Intel Software Network articles feed

Intel® Active Management Technology PC Alarm Clock

Thu, 11 Jun 2009 16:17:31 -0700

Download entire article

Download Intel® Active Management Technology PC Alarm Clock [82KB PDF]

Introduction

Management of client systems in an enterprise environment typically involves an IT management console communicating with agents that require the client systems to be powered on. This situation poses a couple of options. The first is to perform management operations while the users of the client systems are present and potentially disrupt their productivity. The second is to perform the management operations when the users are not present which requires the client systems to be left on outside of normal working hours, potentially wasting energy. Management solutions have provided the means to remotely wake systems to address this, but there has not been a solution that allows the local agents to do this autonomously.

There are technologies that allow a system to be scheduled to wake locally from some sleep states, but no standard way to wake locally from off. There are also technologies that allow a system to be powered on remotely through a network connection. The Intel® Active Management Technology (Intel® AMT) PC Alarm Clock feature, available on systems with Intel® vPro™ technology, provides the means to remotely schedule client systems to wake locally from off or any sleep state without a network connection.

This paper describes how Intel® AMT PC Alarm Clock can be used to manage client systems in a more efficient and scalable manner.

Usage Model

The PC Alarm Clock feature introduced in Intel® AMT version 5.1 provides the ability to remotely schedule systems to wake up and perform tasks autonomously without need for a network connection at the time of the wake. The primary usage model is to schedule client systems with Intel® vPro™ technology to power up and perform tasks during downtime hours.

Here are the steps that would occur in this typical usage model:

Intel® AMT 5.1 client systems are setup and configured within a network.
An IT manager provides task information that it would like to be performed off hours to agents running on the client systems (e.g. security and maintenance actions).
The IT manager sets wake schedules for the client systems using the Intel® AMT PC Alarm Clock.
Users shut down their client systems when the leave for the day.
At scheduled time, Intel® AMT PC Alarm Clock in each system powers up the clients locally and independent of network connection status.
The local agents determine that the PC Alarm Clock woke the system and they run their assigned tasks.
After completing their tasks, the local agents power the system back down to their previous state.

This usage model demonstrates the efficiency and scalability benefits of using the Intel® AMT PC Alarm Clock to perform tasks off hours.

Tasks can be performed off hours without interrupting users to improve productivity
Systems can be powered off when users are not present to save energy/costs[1]
Task assignment is separated from alarm scheduling to provide more flexible usage for IT managers
The wake and tasks are performed locally and autonomously, reducing the time and effort required by IT managers
Network bandwidth requirements are typically small when performing remote power management tasks using Intel® AMT. However, this solution only uses remote calls for scheduling wakes and assigning tasks, which allows for a more scalable solution when running tasks on many systems at once.

Operation

The use of PC Alarm Clock starts with scheduling. When the PC Alarm Clock does not have a set schedule it is in the disabled state. Scheduling is performed remotely by a management console and can be set to wake once or on a recurring basis. After a schedule is set it can be changed or disabled (unset). A scheduled alarm can be missed due to the system already being powered up or ME being asleep. If a single occurrence alarm is missed, the status of the PC Alarm Clock will revert to disabled. If a recurring alarm is missed, the PC Alarm Clock will maintain its status for the next scheduled wake.

When the PC Alarm Clock wakes a system, an entry is added to the Intel® AMT event log that provides two key pieces of information. It indicates that the system was awakened by PC Alarm Clock and it provides the previous sleep state of the system. When the system wakes, the local agent can read the log and look for this event. If the event is present then the agent knows that the wake was due to the PC Alarm Clock and it can proceed with its scheduled tasks. If the event is not present, then the system was booted from another source and the agent may not want to perform the tasks. For example, if the user booted the system just prior to the alarm to get some work done it may not be a good idea to interrupt with a compute intensive management task. The agent is also expected to use this event to return the system to the previous sleep state when finished with its tasks.

The assignment of tasks for the local software agents to perform after an PC Alarm Clock wake is separate from the scheduling of the alarm. This may be done independent of Intel® AMT by direct communication from the management console to each agent while the system is powered up. Alternatively, the 3rd Party Data Store (3PDS) feature of Intel® AMT can be used to pass task information to an agent. The 3PDS provides persistent storage for use with Intel® AMT solutions. At anytime before a scheduled alarm, the management console can use Intel® AMT to connect to the client systems and place task information in the 3PDS even when the systems are shut off. In this case the local agents would be configured to read the task information from the 3PDS after an alarm wakes the system.

When configuring Intel® AMT on client systems that will be using the PC Alarm Clock feature, it is important to select the appropriate power policy for the Manageability Engine (ME). Just like the power saving sleep states of the host system, the ME can be configured to sleep under certain conditions via power packages. Since the PC Alarm Clock feature is only available only when the ME is on it is important to select a power package that will have the ME on when the PC Alarm Clock will be used.

