if($returnValue -like "0")
{
# The $publicPrivateKeyPairRef is an EPR to the new AMT_PublicPrivateKeyPair object.
$publicPrivateKeyPairRef = $outputObject.GetProperty("CreatedKey").Ref
}

# Add AMT Certificate
$certificateBlob = "MIIDcDCCAligAwIBAgIBAjANBgkqhkiG9w0BAQsFADAyMRUwEwYDVQQDEwxEZW1v
IFJvb3QgQ0ExCzAJBgNVBAYTAklMMQwwCgYDVQQLEwNGVEwwHhcNMTAxMTIyMDgy
NTMwWhcNMTExMTIyMDgyNTMwWjAYMRYwFAYDVQQDEw1kdXQuaW50ZWwuY29tMIIB
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9NvDxsVLUAf4N7iZgCpjDdTC
ehQFgQKTtDKTWl8J000NOVvFUiniEJUaQzZkRUIQRQcmr82mBe8NYLZeLR+c6FKE
1BH9dFFWX7SSvNdWOyVBMGLKz5gSbAWidluuzrbreTOnkaNu8jztdAoqCocL3SII
ZgdJR5mmSm4lTlvkINgPPQ9rSHGdhG4CI0BGAgdxMZ6lvsOqJBhEowEQXueqGwH4
/wPfU0++sMrGhmYnsDMkSETk23nI+vS9hIlCu0iagtAdBTJgeNd0TYi2kRBmBx7q
VjbeFhVdBvtCveqTkz7hhu5MBXT7f/xplgWCR1x4UKIpvimgs7Qu9qvSIxtVWQID
AQABo4GqMIGnMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgeAMCAGA1UdJQEB/wQWMBQG
CCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU4v65z5NAqLepfzhYCzgNpnDt
JEQwTAYDVR0jBEUwQ6E2pDQwMjEVMBMGA1UEAxMMRGVtbyBSb290IENBMQswCQYD
VQQGEwJJTDEMMAoGA1UECxMDRlRMggkAl6ElmUpGLZgwDQYJKoZIhvcNAQELBQAD
ggEBAKF7TxMp3dnTkPRxCaWhdEAmCQbox74OGzZg29SlT2TpZVHMe6i5AgFr/JPs
uFXokBW338Pvhkk916jxzpTF9HwNmYr4DGc01wLcT0mOe2HqR7XF2SAzkcvAaObi
sSfrBZ/PHKwgP4T+8Wi0cVYapuM3JwwRQIZxD4vxm0PFJ+ean1G161ks+2S/oIoU
1+CEOK4alIRMygTi9uMbv15Gda2Woh4V2E0SN/8kV7f5oO51LtXYl8WX5igN5O8y
Pv5fNQjnSxNdAjYK2XhG0p4yp3k2GsOb6PqeCfXeohltWswMND9x49Bx3nLg7FaZ
LJ0fAsQOO/8ZtEaIpYUOdqW76xQ="
$publicKeyManagementServiceRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_PublicKeyManagementService WHERE Name='Intel(r) AMT Public Key Management Service'")
$inputCertificate = $publicKeyManagementServiceRef.CreateMethodInput("AddCertificate")
$inputCertificate.AddProperty("CertificateBlob", $certificateBlob)
$outputObject = $publicKeyManagementServiceRef.InvokeMethod($inputCertificate)
$returnValue = $outputObject.GetProperty("ReturnValue")
if($returnValue -like "0")
{
# The $publicKeyCertificateRef is an EPR to the new AMT_PublicKeyCertificate object.
$publicKeyCertificateRef = $outputObject.GetProperty("CreatedCertificate").Ref
}

# Add TLS certificate
$tlsProtocolEndpointCollectionRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_TLSProtocolEndpointCollection WHERE ElementName='TLSProtocolEndpoint Instances Collection'")
$tlsCredentialContextInstance = $wsmanConnectionObject.NewInstance("AMT_TLSCredentialContext")
# $publicKeyCertificateRef is an EPR to the AMT_PublicKeyCertificate object created by the 'Add a Public Key Certificate' use case.
$tlsCredentialContextInstance.SetProperty("ElementInContext", $publicKeyCertificateRef)
$tlsCredentialContextInstance.SetProperty("ElementProvidingContext", $tlsProtocolEndpointCollectionRef)
$tlsCredentialContextInstance.Create()

# Enable TLS on remote interface
$tlsSettingDataRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_TLSSettingData WHERE InstanceID='Intel(r) AMT 802.3 TLS Settings'")
$tlsSettingDataInstance = $tlsSettingDataRef.Get()
$tlsSettingDataInstance.SetProperty("Enabled", "true")
$tlsSettingDataInstance.SetProperty("MutualAuthentication", "false")
$tlsSettingDataRef.Put($tlsSettingDataInstance)

# Enable TLS on local interface.
$tlsSettingDataRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_TLSSettingData WHERE InstanceID='Intel(r) AMT LMS TLS Settings'")
$tlsSettingDataInstance = $tlsSettingDataRef.Get()
$tlsSettingDataInstance.SetProperty("Enabled", "true")
$tlsSettingDataInstance.SetProperty("MutualAuthentication", "false")
$tlsSettingDataRef.Put($tlsSettingDataInstance)

