This document contains information on how to get started with Intel® Active Management Technology (Intel® AMT). It provides an overview of the features, as well as information on minimum system requirements, configuration of an Intel AMT client, and the developer tools available to help create applications for Intel AMT.
Intel AMT supports remote applications running on Microsoft Windows* or Linux*. Intel AMT Release 2.0 and higher supports only Windows-based local applications. For a complete list of system requirements see the Intel AMT Implementation and Reference Guide.
In order to manage an Intel AMT client or run the samples from the SDK, use a separate system to remotely manage your Intel AMT device. Refer to the Intel AMT Implementation and Reference Guide located in the Docs folder of the Intel AMT SDK for more details.
Intel AMT is part of the Intel® vPro™ technology offering. Platforms equipped with Intel AMT can be managed remotely, regardless of its power state or if it has a functioning OS or not.
The Intel® Converged Security and Manageability Engine (Intel® CSME) powers the Intel AMT system. As a component of the Intel® vPro™ platform, Intel AMT uses a number of elements in the Intel vPro platform architecture. Figure 1 shows the relationship between these elements.
Figure 1. Intel® Active Management Technology 11 Architecture
Pay attention to the network connection associated with the Intel® Management Engine (Intel® ME). The NIC changes according to which Intel AMT release you are using.
Intel AMT stores the following information in flash (Intel ME data):
Figure 2 shows the modes, or stages, that an Intel AMT device passes through before it becomes operational.
Figure 2. Configuration Flow
Before configuring an Intel AMT device from the Setup and Configuration Application (SCA), it must be prepared with initial setup information and placed into Setup Mode. The initial information will be different depending on the available options in the Intel AMT release, and the settings performed by the platform OEM. Table 1 summarizes the methods to perform setup and configuration on the different releases of Intel AMT.
Table 1. Setup Methods According to Intel® Active Management Technology Version
|Setup Method||Applicable to Intel® Active Management Technology (Intel® AMT) Releases||For More Information|
|Legacy||1.0; Releases 2.x and 3.x in legacy mode||Setup and Configuration in Legacy Mode|
|SMB||2.x, 3.x, 4.x, 5.x||Setup and Configuration in SMB Mode|
|PSK||2.0 Through Intel AMT 10, Deprecated in Intel AMT 11||Setup and Configuration Using PSK|
|PKI||2.2, 2.6, 3.0 and later||Setup and Configuration Using PKI (Remote Configuration)|
|Manual||6.0 and later||Manual Setup and Configuration (from Release 6.0)|
|CCM, ACM||7.0 and later||Manually Configuring Clients for Intel AMT 7.0 and Later|
Intel® Setup and Configuration Software (Intel® SCS) 11 can provision systems back to Intel AMT 2.x. For more information about Intel SCS and provisioning methods as they pertain to the various Intel AMT releases, visit Download the latest version of Intel® Setup and Configuration Service (Intel® SCS)
There are no feature limitations when configuring a platform manually since the 6.0 release, but there are some system behaviors to be noted:
Starting with Intel AMT 10, some devices are shipped without a physical LAN adapter. These devices cannot be configured using the current USB Key solutions provided by Intel SCS 11.
During power up, the Intel AMT platform displays the BIOS startup screen, then it processes the MEBx. During this process, access to the Intel MEBX can be made; however the method is BIOS vendor-dependent. Some methods are:
At setup completion, Intel AMT 7.0 and later devices go into one of two control modes:
There is also a configuration method that performs an Upgrade Client to Admin procedure. This procedure presumes the Intel AMT device is in Client Control Mode, but moves the Intel AMT device to Admin Control mode.
In Admin Control Mode there are no limitations to Intel AMT functionality. This reflects the higher level of trust associated with these setup methods.
When a simple host-based configuration completes, the platform enters Client Control Mode and imposes the following limitations:
The Intel AMT platform displays the BIOS startup screen during power up, then processes the BIOS Extensions. Entry into the Intel AMT BIOS Extension is BIOS vendor-dependent.
If you are using an Intel AMT reference platform (SDS or SDP), the display screen prompts you to press <Ctrl+P>. Then the control passes to the Intel CSME main menu.