Developing Solutions

The best place to go to get information on developing solutions with the PC Alarm Clock feature is the Intel® Active Management Technology (AMT) Software Development Kit (SDK). Support for PC Alarm Clock is available in the Intel® AMT SDK version 5.1 or later. The latest version is available for download here: http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk/

The Intel® AMT SDK provides documentation on the interfaces used in development of the PC Alarm Clock feature. The PC Alarm Clock can be developed using either the WS-management interface or the External Operations Interface (EOI) a.k.a. Soap interface. The WS-management class references provide the interface information for WS-management development. The AMT_AlarmClockService and the AMT_MessageLog class references provide the important interface information for PC Alarm Clock development. The Network Interface Guide is the comprehensive reference for all EOI. It should be noted that since the EOI is planned to be deprecated in future releases of Intel® AMT it is recommended that any new development be done using the WS-management interface.

The Intel® AMT SDK also provides sample code that demonstrates how to implement an PC Alarm Clock solution. In version 5.1 of the SDK there is a Windows C# sample that utilizes the WS-management interface and a Windows C++ sample that uses the EOI/Soap interface. There is also Event Log Reader sample code available in C++ on Windows and Linux for both interfaces.

The operations used to implement the PC Alarm Clock feature are basic "get" and "set" functions. The current status of the PC Alarm Clock can be retrieved to see if it is disabled or set and if set, when the next alarm is scheduled to occur, and any recurrence. The PC Alarm Clock can be set to perform a single wake or recurring wakes. A current setting can be modified by simply calling another set operation. And finally, a current setting can be disabled. Following is a table that summarizes the interfaces:

Operation	WS-management	EOI/Soap
Get current status	Get()	GetAlarmWakeUp()
Set single wake occurrence	Set() with NextAMTAlarmTime	SetAlarmWakeUp() indicate Set with StartTime
Set recurring wake occurrence	Set() with NextAMTAlarmTime & AMTAlarmClockInterval	SetAlarmWakeUp() indicate Set with StartTime & Interval
Disable current wake setting	Set() with Null parameters	SetAlarmWakeUp() indicate Clear with no other parameters

References

[1] Case Study: State of Indiana Improves IT Efficiency, Maximizing Taxpayer Dollars: http://communities.intel.com/docs/DOC-1497

Special thanks to Tom Propst and Michelle Chuaprasert for providing peer review.

Download the Intel® AMT Setup and Configuration Service (SCS) 6.0 Technology Preview

Tue, 19 May 2009 13:49:55 -0700

Thank you for your interest in the Intel® Active Management Technology (Intel® AMT) Setup and Configuration Service (SCS) Technology Previews.

Introduction

Setup and Configuration Service (SCS) 6.0 is being implemented using the SCRUM method, where the functionality is being built up in stages. This way we are able to share incremental high quality releases on a regular basis. The goal of releasing the technology previews on the manageability developer community is to get feedback from the community members.

We are releasing the first gold quality release SCS 6.0 Technology Preview #1. It holds partial functionality but has been tested and found to be of high quality. The main theme of this release is lightweight vPro configuration for the small and medium business segments.

Features of the Technology Preview #1 release include:

Remote Configuration, both PSK and PKI
Activator tool, including new GUI
Config-Lite using XML
Local USB-key configuration
A more robust and scalable design vs. previous versions of the SCS

Intel SCS 6.0 Lightweight – The lightweight version enables small and medium businesses customers to quickly setup and use the Intel SCS in a simple network infrastructure.

Download Intel® SCS 6.0 Technology Preview Release #1 *

Features of the Technology Preview #2 release:

Intel SCS enables you to setup and use the Intel SCS in an enterprise network infrastructure. The full version includes the following options that are not supported in the lightweight version:

Integration with Active Directory
The application of Transport Layer Security (TLS) and Certificate Authority (CA) in configuration profiles
SQL Databases
Access Control Lists in profiles
Configuring up to 1000 platforms
If you do not require any of these options, download and install the Intel SCS Lightweight version instead.

Download Intel SCS 6.0 Technology Preview Release #2 *

For more information, see the Release Notes included with each version.

* Please note that the terms of the software license agreement included with any software you download will control your use of the software.

Additional Information

Intel® WS-Management Translator

Tue, 19 May 2009 13:48:24 -0700

Introduction

Beginning with Intel® Active Management Technology (Intel® AMT) release 3.0, Intel introduced support for the industry standard WS-Management protocol. This allows management software to use a combination of standard CIM classes, as well as Intel specific classes, to perform Intel® AMT operations. Support for the WS-Management specification enables software developers and IT professionals to leverage off-the-shelf infrastructure and tools to interact with Intel® AMT platforms. But what about using WS-Management based software in conjunction with Intel® AMT platforms older than release 3.0? Intel has shipped many platforms that can only support a firmware version of 2.6 or below. Can WS-Management based software be used with these older Intel platforms?

Enter the Translator

The Intel® WS-Management Translator makes it possible for WS-Management based software to be used in conjunction with Intel® AMT platforms older than version 3.0. Using the translator, management software can send WS-Management commands to the translator, the translator will in turn perform the equivalent operation on an Intel® AMT device using a proprietary SOAP based protocol understood by all Intel® AMT platforms.

Download The Intel® WS-Management Translator for vPro™ Processor Technology

File Name:	WSTrans.msi *build 552
Date Published:	08/19/08
Download Size:	2.67 MB

Key features in the Translator 1.0 (build 552)

Provides support for running on 64-bit systems
Provides additional translation services for legacy systems such as wireless profiles, and 8021.x.
You can upgrade from existing builds by using this VB Script or it can be installed on its own.