# Commit changes
$setupAndConfigurationServiceRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_SetupAndConfigurationService WHERE Name='Intel(r) AMT Setup and Configuration Service'")
$inputObject = $setupAndConfigurationServiceRef.CreateMethodInput("CommitChanges")
$outputObject = $setupAndConfigurationServiceRef.InvokeMethod($inputObject)
$returnValue = $outputObject.GetProperty("ReturnValue")

Remove-Module 'IntelvPro'

 

##### End of file

]]> http://software.intel.com/en-us/blogs/2012/01/18/how-to-create-amt-certificates-using-the-amt-sdk-and-openssl/feed/ 0 Jeff's Notebook: Intel® vPro ™ Developer Community - A resource for developing PC manageability & security software http://software.intel.com/en-us/blogs/2012/01/17/jeffs-notebook-intel-vpro-developer-community-a-resource-for-developing-pc-manageability-security-software/ http://software.intel.com/en-us/blogs/2012/01/17/jeffs-notebook-intel-vpro-developer-community-a-resource-for-developing-pc-manageability-security-software/#comments Tue, 17 Jan 2012 23:13:20 +0000 Jeff Kataoka (Intel) http://software.intel.com/en-us/blogs/2012/01/17/jeffs-notebook-intel-vpro-developer-community-a-resource-for-developing-pc-manageability-security-software/ Well, 2012 is here and with the New Year, you'll be seeing some new topic areas for my blogs.  This year, I'm going to be exploring the additional areas of PC manageability and security software. 

This is an area that continues to gain attention by IT managers and software developers that are trying to address the needs of efficiently managing PC's, addressing malware/viruses and the security of data on PC's.  Intel has been addressing these concerns for some years with its Intel vPro technology that has been built into various Intel processor-based desktops and laptops.  So, if you are a software developer of IT manageability and security software and you want to learn more about vPro technology and how to enable your software to take advantage of it, recently a new community has been launched to provide you with the information that you may want.  This is the Intel vPro Developer Community.  Check out this new community and discover more about Intel vPro technology.

]]> http://software.intel.com/en-us/blogs/2012/01/17/jeffs-notebook-intel-vpro-developer-community-a-resource-for-developing-pc-manageability-security-software/feed/ 0 01.2012: Intel(r) AMT Developer's Most Wanted http://software.intel.com/en-us/blogs/2012/01/11/012012-intelr-amt-developers-most-wanted/ http://software.intel.com/en-us/blogs/2012/01/11/012012-intelr-amt-developers-most-wanted/#comments Wed, 11 Jan 2012 18:41:03 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2012/01/11/012012-intelr-amt-developers-most-wanted/ What is the Heci and LMS - this is the rolling question week after week.  Reseting the ME password. Intel VT-d and how is Intel AMT enabled?  Here are the most popular Forum threads and blogs during the last few weeks.

Top 15 Forum Threads

  1. HP DC7700 (2007)
  2. Intel Management Engine Password Reset (2007)
  3. AMT Error Message "[UNS] Failed to subscribe to local Intel(R) AMT" (2008)
  4. how to install AMT SOL/LMS and HECI drivers silently (2008)
  5. lms service cannot connect to heci driver (2009)
  6. "Me is in recovery state" (2008)
  7. Intel AMT status is disabled (2007)
  8. Need to Enable or Disable AMT on your system? (2008)
  9. problem with HECI and network connection? (2008)
  10. intel management engine interface device cannot start code 10 on HP 8200 elite (2011)
  11. Intel Active Management Technology Status: Disable  (2008)
  12. AMT is disabled (2009)
  13. Enabling AMT on system (2008)
  14. AMT status error message  (2007)
  15. Intel motherboard monitoring (voltage/fan/temperature/CI status) programming documentation (2009)

 Forum posts can be great for finding answers to your questions, but it is even better if the question has been blogged. Here are Top Blogs that our developers have been reading:

Top 20 Blogs (pretty much the same list as from last month with a couple of exceptions.)

  1. Let us talk about HECI and LMS   (2007)
  2. Understanding VT-d: Intel Virtualization Technology for Directed I/O (2009)
  3. Intel AMT software: LMS, HECI, MEI... why do I need those? Part 10 in the series (2009)
  4. I forgot my "ME" Password! (2008)
  5. All about System Power States (S0-S5) (2007)
  6. Tips & Tricks for Setting up & Accessing an Intel AMT Client (2008)
  7. Step by Step Guide on How to Enable VT-d and Perform Direct Device Assignment (2009)
  8. Intel Management and Security Status (IMSS), advanced configurations. Part 9 (2009)
  9. To VT-d or Not to VT-d? A guide on whether to Utilize Direct Device Attach in your Virtualized System? (2010)
  10. UNS "Failed to subscribe to local Intel AMT" Error Messages and how to fix them (Intel AMT SW, 7th part) (2009)
  11. Instructions to disable the Intel AMT privacy notification popup (2007)
  12. Meshcentral.com - New Mobile Application (New in Jan 2012!)
  13. How about a Security Layer? (2011)
  14. Dual Boot Windows Vista and Windows Server 2008  (2008)
  15. More configurations (disabling) of the Intel AMT icon. Part 4 in the Intel AMT software series (2008)
  16. And the Lenovo T400 said: "Beep.Beep-Beep-Beep.Beep-Beep-Beep.Beep! (2009)
  17. Wake On LAN and the Magic Packet (2007)
  18. Sharing Virtual Disks Among VMs using VMware* ESX Server (2009)
  19. The Keys to Intel vPro Technology: HECI-MEI-LMS-SOL-UNS (2011)
  20. Intel® AMT User Notification Service (2009)
]]> http://software.intel.com/en-us/blogs/2012/01/11/012012-intelr-amt-developers-most-wanted/feed/ 0 12.2011: Intel(r) AMT Developer's Most Wanted http://software.intel.com/en-us/blogs/2011/12/14/122011-intelr-amt-developers-most-wanted/ http://software.intel.com/en-us/blogs/2011/12/14/122011-intelr-amt-developers-most-wanted/#comments Wed, 14 Dec 2011 23:36:48 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2011/12/14/122011-intelr-amt-developers-most-wanted/ From UNS,LMS, SOL/LMS/HECI Drivers, MEI Passwords to Clearing the CMOS,  I just ran across a list of our most popular forum threads and blogs and thought it might be good to highlight them. 