In the case of it being a OEM system It is still easy to use the one-time boot menu, although entry into Intel CSME is usually an included option as part of the one-time boot menu. The exact key sequence varies by OEM, BIOS and Model.
Many systems no longer have a wired LAN connector. You can configure and activate the Intel ME, then via WebUI or some alternate method to push the wireless settings.
Enter the Intel CSME default password (“admin”).
Change the default password (required to proceed). The new value must be a strong password. It should contain at least one uppercase letter, one lowercase letter, one digit, and one special character, and be at least eight characters. A management console application can change the Intel AMT password without modifying the Intel CSME password.
An administrator with user rights can remotely connect to the Intel AMT device via the Web UI by entering the URL of the device. Depending on whether TLS has been activated, the URL will change:
You can also use a local connection using the host’s browser for a non TLS connection. Use either localhost or 127.0.0.1 as the IP address. Example: http://127.0.0.1:16992
In addition to having the BIOS and Intel CSME configured correctly, the Wireless NIC needs to be Intel AMT Compliant. Specific drivers and services must be present and running in order to use the Intel AMT to manage the host OS.
To verify that the Intel AMT drivers and services are loaded correctly, look for them in the Device Manger and Services in the host OS. Frequently check the OEM’s download site for upgraded versions of the BIOS, firmware, and drivers.
Here are the drivers and services that should appear in the host OS:
* Network controller and wireless interface versions will vary depending on the generation of the Intel vPro platform.
** Part of the complete Intel MEI (Chipset) Driver package
*** HID Drivers are needed when connecting via Intel AMT KVM. These default drivers are not normally an issue; however, we have seen issues on stripped-down custom OS installs. If a connection is made to a device without the HID drivers, the OS tries to auto-download the drivers. Once the install is done, reconnect the KVM connection.
Note: The version level of the drivers must match the version level of the firmware and BIOS. If non-compatible versions are installed, Intel AMT will not work with the features that require those interfaces.
By default, any wireless Intel vPro platform will have an Intel AMT enabled wireless card installed, such as an Intel Dual Band Wireless-AC 8260. Any wireless card other than one from Intel will not have wireless Intel AMT capabilities. If you have a card other than the Intel Dual Band Wireless-AC 8260 you can use ark.intel.com to verify whether the wireless card is Intel AMT compliant.
Device drivers are not necessary for remote management; however, they are essential for local communication to the firmware. Functions like discovery or configuration via the OS will require the Intel MEI driver, SOL driver, LMS service and Intel® Management and Security Status (Intel® MSS).
Intel MEI is required to communicate to the firmware. The Windows automatic update installs the Intel MEI driver by default. The Intel MEI driver should stay in version step with the Intel MEBX version.
The Intel MEI driver is in the Device Manager under “System devices” as “Intel® Management Engine Interface.”
The SOL driver used during redirection operation where a remote CD drive is mounted during a IDE redirection operation.
The SOL driver is in the Device Manager under “Ports” as “Intel® Active Management Technology – SOL (COM3).”
Figure 3. Serial-Over-LAN Driver.
The Local Manageability Service (LMS) runs locally in an Intel AMT device and enables local management applications to send requests and receive responses. The LMS responds to the requests directed at the Intel AMT local host and routes them to the Intel® ME via the Intel® MEI driver. This service installer is packaged with the Intel MEI drivers on the OEM websites.
Please note that when installing the Windows OS, the Windows Automatic Update service installs the Intel MEI driver only. IMSS and the LMS Service are not installed. The LMS service communicates from an OS application to the Intel MEI driver. If the LMS service is not installed, go to the OEM website and download the Intel MEI driver, which is usually under the Chipset Driver category.
Figure 4. Intel® Management Engine Interface Driver.
The LMS is a Windows service installed on the host platform that has Intel AMT Release 9.0 or greater. Prior to this, the LMS was known as the User Notification Service (UNS) starting from Intel AMT Release 2.5 to 8.1.
The LMS receives a set of alerts from the Intel AMT device. LMS logs the alert in the Windows Application event log. To view the alerts, right-click My Computer, and then select Manage>System Tools>Event Viewer>Application.
The Intel MSS tool can be accessed by the blue-key icon in the Windows tray.
Figure 5. Sys Tray Intel® Management and Security Status Icon.
The General tab of the Intel MSS tool shows the status of Intel vPro features available on the platform and an event history. Each tab has additional details.