Download Source Code for The Intel® WS-Management Translator for vPro™ Processor Technology

File Name:	Source Code (wstrans_src_build_542.zip)
Date Published:	08/19/08
Download Size:	640 kb

Genscript

Genscript is a tool for activating Intel® Active Management Technology (Intel® AMT) features in a scriptable environment. Genscript generates Visual Basic® scripts that can be applied to a single machine or many machines. These scripts programmatically can activate various Intel AMT features using Windows Remote Management (WinRM). Genscript can also be used in conjunction with the Intel WS-Management Translator to perform initial setup of Intel AMT clients and programmatically activate features on AMT clients that don’t natively support WinRM. Intel AMT clients that are already setup, and natively support the WS-Management interface, will not require the assistance of the Intel WS-Management translator software.

Download Genscript for The Intel® WS-Management Translator for vPro™ Processor Technology

File Name:	genscript1_0_15.zip
Date Published:	02/13/09
Download Size:	62.2 kb

Additional Information

Intel® Client Manageability Add-on for Microsoft* SMS 2003

Tue, 19 May 2009 13:47:10 -0700

Reducing costs with accurate inventories, remote management, and improved security for desktop PCs

The Intel® Client Manageability Add-on for Microsoft* SMS 2003 enables Microsoft* SMS 2003 to discover and manage Intel® VPro™ processor technology based PCs remotely.

Download the most recent update to the Intel® Client Manageability Add-on for Microsoft* SMS 2003.

Overview

Intel® Client Manageability Add-on for Microsoft Systems Management Server* (SMS) 2003, a plug-in utility to extend the functionality of Microsoft* SMS 2003, is now available. The plug-in enables SMS to take advantage of the advanced, hardware-based system management capabilities of Intel® AMT, which are built into PCs with Intel® VPro™ processor technology. These capabilities will help reduce the cost of discovering, managing and securing desktop PCs in the enterprise and thereby improving compliance with corporate policies. Information Technology (IT) support staff can now rapidly and remotely communicate with, power up, reboot, control, inventory assets, and remediate desktop PCs with Intel® VPro™ processor technology even if the PC is powered off or the operating system is not functioning. Support staff are able to manage PCs more effectively from the IT support center which leads to a reduction in desk-side visits and hence the total cost of ownership of computing systems equipped with Intel® VPro™ processor technology.

Related Downloads

Intel AMT Setup and Configuration Service (SCS) to Microsoft System Center Configuration Manager (SCCM) SP1 System Migration: The Intel® SCS to Microsoft® SCCM utility is aimed for users interested in migrating SCS-provisioned systems to Microsoft SCCM.

Additional Information

Video Tutorials


Integrating the Intel® Client Manageability Add-on for Microsoft* SMS 2003 with SCS A video showing how to configure the Intel® Client Manageability Add-on for Microsoft* SMS 2003 for integration with the Intel (R) SCS. The video shows how to specify the relevant settings in the Setup and Configuration tab of the Add-on Settings dialog box.	Create PEM Certificate Files A video showing how to create PEM certificate files and store them on the file server. You need to perform this procedure if you are working in External (non-SCS-Integrated) mode, or if you are working in SCS-Integrated mode and intend using the redirection functions.

Download the latest version of Intel® AMT Setup and Configuration Service - SCS

Tue, 19 May 2009 13:43:11 -0700

Thank you for your interest in the Intel® Active Management Technology (Intel® AMT) Setup and Configuration Service (SCS).

Introduction

Intel® Active Management Technology’s (Intel® AMT) Setup and Configuration Service (Intel SCS or SCS) provides developer or ISV with the tools to set up and configure Intel AMT devices. The Setup and Configuration Service (SCS) allows for most aspects of setup and configuration to be completed through a remote management console. It supports end user environments that implement TLS security and a DHCP network. The service package consists of a configuration engine and installer in binary form, plus a reference graphical user interface that the ISV may integrate into their own software.

Download the most recent Intel® AMT SCS update and get tools to set up and configure Intel AMT devices.

Download the recent update for Intel® AMT SCS and get tools to set up and configure Intel AMT devices.

Intel® AMT Release 5.1 includes DASH compliance changes that impact the Intel® AMT Setup and Configuration Service. In order to provision Intel AMT Release 5.1 with the Intel SCS, you must use version 5.0.2 or greater.

Intel_AMT_SCS_Release_5.1.0.50.zip

File Name:	Intel_AMT_SCS_Release_5.1.0.50.zip
Version:	5.1.0.50
Date Published:	03/12/2009
Download Size:	47.5 MB

SCS 5.1 is a point-release based on SCS 5.0 code-base. Feature set includes the following (See release notes for full details):
• Wireless Sx support and Wake on Wireless
• Include special characters in host names
• AT5.1 DASH updates
(First three features were already supported in the 5.0.2 Release)
• 64bit O/S Support
• Level III Manageability Upgrade (B43 SKU) support
• Activator DHCP Renew option
• CIRA Actions logging
• Improvements when exporting TLS-PSK keys to a USB (UKPU-like)
• OpenSSL Library update
• Various bug fixes/improvements over 5.0 release

Intel® SCS Setup Wizard - v5.1 Now Available

This utility is designed to automate the installation of the Intel® Setup and Configuration Service (SCS) along with the third party pre-requisite components automatically. This version replaces all previous releases of the wizard.