Top 10 Forum Threads (for the last 13 Weeks)

  1. AMT Error Message "[UNS] Failed to subscribe to local Intel(R) AMT"
  2. lms service cannot connect to heci driver
  3. Intel Management Engine Password Reset
  4. how to install AMT SOL/LMS and HECI drivers silently
  5. "Me is in recovery state"
  6. Intel AMT status is disabled
  7. Need to Enable or Disable AMT on your system?
  8. problem with HECI and network connection?
  9. AMT is disabled
  10. vPro management software

Forum posts can be great for finding answers to your questions, but it is even better if the question has been blogged. Here are Top Blogs that our developers have been reading: 

 Top  20 Blogs (for the last 13 Weeks)

  1. Understanding VT-d: Intel Virtualization Technology for Directed I/O
  2. Let us talk about HECI and LMS
  3. Intel AMT software: LMS, HECI, MEI... why do I need those? Part 10 in the series
  4. Tips & Tricks for Setting up & Accessing an Intel AMT Client
  5. Intel System Defense Utility - Tech10 Video!
  6. I forgot my "ME" Password!
  7. Step by Step Guide on How to Enable VT-d and Perform Direct Device Assignment
  8. All about System Power States (S0-S5)
  9. Intel Management and Security Status (IMSS), advanced configurations. Part 9
  10. Instructions to disable the Intel AMT privacy notification popup
  11. More configurations (disabling) of the Intel AMT icon. Part 4 in the Intel AMT software series
  12. Sharing Virtual Disks Among VMs using VMware* ESX Server
  13. UNS "Failed to subscribe to local Intel AMT" Error Messages and how to fix them (Intel AMT SW, 7th part)
  14. To VT-d or Not to VT-d? A guide on whether to Utilize Direct Device Attach in your Virtualized System?
  15. 了解Intel® AMT User Notification Service
  16. Dual Boot Windows Vista and Windows Server 2008
  17. Reset Lenovo T61 manageability settings to factory defaults
  18. How to test CIRA in 9 easy steps (Client Initiated Remote Access)
  19. How about a Security Layer?
  20. Wake On LAN and the Magic Packet
]]> http://software.intel.com/en-us/blogs/2011/12/14/122011-intelr-amt-developers-most-wanted/feed/ 0 Intel(r) AMT and the Intel(r) ME http://software.intel.com/en-us/blogs/2011/12/14/intelr-amt-and-the-intelr-me/ http://software.intel.com/en-us/blogs/2011/12/14/intelr-amt-and-the-intelr-me/#comments Wed, 14 Dec 2011 22:08:05 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2011/12/14/intelr-amt-and-the-intelr-me/ The Intel® ME is the steam behind Intel Active Management Technology.  Intel AMT is a component of the Intel vPro platform. It uses a number of elements in the Intel vPro platform architecture. The following figure shows the relationship between these elements.

The Intel AMT functionality is contained in the ME firmware (Manageability Engine Firmware).

  • The firmware image is stored in the Flash memory.
  • The Intel AMT capability is enabled using the Intel® Management Engine (Intel® ME) BIOS extension as implemented by an OEM platform provider. A remote application performs enterprise setup and configuration
  • On power-up, the firmware image is copied into the Double Data Rate (DDR) random-access memory (RAM).
  • The firmware executes on the Intel ME processor and uses a small portion of the DDR RAM (Slot 0) for storage during execution. RAM slot 0 must be populated and powered on for the firmware to run.

Intel AMT stores the following information in the Flash (ME Data):

  • OEM-configurable parameters
  • Setup and configuration parameters such as passwords, network configuration, certificates, and access control lists (ACLs)
  • Other configuration information, such as lists of alerts and System Defense policies
  • The hardware configuration captured by the BIOS at startup
  • Intel AMT also manages third-party data storage (3PDS).The storage area can be allocated by independent software vendor (ISVs) for local storage of information critical to their applications.
  • The Flash also contains the BIOS executable code (BIOS), as well as the executable code for the Intel® 82566DM Gigabit Network Connection (GbE Ntwk FW).

The Flash is protected against unauthorized host access by a hardware mechanism activated by the OEM during manufacturing.

The PCH   (replaces MCH and ICH from pre Intel AMT 6.0) holds the filter definitions that are applied to incoming and outgoing in-band network traffic (the message traffic to and from the CPU). These include both internally-defined filters and the application filters defined by ISVs using the System Defense and Agent Presence capabilities.