Figure 6. Intel® Management and Security Status General Tab.
This interface allows the local user to terminate KVM and Media Redirection operations, perform a Fast Call for Help, and see the System Defense state.
Figure 7. Intel® Management and Security Status Intel AMT tab
The Advanced tab of the Intel MSS tool shows more detailed information on the configuration of Intel AMT and its features. The screenshot in Figure 8 verifies that Intel AMT has been configured on this system.
Figure 8. Intel® Management and Security Status Advanced Tab
The Intel AMT Software Development Kit (SDK) provides low-level programming capabilities so developers can build manageability applications that take full advantage of Intel AMT.
The Intel AMT SDK provides sample code and a set of APIs that let developers easily and quickly incorporate Intel AMT support into their applications. The SDK also includes a full set of HTML documentation.
The SDK supports C++ and C# on Microsoft Windows and Linux operating systems. Refer to the user guide and the Readme files in each directory for important information on building the samples.
The SDK, as delivered, is a set of directories that can be copied to any location. The directory structure should be copied in its entirety due to the interdependencies between components. There are three folders at the top level: DOCS (contains SDK documentation), and one each for Linux and Windows (sample code.) For more information on how to get started and how to use the SDK, see the Intel® AMT Implementation and Reference Guide.
As illustrated by the screenshot in Figure 9 of the Intel® AMT Implementation and Reference Guide, you can get more information on system requirements and how to build the sample code by reading the Using the Intel® AMT SDK section. The documentation is available on the Intel® Software Network here: Intel® AMT SDK (Latest Release)
Figure 9. Intel AMT Implementation and Reference Guide
Intel AMT Implementation and Reference Guide
Intel AMT SDK Download
High-level API Article and download
Intel® Platform Solutions Manager Article and Download
Power Shell Module download
KVM Application Developer’s Guide
C++ CIM Framework API
C# CIM Framework API
Intel® ME WMI Provider
System Health Validation (NAP)
Use Case Reference Designs
The following table provides a snapshot of features supported by Intel AMT Releases 8 through 12.
Read about all the features in the Intel AMT SDK Implementation and Reference Guide (“Intel AMT Features” section.)
|Feature||Intel® Active Management Technology (Intel® AMT) 8||Intel AMT 9||Intel AMT 10||Intel AMT 11||Intel AMT 12|
|Remote Power On/Off||X||X||X||X||X|
|Third-Party Data Storage||X||X||X||Deprecated||Deprecated|
|Built-in Web Server||X||X||X||X||X|
|Web Application Hosting||X||X|
|HTTP Digest/ TLS||X||X||X||X||X|
|Static and Dynamic IP||X||X||X||X||X|
|Feature||AMT 8||AMT 9||AMT 10||AMT 11||AMT 12|
|Intel® Management Engine Wake-on-LAN||X||X||X||X||X|
|Endpoint Access Control (EAC) 802.1||X||X||X||X||X|
|Event Log Reader Realm||X||X||X||X||X|
|System Defense Heuristics||X||X||X||X||X|
|Feature||AMT 8||AMT 9||AMT 10||AMT 11||AMT 12|
|Fast Call For Help (CIRA)||X||X||X||X||X|
|Microsoft NAP* Support||X||X||X||X||X|
|Virtualization Support for Agent Presence||X||X||X||X||X|
|PC Alarm Clock||X||X||X||X||X|
|KVM Remote Control||X||X||X||X||X|
|Wireless Profile Synchronization||X||X||X||X||X|
|Support for Internet Protocol Version 6||X||X||X||X||X|
|Remote Secure Erase||X||X|
Intel's compilers may or may not optimize to the same degree for non-Intel microprocessors for optimizations that are not unique to Intel microprocessors. These optimizations include SSE2, SSE3, and SSSE3 instruction sets and other optimizations. Intel does not guarantee the availability, functionality, or effectiveness of any optimization on microprocessors not manufactured by Intel. Microprocessor-dependent optimizations in this product are intended for use with Intel microprocessors. Certain optimizations not specific to Intel microarchitecture are reserved for Intel microprocessors. Please refer to the applicable product User and Reference Guides for more information regarding the specific instruction sets covered by this notice.
Notice revision #20110804