The Intel® SCS Setup Wizard will install or verify existing components that are required by the SCS, and then install the service and the Intel® SCS Console. After running the Intel® SCS Setup Wizard, the Intel® SCS Console can be used to provision Intel® vPro™ technology client systems.

Download Intel® SCS Setup Wizard - v5.1

Documentation:

Check out the Manageability blogs for all the latest updates, news and discussions related to Intel AMT and Intel SCS. Need more help? Refer to the FAQs or get expert advice from the Developer Discussion Forum

Older Versions of Intel® AMT SCS:

Intel AMT SCS Version Details

SCS Version	Intel AMT Version	Hotfix	Comments
3.3.2	3.2 and below	3.3.3	Does not support Intel AMT 5.x features. Use for provisioning Intel AMT release 3.x systems
5.0.2.4	5.0.x and Below	5.0.3	Use this version of the SCS to provision systems that are Intel AMT 5.0x
5.1	5.1	NA	Incluses DASH compliance changes that impact the Intel AMT SCS. In order to provision Intel AMT Re;ease 5.1, you must use SCS version 5.0.2 or greater

Intel AMT Setup and Configuration Service (SCS) 5.0.2.4

File Name:	IntelAMTSCS_5.0.2.4.zip
Version:	5.0.2.4
Date Published:	07/20/08
Download Size:	36 MB
Release Notes

Download the IntelAMTSCS_5.0.3.0 Hotfix
This hotfix contains the OpenSSL Library security update.

File Name:	IntelAMTSCS_5.0.3.0.zip
Version:	5.0.3.0(Hotfix)
Date Published:	04/03/2009
Download Size:	2.16 MB

Intel AMT Setup and Configuration Service (SCS) 3.3.2.

The SCS 3.3.2 contains the following (See the release notes for the full details):

RCT renamed to Activator and synchronized with standalone release of Activator
Vlan bug fixed: SCS sets vlan_tag only if vlan mode is enabled in profile
Fixed the bug caused to remove an existing DB during the upgrade or multi-SCS installations
Handle leak during PKI configuration flow fixed

File Name:	IntelAMTSCS_3.3.2.1.0.zip
Version:	3.3.2.1.0
Date Published:	07/20/08
Download Size:	22.2 MB
Release Notes	ReleaseNotes_3.3.2.1.0

Download the SCS_3.3.3.0 Hotfix (Do not apply this hot fix for any of the Intel SCS 5.X releases)
This hotfix contains the OpenSSL Library security update.

File Name:	SCS_3.3.3.0.zip
Version:	3.3.3.0
Date Published:	03/31/09
Download Size:	1.62 MB

Version 3.3

SCS Build 3.2.2.1
SCS 3.2.2 includes the following new feature: The user can choose to type-in the SQL server username and password, to address specific customer DB strong password requirements.

SCS 3.3 includes the following new features:

RCT Can Send “Hello” Packets
Improve the AMT FQDN (Fully Qualified Domain Name) change process
SCS 3.3 Bug fixes

The SCS no longer performs unnecessary re-provisioning after initial successful provisioning of Intel AMT systems.
The procedure that cleans the csto_status_of_requests table in the SCS database has been made more efficient and takes less time to run.

Intel AMT SCS 3.1 package includes the SCS Installer, Release Notes, Configuration Server Interface Guide, and Sample Scripts. And, the SCS Installer includes all components in two packages – one for the console and one for the remaining components. The components are: WinService, SOAP API, Console, and the Add User Command Line.

Additional Information

The following new features were added to SCS since the 5.0.0.92 release:

In supported firmware versions SCS now accepts special characters such as underscore (“_”) and pound sign ("#") for the AMT host name.
If the Wake on Wired feature is enabled, then the Wake on Wireless feature is also enabled. The latter is part of Support for Wireless in Sx, which is supported in AMT Mobile FW since version 4.0.
- The restart IIS feature, used during install and uninstall, can be disabled through the registry:
- To prevent restarting the IIS during installation create the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Intel\SCSNotRestartIIS_Install
- To prevent restarting the IIS during an uninstall create the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Intel\SCSNotRestartIIS_UnInstall
New features in Activator
Bug fixes and some improvement of the RN issues mitigation

SCS 5.0 includes the following new features: (please refer to the release notes to learn more).

NAP support
Usuability improvements
Support for change hostname/UUID
Support for automatic configuring and extracting PID from hello packet.
Extended AMTList APIs to support recovering configuration parameters.
Attempt connection with AMT using FQDN.
SCS tested in various Active Directory forest configurations.
New SCS console
WSDL improvements
Perform wireless configuration over WS-MAN.
The installer now registers the SCS in Active Directory.
Includes a sample script for creating a certificate template that can be used for both 8021x and TLS.

Online support for the Intel® AMT Setup and Configuration Service is available online through the Manageability Software Development forum.

Download the latest Intel® AMT Software Development Kit (SDK)

Tue, 19 May 2009 13:40:08 -0700

Thank you for your interest in the Intel® Active Management Technology (Intel® AMT) Software Development Kit. The Intel® AMT SDK (Software Development Kit) contains the building blocks and documentation material needed to develop software that interacts with Intel® AMT systems.

Intel® AMT 5.1 SDK is now available!!