The Intel® 82566 Gigabit Network Connection identifies out-of-band (OOB) network traffic (traffic targeted to Intel AMT) and routes it to the Intel ME instead of to the CPU. Intel AMT traffic is identified by dedicated IANA-registered port numbers.

The following elements interact with Intel AMT:

  • The BIOS can be used to initialize Intel AMT or to reset it to its initial state. It captures platform hardware configuration information and stores it in NVM so that Intel AMT can make the information available out of band.
  • The PCH sensor capability detects the state of various platform sensors, such as temperatures, fan status, and chassis integrity. Intel AMT can be configured to store and/or forward an alert when the state of any selected sensor changes or crosses a threshold.
  • Software Agents (typically written by management ISVs) executing on the CPU can register with Intel AMT and report their presence to Intel AMT and to a management console using “heartbeats”. Intel AMT monitors the heartbeats and can take action when there is a problem with Agent execution.
  • ISV Applications on the CPU can communicate locally with Intel AMT using dedicated drivers that are compatible with the host operating system.

 

Tags:  heci driver, intel active management technology, management engine, intel me

]]> http://software.intel.com/en-us/blogs/2011/12/14/intelr-amt-and-the-intelr-me/feed/ 0 Gael's Intel(r) vPro(tm) Technology Knowledge Base http://software.intel.com/en-us/blogs/2011/12/13/gaels-intelr-vprotm-technology-knowledge-base/ http://software.intel.com/en-us/blogs/2011/12/13/gaels-intelr-vprotm-technology-knowledge-base/#comments Tue, 13 Dec 2011 18:15:39 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2011/12/13/gaels-intelr-vprotm-technology-knowledge-base/ I'm playing around with knowledgebase providers. Tell me what you think about this and if it is useful. Also let me know if you want to participate in adding articles to it.

Here is a handy link to my My Intel vPro Knowledge Base

]]> http://software.intel.com/en-us/blogs/2011/12/13/gaels-intelr-vprotm-technology-knowledge-base/feed/ 0 Intel(r) AMT KVM not Working http://software.intel.com/en-us/blogs/2011/12/08/intelr-amt-kvm-not-working/ http://software.intel.com/en-us/blogs/2011/12/08/intelr-amt-kvm-not-working/#comments Fri, 09 Dec 2011 00:45:20 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2011/12/08/intelr-amt-kvm-not-working/ What do you do when you are ready to get started working with Intel Active Management Technology and you are excited about the recent inclusion of a software based (AMT) KVM feature and you can't get it to work?

A while back I wrote a blog --> HERE <-- to help out with determining which systems to purchase that support Intel AMT as well as the KVM feature.  I'm not sure it is widely known that just because your vPro system is Intel AMT capable, it might not, in fact, support the KVM feature.   One thing I have run into also is that just because you found a system on an OEM's website that has all of the right parts and you even triple checked our  ark.intel.com website and the processor  is listed as supporting KVM, you might get your system and find out that it does not, in fact, support KVM.  Why is this?  The answer is simple.  While the processor may support Integrated Graphics, the OEM may chose to build the system with Discrete  Graphics  - this is common in the Intel Core i7 product line.  Always check the graphics capability before purchasing your system if  you want to take advantage of the KVM feature within Intel Active Management Technology.

If you already have an Intel AMT capable system and KVM is not working, here are some things to check.

  1. Make sure your system supports KVM (Integrated Graphics)
  2. Is Intel AMT enabled?
  3. Is IDER and KVM enabled in the MEBx?  (IDE-Redirect must be enabled as well.)
  4. You have properly configured the KVM viewer

1. Checking the Graphics Capability of your System

Go into the Device manager for your computer and look for the Display Adpater.  You will be able to see whether or not you have Integrated or Discrete Graphics  (the KVM feature cannot run with Discrete graphics.)  If you do not have integrated graphics, the KVM feature is not for you.

 

Some OEMs provide the option of "Switchable" Display adapters.  As long as you can run with the Integrated Display Adapter, you should be OK.

For steps 2 and 3 you will need to go get the SCS Discovery tool and run it on your system.

Run the tool as follows (on a CMD window)

  • >SCSDiscovery.exe /Output file test.xml SystemDiscovery /NoRegistry
  • test.xml will be a debug file - look for another file named as follows: FQDN.domainname.

2.  Is Intel AMT Enabled?

Open the xml file from running the Discovery tool an look for the following lines:

  • <AMTversion>7.1.4</AMTversion>
  • <MEIVersion>7.0.0.1144</MEIVersion>
  • <FWVersion>7.1.4.1068</FWVersion>
  • <IsAMTConfigured>true</IsAMTConfigured>

You want to make sure the system's version of Intel AMT supports KVM and it has a valid MEI (HECI) Driver/Firmware and that Intel AMT has been enabled/configured.  (Check!  Check/Check! Check!) All version numbers should match up for the major number (7 here.)

If your system is passing all the tests so far, you can move down to the next step of verifying that KVM is enabled and supported.

3.  Is your system KVM capable?

Take another look at that XML file.  Look for the following entries:

  • <IsAMTKVMSupported>true</IsAMTKVMSupported>
  • <IsAMTIDEREnabled>true</IsAMTIDEREnabled> (IDER must be enabled )
  • <IsAMTKVMEnabled>false</IsAMTKVMEnabled>
  • <IsKVMEnabledInBIOS>true</IsKVMEnabledInBIOS>
  • <IsKVMSupportedInBIOS>false</IsKVMSupportedInBIOS> (Not a reliable indicator!!)

<IsAMTKVMSupported> True if the KVM redirection interface is supported in the Intel AMT Firmware.

<IsAMTIDEREnabled> IDE-Redirection must be enabled in the bios in order to use the KVM feature using the Redirection ports.

<IsAMTKVMEnabled> True if the Keyboard Video Mouse (KVM) redirection interface is enabled in Intel AMT  (This refers to the listener and if you have enabled Intel AMT but have not yet configured your KVM connections, this will show up as false.)

<IsKVMEnabledInBIOS> True if KVM redirection is enabled in the MEBx of the Intel  AMT device

<IsKVMSupportedInBIOS> True if the BIOS of the platform supports KVM redirection.  This entry is not always reported correctly - as you can see on my system it indicates false.  But my system is KVM capable.

It is important to note that the Discovery tool may indicate that your system can do KVM even if you do not have the right graphics card - that's why you check for that first.

4.  Configuration

Follow the guides in the SDK documentation.  Search for the following topic:  (Setting Up the Integrated Viewer Application) Note that you need to configure the listener/ports/password.

Port 5900 is the IANA port reserved for Virtual Network Computing (VNC). By enabling port 5900, all traffic to this port is routed to Intel AMT for KVM processing. The RFB protocol requires a password, so the first time an application enables port 5900, it should also set the RFB password (which must be 8 characters exactly.)  KVM can also use the Redirection Port.

If, after all of this, you are still having problems, post your question on our forum.

]]> http://software.intel.com/en-us/blogs/2011/12/08/intelr-amt-kvm-not-working/feed/ 0 WMI: Provider Not Found http://software.intel.com/en-us/blogs/2011/12/02/wmi-provider-not-found/ http://software.intel.com/en-us/blogs/2011/12/02/wmi-provider-not-found/#comments Fri, 02 Dec 2011 23:15:05 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2011/12/02/wmi-provider-not-found/ Do you have a system that you believe is Intel(R) AMT capable and you are trying to run the WMI samples but are getting an error?  Here are some tips on how to make sure your systems *is* Intel AMT capable and is also capable of running the WMI samples supported by the WMI Provider.

1.  Download and run the SCS Discovery Tool  in a CMD window: 

  • >SCSDiscovery.exe /Output file test.xml SystemDiscovery /NoRegistry
  • test.xml will be a debug file - look for another file named with the FQDN of your computer.  Here is a snippet of the xml file and some of the key fields to look for:

 

  •  IsAMTSupported should be "True"
  • AMTSKU should be Full AMT Manageability (possibly, but that's another discussion...)
  • There should be an MEI version and it should be enabled
  • The major AMT version number should be the same as for the MEI Driver version (here it is 7)

If your system supports Intel AMT then you can proceed to step number 2.

2. Go into your Computer Management and look under the Services and Applications.  You should see a "WMI Control" entry.  If you right-click on that you can get the properties.  Go into the Security Tab, expand "Root" and you should see "Intel_ME".  If you see that, then the MEProv.dll was included in your system build  and it will support the WMI Provider APIs.

If you do not see the Intel_ME namespace then the MEProv.dll which allows access to the WMI Provider classes is not part of your OS installation.  If it is there then you should be able to go to where the WMI samples are in the SDK:  <SDK ROOT>/Windows/Intel_AMT/Samples/WMI and type in the following from a CMD window:
> cscript SystemProperties.vbs 

Does this command execute successfully?

The WMI Provider (MEProv.dll)  is optional for OEMs to provide as part of their OS installation and on their support site.  If this is the case for your system, you will not have the option of using the WMI provider classes and your access to the MEI driver would be to use the API's documented in the AMT SDK (very limited set of APIs).

In order to find systems that support Intel AMT you might find this blog helpful - it outlines all the components that a processor and platform must have in order to be Intel AMT capable.  Also check out the ARK site for any updates that did not make into the blog.

I hope this blog helps!

]]> http://software.intel.com/en-us/blogs/2011/12/02/wmi-provider-not-found/feed/ 0 Communication error between application and Intel® ME module (FW Update Client) http://software.intel.com/en-us/blogs/2011/11/22/communication-error-between-application-and-intel-me-module-fw-update-client/ http://software.intel.com/en-us/blogs/2011/11/22/communication-error-between-application-and-intel-me-module-fw-update-client/#comments Wed, 23 Nov 2011 00:25:21 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2011/11/22/communication-error-between-application-and-intel-me-module-fw-update-client/ Have you experienced this error message, or one like it?  Then this blog is for you because you could be experiencing an issue with your MEI Driver.  This write-up contains information on how to go about determining if your vPro software is dishing out error messages due to not having a valid MEI Driver installed. 

Note:  All OEM reference information in this document is subject to change without notice. Please contact OEMs regarding any requests for reference information updates.