Overview

Intel® Active Management Technology (Intel® AMT) is a capability embedded in Intel® vPro™ technology based PCs that enhance the ability of IT organizations to manage enterprise computing facilities. Intel AMT operates independently of the platform processor and operating system. Remote platform management applications can access Intel AMT securely, even when the platform is turned off, as long as the platform is connected to line power and to a network. Independent software vendors (ISVs) can build applications that take advantage of the features of Intel AMT using the application programming interface (API).

Download the most recent update to the Intel® AMT SDK and get everything you need to develop manageability applications.

Download Intel® AMT SDK

Version:	Release 5.1
Date Published:	03/17/2009
Download Size:	106 MB

The main changes in the 5.1 SDK, besides some bug fixes, are:
• Alarm Clock feature
• DASH 1.0 support
• OpenSSL vulnerability fix

Intel AMT 5.0 New Features:

Secure Audit Log - Configuration and samples (4.0 & 5.0).
Client Initiated Remote access (CIRA) - Manageability Presence Server (MPS)
sample provided, configuration support & most samples updated to support
working remotely (4.0 & 5.0).
Network Access Protection (NAP) - System Health Validator (SHV) sample
(4.0 & 5.0).
Samples for additional DASH 1.0 profiles - 'Role Based authorization (ACL)',
WS-Eventing & DASH Discovery support (3.2 - apart from WS-Eventing, 4.0 &
5.0).
USB configuration has been updated to support many configuration options.
Wireless configuration WS-Management support (4.0).
New event log interface (3.2, 4.0 & 5.0).

The key new features of Intel AMT 4.0 that are supported in this SDK:

Client Initiated Remote Access – allow client machines outside of their trusted intranet to make a call for help over the internet and establish a remote management connection.
Secure Audit Log support – enables some policy based events on the system to be monitored by designated auditors without any possible disruption by administrators.
Network Access Protection (NAP) support - Allows Intel AMT to gain Out Of Band access to a Microsoft NAP enabled 802.1x network to for SW updates, inventories, remote diagnostics, etc.
Wireless Configuration – provides ability to manage the clients through their wireless network connection and modify communication profiles and settings.

Release Details

Read Gael Holmes's blog post "Hot Fix for Intel® AMT SDK (3.0.2)" to learn more about this hot fix
Read Ajith Illendula's blog post "Update for Intel AMT SDK 3.0" to learn more about this latest release
Read Gael Holmes's blog post "Announcing a new Intel AMT SDK" to find out all about the features that the different AMT releases support
Need more help? Refer to the FAQs or get expert advice from the Developer Discussion Forum

Additional Information

Resources

Online support for the Intel® AMT Software Development Kit is available online through the Manageability Software Development forum.

Intel Software License Agreement Intel® AMT SCS Technology Preview

Wed, 08 Apr 2009 10:06:44 -0700

IMPORTANT - READ BEFORE COPYING, INSTALLING OR USING

Do not use or load this software and any associated materials (collectively, the “Software”) until you have carefully read the following terms and conditions. By loading or using the Software, you agree to the terms of this Agreement. If you do not wish to so agree, do not install or use the Software.

Please Also Note:

If you are an Original Equipment Manufacturer (OEM), Independent Hardware Vendor (IHV), or Independent Software Vendor (ISV), this complete LICENSE AGREEMENT applies;
If you are an End-User, then only Exhibit A, the INTEL SOFTWARE LICENSE AGREEMENT, applies.

For OEMs, IHVs, and ISVs:

LICENSE

This Software is licensed for use only in conjunction with Intel component products. Use of the Software in conjunction with non-Intel component products is not licensed hereunder. Subject to the terms of this Agreement, Intel grants to You a nonexclusive, nontransferable, worldwide, fully paid-up license under Intel’s copyrights to:

use, modify and copy Software internally for Your own development and maintenance purposes; and
modify, copy and distribute Software, including derivative works of the Software, to Your end-users, but only under a license agreement with terms at least as restrictive as those contained in Intel's Final, Single User License Agreement, attached as Exhibit A; and
modify, copy and distribute the end-user documentation which may accompany the Software, but only in association with the Software.

If You are not the final manufacturer or vendor of a computer system or software program incorporating the Software, then You may transfer a copy of the Software, including derivative works of the Software (and related end-user documentation) to Your recipient for use in accordance with the terms of this Agreement, provided such recipient agrees to be fully bound by the terms hereof. You shall not otherwise assign, sublicense, lease, or in any other way transfer or disclose Software to any third party. You shall not reverse- compile, disassemble or otherwise reverse-engineer the Software.

Except as expressly stated in this Agreement, no license or right is granted to You directly or by implication, inducement, estoppel or otherwise. Intel shall have the right to inspect or have an independent auditor inspect Your relevant records to verify Your compliance with the terms and conditions of this Agreement.

CONFIDENTIALITY.
If You wish to have a third party consultant or subcontractor ("Contractor") perform work on Your behalf which involves access to or use of Software, You shall obtain a written confidentiality agreement from the Contractor which contains terms and obligations with respect to access to or use of Software no less restrictive than those set forth in this Agreement and excluding any distribution rights, and use for any other purpose. Otherwise, You shall not disclose the terms or existence of this Agreement or use Intel's name in any publications, advertisements, or other announcements without Intel's prior written consent. You do not have any rights to use any Intel trademarks or logos.