First let us cover what are the key Intel Technologies that utilize the MEI Driver:

  • Intel® Active Management Technology  (AMT)
  • Intel® Anti-Theft (AT)  Technology

Symptoms of an invalid or Missing Driver:

For Intel® AMT, the MEI driver is needed for the following functionality:

  1. Discovery (The SCS Discovery tool, for example, runs on the local client)
  2. Host Based Provisioning (Intel AMT makes local calls to the Manageability Engine (ME) and thus the driver needs to be present)
  3. Agent Presence Feature (local calls to the ME are required to set up Watchdog timers)
  4. 3PDS Storage feature  (local client usage only) - MEI driver is not used when making the remote API calls.

 For Intel® AT, the MEI driver is needed for the following functionality:

  1. Enrollment
  2. Rendezvous with the Server
  3. Unenrollment

 To sum it up, the MEI driver is needed whenever the Manageability Engine is accessed from software running on the local client.  The first symptom you would run into is an error message of sorts - it may resemble the following:

  • Error 9450:  Communication error between application and Intel® ME module (FW Update Client)
  • Error 9459: Internal error (Could not determine FW features information)
  • Unable to initialize CLS:  Error (259):  Cannot locate device interface info for HECI:  No more data is available.
  • Error:  Error state returned when testing Intel® AT.
  • Please verify Intel® Management Engine Interface driver is installed and system supports Intel® AT capability.

Getting to the root of the issue:

First, you should make sure that the Manageability Engine  is enabled in the BIOS - if it is not, then enable it.  If you are experiencing errors with Intel® AT, also make sure Intel® AT is enabled in the BIOS.  The same goes for Intel® AMT - make sure the ME and Intel AMT are both enabled in the BIOS.  Be aware that the OEMs have differing ways to enable features in their BIOS's and you will experience variances here.

If your problem was  simply not enabling the ME / Intel AT/ Intel AMT then you may need to go download some tools.  Here are my recommendations:

  • (1 Star) If you are running Intel® Anti-Theft, download the  Anti-Theft Status tool.  This tool reports whether or not the system is capable of running Intel® Anti-theft and whether or not there is a valid MEI driver.  It does NOT output the version of the MEI driver, if installed.  This tool is really only useful if you want to know if there is a valid MEI driver on the system and if the system supports Intel® Anti-Theft.
  • (4 Stars) If you want to do an actual "Discovery" of the system, you want to go download the SCS Discovery Tool.  This tool is often pushed down to systems by Manageability Consoles in order to do a system "Scan."  It reports the following: MEI Driver/version, LMS and UNS versions, ME enabled, a host of information needed for implementing Intel AMT, Intel Anti-Theft status, network configurations and more.  It can write everything to the system's registry or to an XML output file.
  • (4 Stars)  The Intel Manageability and Security Status tool is also handy to have installed.  It normally comes bundled with the Intel AMT drivers from the various OEM websites  (note that the Intel AMT drivers are the same for Intel Anti-theft .)  Although this tool is great to have, it is not necessary.
  • (3 Stars) Another thing  (actually, the first thing)  to look at is the Device Manager, if the system is running a Windows OS.  No need to download, it is already on your system.

 The above tools offer a variety of ways to find out information about your system and the  MEI driver status.  Get them all and play with them.  I would say that for just the question of whether or not the system has a valid MEI driver, all you need is your Device Manager.  If you need or want to know more, like for determining the status of Intel AT or Intel AMT in finer detail you should use the SCS Discovery tool.  Let's look at the tools individually and see what they have to offer.

I have included screen shots here of the information you can get from each of the tools.  While there is definitely a lot of overlap, you can see that they all give you the basic information that you need.

Intel Anti-Theft Status Tool - note that this tool does not give you deeper information about how Intel AT is configured on your system - if Intel AT is configured on your system then it had a valid MEI driver at one point.  The output below shows what the tool tells us if there is not an MEI driver installed as well as what it displays when there is a valid MEI Driver.

 

SCS Discovery Tool -output is either written to the registers, or to an XML file.  Below is a very small snippet showing basic information that is important for Intel AMT and Intel AT support.

Intel Management and Security Status Tool - you can quickly find out if Intel AMT and/or Intel AT is enabled in the Bios,  what are the versions of the FW and of the associated components. Go to "Programs-->Intel--> IMSS"

 

Windows Device Manager - Invalid MEI Driver - look under System Devices.  If it is present, find out if it is valid or not by looking at the properties.  If it shows that there is a driver, but the major version number  doesn't match the major version number of the FW  or it actually has no files associated with it, it is an invalid or a dummy* driver.

*Microsoft was pushing out a dummy driver in order to get rid of the yellow bang that would be present when a valid MEI driver was not installed for whatever reason. The good news is that for both 2010 and 2011 platforms Microsoft is now pushing out a valid MEI driver.  While this is better than the dummy driver, we recommend to always go out to the OEM site to get up-to-date MEI drivers for your vPro platform.

 

Windows Device Manager - Valid MEI Driver.  Look for the version number and it should have the same major version number as the FW version. 

 

You have used the tools and now you know that you need a valid driver.  Where do you get the MEI driver package if it is not installed on your system?

As stated above, it is always best to get the right driver package from your OEM's support site.  There are multiple technologies that depend on the Intel ME, and OEM’s will often have a single MEI driver package that covers multiple technologies.  Typically a package also covers multiple models.

Each OEM has their own page structure and their own way of finding the driver package.

Lenovo:

  • Default support: http://support.lenovo.com/en_US/downloads/default.page?
  • Three mechanisms for finding the appropriate driver package, Quick Path allows for putting in just model (E420, T420, for example), and is probably the most straightforward to use.
  • The MEI bundle is under the Advanced System Management category, normally this category also contains a readme describing which systems the bundle applies to.  A typical package name is Intel Management Engine Interface.

 HP:

  • Default support: http://h20000.www2.hp.com/bizsupport/TechSupport/ProductRoot.jsp
  • The “Search Products” field is on right side of page, the model (Elitebook 8560w, Envy 14 Beats, ProBook 6560b) is sufficient to find the appropriate package.
  • It is necessary to select “Drivers and Software”, and then the OS type before picking a driver package.  HP puts MEI package in the “Driver – Chipset” category.  A typical package name is Intel Management Engine Components Driver. 

Dell:

  • Default support page: http://support.dell.com/support/
  • A pop-up dialog box will come up with options, “Choose a Model” is straightforward. 
  • It’s necessary to select “Product Family” (example: Laptop), then “Product Line” (example: Precision Laptop), then “Product Model” (example: M6600), then confirm your selection.
  • On Dell’s site, the MEI driver package is located under the “Chipset” category, a common name is Intel AMT HECI or AMT 7 Management Interface driver.

 Specific Driver Packages (2010 Platforms; Intel AT 2.0/Intel AMT 6.0)

]]> http://software.intel.com/en-us/blogs/2011/11/22/communication-error-between-application-and-intel-me-module-fw-update-client/feed/ 0 Understanding Intel's Android 4.0 x86 Optimizations- What AnandTech has explained http://software.intel.com/en-us/blogs/2011/11/15/understanding-intels-android-40-x86-optimizations-what-anandtech-has-explained/ http://software.intel.com/en-us/blogs/2011/11/15/understanding-intels-android-40-x86-optimizations-what-anandtech-has-explained/#comments Tue, 15 Nov 2011 19:10:16 +0000 Tao B Wang (Intel) http://software.intel.com/en-us/blogs/2011/11/15/understanding-intels-android-40-x86-optimizations-what-anandtech-has-explained/ Last week, I attended Android Developer Conference ( AnDevConII) at San Francisco, and had chance to get shocked by Google's latest Android 4.0 Ice Cream Sandwich (ICS) demoed by two Google senior Engineers Chet Haase and Romain Guy. The title of their keynote is "Android  Awesomeness". It is indeed Awesomeness! Chet and Romain somehow figured out using a special adapter and a mini HDMI cable to display their ICS phone on large screen. And during the keynote, Chet and Romain joked at jealious App developers who despearately wanted an ICS phone that  I have three ICS's here, your guys has none!

In many classes during the 4-day conference,  a lot of developers asked about Android for x86. The most commonly agreed answers by those developers are simple and straight forward: " Are there any Android device powered with Intel chip (x86) in the market? Not yet, at least not one sold in large scale except Logitec/Google TV"; then it comes to the 2nd questions " are there any Android for x86 phone or tablet coming to the market in future? A lot  agreed: Yes, probablly a lot!"

So it has been said that ICS has been optimized for Intel x86, then what are those optimization? AnandTech has a  artilce that give some clues: Understanding Intel's Android 4.0 x86 Optimizations. Just read on!!

]]> http://software.intel.com/en-us/blogs/2011/11/15/understanding-intels-android-40-x86-optimizations-what-anandtech-has-explained/feed/ 0 The Keys to Intel vPro Technology: HECI MEI LMS SOL UNS http://software.intel.com/en-us/blogs/2011/10/24/the-keys-to-intel-vpro-technology-heci-mei-lms-sol-uns/ http://software.intel.com/en-us/blogs/2011/10/24/the-keys-to-intel-vpro-technology-heci-mei-lms-sol-uns/#comments Mon, 24 Oct 2011 18:12:05 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2011/10/24/the-keys-to-intel-vpro-technology-heci-mei-lms-sol-uns/ It seems that our Developers are spending a lot of time looking for information about HECI drivers.  With vPro being around for many years now (we are on our 7th revision going on 8) I was wondering if this piece of Active Management Technology  is still a puzzle to developers.  In the spirit of figuring out what vPro Developers need, I went through our blogs and put together a collection of blogs here that might be helpful.

Note that I added all of Shmuel's 11 part series below.  His blogs range across most of our releases of Intel AMT and so there will be some information that may be dated, but still applicable to the older releases of Intel AMT.

If you are looking for information on this topic and the blogs below do not answer your questions, please post a comment and let us know what information you need.

First, are you here because you simply want updated Linux drivers? You can download them here (SLED 11).  If not, read on.

Here is an over-all picture of the architecture with regards to the ME and the AMT architecture:

(Ajay Mungara) High level overview of why and when Intel AMT requires the HECI/MEI driver and the LMS service. Note that this blog is circa 2007 and Intel AMT has gone through some architectural changes since then but this blogs provides a nice overview of the interaction of the driver and associated service that is required to be running.

Here is a handful of Shmuel Gerson's blogs about Intel AMT focused around the User Notification and the HECI/MEI/LMS/SOL components.