OWNERSHIP OF SOFTWARE AND COPYRIGHTS.
Title to all copies of the Software remains with Intel or its suppliers. The Software is copyrighted and protected by the laws of the United States and other countries, and international treaty provisions. You may not remove any copyright notices from the Software. Intel may make changes to the Software, or to items referenced therein, at any time and without notice, but is not obligated to support or update the Software. Except as otherwise expressly provided, Intel grants no express or implied right under Intel patents, copyrights, trademarks, or other intellectual property rights. You may transfer the Software only if the recipient agrees to be fully bound by these terms and if you retain no copies of the Software.

LIMITED MEDIA WARRANTY.
If the Software has been delivered by Intel on physical media, Intel warrants the media to be free from material physical defects for a period of ninety (90) days after delivery by Intel. If such a defect is found, return the media to Intel for replacement or alternate delivery of the Software as Intel may select.

EXCLUSION OF OTHER WARRANTIES.
EXCEPT AS PROVIDED ABOVE, THE SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY EXPRESS OR IMPLIED WARRANTY OF ANY KIND, INCLUDING WARRANTIES OF MERCHANTABILITY, NONINFRINGEMENT, OR FITNESS FOR A PARTICULAR PURPOSE. Intel does not warrant or assume responsibility for the accuracy or completeness of any information, text, graphics, links or other items contained within the Software.

LIMITATION OF LIABILITY.
IN NO EVENT SHALL INTEL OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, LOST PROF¬ITS, BUSINESS INTERRUPTION OR LOST INFORMATION) ARISING OUT OF THE USE OF OR IN¬ABILITY TO USE THE SOFTWARE, EVEN IF INTEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS PROHIBIT EXCLUSION OR LIMITATION OF LIABILITY FOR IMPLIED WARRANTIES OR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE LIMITA¬TION MAY NOT APPLY TO YOU. YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY FROM JURISDICTION TO JURISDICTION.

TERMINATION OF THIS AGREEMENT.
Intel may terminate this Agreement at any time if you violate its terms. Upon termination, you will immediately destroy the Software or return all copies of the Software to Intel.

APPLICABLE LAWS.
Claims arising under this Agreement shall be governed by the laws of California, excluding its principles of conflict of laws and the United Nations Convention on Contracts for the Sale of Goods. You may not export the Software in violation of applicable export laws and regulations. Intel is not obligated under any other agreements unless they are in writing and signed by an authorized representative of Intel.

GOVERNMENT RESTRICTED RIGHTS.
The Software is provided with "RESTRICTED RIGHTS." Use, duplication, or disclosure by the Government is subject to restrictions as set forth in FAR52.227-14 and DFAR252.227-7013 et seq. or their successors. Use of the Software by the Government constitutes acknowledg¬ment of Intel's proprietary rights therein. Contractor or Manufacturer is Intel Corporation, 2200 Mission College Blvd., Santa Clara, CA 95052.

EXHIBIT “A”

INTEL SOFTWARE LICENSE AGREEMENT (Final, Site License)

IMPORTANT - READ BEFORE COPYING, INSTALLING OR USING

Do not use, install or load this software and any associated materials (collectively, the “Software”) until you have carefully read the following terms and conditions. By loading, installing or using the Software, you agree to the terms of this Agreement. If you do not agree, do not use, install or load the Software.

LICENSE

This Software is licensed for use only in conjunction with Intel component products. Use of the Software in conjunction with non-Intel component products is not licensed hereunder. You may copy the Software onto your organization's computers for your organization's internal use, and you may make a reasonable number of back-up copies of the Software, subject to these conditions:

You may not copy, modify, rent, sell, distribute or transfer any part of the Software except as provided in this Agreement, and you agree to prevent unauthorized copying of the Software.
You may not reverse engineer, decompile, or disassemble the Software.
You may not sublicense the Software.
The Software may include portions offered on terms in addition to those set out here, as set out in a license accompanying those portions.

OWNERSHIP OF SOFTWARE AND COPYRIGHTS.
Title to all copies of the Software remains with Intel or its suppliers. The Software is copyrighted and protected by the laws of the United States and other countries, and international treaty provisions. You may not remove any copyright notices from the Software. Intel may make changes to the Software, or to items referenced therein, at any time without notice, but is not obligated to support or update the Software. Except as otherwise expressly provided, Intel grants no express or implied right under Intel patents, copyrights, trademarks, or other intellectual property rights.

LIMITED MEDIA WARRANTY.
If the Software has been delivered by Intel on physical media, Intel warrants the media to be free from material physical defects for a period of ninety (90) days after delivery by Intel. If such a defect is found, return the media to Intel for replacement or alternate delivery of the Software as Intel may select.

EXCLUSION OF OTHER WARRANTIES.
EXCEPT AS PROVIDED ABOVE, THE SOFTWARE IS PROVIDED "AS IS" WITHOUT ANY EXPRESS OR IMPLIED WARRANTY OF ANY KIND INCLUDING WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, OR FITNESS FOR A PARTICULAR PURPOSE. Intel does not warrant or assume responsibility for the accuracy or completeness of any information, text, graphics, links or other items contained within the Software.