  1. The software bundled with Intel AMT: Part 1
  2. Intel AMT SW, part 2: The notification area icon - understanding the pop-up
  3. Configuring the notification area icon & app. Intel AMT SW Part 3
  4. More configurations (disabling) of the Intel AMT icon. Part 4 in the Intel AMT software series
  5. Part 5: Detailed information to the user with the User Notification Service
  6. How the UNS works. Part 6 in the Intel AMT software series.
  7. UNS "Failed to subscribe to local Intel AMT" Error Messages and how to fix them (Intel AMT SW, 7th part)
  8. Intel AMT SW Part 8: Newfangled Intel Management and Security Status
  9. Intel Management and Security Status (IMSS), advanced configurations. Part 9
  10. Intel AMT software: LMS, HECI, MEI... why do I need those? Part 10 in the series
  11. Wrapping all Intel AMT software together - AMT SW, part 11
]]> http://software.intel.com/en-us/blogs/2011/10/24/the-keys-to-intel-vpro-technology-heci-mei-lms-sol-uns/feed/ 0 When the vPro Universe Collides with Other People and goes "Fractal" http://software.intel.com/en-us/blogs/2011/10/21/when-the-vpro-universe-collides-with-other-people-and-goes-fractal/ http://software.intel.com/en-us/blogs/2011/10/21/when-the-vpro-universe-collides-with-other-people-and-goes-fractal/#comments Fri, 21 Oct 2011 22:31:28 +0000 Gael Holmes Hofemeier (Intel) http://software.intel.com/en-us/blogs/2011/10/21/when-the-vpro-universe-collides-with-other-people-and-goes-fractal/ This is one of those things in life that you probably don't know what it is and why it is important until you need it.  If you are part of the "Other People" then you don't care.  You should probably go find something else to read, in that case.  But let me just say, in my opinion,  the collision is all your fault.

What does HECI and MEI stand for?

  • HECI:  Host Embedded Controller Interface
  • MEI:  Manageability Engine Interface

What is this driver used for?

"MEI" is simply the not-so-new (Intel AMT Release 3 and beyond)  name for "HECI" driver that is part of the factory-installed Windows Installation on any vPro capable system*.  What's nice about this is that when you get your system, you can be sure that it has "the" correct version of the driver.  Notice the emphasis on the word "the."  This driver is absolutely crucial for any software running on a vPro system that is trying to communicate, locally,  with the Manageability Engine (like Intel Active Management Technology, Intel Anti-Theft Technology.) Here is another blog written by Ajay Mungara taking this discussion into more depth.

What is the first thing some consumers and most IT shops do when they get a new PC?

That's easy:  They wipe out the factory-installed OS and install their own OS!

What happens to the MEI driver when the factory-installed OS is replaced?

It's GONE!  (Well, your guess is as good as mine as to why this driver sometimes goes MIA on so many PCs.)

Ok, now the MEI driver is not there anymore and the user who knows enough to be dangerous, goes out to the Device Manager and notices a Yellow Bang (or maybe they get an alert that says there is an unhappy device on their computer.)  Anyway, we don't like Yellow Bangs, even if we have no idea what sort of device they are applicable to.

This is where the "Other People" come in.  You called Microsoft in force and made them help you get rid of that Yellow Bang because it was ugly and so they did.  They created a "Dummy" MEI driver for you to install (it actually went out in window's updates so that everyone's pesky Yellow Bangs would be abolished.)  So now everyone's Manageability Engine device is happy now that it has a driver associated with it.

Now here is where the Universes collide and goes Fractal:

vPro users from around the world find that their software that wants to talk to their Manageability Engines is broken.  They run their software and get errors - something about a communication error with the MEI interface…  They go look at their Device Manager and see that there is an MEI driver installed, so what's the problem?  Here are some things you should know in order to get your universe back in order:

  1. Check the version of the HECI/MEI driver.  It should not be 1.xxx.  Valid HECI/MEI driver versions start with the release version of the Intel Active Management Technology that is applicable to the vPro system.  Valid version numbers start with 2 (circa 2004 platforms)  and go to 7 (for 2011 platforms.)
  2. If your vPro system has the 1.xxx version of the HECI/MEI driver and it is a 2011 platform running Win7 64 bit, Microsoft now has a correct (default) version of the MEI driver.  Here is what you need to do to get it.
    • Uninstall the MEI driver package, so you have the yellow bang for both the MEI driver and SOL driver.
    • When the system has internet access, go into the Device Manager, then right click the MEI device (should be under “Other devices”, it will be the one that doesn’t show a COM port) and select “Update Driver Software”
    • In the following dialog box that pops up, select “Search Automatically for updated driver software”.  This will search Windows update for the MEI driver
  3. If you have a pre-2011 vPro system that needs the correct driver, you will need to visit your OEM's website and look for downloads for your specific make and model.  This is typically found under "support."
  4. If you are getting errors and your system has a HECI driver version starting with 9.xxx - it's bad too.  We are only up to version 7 until 2012 platforms hit the market.  I'm not getting into the story behind this one, just uninstall it and go get the right driver!

I know you "Other People" don't care (so you probably haven't made it this far in my blog) but I am curious with regards to our vPro Community - has this affected you?

 

*Intel® Core i5 and Intel® Core i7 platforms are current generation vPro Platforms

]]> http://software.intel.com/en-us/blogs/2011/10/21/when-the-vpro-universe-collides-with-other-people-and-goes-fractal/feed/ 0