LIMITATION OF LIABILITY.
IN NO EVENT SHALL INTEL OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, LOST PROF¬ITS, BUSINESS INTERRUPTION, OR LOST INFORMATION) ARISING OUT OF THE USE OF OR IN¬ABILITY TO USE THE SOFTWARE, EVEN IF INTEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME JURISDICTIONS PROHIBIT EXCLUSION OR LIMITA¬TION OF LIABILITY FOR IMPLIED WARRANTIES OR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE LIMITA¬TION MAY NOT APPLY TO YOU. YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY F ROM JURISDICTION TO JURISDICTION.

TERMINATION OF THIS AGREEMENT.
Intel may terminate this Agreement at any time if you violate its terms. Upon termination, you will immediately destroy the Software or return all copies of the Software to Intel.

APPLICABLE LAWS.
Claims arising under this Agreement shall be governed by the laws of Delaware, excluding its principles of conflict of laws, and the United Nations Convention on Contracts for the Sale of Goods. You may not export the Software in violation of applicable export laws and regulations. Intel is not obligated under any other agreements unless they are in writing and signed by an authorized representative of Intel.

GOVERNMENT RESTRICTED RIGHTS.
The Software is provided with "RESTRICTED RIGHTS." Use, duplication, or disclosure by the Government is subject to restrictions as set forth in FAR52.227-14 and DFAR252.227-7013 et seq. or their successors. Use of the Software by the Government constitutes acknowledg¬ment of Intel's proprietary rights therein. Contractor or Manufacturer is Intel Corporation, 2200 Mission College Blvd., Santa Clara, CA, USA 95052.

Troubleshooting the IMR_RES_TLS_CONNECTION_FAILED error in mutual TLS

Wed, 08 Apr 2009 03:36:05 -0700

Troubleshooting the IMR_RES_TLS_CONNECTION_FAILED error in mutual TLS

This article expands on the author’s previous blog post titled “Tips to check if the SCS, the DTK or your app doesn’t connect to an AMT Enterprise machine” . It includes some specific steps to troubleshoot this error message. This article is written by Javier Andres Caceres Alvis. Javier works as a Software Engineer for Aranda Software (ISV enabling for Intel AMT).

The Manageability DTK and other applications that use SOL and IDER-R capabilities utilize the functionality exposed by the Redirection Library. This library is included in the imrsdk.dll file and is the one in charge of establishing a TCP (port 16994) or TLS (port 16995) connection, so if you’re sure you’ve checked all the possible error sources mention in the post above followingnext steps will help.

Picture 1. Key values.

Verify that your SSL client and server certificates contain the keys shown in picture 1; these values must be 1.3.6.1.5.5.7.3.2 and 2.16.840.1.113741.1.2.1, or both (no matter if you used a customized template or a standard one). If your client application still has the same error, please find the imrsdk.ini file (which must be in the same folder that imrsdk.dll), open it and set the debug level to “2”:
[COMMON]
Debug_Level=2
Storage_Enabled=0

With Debug_Level=2 you will get a log file that specifies what the concrete error is. In this example, I got these entries in my log.txt found it to be due to a duplicated certificate in my store:
LOG STARTED Fri Mar 13 11:09:37 2009
NETMGR: added UDP socket to read socks: 1456
NETMGR: Signal socket created: 1500
SSLSocket::connect: failed to set certificate chain file file
SSLSocket::connect: func X509_STORE_add_cert, reason cert already in hash table
SSLSocket::connect: failed to set certificate chain file file
SSLSocket::connect: func X509_STORE_add_cert, reason cert already in hash table
LOG ENDED Fri Mar 13 11:13:07 2009

Picture 2. Duplicate certificate.

As shown in picture 2, in this example, the same certificate appeared twice in “Trust root certification Authorities“; To know which one to delete navigate to the IAMT machine’s WebUI, find the issuer certificates’ serial number (Picture 3), delete the bad one and the DTK will work fine.

Picture 3. Issuer certificate’s serial number.

Don’t forget that the DTK takes ALL the trusted root certificates to a *.pem file called “Trusted Root Certificates.pem” the first time is started, so if you changed something in your environment please delete this file and start the application again.

Building an Intel AMT Agent Monitor (Part 1)

Wed, 08 Apr 2009 03:32:35 -0700

This article explores the security benefits of Intel® Active Management Technology (Intel® AMT), specifically the System Defense feature, network security policies and heuristic filters to finally build an Agent monitor (or "Agent Presence"). This article is written by Javier Andres Caceres Alvis. Javier works as a Software Engineer for Aranda Software (ISV enabling for Intel AMT).

Introduction

Intel AMT has two closely related features: System Defense and Agent Presence. Below is a brief description of what they are and how to use them:

• System Defense (previously known as "circuit breaker"): is in short the capacity of a machine to block the traffic of packets through a network security policy. A network security policy is the way to group filters and a filter is a test made to the incoming or outgoing traffic from one machine to verify if it meets certain conditions (for example, a common condition is to review the packages’ IP).

There are pre-loaded filters and the possibility of creating new ones. Heuristic filters are types of filter that can block the outgoing traffic from one machine to prevent it from infecting / attacking other machines on the network. This traffic blocking is done through the inspection of outgoing packets in order to find unusual operating conditions. Find more on this topic here (http://software.intel.com/en-us/articles/download-the-latest-intel-amt-software-development-kit-sdk/).

• Agent Presence: This feature allows an independent vendor’s software agent (like: a firewall, an anti viruses, an asset tracker) to report to Intel AMT that: 1) it is started, 2) it is running 3) it is shutdown. This very important because a user or an exceptional condition may terminate or stop a software agent unexpectedly.

The way Agent Presence and policies interact with an agent monitor is through state transitions. For example: when the monitor reports that an agent changes from "Running" to "Expired" state, it is possible to automatically activate/disable a policy to allow / block all inbound / outbound traffic.

Building an agent monitor

Agent monitors are built in two pieces: one in the AMT machine (local) and one in the monitoring console (remote). The remote piece is for agent monitor management functions: like creation, selection, and deletion. The local piece is for agent monitor registration (previously created in the remote interface) and reporting (of its currently state through “heartbeat” signals). The way in which both parts communicate is via a shared GUID.

Using the Intel Manageability DTK:

In the Manageability DTK, there is an application called “Intel AMT Outpost” which one simulates to be an agent monitor and it attracted my attention because it lets making a relation between the heartbeat signals and any application’s execution.

You can start by taking the DTK’s source code as a basis to write a C# solution made of a monitor console and an agent. Both the console and the agent consume Intel AMT machine’s web services (EOI, not WS-Man). Agent monitors are also known as watchdogs. The results of this exercise are two sample applications: a remote one (Figure 1) for watchdog creation, deletion and selection and a local one (Figure 2) for watchdog registration and reporting.

Figure 1. Agent monitor console.

Both applications share a GUID to uniquely identify each other. The application’s source code is available. Some agent monitor’s parameters (like heartbeats) are static. Note that this is a sample, so it does not meet best design practices.

Figure 2. Agent monitor.

During the development of this sample I learnt two things: 1) it’s necessary to increment the heartbeat sequence and 2) the relation between a heartbeat signal and an application’s execution shown in “Intel AMT Outpost” is merely descriptive; I mean, it is an agent monitor‘s task to perform any action to verify the application’s execution and it is not an built-in AMT function.

During the testing stage I found that it is not necessary to create a “watchdog” before performing a registration or a reporting action. General recommendations: 1) Use “localhost” instead of IP in Windows Vista machines, 2) Don’t use the remote interfaces from AMT host, 3) If you get a "Failed to parse the request" exception while calling any web service method it’s probably that you need to change the WSDL files’ version (in my case, I first added a web service reference to SDK 5.0.1.4 WSDL files and then I needed to change them) and 4) be careful with the heartbeat sequence increments because your unsigned int variable (that holds this value) can become huge.

Intel Software License Agreement (OEM / IHV / ISV Distribution & Single User)

Sun, 05 Apr 2009 15:31:20 -0700

IMPORTANT - READ BEFORE COPYING, INSTALLING OR USING

If you are an Original Equipment Manufacturer (OEM), Independent Hardware Vendor (IHV), or Independent Software Vendor (ISV), this complete LICENSE AGREEMENT applies;
If you are an End-User, then only Exhibit A, the INTEL SOFTWARE LICENSE AGREEMENT, applies.

For OEMs, IHVs, and ISVs:

LICENSE

use, modify and copy Software internally for Your own development and maintenance purposes; and
modify, copy and distribute Software, including derivative works of the Software, to Your end-users, but only under a license agreement with terms at least as restrictive as those contained in Intel's Final, Single User License Agreement, attached as Exhibit A; and
modify, copy and distribute the end-user documentation which may accompany the Software, but only in association with the Software.

EXHIBIT “A”

INTEL SOFTWARE LICENSE AGREEMENT (Final, Site License)

IMPORTANT - READ BEFORE COPYING, INSTALLING OR USING

LICENSE

This Software is licensed for use only in conjunction with Intel component products. Use of the Software in conjunction with non-Intel component products is not licensed hereunder. You may copy the Software onto your organization's computers for your organization's internal use, and you may make a reasonable number of back-up copies of the Software, subject to these conditions:

You may not copy, modify, rent, sell, distribute or transfer any part of the Software except as provided in this Agreement, and you agree to prevent unauthorized copying of the Software.
You may not reverse engineer, decompile, or disassemble the Software.
You may not sublicense the Software.
The Software may include portions offered on terms in addition to those set out here, as set out in a license accompanying those portions.

Intel Software Network articles feed

Intel® Active Management Technology PC Alarm Clock

Download entire article

Introduction

Usage Model

Operation

Developing Solutions

References

Related Links

Download the Intel® AMT Setup and Configuration Service (SCS) 6.0 Technology Preview

Intel® WS-Management Translator

Introduction

Enter the Translator

Key features in the Translator 1.0 (build 552)

Intel® Client Manageability Add-on for Microsoft* SMS 2003

Download the latest version of Intel® AMT Setup and Configuration Service - SCS

Download the latest Intel® AMT Software Development Kit (SDK)

Intel Software License Agreement Intel® AMT SCS Technology Preview

Troubleshooting the IMR_RES_TLS_CONNECTION_FAILED error in mutual TLS

Building an Intel AMT Agent Monitor (Part 1)

Intel Software License Agreement (OEM / IHV / ISV Distribution & Single User)